Privacy Policy

1. Who we are

[REGISTERED COMPANY NAME], [REGISTERED ADDRESS], registered under [COMPANY REGISTRATION NUMBER], is the controller of the personal data described here. Reach us at [privacy@yourdomain].

2. What we collect, and why

We collect only what the service needs to function:

• Account details — your email address and name, to create and authenticate your account. Lawful basis: performance of a contract.
• Organisation details — company name, industry sector and VAT number, to identify the manufacturer on the passports you publish. Lawful basis: performance of a contract, and compliance with the ESPR obligations that make the manufacturer identifiable.
• Technical logs — request timestamps, IP address and error traces, kept to operate and secure the service. Lawful basis: legitimate interest in keeping the service available and detecting abuse.

We do not use tracking or advertising cookies, and we do not sell or share personal data for marketing.

3. Passport data is public by design

Publishing a product passport makes it publicly readable by anyone who scans its QR code — that is the entire purpose of the Digital Product Passport under ESPR. What appears there is product and material information, plus the manufacturer's name. Do not put personal data into product fields: once published, it is public.

4. Where your data is held

In Ireland (AWS eu-west-1). It is not transferred outside the European Economic Area in the normal course of operating the service.

5. Who else processes it

• Amazon Web Services EMEA SARL — Hosting, database, authentication, email delivery and content distribution. Located in Ireland (eu-west-1); email sending from the same region.

6. How long we keep it

Account and organisation data is kept for as long as the account is open, and for [RETENTION PERIOD] after closure so that we can meet accounting and legal obligations. Technical logs are kept for [LOG RETENTION PERIOD]. Published passports remain available while the product is published; withdrawing it replaces the public page with a withdrawal notice.

7. Your rights

You can ask us for a copy of your personal data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable form. Write to [privacy@yourdomain] and we will respond within one month. If you are not satisfied, you may complain to [SUPERVISORY AUTHORITY].

8. Changes

If we change this policy substantively we will raise the version shown above and tell account holders by email before the change takes effect.