Privacybeleid

PassportCraft LLC Effective Date: February 8, 2026 Last Updated: June 25, 2026

---

Privacy at a Glance

This is a short summary to help you find what matters most. It is not a substitute for the full policy below — each point links to the detailed section that governs.

• Who we are: PassportCraft LLC, a New York (USA) company providing a Digital Product Passport platform; we act as both a Data Controller and a Data Processor (see Section 1).
• What we collect: account and billing details, product/DPP data uploaded by our customers, usage and website data, and limited technical data when someone scans a published passport (see Section 2).
• Why we use it (legal basis): to provide and bill for the service, to communicate with you, for security and legal compliance, and — where you have consented — for analytics (see Section 3). We do not send marketing emails or build a marketing list.
• Who we share it with: vetted sub-processors (such as our hosting, email, analytics, and payment providers) and, where required, advisors and authorities; we do not sell your personal data (see Section 5).
• Your rights: access, rectification, erasure, portability, objection, and more, for individuals in the EEA, the UK, and Switzerland, plus equivalent rights for US state residents (see Section 9 and Section 12).
• How to contact us or complain: email privacy@passportcraft.com or our EU representative (see Section 16); you may also lodge a complaint with a supervisory authority (see Section 9.5).

---

1. Who We Are

PassportCraft LLC ("PassportCraft," "we," "us," or "our") is a New York, USA limited liability company that operates a Software-as-a-Service (SaaS) platform for creating and hosting Digital Product Passports (DPPs) under the EU Ecodesign for Sustainable Products Regulation (ESPR).

1.1 Our Role in Data Processing

PassportCraft acts in two distinct data-processing capacities:

• Data Controller — for personal data we collect and process for our own purposes, including website analytics, account management, billing, and customer support.
• Data Processor — for personal data our customers upload to the platform as part of their Digital Product Passports (e.g., product specifications, supplier information, compliance documentation). In this capacity, we process data solely on our customers' instructions and in accordance with a separate Data Processing Agreement (DPA).

This Privacy Policy primarily addresses our activities as a Data Controller. Our processing activities as a Data Processor are governed by the DPA agreed with each customer.

---

2. What Data We Collect

We collect and process the following categories of personal data:

2.1 Account Data

Data you provide when creating an account or contacting us.

Where you are an EU/EEA business customer, we collect your VAT identification number to determine the correct VAT treatment of your subscription and to issue compliant invoices (including, where applicable, applying the reverse-charge mechanism for intra-EU business-to-business supplies). The invoicing terms that apply to your VAT identification number are set out in our Terms of Service.

2.2 Product and DPP Data (Processed as Data Processor)

Data our customers upload to create Digital Product Passports. This may include:

Important: We process this data solely as a Data Processor on behalf of our customers. Our customers are the Data Controllers for their DPP data and are responsible for ensuring they have a lawful basis to share any personal data contained within it. We do not use DPP data for our own purposes.

Special categories of data: We do not collect or process special categories of personal data as defined under Art. 9 GDPR (e.g., health data, biometric data, racial or ethnic origin, political opinions, religious beliefs). Customers are prohibited from uploading special category data to the platform.

2.3 Usage Data

Data collected automatically when you use our website or platform.

2.4 Communication Data

Data generated through your interactions with us.

2.5 Payment Data

Data required for processing payments.

Important: We do not store full credit card numbers, CVVs, or other sensitive payment credentials. All payment processing is handled by our payment processor, Stripe, which is certified PCI DSS Level 1.

2.6 Website Visitor Data

Data collected from visitors to passportcraft.com who may not have an account.

2.7 Data We Collect From Other Sources

Most of the personal data we hold is provided directly by you (Sections 2.1, 2.2, 2.4, 2.5, 2.6) or collected automatically when you use our website or platform (Sections 2.3, 2.6). In addition, we receive a limited set of personal data indirectly, from the following sources:

We do not purchase personal data from data brokers, and we do not enrich your data using marketing, referral, or third-party data-enhancement services. Where we collect personal data from a source other than you directly, we process it on the legal bases set out in Section 3 and provide the transparency information required by Art. 14 GDPR through this Privacy Policy.

2.8 Data Collected When You Scan a Digital Product Passport

This section is addressed to consumers and other members of the public who view or scan a publicly hosted Digital Product Passport (DPP) page — for example, by scanning a QR code on a product. It does not concern brands or account holders.

