How we handle personal data during the pre-pilot.

ARRETIA Networks & Company (the “Controller”) operates the platform described at arretia.com. Contact for any data-subject request: privacy@arretia.com.

For brand and operator accounts we collect the credentials required to authenticate and authorise the user (email, hashed password, role, tenant binding, IP address of the login session). For the public Digital Product Passport viewer we collect no user data: scans of the QR are anonymous, no cookies, no client-side tracking scripts.

Authentication + service delivery: contract performance (Art. 6(1)(b) GDPR). Security + abuse prevention: legitimate interest (Art. 6(1)(f)). The cryptographic audit log of Digital Product Passports is required by ESPR (EU 2024/1781), Art. 9 + Art. 10—public-task obligation (Art. 6(1)(c)).

Today we rely on four subprocessors: Supabase (database + auth + storage · EU region), Vercel (hosting + CDN), hCaptcha (captcha on public forms), Resend (transactional email · EU region). All bound by standard contractual clauses.

Account data: retained while the account is active, deleted within 30 days of account closure. Digital Product Passport content (the regulated record): retained for the product's lifetime + the availability window mandated by the relevant ESPR delegated act. Audit logs: 7 years (financial-records baseline).

Access, rectification, erasure, restriction, portability, and objection—exercise any of these by emailing privacy@arretia.com with the subject “Data-subject request”. We respond within 30 days. You also have the right to lodge a complaint with your national supervisory authority.

This pre-pilot draft will be replaced by a counsel-reviewed notice before commercial launch. Material changes will be announced via the affected accounts and on this page at least 30 days in advance.