Privacy notice
Last updated 23 October 2026
This notice explains what personal data DPP Host processes, why and for how long: when you visit dpphost.eu, open a product passport on id.dpphost.eu, write to us, use the dashboard at app.dpphost.eu, the API or the MCP server, or answer a supplier request on forms.dpphost.eu. For some of this data, the brand that uses DPP Host is responsible and we process it on the brand's behalf; the sections below say where.
Who is responsible
The data controller is Qubites ApS, Ulsøparken 49, 2. 2660 Brøndby Strand, Denmark (CVR 37061026), which runs DPP Host. Write to privacy@dpphost.eu about your personal data, and to hello@dpphost.eu about anything else.
When a brand is responsible
Brands, meaning the businesses that use DPP Host, publish product passports with it, ask their suppliers for product data and, on Premium, offer services to the owners of their products. For the personal data in that work, the brand is the data controller and DPP Host is its data processor: what the brand puts in its passports and pages, its suppliers' contact details and answers, and the data in its owner services. We use that data only on the brand's instructions. Questions about it, and requests to see, correct or delete it, go to the brand. If you send them to us, we pass them on to the brand.
Technical data
When you open any of our sites or use the API, Cloudflare, which delivers them, processes your IP address and technical data about each request, such as the address requested, the time and your browser, to deliver the service and to protect it against abuse. Requests that reach our database are also logged by Supabase. The API, the MCP server and the supplier forms limit how many requests one IP address can make in a minute; Cloudflare counts this for the current minute only, and we do not store the address. The providers delete these logs after a short period. The legal basis is our legitimate interest in running a secure service (GDPR Art. 6(1)(f)).
On the dashboard's pages where you sign in, create an account or reset a password, including the sign-in to a brand's owner services, and when you sign in again before a sensitive action, Cloudflare Turnstile checks that a person and not an automated program is making the request; most people see nothing of this check. For it, Cloudflare processes your IP address and technical signals from your browser and device, as our data processor. The legal basis is our legitimate interest in protecting accounts and sign-ins against automated abuse (GDPR Art. 6(1)(f)). The same check protects the form for messaging the owner of a product you found.
Product passports
Each product passport on id.dpphost.eu is published by the brand responsible for the product, and the brand decides what it shows. Each new passport version also shows the brand's verified legal name, its country and, for a company, its verified VAT or registration number. For a sole trader, the legal name is their own name. Where a passport shows personal data, the brand is responsible for it and we publish it on the brand's behalf. Published passports stay online for the period EU rules require, which can be many years. To have personal data removed from a passport, contact the brand named on it, or us. Opening a passport needs no account. We count how often passports are opened, without personal data: per day, product (without its serial number), language, country and whether the current or an earlier version was opened. We do not record IP addresses, browser details, cookies or the page you came from. Brands on Premium can see these daily totals for their own products. Cloudflare keeps the counts for 3 months; our database keeps the daily totals for 25 months.
If a brand shows a video from YouTube or Vimeo on its passport page, the page first shows a still image from our own servers, and nothing loads from YouTube or Vimeo until you press play. When you do, the video plays from YouTube (Google) in its privacy-enhanced mode or from Vimeo with its "do not track" setting, and that provider receives your IP address and information about your browser, and may store information in your browser, under its own privacy terms. Links on a passport page, for example to documents or a certificate check, open other websites only when you click them.
If you write to us
If you email us at hello@dpphost.eu or privacy@dpphost.eu, for example to send documents for a business check, we process your email address, your name and what you write, to answer you and follow up. The legal basis is our legitimate interest in answering the people who contact us (GDPR Art. 6(1)(f)) and, for requests about your rights, our legal obligation to answer them (GDPR Art. 6(1)(c)). We keep these emails as long as we need them to answer you and follow up, and at most 2 years after our last exchange.
If you sign up for alerts about EU rules
If you sign up on dpphost.eu for alerts about EU product rules, we store your email address, the company or product web address you give, the language of the page and when you signed up and confirmed. We send a confirmation email first, and alerts only after you confirm: when a passport rule for products like yours gets a date, and again before it applies; never advertising. Every email has a link to stop the alerts. The legal basis is your consent (GDPR Art. 6(1)(a)), which you withdraw with that link. An address that is not confirmed within 7 days is deleted, and your record is deleted 30 days after you stop the alerts. Our record of each email we send you is deleted after 30 days. To limit abuse of the form, we keep a keyed hash of your IP address in our counters for at most a day, never the address itself.
Accounts in the dashboard
When you create an account at app.dpphost.eu, we process your name, your email address, a securely hashed password if you set one, your language, the organisations you belong to with your role in each, and a log of the actions you take in them. Supabase, which runs our sign-in, also records your sessions and sign-ins with your IP address and browser. We need this to provide the service you or your organisation signed up for (GDPR Art. 6(1)(b)); without a name and an email address you cannot have an account. You stay signed in for up to 90 days, and for up to 30 days without use. We keep your account until you delete it on your Account page or ask us to delete it. Deleting it removes your memberships, your sign-in and the log of your sign-ins at once; the entries in your organisations' action logs about what you did there stay, under an identifier that no longer leads to your account. Before you can delete it, make another member owner of any organisation that you alone own and that has other members, write to us to close any organisation of which you are the only member, and delete any owner account you have at a brand. The action log of an organisation is kept for as long as its published passports are available, because it documents who published and changed them.
You can also sign in with Google, Apple or Microsoft. If you do, that provider confirms who you are under its own privacy terms and, at your request, shares with us your email address, your user identifier with that provider and, if it includes them, your name and other basic profile details. We store them with your account so you can sign in the same way again, and the provider learns that you sign in to DPP Host. We never receive your password for that provider. If you choose Apple's "Hide My Email", we receive an address at Apple that forwards our emails to you. If you turn on two-step sign-in, a secret for your authenticator app is stored with your account (by Supabase, in Frankfurt) and the times you use it are logged; you can turn it off on your Account page. The legal basis for both is the contract with you or your organisation (GDPR Art. 6(1)(b)).
Organisations, business checks and GTINs
An organisation must pass a business check before it can publish passports. An EU VAT number is checked automatically in the EU's VAT register VIES, which the European Commission runs with the national tax authorities and which can return the registered name and address; if VIES does not confirm the number, the check is refused, and the organisation can start a new check that our staff make by hand. Our staff check other registers, such as the Danish CVR, by hand. Where no register can confirm the business, for example for many sole traders and businesses outside the EU, our staff ask by email for documents such as a register extract or business licence, and delete that email once the check is decided. We store the country, the number, the legal name and, where a register gives it, the address, any note the organisation adds, the result, and who asked and decided. Our staff also check the legal name against the EU's sanctions lists. For a sole trader, these records are personal data. We use them to let only real businesses publish, to allow each business one verified organisation, to show the verified details in its passports (see "Product passports"; a number checked through the sole-trader route is never shown) and to keep passports trustworthy. The legal bases are the contract with your organisation (GDPR Art. 6(1)(b)), our legitimate interest in preventing misuse (Art. 6(1)(f)) and, for the sanctions check, our legal obligation (Art. 6(1)(c)). We keep these records for as long as the organisation exists in DPP Host, because they show why it was allowed to publish.
To publish passports for a GTIN (a barcode number), an organisation needs a claim to it, or permission from the organisation that holds the claim. A claim comes with evidence, such as the name of the GS1 licensee, a proof on the organisation's web domain or a GS1 Digital Link address, which our staff check by hand. We store the claim, the licensee's name, the evidence, any note or dispute, and who asked and decided. These records are personal data only where they name a person, such as a sole trader. We keep them for as long as the organisation exists, for the same reasons and on the same legal bases as the business check. To prove that it controls a web domain, an organisation adds a code to the domain's DNS records, which we look up through Cloudflare.
