Privacy Policy

1. Data controller

DPPora is operated by Christopher Alan Peachey, a self-employed professional registered in Spain, trading as Faro Digital Media. For personal data processed in connection with the DPPora website and service, the controller is Christopher Alan Peachey / Faro Digital Media, NIF Y0270240G, Paseo de la Dirección 161, Madrid, 28039, Spain. Privacy enquiries may be sent to admin@farodigitalmedia.com.

2. Scope of this policy

This Privacy Policy applies to personal data processed through the DPPora website, account registration, authentication, organization workspaces, product and Digital Product Passport management, support communications, security systems and related platform functions. It does not govern independent websites or services operated by third parties.

3. Personal data we collect

Depending on how DPPora is used, we may process account information such as name, email address, authentication identifiers and preferred language; organization and professional contact information; billing and tax information for paid services; subscription status, payment status and transaction references; support and correspondence records; technical information such as IP address, browser and device information, timestamps, security events and request logs; and information contained in files, evidence or other materials uploaded to the platform. Payment-card details are entered into Stripe’s secure payment service and are not stored by DPPora.

4. Product and passport information

DPPora processes product, manufacturer, responsible economic operator, regulatory, sustainability and supporting information supplied by users. Much of this information relates to products or organizations rather than identifiable individuals. Where product records, documents or public passports contain personal data, that information is also processed in accordance with this policy. Users must avoid including unnecessary personal data in product records and uploaded evidence.

5. How we use personal data

We use personal data to create and secure accounts; authenticate users; provide organization workspaces and platform functionality; create, maintain and publish Digital Product Passports; provide translation, validation and related processing requested by users; communicate about accounts, support, security and service changes; administer subscriptions, payments, invoices and billing; prevent fraud, abuse and unauthorized access; diagnose technical problems; maintain records; comply with legal obligations; and establish, exercise or defend legal claims where necessary.

6. Legal bases for processing

Accounts and requested workspace functions: contract, GDPR 6(1)(b). Tax and legally required billing records: legal obligation, 6(1)(c). Security, support and necessary authorised organisation continuity: legitimate interests, 6(1)(f), subject to balancing and objection rights. Optional GA4: consent, 6(1)(a). Required registration fields are needed to provide the account; without them it cannot be created. Resend delivers service emails. Some payment and sign-in providers act as independent controllers. Request details, transfer safeguards or exercise your rights at admin@farodigitalmedia.com; we respond within one month, subject to lawful extensions.

7. Business customers and data processed on their behalf

DPPora is intended for business and professional customers. In some circumstances a customer organization may determine the purposes and means of processing personal data contained in information it submits, while DPPora processes that data on the organization’s behalf. In those circumstances the customer may be the controller and DPPora may act as a processor or service provider. Customers are responsible for ensuring that they have a lawful basis for personal data they submit to the platform.

8. Public Digital Product Passports

Information intentionally published in a Digital Product Passport may be publicly accessible through a stable URL or QR code while DPPora hosts the passport. Users must review a passport before publication and ensure that information intended to remain private is not included in public fields. Publicly published information may be viewed, copied or indexed by third parties outside DPPora’s control.

9. Translation and automated processing

Where translation or other automated assistance is requested, relevant text may be processed by Microsoft Azure AI Translator or Cloudflare Workers AI, depending on the feature, language and service availability. DPPora limits such processing to the information needed for the requested function. Automated translations and suggestions may require human review, and DPPora does not use these systems to make decisions about individuals that produce legal or similarly significant effects. Users should not submit unnecessary personal or sensitive information for translation or automated processing.

10. Service providers and processors

DPPora uses specialist third-party providers to operate the service. These currently include Cloudflare for delivery, security and Workers AI translation functions; Supabase for EU-hosted database, authentication and file-storage infrastructure; Microsoft Azure AI Translator for translation services, using a North Europe resource where configured; Stripe for payment processing and subscription billing; and Apple and Google when a user chooses their optional sign-in services. These providers process data only as necessary to provide their services to DPPora and are subject to their applicable contractual and data-protection obligations. Additional providers may be used where reasonably necessary to operate, secure or improve the service.

11. Cloudflare Turnstile and security

DPPora uses Cloudflare Turnstile and other security measures to distinguish legitimate users from automated or abusive traffic and to protect registration, sign-in and platform functions. These systems may process technical information about requests, browsers, devices, network connections and security signals for fraud-prevention and security purposes.

