Privacy notice

Version 2026-10-13. This notice covers the CBN website and professional platform, including guest accounts, membership applications, the directory, communications, customs tools and professional invitations.

Who is responsible?

C&S Nordivia Invest OÜ, Estonian register 17515263, Harju maakond, Tallinn, Põhja-Tallinna linnaosa, Telliskivi tn 57, 10412, Estonia, is the controller for operating the CBN platform. Contact info@cbnetwork.org for privacy questions. This is the operator’s contact; no appointed Data Protection Officer is identified here.

Information we use and why

Personal data can include your name, professional email, telephone, role, company, office locations, professional photographs, account identifiers, application and approval history, content you submit, correspondence, service and payment records, and technical connection information. Passwords are handled by the authentication service and must never be included in a profile, message or privacy request.

Purpose	Legal basis and scope
Account, application, membership and requested services	Steps requested before a contract and performance of a contract with you (GDPR Article 6(1)(b)); for an employee or representative of a member company, our legitimate interests in providing the company’s requested service (Article 6(1)(f)). Required fields are marked. Without the necessary information, we cannot create or validate the account or provide the requested service.
Professional directory, offices and network introductions	Providing the requested professional network and our legitimate interests in connecting verified professionals. A published professional profile, contact details and selected professional images are accessible to authorised members, who may be located internationally. Keep private documents and information about other people out of profile fields. Contact CBN to correct or restrict a publication.
Chats, sales requests, events, watches and support	Providing the service you request and legitimate interests in administering professional exchanges, organising events and responding to support requests. Audience depends on the feature: a published event or business request reaches eligible members; a private conversation reaches its participants. Do not submit unnecessary personal or confidential client information.
Customs analysis and expert review	Performance of the requested service and legitimate interests in delivering and checking professional assistance. Product descriptions may be sent to the configured AI service. Client contact fields are kept separate from the AI classification prompt. An expert introduction requires the client permission requested in that workflow.
Security, abuse reports and dispute handling	Legitimate interests in protecting accounts, investigating misuse and establishing, exercising or defending legal claims; legal obligations where applicable (Article 6(1)(c)). Human review is required for contested risk alerts and moderation decisions.
Professional invitations and promotional emails	Consent where required (Article 6(1)(a)), or legitimate interests for permitted contact of a legal person subject to the applicable electronic marketing rules. A named work address is not automatically a corporate address exempt from consent. Public availability alone is insufficient. You can object at any time using the unsubscribe link or our contact address.
Contract, invoice and privacy request records	Performance of the service, applicable legal obligations and legitimate interests in keeping evidence of contracts, responding to rights requests and handling claims.

When processing is based on legitimate interests, you may object for reasons relating to your situation. An objection to direct marketing is effective without having to give a reason. Consent, when used, is separate from membership terms and can be withdrawn without affecting earlier lawful processing.

Where the information comes from

We receive information from you, your company’s authorised representative, another member involved in an exchange, or an invitation/referral. Prospect details may also come from professional public sources, company websites, event contacts, and configured research services such as Hunter or Apollo. Those details can include professional contact information, company, position, location, source and a relevance score. You can ask for the source and a copy of the information about you. Automated lead scores help prioritise outreach; they do not confer membership or professional accreditation.

Recipients and international access

Authorised CBN administrators receive information needed for their responsibilities. Other members receive information shared with the audience of the relevant feature. A member receiving data for its own business purposes is responsible for that further use and may not harvest the directory or use it for unsolicited mass marketing.

The site is delivered through ChatGPT Sites (OpenAI) with Cloudflare infrastructure. The technical services used by this platform include Supabase for authentication and member/chat data; Cloudflare Workers, D1 and R2 for delivery, operational records and files; and Cloudflare Workers AI for configured customs analysis. Google Workspace can handle connected mailbox delivery and replies. Research, email delivery and social publication integrations operate only when configured; these can include Hunter, Apollo, Resend and Instagram. The Supabase project is configured in the EU (eu-west-1); this does not mean that all providers, support access or network recipients are within the EEA.

Access or processing outside the EEA may require an adequacy decision or appropriate safeguards, such as Standard Contractual Clauses with any necessary supplementary measures. Ask CBN for the recipients, locations and safeguards applicable to your data, and how to obtain a copy. Sharing a professional profile is not blanket consent to an unrestricted international transfer.

How long information is kept

Account and directory information is needed while an application or membership is being managed. After withdrawal or closure, operational information must be reviewed for deletion or anonymisation; limited records may still be needed for unresolved exchanges, contractual claims or legal requirements. Conversation and event records are assessed according to the ongoing exchange, participant interests and disputes. Invoices and necessary evidence are retained for the applicable statutory or claims period, with access limited to that purpose.

Prospect information is reviewed when an invitation ends or the contact is no longer relevant. We keep a minimal suppression record to respect an objection and prevent re-importing an unsubscribed address. Privacy request records are kept as evidence of handling and reviewed after resolution. Retention is assessed by category; closing an account does not immediately erase every record or other participants’ conversations. You can request the period or criteria for a particular record and ask for erasure or restriction.

Browser copies and their controls are described separately. Clearing a browser does not delete records held by the platform.

Automation, risk alerts and human decisions

IRIS, Sophia, Kira and Mozart are CBN software agents; Customs Intelligence uses AI to assist analysis. Generated drafts, summaries, lead scores and tariff suggestions can be wrong. They are not official customs decisions, credit determinations or legal advice. CBN Administration handles membership approval, contested alerts and complaints. You may request human review and challenge an automated result using the contact or request form below. Do not submit health data, identity documents, criminal allegations or other unnecessary sensitive information to these tools.

A company risk alert may also concern an identifiable individual or sole trader. Such information needs a justified basis, reliable evidence, restricted recipients and review. An alert is not a court judgment. Contact CBN to contest accuracy, request restriction or report unlawful content.

Your rights and how to exercise them

You may request access and a copy, correction, erasure, restriction, portability where applicable, object to processing, withdraw consent and request safeguards concerning automated decisions. These rights depend on the applicable legal conditions. We must consider other people’s rights and any lawful need to retain information.

Use Personal data requests when signed in, or write to info@cbnetwork.org if you have no access, are not a member or prefer email. Requests are normally free. We may ask for proportionate information to confirm identity if there is reasonable doubt; do not send a password or identity document unless specifically justified.

The normal response period is one calendar month. For a complex request, the GDPR permits up to two further months, with reasons communicated within the initial month. A refusal must explain the reasons and your complaint and judicial remedies. You may complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia, or the competent authority where you live or work, and seek a judicial remedy.

Changes and security reports

This notice is versioned. Material changes in purposes or recipients require information before the new processing. Report suspected account misuse, a data incident or inaccurate information to info@cbnetwork.org. Include enough context to locate the issue, without copying unnecessary confidential material.