When a published DPP page is viewed, we record a limited set of technical data about the visit so that we can produce aggregate scan analytics. We collect:

Who is responsible. For this scan analytics, PassportCraft acts as a Data Controller, because we determine the purposes and means of this processing. This is distinct from the Data Processor role we hold for the DPP content that the publishing brand supplies (see Section 1.1). The product information shown on the passport page is supplied and controlled by the brand that publishes it, not by PassportCraft.

Purpose. We use this data to generate aggregate scan analytics — such as the number of views and the approximate regions and device types of viewers — which we make available to the brand that published the passport and use to operate, secure, and improve the Service. We do not use this data to identify you, to build a profile of you, or to serve you advertising.

Legal basis. We process this data on the basis of our legitimate interest (Art. 6(1)(f) GDPR) in measuring engagement with DPP pages, providing analytics to the publishing brand, and operating and improving the Service. We have weighed this interest against your interests and rights: the data is limited to coarse technical metadata (approximate location and device type), we do not store your IP address, any IP-derived identifier, or your browser's User-Agent string, and the analytics we produce are aggregated, which we consider a minimal privacy impact. This analytics processing does not store information on, or read information from, your device beyond what is strictly necessary to display the page you requested, so it does not place analytics cookies on your device.

Retention. We retain this scan data for 12 months from collection, consistent with the analytics retention period in Section 7, after which it is purged.

Your rights and how to contact us. Because we do not hold your name, your IP address, your browser's User-Agent, or any other identifier that could re-identify you, we are generally unable to associate a particular scan with a particular individual. To the extent this data relates to you, the rights described in Section 9 (for individuals in the EEA, the UK, or Switzerland) and Section 12 (for US residents) apply, and you may contact us at privacy@passportcraft.com.

How this information reaches you (Art. 13 GDPR). As we cannot proactively reach an anonymous visitor, the information required under Art. 13 GDPR about this scan analytics is provided here, in this Privacy Policy, which is published at https://passportcraft.com/privacy. The published passport page itself currently identifies PassportCraft as its host (it carries a "Powered by PassportCraft" mark), and we are adding a direct link from that mark to this Privacy Policy so that visitors can reach this notice from the page. Until that link is in place, the descriptions of this processing in this Privacy Policy — not any text on the passport page itself — are what govern; the product information shown on the passport page is supplied and controlled by the publishing brand (see Section 1.1), and the brand remains responsible for any separate notice it chooses to present about its own content.

---

3. Legal Basis for Processing (GDPR Art. 6)

We process personal data only where we have a valid legal basis under the General Data Protection Regulation (GDPR). The table below maps each processing activity to its legal basis.

3.1 Consent — Art. 6(1)(a)

You may withdraw your consent at any time without affecting the lawfulness of processing that occurred before withdrawal. To withdraw consent, adjust your cookie preferences on our website or contact privacy@passportcraft.com.

3.2 Performance of a Contract — Art. 6(1)(b)

3.3 Legal Obligation — Art. 6(1)(c)

3.4 Legitimate Interest — Art. 6(1)(f)

You have the right to object to processing based on legitimate interest at any time (see Section 9).

---

4. How We Use Your Data

We use the personal data we collect for the following purposes:

4.1 Providing and Operating Our Service

• Creating and managing your account
• Enabling you to create, edit, host, and share Digital Product Passports
• Generating and hosting QR codes linked to your DPP pages
• Processing your payments and managing your subscription
• Providing technical support and resolving service issues

4.2 Communicating with You

• Sending transactional emails about your account or service (e.g., payment confirmations, security alerts, feature changes)
• Responding to inquiries submitted through contact forms, email, or support channels

4.3 Improving Our Service

• Analyzing aggregated usage data to understand how our platform is used
• Identifying technical issues and improving platform performance
• Developing new features based on usage patterns and feedback
• Conducting A/B testing for user interface improvements

4.4 Ensuring Security and Compliance

• Monitoring for unauthorized access, fraud, and security threats
• Maintaining server and application logs for incident investigation
• Complying with legal and regulatory obligations
• Enforcing our Terms of Service

4.5 Website Analytics and Attribution

• Analyzing website traffic sources and referral/campaign attribution to understand how visitors find us (consent-based, via Google Analytics only)

We do not send marketing or promotional emails and do not maintain a marketing mailing list.

4.6 Lifecycle Product Emails

We send automated service and product emails to account owners throughout the lifecycle of their PassportCraft subscription. These emails fall into two categories:

Onboarding and product emails — a welcome email on account creation, and milestone emails tied to the state of the account (for example, a prompt to create or publish a first product passport). These are sent on the basis of our legitimate interest (Art. 6(1)(f) GDPR) in helping account holders get value from the service they have signed up for. Every such email contains a one-click unsubscribe link; once unsubscribed, the account owner may resubscribe at any time via the link on the unsubscribe confirmation page.

