Privacy Notice

1. Who we are

Tracevora DPP is a software platform operated by Kyriacos Sakkas under the trade name Tracevora.eu and provides tools for creating and managing Digital Product Passports (DPPs) and related sustainability documentation.

Kyriacos Sakkas ("we", "us") acts as the data controller for personal data processed through the service.

Business address: Nicosia, Cyprus.
Contact: support@tracevora.eu

2. Personal data we collect

• Account data: name, email, hashed credentials, company name, role.
• Product & passport content: data you upload to create Digital Product Passports.
• Usage & telemetry: pages visited, features used, scan events, device identifiers, IP address.
• Support communications: messages you send us.
• Cookies: essential session and security cookies (see section 9).

3. Purposes & legal basis

• Provide the service and your account (contract).
• Security, fraud prevention, abuse throttling (legitimate interests).
• Service improvement and analytics (legitimate interests).
• Customer support (contract / legitimate interests).
• Legal & tax compliance (legal obligation).
• Optional marketing emails (consent, withdrawable anytime).

4. Sharing your data

We share personal data with:

• Subprocessors: cloud hosting, database, email delivery, analytics, AI processing. See our Subprocessors page.
• Paddle.com Market Ltd. — our Merchant of Record for all sales, subscription management, payments, tax compliance and invoicing. Paddle acts as an independent controller for payment data.
• Professional advisers (legal, accounting) where necessary.
• Authorities where required by law.

5. International transfers

Where data leaves the UK/EEA, we rely on adequacy decisions or Standard Contractual Clauses with appropriate safeguards.

6. Retention

We retain account and passport data for the lifetime of your account, plus up to 12 months after closure for backup and legal purposes, after which data is deleted or anonymised. Tax records are retained as required by law.

7. Your rights

Subject to applicable law (including GDPR), you may request: access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. We respond within one month.

To exercise rights, email support@tracevora.eu.

8. Supervisory authority

You have the right to lodge a complaint with your local data protection authority. If you are located in Cyprus, complaints may be submitted to the Commissioner for Personal Data Protection of Cyprus.

9. Cookies

Tracevora DPP uses only essential cookies required for authentication, session management, and security. We do not currently use advertising, marketing, or third-party tracking cookies. If non-essential cookies are introduced in the future, we will request your consent via a cookie banner and allow you to manage or withdraw consent at any time.

10. Security

We use appropriate technical and organisational measures including encryption in transit, access controls, row-level security and audit logging.

11. Changes

We will post material changes on this page and update the "last updated" date.