Privacy Policy

1. Introduction

Passport Digital Limited (company number 17067449), trading as MyProductPassport ("we", "us", or "our"), operates the myproductpassport.co.uk website and Digital Product Passport platform. This Privacy Policy explains what personal data we collect, why, on what legal basis, how long we keep it, and your rights under the UK GDPR and the Data Protection Act 2018.

2. Who We Are (Data Controller)

The data controller for the personal data described in this policy is:

• Name: Passport Digital Limited (trading as MyProductPassport)
• Company number: 17067449 (registered in England and Wales)
• Registered address: 124-128 City Road, London, EC1V 2NX
• ICO Registration: ZC108684
• Privacy contact: [email protected]

We have not appointed a statutory Data Protection Officer because we are not required to under UK GDPR Article 37. Privacy queries are handled by the privacy contact above.

3. Information We Collect

• Account information: name, email address, password (hashed), company name, company number, VAT number and phone number.
• Product data: information you add about products, including names, descriptions, SKUs, GTINs, documents and compliance data. This may include personal data if you include it (e.g., a named contact on a compliance document).
• Payment information: billing name, address, VAT number and subscription status. Card details are captured and stored by Stripe; we do not see or store full card numbers.
• Usage data: pages visited, features used, device/browser type, referring URL, and Digital Product Passport scan analytics (aggregate and pseudonymous).
• Communications: support tickets, email replies, newsletter preferences and consent records (timestamp, source, opt-in evidence).
• Server logs: IP address, user agent and timestamps — retained for security and fraud prevention.

4. How We Use It & Legal Bases

We process personal data only where we have a lawful basis under UK GDPR Article 6:

• Contract (Art. 6(1)(b)): to register and operate your account, generate and publish Digital Product Passports, process payments, provide support, and deliver the service you have subscribed to.
• Legal obligation (Art. 6(1)(c)): to keep accounting and tax records (HMRC, 6 years), respond to lawful requests, and meet our obligations under UK data protection and consumer law.
• Legitimate interests (Art. 6(1)(f)): to secure the platform against abuse and fraud, send service-related notices (including regulatory alerts relevant to your products), measure aggregate usage to improve the product, and protect our legal rights. We have assessed that these uses do not override your rights.
• Consent (Art. 6(1)(a)): to send marketing emails and newsletters, to set non-essential analytics or advertising cookies, and to process any optional information you explicitly provide. You can withdraw consent at any time via the unsubscribe link in any marketing email or via account settings.

5. Sub-processors & Third Parties

We do not sell personal data. We use the following sub-processors under written data processing terms to operate the service:

• Stripe Payments Europe Ltd. (Ireland / US — Standard Contractual Clauses) — payment processing and subscription management.
• Cloudways / DigitalOcean (EU and US regions) — application hosting and database storage.
• Cloudflare, Inc. (US — Standard Contractual Clauses) — DNS, CDN, bot protection, DDoS mitigation and Turnstile (captcha-free anti-abuse). Cloudflare processes IP addresses and request metadata as a network-layer service.
• Sendinblue SAS (Brevo) (France) — transactional and marketing email delivery and newsletter list storage.
• Plausible Analytics (EU, self-hosted or hosted in the EU) — privacy-friendly, cookieless website analytics. No personal data is collected and no cross-site tracking occurs.
• Google LLC (US — Standard Contractual Clauses) — Google Analytics 4 and Google Ads conversion measurement, only if you grant consent via our cookie banner.
• Anthropic, PBC (US — Standard Contractual Clauses) — AI-assisted content generation where you voluntarily use AI features; inputs are not used to train foundation models.

We also share data with public authorities, auditors or courts where required by law or legal process, and in an anonymised or aggregated form for service improvement.

Published passport data: when you publish a Digital Product Passport, the product information you choose to include becomes publicly accessible via its passport URL and QR code. This is the core purpose of the service. Do not include personal data in published passport fields unless you intend it to be public.

6. International Transfers

Some sub-processors above are located outside the UK/EEA (primarily the United States). Where we transfer personal data outside the UK, we rely on the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or an equivalent safeguard recognised by the ICO. Copies of the relevant transfer mechanisms are available on request.

7. Data Security

We use encryption in transit (TLS 1.2+), encrypted database storage at rest, hashed passwords (bcrypt), role-based access controls, audit logging of privileged actions, and regular dependency patching. No method of transmission over the Internet is 100% secure, but we work to an industry-standard security baseline and report any notifiable personal data breach to the ICO within 72 hours of becoming aware of it.

8. Data Retention

We keep personal data only as long as we need it for the purpose it was collected:

• Account records: for the life of your account, plus 30 days after closure for restoration, then deleted or anonymised.
• Billing and tax records: 6 years from the end of the relevant tax year (HMRC requirement).
• Published passports: remain live while your account is active. On account closure they are taken offline; you can request immediate takedown at any time.
• Server and security logs: 90 days, then purged.
• Newsletter subscribers: until you unsubscribe, with consent evidence (timestamp, source, IP) retained for a further 12 months to evidence lawful processing.
• Support correspondence: 24 months from last contact, then archived or deleted.
• Audit logs of privileged account actions: 5 years, for security and dispute resolution.

9. Your Rights

Under the UK GDPR and the Data Protection Act 2018 you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete personal data.
• Erasure ("right to be forgotten") of your personal data, subject to our legal retention obligations.
• Restrict or object to processing, including objection to processing based on legitimate interests.
• Portability — receive your data in a structured, machine-readable format (JSON).
• Withdraw consent at any time where processing is based on consent.
• Not be subject to purely automated decisions producing legal or similarly significant effects. We do not use such decisions.
• Lodge a complaint with the Information Commissioner's Office (see below).

You can exercise most of these rights directly: data export and account deletion are available in account settings. For other requests, email [email protected]. We respond within one calendar month as required by UK GDPR Article 12(3).

10. Cookies & Tracking

We use a small number of cookies. You can set your preferences via the "Cookie Settings" button at the bottom-left of any page.

Strictly necessary (no consent required):

• laravel_session — keeps you signed in. First-party. 2 hours.
• XSRF-TOKEN — protects forms against cross-site request forgery. First-party. 2 hours.
• cookie_consent — remembers your cookie choice. First-party. 12 months.

Analytics and advertising (set only if you click "Accept all"):

• Google Analytics 4 (_ga, _ga_*) — aggregate site analytics. Third-party (Google). Up to 24 months.
• Google Ads conversion (_gcl_au) — measures ad campaign effectiveness. Third-party (Google). 90 days.

Google tags run in Consent Mode v2 with default-deny: until you consent, no analytics or advertising identifiers are stored. Plausible Analytics is cookieless and does not set any cookie. You can withdraw consent at any time by clicking "Cookie Settings".

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes are announced by email (for account holders) and by updating the "Last updated" date on this page. Non-material edits (typos, clarifications) are made without notice.

12. Contact & Complaints

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us at [email protected].

If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office.