12. Cookies and local storage

Necessary browser storage: dppora_locale remembers your language; Supabase local storage maintains your signed-in session; Cloudflare Turnstile may use security storage. Stripe, Apple and Google use storage on their own payment or sign-in pages. Essential storage keeps the site working. With your permission, Google Analytics measures website visits, tutorial viewing and signups. Analytics is not used on product passports or in the customer portal. Your choice is stored for six months. Analytics cookies (_ga and _ga_*) expire after six months and may be renewed on visits. You can withdraw consent at any time through Cookie settings. DPPora measures successful public passport page views on the server to provide anonymous, aggregated passport statistics to eligible customer organisations. This measurement does not set analytics cookies or use local storage, tracking pixels, fingerprints, persistent identifiers, IP-address hashes or cross-site tracking. The analytics dataset contains only the organisation, product or passport, date, coarse country code and a count. It does not store visitor IP addresses, full user agents, referrers or query strings. Customers receive aggregated view counts, not unique-visitor or individual-level data.

13. International data transfers

DPPora uses EU-hosted database, authentication, storage and Azure translation resources where practicable. Cloudflare operates a global network, and some providers or support functions may involve processing or access from countries outside the European Economic Area. Where European data-protection law requires safeguards for an international transfer, we rely on an applicable lawful transfer mechanism, such as an adequacy decision, approved contractual safeguards or another mechanism permitted by law.

14. Data retention

Deleting your personal account removes your login, profile and access; it does not delete the organisation, products, passports or version history. If you are the last owner, renewal is cancelled and public hosting continues until the end of the paid subscription. If another owner remains, the organisation and subscription continue normally. After hosting ends, organisation records remain private for authorised continuity and recovery; there is no automatic 90-day deletion. Request permanent organisation and passport deletion at admin@farodigitalmedia.com. We verify authority before erasure or restoring access to a colleague; signing up alone grants no access to an existing organisation. Personal data is retained only while necessary for a lawful purpose, including legal recordkeeping and claims; statutory privacy rights remain available independently of organisation deletion. Anonymous daily passport analytics aggregates are retained for no more than 25 months.

15. Data security

We use reasonable technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, loss or destruction. These measures include access controls, authentication, security filtering and the protections provided by our infrastructure providers. No internet service can guarantee absolute security, and users are responsible for protecting their credentials and devices.

16. Your data-protection rights

Where applicable, you may have rights to request access to personal data concerning you, correction of inaccurate data, deletion, restriction of processing, data portability, and objection to processing based on legitimate interests. You may also withdraw consent where processing relies on consent. Rights are subject to the conditions and exceptions provided by applicable law. Requests may be sent to admin@farodigitalmedia.com, and we may need to verify your identity before acting on a request.

17. Complaints

If you believe your personal data has been processed unlawfully, please contact us so that we can investigate. Where the GDPR applies, you also have the right to lodge a complaint with a competent supervisory authority. As the controller is established in Spain, the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) is the principal supervisory authority for our establishment.

18. Children

DPPora is a business and professional platform and is not intended for children. We do not knowingly offer accounts or services to children acting in a personal capacity.

19. Changes to this policy

We may update this Privacy Policy when our service, processing activities, providers or legal obligations change. The effective date shown at the top of the policy will identify the current version. Where a material change requires additional notice or consent, we will provide it as required by applicable law.

20. Contact

For privacy questions or data-protection requests, contact admin@farodigitalmedia.com or write to Faro Digital Media, Paseo de la Dirección 161, Madrid, 28039, Spain.

