Privacy notice

1. Controller

The controller of personal data processed via this site is the EU Digital Product Passport Foundation. For data-protection matters, write to us through the contact form with the subject line "Data protection".

2. What we collect and why

• Contact form submissions. When you write to us, we receive your name, email, organisation and message. Basis: Art. 6(1)(b) GDPR (pre-contractual / service) or Art. 6(1)(f) (our legitimate interest in replying).
• Server logs. IP address, user agent, request timestamps, for security and troubleshooting. Basis: Art. 6(1)(f). Retained 30 days.
• Analytics (if you consent). Aggregated, anonymised page-view data. No persistent identifiers. Basis: Art. 6(1)(a).
• Preferences (if you consent). Locale, sector filter. Stored in your browser only. Basis: Art. 6(1)(a).

3. What we do not do

• We do not sell personal data.
• We do not use advertising, profiling or cross-site tracking cookies.
• We do not transfer personal data outside the EEA without an adequate legal basis (Article 46 GDPR).

4. Retention

Contact enquiries: up to 24 months after the last interaction, unless a longer period is required by law or by an ongoing relationship. Server logs: 30 days. Analytics: maximum 26 months. Cookie preferences: up to 12 months or until you withdraw consent.

5. Your rights

Under the GDPR you have the right to:

• Access your personal data (Art. 15).
• Rectify inaccurate data (Art. 16).
• Erase your data where applicable (Art. 17).
• Restrict processing (Art. 18) and object to processing (Art. 21).
• Data portability for data you gave us (Art. 20).
• Withdraw consent at any time (Art. 7), without affecting prior lawful processing.
• Lodge a complaint with your national data-protection supervisory authority (Art. 77).

6. Cookies

See our cookies policy for the list of cookies, their purposes and how to manage them.

7. Changes

We update this notice when our processing changes. Material changes are announced via the updates section.