Privacy Policy

1. Introduction

Global Tariff Rates Ltd (“we”, “us”, “our”), a company registered in England and Wales with its registered office in London, UK, is committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our trade compliance platform and related services (the “Service”).

By accessing or using the Service, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access or use the Service.

2. Information We Collect

We collect information in the following categories:

2.1 Information You Provide

• Account information: name, email address, company name, job title, and password when you create an account.
• Product and trade data: product descriptions, HS codes, tariff classifications, trade compliance documentation, and related commercial data that you upload or input into the Service.
• Payment information: billing address and payment details processed securely through our third-party payment processor (Stripe). We do not store full payment card numbers on our servers.
• Communications: information you provide when you contact us, submit support requests, or participate in surveys.

2.2 Information Collected Automatically

• Usage data: pages visited, features used, classification queries, search terms, and interaction patterns.
• Device and technical data: IP address, browser type and version, operating system, device identifiers, and referring URLs.
• Log data: server logs, error reports, and performance metrics.

2.3 Information from Third Parties

• Integration data: if you connect third-party services (e.g., Shopify, ERP systems), we receive product and order data as authorised by you.
• Public trade data: tariff schedules, regulatory updates, and trade policy information from government and public sources.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Providing the Service: to classify products, generate tariff assessments, monitor regulatory changes, and deliver trade compliance intelligence.
• AI model improvement: to train and improve our classification models. Product data used for model training is anonymised and aggregated. You may opt out of model training via your account settings.
• Account management: to create and manage your account, process payments, and provide customer support.
• Communications: to send service notifications, tariff alerts, product updates, and (with your consent) marketing communications.
• Security and fraud prevention: to detect, prevent, and respond to security incidents and fraudulent activity.
• Legal compliance: to comply with applicable laws, regulations, and legal processes.
• Analytics: to understand usage patterns, improve the Service, and develop new features.

4. Data Sharing

We do not sell your personal data. We may share your information in the following limited circumstances:

• Service providers: with trusted third-party providers who assist us in operating the Service, including cloud hosting (Vercel, Supabase), payment processing (Stripe), AI model providers, and analytics services. These providers are contractually bound to protect your data.
• Expert reviewers: if you use our expert review marketplace, relevant product data is shared with the assigned trade compliance expert solely for the purpose of completing the review. Experts are bound by confidentiality agreements.
• Organisation members: data within your organisation account is accessible to authorised team members based on their assigned roles.
• Legal requirements: when required by law, regulation, legal process, or governmental request.
• Business transfers: in connection with a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction.

5. Data Security

We implement industry-standard technical and organisational measures to protect your data, including AES-256 encryption at rest, TLS 1.3 encryption in transit, role-based access controls, comprehensive audit logging, and regular security assessments. We are actively pursuing SOC 2 Type II certification. While we strive to protect your personal data, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

6. Your Rights (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, you have the following rights under the General Data Protection Regulation (GDPR) and the UK GDPR:

• Right of access: request a copy of the personal data we hold about you.
• Right to rectification: request correction of inaccurate or incomplete personal data.
• Right to erasure: request deletion of your personal data, subject to legal retention obligations.
• Right to restrict processing: request that we limit the processing of your personal data in certain circumstances.
• Right to data portability: request a machine-readable copy of your personal data.
• Right to object: object to the processing of your personal data for direct marketing or where processing is based on legitimate interests.
• Right to withdraw consent: where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at privacy@globaltariffrates.com. We will respond to your request within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) in the UK or your local supervisory authority.

7. Cookies

We use cookies and similar tracking technologies to operate and improve the Service. The types of cookies we use include:

• Essential cookies: required for the Service to function, including authentication and session management.
• Analytics cookies: help us understand how visitors interact with the Service so we can improve the user experience.
• Preference cookies: remember your settings and preferences across sessions.

You can manage your cookie preferences through your browser settings. Disabling essential cookies may affect the functionality of the Service.

8. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. Classification results, audit trails, and evidence packs are retained for a minimum of seven years to support trade compliance audit requirements. When you delete your account, we will delete or anonymise your personal data within 90 days, except where retention is required by law or for legitimate business purposes (e.g., resolving disputes, enforcing agreements). Anonymised and aggregated data that cannot identify you may be retained indefinitely for analytics and model improvement purposes.

9. International Transfers

Your data may be transferred to and processed in countries outside the UK and EEA. Where we transfer personal data internationally, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, adequacy decisions, or other legally recognised transfer mechanisms. Our primary infrastructure is hosted within the EU and UK, and Enterprise customers may select specific data residency regions.

10. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child without parental consent, we will take steps to delete that information promptly. If you believe we have inadvertently collected data from a child, please contact us at privacy@globaltariffrates.com.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by posting the updated policy on this page and updating the “Last updated” date. For significant changes, we will provide additional notice via email or an in-app notification. Your continued use of the Service after any changes constitutes acceptance of the updated Privacy Policy.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us: