Data Processing Addendum

For Customer Data you upload, you act as controller and TagPass acts as processor. For account and billing data, TagPass acts as controller under its Privacy Policy.

We process personal data for the purpose of providing the Digital Product Passport service for as long as your account is active, plus a 30-day export window after termination.

Processing includes storage, structuring, validation, hosting, publication of passports you choose to publish, backup and deletion. Data subjects may include your personnel, and any contacts you enter, such as economic operator or repair-service contacts.

We process personal data only on your documented instructions; ensure personnel are bound by confidentiality; implement appropriate technical and organisational security measures; assist you with data subject requests, impact assessments and breach notification; and delete or return personal data at the end of the service.

You give general authorisation for us to engage sub-processors for cloud hosting and database infrastructure, transactional email, payment processing and error monitoring. We impose equivalent data protection obligations on each and remain liable for their performance. We will give notice before adding or replacing a sub-processor so you may object on reasonable grounds.

Measures include encryption in transit and at rest, organisation-scoped row-level access control, least-privilege administrative access, audit logging, backup and restore procedures, and regular dependency patching.

We will notify you without undue delay after becoming aware of a personal data breach affecting Customer Data, with the information reasonably available to us.

Where personal data is transferred outside the EEA or UK, transfers are made under the European Commission's standard contractual clauses or another approved safeguard.

On reasonable written request, and no more than once per year unless required by a supervisory authority, we will provide information necessary to demonstrate compliance with this addendum.

Data protection enquiries: privacy@tagpass.one — Musivo LLC, Tornado Tower, Doha, Qatar.