Privacy Notice
Welcome to Declara. We believe in keeping data processing minimal, ethical, and completely transparent. This Privacy Notice explains exactly what personal data we collect when you use Declara, why we collect it, and how we protect it.
1. Who We Are
Declara is a trade data decision-support tool. For the purposes of data protection law, we act as the Data Controller for the information you provide when creating an account or joining our waitlist.
If you have any questions about this notice, or wish to exercise any of your data rights, you can contact us at: support@declara.co.uk.
2. What Personal Data We Collect & Process
We collect the minimum amount of information required to run the platform:
- Account & Waitlist Information: Your first name, last name, email address, and (when you create a full account) a password. Passwords are managed securely by our authentication provider and are never visible to us.
- Technical Session Data: Authentication and session cookies set by our authentication provider to keep you securely signed in. Your IP address is processed temporarily for security and anti-abuse purposes (see Section 3).
- Usage Inputs: The 10-digit commodity codes you enter into our search utility to look up tariff data.
We do not operate our own user database. Your account and identity information is held securely by our authentication provider (Clerk — see Section 4), not in a separate database of our own.
Do you have to provide it? Providing your name and email is necessary to create an account or join the waitlist — it's how we set up and secure your access. You don't have to give it, but without it we can't create an account for you, so you wouldn't be able to use the tool.
2.1 File Uploads & Data Minimisation
The platform lets you load data from files in two places: the commodity-code screening tool, and the duty estimate tool. In both cases, your file is processed entirely within your own web browser and is never uploaded to our servers. Regardless of what your file contains, only the commodity codes are ever transmitted to us — and from us to HMRC. No other content from your file is sent to us, stored by us, or logged by us.
The two features handle files slightly differently, which we explain transparently below.
Commodity-code screening upload (CSV): Your file is read in your browser, and only the values in the first column of each row are extracted. Every other column is discarded immediately in your browser and is never read or transmitted. If your file contains additional columns — such as customer names or addresses — that information never leaves your device, because we never read it. (When using the screening tool you may also select a destination country from a dropdown; this is a country code such as "US" or "FR," is not personal data, does not come from your file, and is used only to filter results.)
Duty estimate upload (CSV or Excel): To calculate per-parcel duty, this feature reads your order file in your browser and maps the relevant columns it recognises (such as commodity code, order reference, value, currency, destination country, and quantity). The calculation — grouping line items, applying exchange rates, and estimating duty — happens entirely within your browser. Because this feature reads the whole file to find the columns it needs, any other columns present in your file (for example, if your order export includes recipient names, addresses, or emails) are temporarily held in your browser's memory for the duration of your session. None of this information is transmitted to us or to anyone else — only the commodity codes are sent. All of it is cleared from your browser when you select "Start over," navigate away, or refresh the page.
In both cases, you should ensure your commodity codes are present in your file, and we recommend not including any personal or confidential information you don't need to. But by design, even if such information is in your file, it stays on your device.
2.2 Information Stored Locally on Your Device
If you use the confirmation/attestation feature within the tool, the records you create (which may include a customer name you type into the confirmation step) are saved only in your own browser's local storage, on your own device. This information is never transmitted to or stored by us. You can clear it at any time by clearing your browser data.
3. How We Use Your Data (Lawful Basis)
Under the EU General Data Protection Regulation (GDPR) — and the UK GDPR where it applies to users in the UK — our lawful bases for processing your data are:
- Consent: When you provide your name and email to join our waitlist or create an account.
- Legitimate Interests: To maintain the security, stability, and anti-abuse architecture of our service. This includes the temporary use of your IP address to enforce rate limits — both to protect our service from automated abuse and to ensure we use the official UK Trade Tariff API responsibly and within fair-use limits.
Where we rely on your consent to hold your waitlist or account details, you can withdraw it at any time by emailing support@declara.co.uk. This won't affect anything done before you withdrew it.
No automated decisions: Declara does not carry out automated decision-making or profiling that produces legal or similarly significant effects on you. It is a decision-support tool — it surfaces information and options, and a person always makes the final decision.
4. Who We Share Your Data With
We never sell your data. We only share it with the infrastructure providers necessary to operate the application:
- Clerk — handles secure sign-in, account creation, and identity. Clerk stores your name, email, and password on our behalf. (clerk.com/legal/privacy)
- Railway — our cloud hosting provider, where our application runs. Whatever transits the application passes through Railway's infrastructure. (railway.com/legal/privacy)
- HM Revenue & Customs (HMRC) — your commodity codes are sent securely to the official UK Trade Tariff API to retrieve live tariff data. Only commodity codes are sent to HMRC. No names, email addresses, IP addresses, or uploaded files are ever sent to HMRC.
International transfers. Some of our providers process data outside the EEA and the UK (for example, in the United States). Where they do, the transfer is protected by recognised legal safeguards: Clerk is certified under the EU-US Data Privacy Framework (and its UK extension), with Standard Contractual Clauses as a fallback; Railway relies on the EU Standard Contractual Clauses (and the UK Addendum), with the Data Privacy Framework where applicable. These safeguards are set out in our providers' data processing agreements — Clerk (clerk.com/legal/dpa) and Railway (railway.com/legal/dpa).
No analytics or tracking: We do not use any analytics, advertising, or behavioural tracking tools (such as Google Analytics, Meta Pixel, or similar). We do not set any tracking cookies.
5. Cookies
Our own application and website do not set any cookies. The only cookies used are the strictly necessary authentication and session cookies set by our authentication provider (Clerk) to keep you securely signed in. We do not use analytics, advertising, or tracking cookies of any kind.
6. Data Retention
- Account & Waitlist Data: Retained for as long as you maintain an active account or remain on the waitlist. You can ask us to delete your data at any time (see Section 7).
- Commodity Code Lookups: We do not keep a persistent record of the codes you look up. Lookup results are temporarily cached in memory only (to reduce repeated calls to HMRC) and are automatically cleared after a short period, and wiped entirely whenever our service restarts. This cache contains only commodity codes and tariff data, with no information identifying you.
- IP Addresses: Your IP address is held only temporarily, in memory, solely for rate-limiting, within a rolling window of no more than one hour, and is fully cleared whenever our service restarts. It is not written to a database and is not shared with any third party.
- Server Logs: As is standard for web hosting, our hosting provider may briefly retain automatic server access logs that can include IP addresses. This is governed by our hosting provider's retention practices. Our own application does not store these.
7. Your Rights
Under the GDPR, you have the right to access the data we hold about you, request corrections, request erasure, restrict or object to processing, and request data portability.
To exercise any of these rights — including deleting your account or updating your email address — email us at support@declara.co.uk and we will respond within one calendar month, free of charge.
If you believe we are mishandling your data, you have the right to lodge a complaint with a data protection supervisory authority — in Spain, where we are based, the Agencia Española de Protección de Datos (aepd.es); or, if you are in the UK, the Information Commissioner's Office (ico.org.uk).
8. Children
Declara is a business tool intended for use by professionals and is not directed at, or intended for use by, anyone under the age of 18. We do not knowingly collect personal data from children.
9. Changes to This Notice
We may update this notice from time to time as the platform develops. When we make material changes, we will update the "Last Updated" date at the top of this page. We encourage you to review it periodically.