Trial and account service notices — notifications relating to the status of a trial subscription (for example, a notice that a trial is approaching its end). These are sent on the basis of performance of the contract (Art. 6(1)(b) GDPR), because they concern the service terms the account holder has accepted. As service-essential communications, they are not subject to the marketing opt-out described above.

To prevent duplicate sends, we maintain a send log recording which lifecycle email was sent to which organization (identified by organization ID), the recipient email address, and the timestamp of the send. This log is deleted together with the organization's account; residual copies in encrypted backups are overwritten through the normal backup rotation cycle (see Section 7.1).

Lifecycle emails are delivered via Resend Inc., our email delivery sub-processor (see Section 5.1). No separate Resend entry is needed for lifecycle emails — the existing Resend engagement covers this processing.

---

5. Data Sharing and Processors

We do not sell personal data. We share personal data only with the categories of recipients and specific processors described below, and only to the extent necessary for the stated purposes.

5.1 Sub-Processors

The following third-party service providers process personal data on our behalf:

5.2 Other Recipients

We may share personal data with the following categories of recipients:

We will never share your personal data with third parties for their own marketing purposes.

5.3 Sub-Processor Changes

We maintain a current list of sub-processors on our website. We will notify customers of any new sub-processors at least 30 days before they begin processing personal data, giving customers the opportunity to object.

5.4 AI-Assisted Features

Certain optional features of our platform use artificial intelligence to assist you — for example, rewriting sustainability claims or suggesting care symbols. When you use these features, the text you submit is sent to our AI sub-processor, OpenAI, to generate a suggestion. We use AI only to transform the content you provide, and AI output is presented as a suggestion that you review and edit before it is published. OpenAI does not use data submitted through its API to train its models by default, and we do not use your content to train our own models. AI features are not used to make automated decisions that produce legal or similarly significant effects (see Section 11).

---

6. International Data Transfers

PassportCraft is based in the United States. When you use our service from the European Economic Area (EEA), the United Kingdom, or Switzerland, your personal data may be transferred to countries outside these regions.

6.1 Transfer Mechanisms

We rely on the following legal mechanisms to ensure an adequate level of data protection for international transfers:

PassportCraft is not itself self-certified under the EU-US Data Privacy Framework. Our reliance on the DPF flows through the individually DPF-certified sub-processors identified in Section 5.1 (currently Vercel, Google, Stripe, and Microsoft), each of which is subject to oversight by the U.S. Federal Trade Commission and offers its own independent recourse mechanism under the Framework. For any sub-processor that is not covered by an adequacy decision, we rely on the Standard Contractual Clauses described above.

6.2 Data Hosting

Customer account and DPP data is hosted in the EU (Ireland; AWS region eu-west-1) via Supabase's EU infrastructure. Website visitor data processed through analytics and hosting providers may be transferred to the USA under the safeguards described above.

6.3 Transfer Impact Assessments

We conduct Transfer Impact Assessments (TIAs) for all data transfers to countries not covered by an EU adequacy decision, in line with EDPB Recommendations 01/2020. You may request a copy of the relevant TIA by contacting privacy@passportcraft.com.

---

7. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. The table below sets out our specific retention periods.

Analytics retention and cookie lifetime. The 12-month analytics retention period above refers to the server-side analytics data we hold. It is distinct from the lifetime of any analytics cookie stored in your browser: the Google Analytics _ga cookie has a browser-side expiry of up to two years (as listed in our Cookie Policy), which is the expiry of the device-side identifier, not the period for which we retain the underlying analytics data.

7.1 Deletion Process

When a retention period expires or you request deletion:

1. Active data is deleted or anonymized within 30 days.
2. Data in backups is overwritten through the normal backup rotation cycle, which does not exceed 90 days.
3. We may retain anonymized, aggregated data indefinitely for statistical purposes, provided it cannot be used to identify any individual.

7.2 Legal Holds

Retention periods may be extended if we are required to preserve data due to pending or anticipated litigation, regulatory investigation, or a valid legal hold request.

---

8. Cookies and Tracking Technologies

We use cookies and similar technologies on our website. For full details about the cookies we use, their purposes, and how to manage your preferences, please see our Cookie Policy.

In summary:

• Essential cookies are required for the website to function and cannot be disabled.
• Analytics cookies (Google Analytics) are set by default to help us understand how visitors use our site. You can decline them via the cookie consent banner.