Professional contacts and business outreach

This policy also covers professional prospect research and DPPora business discussions through LinkedIn, email and Google Meet. We use names, professional profiles, roles, organisations, country, sector, relevance and priority, contact history, factual professional notes and pilot dates to develop relevant business relationships. Sources may include information you provide, LinkedIn profiles and organisation websites; the actual source of indirectly collected details must be identified in the information provided to you. Public availability is not consent. We rely on legitimate interests under GDPR Article 6(1)(f), subject to necessity, balancing and your rights. Notes must exclude sensitive personal details and speculation. Christopher manages the records using DPPora’s Cloudflare/Supabase infrastructure, LinkedIn and Google email/Meet; their processing may involve international transfers as described above. Calls are not recorded or transcribed. Our manual retention policy reviews non-responsive prospects after six months and deletes them after twelve months, measured from first outreach or, if uncontacted, date added. Unanswered follow-ups do not restart the clock. Any exception needs a documented reason and a new review date. Responding contacts are reviewed annually; unnecessary details are deleted when no ongoing relationship or documented reason remains. You may object to direct marketing, including related profiling, at any time and free of charge: reply or contact admin@farodigitalmedia.com. We stop that use, delete unnecessary prospect notes and keep only minimum details needed to prevent further outreach. Promotional email requires separate opt-in and an unsubscribe option; a LinkedIn connection is not that consent. Other rights and complaints are explained above.

Security activity and sessions

DPPora records sign-in attempts and outcomes, session activity, password and account-security changes, and sensitive administrative actions. Records may contain account identifiers, email addresses, IP addresses, browser/device information and timestamps. Cloudflare supplies an approximate country from the request; this is not precise location tracking. We use these records for our legitimate interest in preventing abuse, investigating incidents and protecting accounts. Access is restricted to authorised personnel; users can review their own security history. Security event logs are retained for up to 90 days and then deleted. Authentication session records are managed separately by Supabase. Passwords, verification codes and access or refresh tokens are never included in security event logs.

Company lookup and registration analytics

When a visitor chooses Company or organisation, DPPora may send the submitted business identifier to an official registry or specialist validation provider to return registered business details. Sole traders and individual professionals use manual entry and are not included in company-registry lookups. For up to 90 days, DPPora may retain the returned company name, country, registry source, lookup result, timestamp and whether the lookup led to registration to understand demand, improve registration and prevent misuse. We do not retain the lookup visitor's email address, full IP address or submitted tax identifier in this analytics record. Older records are deleted or reduced to anonymous aggregate statistics.

Support

Send us a message and read our replies here. We keep your IP address for 30 days to prevent abuse and troubleshoot support requests. Only administrators can access it. It is not used for analytics. Messages are kept for two years after the last activity, or removed when your account is deleted. Do not include passwords or payment-card details.

Google Analytics 4 (GA4)

With your consent, DPPora uses Google Analytics 4 (Google Ireland Limited) on its public website to measure visits, tutorial playback and registrations. Google receives cookie identifiers, page paths, referral origins, language, browser/device information and interaction events. IP addresses are used to derive approximate location; Google states that GA4 does not log or store them. We do not send form entries, email addresses, passwords or customer product data. GA4 is excluded from the portal and product passports. Google Signals is off; the website tag disables advertising personalisation. Verified on 18 October 2026: event retention is 2 months, user retention is 2 months and reset on new user activity is off. Analytics loads only after acceptance. You can withdraw consent through Cookie settings; this stops future collection but does not erase data already collected. Google may process data outside the EEA. Cookie expiry and Google’s event-data retention are separate; aggregated reports may be retained longer. With consent, selected campaign and click parameters may also be sent: gclid, gbraid, wbraid and utm_*; other query fields are excluded. Ask admin@farodigitalmedia.com for the configured GA4 event-retention period and applicable transfer safeguards.

Google — Privacy policy · Google Analytics — GA4

Anonymous signup counts

DPPora counts landing-page visits, create-account clicks, registration-page visits, registration attempts and company lookup attempts to help diagnose signup problems. Only daily totals by language, landing-page category and coarse country code are stored, for up to 90 days. These counts do not use analytics cookies, browser storage, visitor identifiers, IP addresses, fingerprints, full URLs, search terms or Google click IDs. No individual journey is linked or sent to Google. Account creation and confirmation totals are calculated separately from existing account records.

Business customers and data processed on their behalf

Data processing and service exit annex — English

Anexo de encargo del tratamiento y salida del servicio — Español

Report this passport

Report allegedly illegal content to admin@farodigitalmedia.com with the exact URL, reasons and relevant evidence, your name and email, and a statement that the information is accurate and complete to the best of your knowledge. Identity exceptions required by law apply. We acknowledge notices, assess them diligently and communicate the decision and available redress. Restrictions are reviewed by a person; affected publishers receive reasons where legally required. This address also serves as the contact point for authorities and users; communication is available in English and Spanish.

admin@farodigitalmedia.com