Teams, invitations and partners
Members of an organisation see each other's names, email addresses and roles, since when they are members and whether they use two-step sign-in; admins also see the organisation's action log. An admin invites someone by creating a link and sharing it; we send no invitation email. We store the invited email address with the organisation and role until the invitation is accepted, and if it is not, we delete it within 30 days after the invitation expires or is withdrawn. The legal basis is the inviting organisation's legitimate interest in adding its team (GDPR Art. 6(1)(f)). An organisation can also let another business, such as an agency, work in it as a partner. The partner's staff then see what members with the same role see, the organisation's members see their names and email addresses, and the action log records what they do. We keep the record of which partner was linked, by whom and when, with the organisation's records, for as long as its action log. The legal basis is the contract with your organisation (GDPR Art. 6(1)(b)). A partner can also prepare an organisation for a brand that has not joined yet and enter the email address of a contact at that brand, to whom we send the partner's requests to approve passports. We keep that address and the language of its emails until the contact takes the organisation over; if they never do, we delete both 90 days after the address was entered or the last request ran out, whichever is later. The partner's staff who send requests there see the address. Each request stays with the organisation's records: who sent which passports and when, the brand's decision, who made it and any reason given, which the partner's people working there see. The legal basis is the legitimate interest in letting a brand approve the passports a partner prepared for it (GDPR Art. 6(1)(f)). A brand that uses owner services can also invite a shop by email to register the brand's products to the shop's customers. We keep the invited address and its language until the invitation is accepted or withdrawn, or otherwise until 29 days after it expires; whoever opens the invitation sees the brand's name and that address. The legal basis is the brand's legitimate interest in adding the shops that sell its products (GDPR Art. 6(1)(f)). Once a shop accepts, we keep which organisation accepted which version of the Retailer Terms, who accepted them and when, on the basis of the contract with that organisation (GDPR Art. 6(1)(b)). A brand can also link a distributor for the countries it serves, and the distributor can then invite a shop by email for the brand's products. We keep that invitation as we keep a brand's, with the distributor that sent it; whoever opens it also sees the distributor's name, and the brand sees each shop a distributor adds. The legal basis is the distributor's and the brand's legitimate interest in adding the shops that sell the brand's products (GDPR Art. 6(1)(f)). When a business sends a brand's products to another business through DPP Host, or marks products it holds as lost or stolen, we record which member did it with the records of the businesses and the brand concerned, for as long as the brand's organisation exists or until that member's account is deleted, on the basis of the contract with those organisations (GDPR Art. 6(1)(b)). If a shop has its invoicing system send a copy of each invoice to its DPP Host address, we read the frame numbers, the invoice number and the date out of the copy, keep those with the shop's sales records for 24 months and discard the copy at once (it may carry the buyer's name and address; a copy we cannot read is noted for 7 days without its content), as the shop's processor under the Retailer Terms.
API keys, AI apps and shops
When an admin creates an API key, we store its name, who created it, its permissions and expiry, its first characters, when it was last used and a keyed hash of it; the full key is shown once and never stored. We count the requests of each organisation per day and keep these counts for 400 days. You can connect an AI app, such as an AI assistant, to DPP Host through our MCP server at mcp.dpphost.eu: you sign in and allow it to work in one organisation, for a period you choose of up to 365 days. We store the connection: your user id, the organisation, the app's name and web address, the permissions, when you allowed it and how much it is used each day; we keep the daily use for 400 days. The connection is also stored, partly encrypted, in Cloudflare Workers KV, which is not limited to the EU. Access lasts 1 hour at a time, and a connection also ends after 30 days without use or when you end it in the dashboard. The organisation's admins see who connected which app. The app receives the passport, product and draft data it asks for within the permissions you gave it, never members' or owners' details, and its provider handles that data under its own terms. An AI app cannot publish: a person approves every change. Apps that register with our MCP server give us their name, web address and, if they choose, contact addresses; we keep these for up to 90 days after the app was last used. When an admin connects a Shopify or WooCommerce shop, we store who connected and approved it and the shop's web address, and email the organisation's admins; the shop sends us product data only, never customer, order or visitor data. Records of keys, connections and shops stay with the organisation's records after they end. The legal basis is the contract with your organisation (GDPR Art. 6(1)(b)).
