PartpassDigital PassportPrivacy policy
Last updated 18 October 2026
1. Controller
Company name, address. Contact: privacy email.
2. What we process and why
| Account data | Email address, password hash, organisation memberships and roles. Purpose: providing the service. Legal basis: contract (Art. 6(1)(b) GDPR). |
|---|---|
| Organisation data | Name, VAT ID, website, country, verification status. Purpose: verifying manufacturers, suppliers, repairers and authorities as the Battery Regulation requires. Basis: contract and legal obligation (Art. 6(1)(b), (c)). |
| Access log | Who opened restricted passport data, when, with which stated purpose or case reference. Purpose: proving that only persons with a legitimate interest accessed restricted data (Regulation (EU) 2023/1542, Annex XIII). Basis: legal obligation and legitimate interest (Art. 6(1)(c), (f)). Visible to the passport owner and to authorities. |
| Verification checks | When an organisation asks to be verified, we automatically check the VAT number in the EU VAT register (VIES), the company name it returns, the LEI in the GLEIF register if given, that the applicant's email address is on the company's web domain, that the VAT number appears on the company website's legal pages, and the domain's registration date (RDAP). Verified VAT numbers are re-checked every 30 days. The results are stored as evidence. Purpose: admitting only real companies and authorities, as the Battery Regulation's access tiers require. Basis: legal obligation and legitimate interest (Art. 6(1)(c), (f)). |
| Automated decisions | Checks only ever approve automatically. If they can't confirm something, a person reviews the request and decides; nothing is rejected automatically (Art. 22 GDPR). You can see what was checked under Team → What we checked, and ask for a human review at any time. |
| Service events | Repairs, state-of-health checks and status changes logged against a unit, with the logging organisation. Basis: legal obligation (Art. 6(1)(c)). |
| Public passport views | No account, no tracking cookies, no analytics. Our hosting provider processes IP addresses in server logs for security for up to 30 days (Art. 6(1)(f)). |
| Rate limiting | Counters tied to your account for sign-in, lookups and invites, deleted after 24 hours. |
3. Cookies and local storage
We use only technically necessary cookies to keep you signed in. The app stores your last-used organisation and, if you install it, recently opened passports on your device for offline use. You can clear these in the app or in your browser.
4. Processors
Supabase (database, authentication and verification checks, hosted in the EU), Cloudflare (web hosting, content delivery and protection against attacks; requests are processed on Cloudflare's network, and the server code runs near the database in Frankfurt). Verification queries are sent to the European Commission (VIES), GLEIF and domain registries (RDAP); they receive only the company data being checked. We have data processing agreements with each. Where a processor is based outside the EU, transfers rely on the EU–US Data Privacy Framework or standard contractual clauses.
5. Retention
Account data is kept while your account exists; you can delete it yourself under Team → Delete my account. Published passports, releases, service events and the access log are kept for the lifetime of the product as the regulation requires (at least 10 years after the last unit is placed on the market) and are not deleted with an individual account; they then show your organisation instead of you.
6. Your rights
Access, rectification, erasure, restriction, portability (Team → Export data) and objection (Art. 15–21 GDPR). Write to privacy email. You can complain to a data protection supervisory authority.