Privacy Policy
Last updated: November 15, 2026
1. Data Controller
TracePass LTD (UIC 208790302), Shtrossmayer Street, 1309 Sofia, Bulgaria, EU.
Website: tracepass.eu
Contact: info@tracepass.eu
Controller vs processor roles. TracePass is the data controller for website visitors, account registration and administration data, and billing data. For the product and passport content you publish through the platform (technical specifications, supplier information, supporting documents, etc.), you are the data controller and TracePass acts as a data processor on your behalf — we process that content only under your instructions to generate, host, and serve your Digital Product Passports. This also means the accuracy, lawfulness, and regulatory truthfulness of passport data remain your responsibility (see Terms, Section 6).
2. What Data We Collect
2.1 Platform
| Data | Purpose | Legal Basis | Retention |
|---|---|---|---|
| Account info (email, company, VAT) | Service provision | Contract (Art. 6(1)(b)) | Until you leave; then retrievable for at least 30 days; 12 months after that we email you the erasure date, 90 days later, and erase from that date unless you withdraw the request or resubscribe (Terms of Service, section 10a) |
| One encrypted offline copy of the data we erase | Establishing, exercising or defending legal claims | Legitimate interest (Art. 6(1)(f)); kept under Art. 17(3)(e) | 5 years after the erasure date, then destroyed |
| Product data you upload | DPP generation | Contract (Art. 6(1)(b)) | Same as account info |
| DPP content | Hosting passports | Contract (Art. 6(1)(b)) | Public while your plan keeps the passports published (Terms of Service, section 10); after you leave, erased with your other data as above, except passports that a product law requires to stay available (batteries: until recycled; toys and detergents: 10 years after placing on the market), which are kept with personal data removed as described in Terms of Service, section 10a. To keep them publicly available after your plan ends, export them or move them to another provider. |
| In-app usage events (steps completed, e.g. product created, datasheet uploaded — account and company IDs only, no document content) | Improving onboarding and the product | Legitimate interest (Art. 6(1)(f)) | 180 days |
| Where you came from when you signed up (campaign tags on the link you followed, such as utm parameters or a LinkedIn click ID; the website that referred you; the product category of the guide you came from) | Learning which channels and content bring sign-ups | Legitimate interest (Art. 6(1)(f)) | Same as account info |
| Payment data | Billing | Contract (Art. 6(1)(b)) | Per tax law (typically 10 years) |
2.2 Automatically collected
IP address, browser type, pages visited via standard web server logs. No tracking cookies are used. Legal basis: Legitimate interest (Art. 6(1)(f)) for security and service improvement. Retention: 90 days.
When someone opens a public product passport (for example by scanning its QR code), we derive an approximate location (country, region and city) from their IP address, using a geolocation database held on our own server, and store only that location with the scan, for the passport owner's scan statistics. The IP address is not stored with the scan and is not sent to any third party; to count unique visitors we keep a one-way hash of the IP address, browser and date, which cannot be turned back into the address. Legal basis: Legitimate interest (Art. 6(1)(f)) in giving manufacturers aggregate scan statistics. Geolocation data by DB-IP (db-ip.com).
2.3 Guide downloads
When someone requests a guide PDF, we collect their email address, company name (optional), selected guide category, and language preference to deliver the guide and send a confirmation copy. Legal basis: Legitimate interest (Art. 6(1)(f)). If the optional marketing box is ticked, we also record the exact consent wording shown and the time of consent, and may send occasional DPP compliance updates. Legal basis for optional emails: Consent (Art. 6(1)(a)). To withdraw consent at any time, reply "unsubscribe" to any such email or write to info@tracepass.eu.
If the link you followed carried campaign tags (utm parameters) or a LinkedIn click ID, we record them with the request to learn which campaign it came from. Legal basis: Legitimate interest (Art. 6(1)(f)). Only if you accepted cookies (section 7) do we also report the download to LinkedIn as an ad conversion; LinkedIn then receives your email address as a one-way hash, never in readable form, and the click ID if there is one.
3. How We Use Your Data
- To contact you about your account, billing, security, and material product changes
- To provide the DPP generation and hosting service
- To host and serve your Digital Product Passports
- To improve our platform and fix issues
- To comply with legal obligations
We do NOT sell, rent, or share your personal data with third parties for marketing purposes.
4. Third-Party Processors
| Service | Purpose | Location | Status |
|---|---|---|---|
| Cloudflare | DNS | Global (EU nodes) | Active |
| Hetzner | Platform and website hosting | Germany | Active |
| Cloudflare R2 | Document & image storage, database backups | EU (customer files, backups); public images not restricted | Active |
| Stripe | Payment processing | Ireland (Stripe Payments Europe); Stripe, Inc. (USA) may also process it | Active |
| Resend | Transactional email | EU sending region (Ireland); Resend, Inc. is based in the USA | Active |
| Anthropic (Claude API) | AI document processing | USA (documents uploaded for extraction) | Active |
5. Data Storage & Security
The application, its database and the website are hosted in the EU (Hetzner, Germany). Uploaded files, generated documents and database backups are stored with Cloudflare R2 in its EU jurisdiction; the public images that published passports show are stored there without an EU restriction. Data is encrypted in transit (HTTPS/TLS), and stored files, the database and its backups are encrypted at rest. We use industry-standard security measures to protect your data.
6. Your Rights (GDPR)
You have the right to:
- Access (Art. 15) — request a copy of your data
- Rectification (Art. 16) — correct inaccurate data
- Erasure (Art. 17) — request deletion of your data
- Restriction (Art. 18) — restrict processing of your data
- Portability (Art. 20) — receive your data in machine-readable format
- Objection (Art. 21) — object to processing based on legitimate interest
- Withdraw consent (Art. 7(3)) — at any time, without affecting prior processing
How to exercise your rights: Email info@tracepass.eu with your request. We will verify your identity and respond within 30 days. If we need more time, we will inform you within the initial 30-day period.
Right to lodge a complaint: You have the right to lodge a complaint with the Commission for Personal Data Protection (CPDP), Bulgaria, or your local supervisory authority.
7. Cookies
We use Google Analytics 4 for site-traffic analysis and the LinkedIn Insight Tag for measuring our ad-campaign performance. Both are loaded only after you accept cookies via our consent banner — decline and no third-party scripts run. Essential cookies (e.g., session management on the application portal) may be used regardless of your choice.
If you accept cookies, we also keep the campaign tags of your visit (utm parameters, LinkedIn click ID and the website that referred you) in your browser's session storage, so they are still known if you sign up or request a guide from another page. The session storage is cleared when you close the tab. If you decline, nothing is stored: the tags are only read from the page you are on.
8. International Transfers
The application, its database and the website are hosted in the EU. Some of the services we use (section 4, and the cookies in section 7) are based in the USA or may process data there:
- Anthropic (AI document processing). The documents you upload for extraction are sent to it, and they can contain personal data where a document includes it (for example a contact name on a datasheet).
- Cloudflare (file storage and database backups).
- Stripe, Inc. and Resend, Inc., the US parent companies of our payment and email providers.
- Google and LinkedIn, only if you accept analytics cookies (section 7).
Each transfer relies on the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on the EU Standard Contractual Clauses in the recipient's data processing agreement. You can request a copy of the safeguards at info@tracepass.eu.
9. Changes to This Policy
We may update this policy. Changes will be posted on this page with an updated date. Significant changes will be communicated via email to registered users.
10. Contact
For any privacy-related questions or requests:
Email: info@tracepass.eu
TracePass LTD, Shtrossmayer Street, 1309 Sofia, Bulgaria, EU