Data processing agreement

1. The parties and their roles

The Provider’s role is twofold, and the distinction matters:

• Controller for its own customer data: account data, billing, enquiries, the sign-in attempt log and marketing-style contact. These are governed by our Privacy notice.
• Processor for everything the User enters or instructs us to do: product passport data (where it contains personal data, for example the economic operator’s contact person), uploaded documents, supplier contact details, invited team members, outbound notifications and access links. These are governed by this agreement. In that relationship the User is the controller.

2. Subject matter, purpose and duration

Subject matter and purpose: producing, publishing, making machine-readable and managing the lifecycle of EU digital product passports on the User’s instruction. Duration: the lifetime of the User’s account. After closure we keep internal data for 30 days (for export and for second thoughts), then delete it permanently; the public passport becomes unavailable at the moment of closure.

3. Data processed and categories of data subjects

The Provider does not process special categories of data under GDPR Article 9, nor does it request any. If the User enters such data (for example inside an uploaded document), they do so on their own responsibility and legal basis, and must inform the Provider in advance.

4. The Provider’s obligations

• Only on instruction: the Provider processes personal data solely on the User’s instruction and within this agreement. If the Provider considers an instruction unlawful, it informs the User without delay and may suspend execution.
• Confidentiality: the Provider ensures that staff with access are bound by confidentiality and access data only to the extent needed for their task. Access to an account is recorded in an append-only log, and the log is also visible to the User in Settings.
• Assistance: the Provider assists the User, with the means at its disposal, in handling data-subject requests, carrying out impact assessments and responding to authority enquiries. Data is exportable in the form it was entered.
• Deletion and return: on termination the Provider deletes personal data within the period stated in section 2. There are two exceptions, and we state them plainly: the passport version history and the account-access log are not touched by automatic clean-up — the former is the evidence of what was published and when, the latter the trace of accountability. They end together with the deletion of the account.

5. Technical and organisational measures

The measures below describe what the system actually does, not an intention:

• Passwords: stored only as one-way salted hashes; the Provider does not know and cannot recover a plain password.
• Tenant-level isolation: every query filters on the account identifier. Automated tests verify this: one account cannot read or write using another account’s identifiers.
• Document store: uploaded files reside in a directory not directly reachable from the web; they are served only after an access check. File type is determined from the content, not the filename, and the stored extension derives from the detected type.
• Layered access: non-public fields and documents are visible only with the matching access tier. A narrower access does not open a stricter tier — this too is verified by an automated test.
• Minimised scan analytics: we do not store IP addresses. The pseudonym is a hash of the IP prefix (IPv4 /24, IPv6 /64) with a monthly-rotated salt, so long-term linkage is not possible. If the salt is not configured, the system stores no pseudonym at all rather than writing reversible data.
• Integrity: every published version is sealed with a cryptographic hash, and the hashes form a chain — a later, unnoticed modification is detectable.
• Abuse limiting: sign-in attempts are throttled, the machine interface is protected by a rate limit, and sessions are invalidated on password change.
• Test environment: the User’s sandbox account sends no outbound calls — neither email nor notifications — so experimentation cannot affect third parties.

6. Sub-processors

The User gives general authorisation for the use of the sub-processors below. The Provider maintains an Article 28-compliant contract with each and remains liable for them as for its own performance.

In the event of a change, the Provider notifies the User in advance of a new or replaced sub-processor on this page and at the email address registered to the account. If the User objects, they may terminate the contract before the change takes effect.

7. Personal data breach

The Provider notifies the User of any personal data breach it becomes aware of without undue delay and no later than 48 hours after becoming aware, providing everything it knows: what happened, which data categories and approximately how many data subjects are affected, the likely consequences, and the measures taken. Notifying the authority is the obligation of the User as controller; the Provider assists with the logs and data at its disposal. The system’s logs (access log, delivery log, version history) support that reconstruction.

8. Audit rights

The User is entitled to satisfy themselves that the Provider complies with this agreement. The ordinary route is documented information: on request we provide a description of the technical and organisational measures, the list of sub-processors and relevant log extracts. On-site inspection is permitted by prior written arrangement, during working hours, without touching other customers’ data; the User bears its reasonable cost. The Provider may also share the results of its own checks (for example automated test reports).

9. Transfers to third countries

Data is stored in the European Union. Processing outside the Union occurs in two places, both listed in the table above: the Cloudflare network (traffic passing through) and Stripe’s parent company. Both are covered by the European Commission’s standard contractual clauses and further safeguards. Beyond these, the Provider transfers data to one further third-country destination only: the endpoint specified by the User — choosing it and ensuring its lawfulness is the User’s decision and responsibility.

10. Related documents

Terms of Service · Privacy notice · Cookie policy · Imprint. In case of conflict, this agreement prevails in matters of data processing.