We do not use marketing, advertising, or social-media tracking cookies.

You can manage your cookie preferences at any time through the cookie settings panel accessible from any page of our website.

8.1 Do Not Track and Global Privacy Control Signals

Some browsers and extensions can transmit a "Do Not Track" (DNT) signal or a Global Privacy Control (GPC) signal that communicates a user's privacy preference. We treat these signals as follows:

• Sale and sharing of personal information. As explained in Section 12.4, we do not sell personal information and we do not share personal information for cross-context behavioral advertising. Because there is no such activity to opt out of, no GPC-driven opt-out of sale or sharing is required, and where we are legally required to honor the Global Privacy Control as an opt-out of sale/sharing, that preference is already satisfied by our no-sale, no-share posture.
• Cookies and analytics. Our analytics layer honors DNT and GPC signals. When your browser or extension transmits either signal, our analytics initialize in a "denied" state and no analytics cookies (such as Google Analytics _ga cookies) are placed or read on your device, regardless of region or any prior cookie consent banner selection. This signal-based behavior operates independently of the on-screen banner; you can also use the cookie consent banner or the cookie settings panel described above to decline non-essential cookies at any time.

---

9. Your Rights Under GDPR

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, you have the following rights regarding your personal data under the General Data Protection Regulation (GDPR) and equivalent local laws.

9.1 How to Exercise Your Rights

To exercise any of your rights, contact us at:

• Email: privacy@passportcraft.com
• Subject line: Include "Data Subject Request" and the specific right you wish to exercise.

9.2 Verification

We may need to verify your identity before processing your request. We will ask you to confirm information we already hold to authenticate your request without collecting additional personal data.

9.3 Response Time

We will respond to your request within 30 days of receipt. If your request is complex or we receive a high volume of requests, we may extend this period by an additional 60 days. We will inform you of any extension and the reasons for it within the initial 30-day period.

9.4 Fees

We process data subject requests free of charge. If requests are manifestly unfounded or excessive (particularly if repetitive), we may charge a reasonable fee based on administrative costs or refuse the request, providing our reasons.

9.5 Right to Lodge a Complaint

If you are not satisfied with our response or believe we are processing your data unlawfully, you have the right to lodge a complaint with a supervisory authority. You may complain to the supervisory authority in your EU/EEA Member State of residence, your place of work, or the place of the alleged infringement.

A list of EU/EEA supervisory authorities is available at: https://edpb.europa.eu/about-edpb/about-edpb/members_en

9.6 Authorized Agents

You may use an authorized agent to submit a privacy rights request on your behalf under any framework this Privacy Policy covers (GDPR, the CCPA/CPRA, and other applicable US state privacy laws). We will ask the agent to provide proof of your written authorization, and we may still take reasonable steps to verify the identity of the individual whose data is the subject of the request before we act on it.

---

10. Children's Privacy

Our service is directed at businesses and professionals. We do not knowingly collect or solicit personal data from anyone under the age of 18. If you are under 18, do not use our service or provide any personal data to us. If we become aware that we have collected personal data from a child under 18, we will delete that information promptly. If you believe we have collected data from a child under 18, please contact us at privacy@passportcraft.com.

---

11. Automated Decision-Making and Profiling

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you, as described in Art. 22 GDPR. All decisions that may affect your account, service access, or contractual relationship are made by humans.

---

12. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), provides you with specific rights regarding your personal information.

12.1 Categories of Personal Information

We collect the categories of personal information described in Section 2 of this Privacy Policy. In the preceding 12 months, we have collected the following CCPA categories, from the sources, for the business or commercial purposes, and disclosed to the categories of recipients set out below.

We have not sold or shared (as those terms are defined under the CCPA/CPRA) any of these categories of personal information in the preceding 12 months; see Sections 12.2 and 12.4. We do not collect or process sensitive personal information for the purpose of inferring characteristics about a consumer.

12.2 Your California Rights

12.3 How to Exercise Your California Rights

Submit requests to privacy@passportcraft.com with the subject line "California Privacy Request." We will verify your identity and respond within 45 days.

12.4 Do Not Sell or Share

We do not sell personal information. We do not share personal information for cross-context behavioral advertising as defined under the CCPA/CPRA.

12.5 Authorized Agent

You may designate an authorized agent to submit California requests on your behalf. Our authorized-agent process is the same one that applies to all privacy rights requests and is described in Section 9.6: we require the agent to provide proof of written authorization and may require you to verify your identity directly.

