Privacy Notice

1. Who we are

Tracevora DPP is a software platform operated by Kyriacos Sakkas under the trade name Tracevora.eu and provides tools for creating and managing Digital Product Passports (DPPs) and related sustainability documentation.

Kyriacos Sakkas ("we", "us") acts as the data controller for personal data processed through the service.

Business address: Nicosia, Cyprus.
Registered address: [15, Axiou St. 2311 Lakatamia, Nicosia Cyprus]
Contact: support@tracevora.eu

2. Personal data we collect

• Account data: name, email, hashed credentials, company name, role.
• Product & passport content: data you upload to create Digital Product Passports.
• Usage & telemetry: pages visited, features used, scan events, device identifiers, IP address.
• Support communications: messages you send us.
• Cookies: essential session and security cookies (see section 9).

3. Purposes & legal basis

• Provide the service and your account (contract).
• Security, fraud prevention, abuse throttling (legitimate interests).
• Service improvement and analytics (legitimate interests).
• Customer support (contract / legitimate interests).
• Legal & tax compliance (legal obligation).
• Optional marketing emails (consent, withdrawable anytime).

4. Sharing your data

We share personal data with:

• Subprocessors: we use the following categories of subprocessors — cloud infrastructure (Supabase), payment processing (Paddle.com Market Ltd.), and AI processing (Anthropic). A full named subprocessor list is available on request at support@tracevora.eu, or see our Subprocessors page.
• Paddle.com Market Ltd. — our Merchant of Record for all sales, subscription management, payments, tax compliance and invoicing. Paddle acts as an independent controller for payment data.
• Professional advisers (legal, accounting) where necessary.
• Authorities where required by law.

5. International transfers

Where data leaves the UK/EEA, we rely on adequacy decisions or Standard Contractual Clauses with appropriate safeguards.

6. Retention

We retain account and passport data for the lifetime of your account, plus up to 12 months after closure for backup and legal purposes, after which data is deleted or anonymised. Tax records are retained as required by law.

7. Your rights

Subject to applicable law (including GDPR), you may request: access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. We respond within one month.

To exercise rights, email support@tracevora.eu.

You may also lodge a complaint with the Cyprus Commissioner for Personal Data Protection (CPDP) at dataprotection.gov.cy, or with the supervisory authority in your country of residence.

8. Supervisory authority

You have the right to lodge a complaint with your local data protection authority. If you are located in Cyprus, complaints may be submitted to the Commissioner for Personal Data Protection of Cyprus.

9. Cookies

We use essential cookies required for authentication and session management. We also use limited first-party analytics cookies to understand how the service is used. Analytics cookies are only set after you accept via the cookie consent banner. You can withdraw consent at any time by clicking "Cookie Settings" in the site footer.

10. Security

We use appropriate technical and organisational measures including encryption in transit, access controls, row-level security and audit logging.

11. Changes

We will post material changes on this page and update the "last updated" date.