On New passport, you can drop files about a product (PDF files or photos) or paste a link to its page. We send them once to Anthropic, whose Claude AI model reads them to find the values the passport needs and where each one is stated; photos are sent without their location and camera data. Every value stays a suggestion until a person confirms it. When an admin adds a GS1 licence certificate or membership invoice to a GTIN claim, we send it to Anthropic once in the same way, to read the company details it shows (who issued it, the licensee, its company prefixes and its dates); we keep only those details with the claim, not the file, and use them to decide the claim. We do not keep the files or the page: they are read in memory and dropped with the request. We keep the values found, each with the file's name and a short quote showing where it was found, and a count of each organisation's reads (who, when and how many files, without their content) for 400 days, to keep to the monthly limit. Anthropic processes the files in the United States or another country where it runs its service, under the EU's standard contractual clauses. It deletes the files and the answer within 30 days and does not use them to train models; only content that its automatic checks flag as breaking its usage policy may be kept longer, for up to 2 years. In the dashboard, the Guide, an AI assistant, helps your organisation's editors make their passports. When you write to the Guide, we send your message, the earlier messages of your conversation and the parts of your organisation's account it needs to answer (its plan, its drafts and what they are missing, its prices and its AI credits) to Anthropic, whose Claude model writes the answer; a file you add in the Guide is read as on New passport. The values the Guide suggests stay suggestions in the draft until a person confirms them. We keep your conversation, which only you can see, for 30 days after its last message, and a count of each person's messages (who, when and how many, without their content) for 400 days, for the hourly limit and the AI credits. Anthropic processes them as described above, deletes them within 30 days and does not use them to train models. Apart from this, DPP Host uses no AI model on your data. The legal basis is the contract with your organisation (GDPR Art. 6(1)(b)).
Emails we send
We send emails from noreply@dpphost.eu through Resend, our data processor: sign-in codes and links, address confirmations and password resets, and emails about your organisation's use of DPP Host, for example about payments and failed payments, plan changes, decisions on business checks and GTIN claims, certificates that are about to expire, exports that are ready, a reminder about a saved import when you ask for one, answers to supplier requests, owners' repair requests, a brand's or a distributor's invitation to a shop, the link a shop asks us to send its customer, deliveries a business receives or that are taken back, a brand's recalls and safety warnings about products a business holds, and problems with webhooks or shop connections. They go to the person concerned or, usually, to the organisation's owners and admins; those about deliveries, recalls and safety warnings also go to its editors. We send no newsletters or advertising, and we do not track whether you open our emails or click their links. Resend sends them from the EU (Ireland) and keeps a copy of each email and its sending log in the United States for 30 days. We keep a record of each email we send, with the address it went to, to show what was sent and to avoid sending it twice; the records of emails to you are deleted with your account, and the others are kept for as long as the organisation they concern exists. The legal basis is the contract with you or your organisation (GDPR Art. 6(1)(b)). Do not reply to these emails; write to hello@dpphost.eu instead. When a finder sends a message about a product its owner marked lost or stolen, we email the owner that a message came, without what the finder wrote. When you ask us for help with a saved import, we keep your request (your message, if you write one, the import's counts and who asked) and send it to our staff with your email address so that we can answer you; your organisation's members see that you asked, and we delete the request 2 years after we close it.
Payments
When an organisation pays for DPP Host, the payment goes through Stripe. We send Stripe the organisation's name, its billing email address (or the buyer's email address) and its language. Stripe collects the billing address, any VAT number, which Stripe checks, and the payment details; we never receive full card or bank account numbers. Stripe calculates the VAT, issues the invoices and runs the customer portal, where admins see invoices and change payment details. We store the Stripe customer reference, the billing email address, the country, the VAT number and its status, and Stripe's notifications about payments. Stripe processes the payment as our data processor; to prevent fraud and to meet its own legal duties, such as anti-money-laundering rules, it is an independent controller under its own privacy policy. The legal bases are the contract with your organisation (GDPR Art. 6(1)(b)) and our duty to keep accounts (Art. 6(1)(c)). Stripe's notifications are deleted 400 days after they arrive, once we have processed them. We keep the billing details for as long as the organisation exists, and invoices and other accounting records for as long as the Danish Bookkeeping Act requires (5 years from the end of the financial year). Stripe can process data in the United States; that transfer is covered by the EU-US Data Privacy Framework and the European Commission's standard contractual clauses.