12.6 Other US State Privacy Rights

A growing number of US states have enacted comprehensive consumer privacy laws (for example, Virginia, Colorado, Connecticut, Texas, and Oregon, among others). If you are a resident of a US state with such a law, you have, to the extent the applicable law grants them, the rights to:

• Access / know the personal information we have collected about you;
• Correct inaccurate personal information;
• Delete personal information we have collected from you, subject to legal exceptions;
• Portability — obtain a copy of your personal information in a portable, readily usable format; and
• Opt out of the sale of personal information, of targeted advertising, and of profiling that produces legal or similarly significant effects.

As explained in Section 12.4, we do not sell personal information, and we do not share it for cross-context behavioral advertising or targeted advertising. We also do not use profiling to make automated decisions that produce legal or similarly significant effects (see Section 11). Because we do not engage in these activities, the related opt-out rights are already satisfied; you do not need to take any action.

To exercise any of these rights, contact us at privacy@passportcraft.com with the subject line "US State Privacy Request" and tell us which state you reside in and which right you wish to exercise. We verify requests as described in Section 9.2, you may use an authorized agent as described in Section 9.6, and we will not discriminate against you for exercising your rights.

12.7 Appeals

If we decline to act on a privacy rights request you have made under a US state privacy law, you may appeal that decision. To appeal, email privacy@passportcraft.com with "Appeal" in the subject line within the time allowed by your state's law. We will review the appeal and respond within the period required by the applicable law (generally 45 or 60 days), explaining the action we have taken or declined to take and the reasons for our decision. Where your state's law provides for it, we will also tell you how to submit a complaint to your state Attorney General. (If you are in the EEA, the United Kingdom, or Switzerland, the equivalent escalation route is the right to lodge a complaint with a supervisory authority described in Section 9.5.)

---

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

13.1 How We Notify You

13.2 Your Options

If you disagree with a material change, you may close your account before the change takes effect. Continued use of our service after the effective date of a material change constitutes acceptance of the updated Privacy Policy.

---

14. Data Security

We maintain technical and organizational measures appropriate to the risk, designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, consistent with Art. 32 GDPR. These measures include, depending on the nature of the data and the processing:

We do not currently hold a SOC 2 or ISO 27001 certification, and formal independent penetration testing is on our security roadmap rather than a current practice; we will update this section as our security program matures.

Despite these measures, no method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security. If you have reason to believe that your interaction with us is no longer secure, please contact us at privacy@passportcraft.com.

---

15. Data Breach Notification

If a personal data breach occurs, we will respond in accordance with our obligations under the GDPR and other applicable law.

• As a Data Controller (for the personal data described in Section 1.1 that we process for our own purposes), where a breach is likely to result in a high risk to the rights and freedoms of affected individuals, we will notify those individuals without undue delay. Where required, we will also notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, in accordance with Art. 33 and Art. 34 GDPR.
• As a Data Processor (for customer DPP data, as described in Section 1.1), where we become aware of a breach affecting personal data we process on behalf of a customer, we will notify the affected customer (the controller) without undue delay and, where feasible, within 72 hours of becoming aware, so that the customer can meet its own notification obligations. The specifics of this processor-side commitment are set out in the Data Processing Agreement (DPA) agreed with each customer.

These timeframes reflect the statutory standards under the GDPR (notification to affected individuals "without undue delay"; to a supervisory authority or affected customer "without undue delay and, where feasible, within 72 hours" of becoming aware). The specific terms of our processor-side commitment are set out in Article 9 of the DPA, which governs.

---

16. Contact Us

If you have questions about this Privacy Policy, wish to exercise your data protection rights, or have concerns about how we handle your personal data, please contact us:

Contacting our EU/UK Representative (DataRep). If you are located in the EEA or the UK, you may contact our appointed Data Protection Representative, Data Protection Representative Limited (trading as DataRep), about our processing of your personal data:

• by email at datarequest@datarep.com, quoting "PassportCraft LLC" in the subject line;
• via the online request form at www.datarep.com/data-request; or
• by post to "DataRep" at any of its local offices across the EEA and the UK (registered office: 77 Camden Street Lower, Dublin D02 XE80, Ireland). Please mark all correspondence for the attention of DataRep, not PassportCraft LLC, or it may not reach them.

For questions about the PassportCraft product or your account, please contact us directly at privacy@passportcraft.com rather than DataRep.

PassportCraft is not required to appoint a Data Protection Officer (DPO) under Article 37 GDPR and has not appointed one; our designated contact for all data protection matters is our privacy team at privacy@passportcraft.com.

We aim to resolve all data protection inquiries within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with a supervisory authority (see Section 9.5).

---

Appendix A: Glossary