If you answer a supplier request
A brand can ask its suppliers for product data with a link to a form on forms.dpphost.eu, which the brand sends itself or we send by email in its name, with up to two reminders. The brand is the data controller and we are its data processor. The brand gives us your contact details, such as your name, email address, country and language, and it receives your answers and the files you upload, such as certificates or photos; we remove location and camera data from photos before we store them. The brand decides how long it keeps your contact details and answers. Files that the brand has not used in a passport are deleted 90 days after the request ends, when it is withdrawn or its link expires. The form needs no account and sets no cookies. Questions about your data there go to the brand that sent the request. If you use "Report this request", we keep a hash of your email address so that we send you no more requests from this brand. For that we are the controller, on the basis of our legitimate interest in preventing misuse (GDPR Art. 6(1)(f)), and we keep the hash until you ask us to remove it.
If you use a brand's owner services
Some brands let the owners of their products register them at app.dpphost.eu/owner/…. In that area the brand is the data controller and DPP Host processes your data on the brand's behalf; the brand's own privacy information is shown there, and questions about your items, requests or data there go to the brand. DPP Host is responsible for your sign-in (your email address and when you confirmed it), which you can use at several brands; we need it to give you the sign-in you asked for (GDPR Art. 6(1)(b)). You can also sign in to an owner area with Apple or Google; what that provider shares and what we keep of it is described under "Accounts in the dashboard". A name an owner gives for their card, or that Apple or Google shares at sign-in, shows on that owner's own card and product page; the other person in a handover sees only the first name and initial, as does the previous owner's card afterwards; a proof of registration that an owner shares shows the product, its serial number, since when it has been registered and the owner's initials, or the full name if the owner chooses; the product passport never shows the name, and none of these shows an email address, phone number or address. If a shop that the brand linked hands a product over to you, the shop's name and the date of sale become part of your registration and your guarantee, and your card and product page show "Bought at" with the shop's name; the shop sees your first name and initial until 30 days after the handover, and nothing else about you. If the shop has us email you the link, your address is used only for that email. Opening a proof of registration counts the view and keeps nothing about you. We keep your sign-in while you have an owner account at any brand or an account in the dashboard. If you ask for a sign-in link but never open an owner account, or your last owner account is deleted, we delete the sign-in after 30 days without use. Questions about your sign-in: privacy@dpphost.eu.
Safety alerts: from a product's passport page you can ask for safety alerts about that product without an owner account. The brand then keeps your email address, its language and the product, and uses them only to tell you about safety warnings and recalls (Regulation (EU) 2023/988, Art. 35), never for marketing; it sees only how many people asked. Registered owners get these alerts at their account's address or at a separate address they give. Each alert has a link to stop them, and the address is then deleted; a separate address that is not confirmed within 7 days is deleted too. The sign-in that confirms your address is deleted straight after, unless you have an owner account or an account in the dashboard.
Receipts: if a shop that the brand linked added your receipt when you bought a product, and you kept it when you took the product over, it is kept with your registration and only you can see or download it. The brand sees it only if you attach it to a repair or guarantee request, and only while that request is open. It is deleted when your registration ends, for example when you hand the product over, or when you remove it; the next owner never sees it. It is stored in the EU, at Cloudflare, and is not part of any backup.
Bikes and batteries: if a bike and its battery are both registered to you, we also record which battery is fitted to which bike, so that each card names the other part and a sale can include both; the brand does not see this, and it ends when one part is sold, marked lost or stolen, or recycled on its own.
Lost or stolen: if you mark a product lost or stolen and let finders message you, its passport page says that its owner is looking for it, with a button to send you a message; the page never shows your name or how to reach you. What a finder sends reaches only you: on your product page, on your wallet card and in an email that tells you a message came. The brand does not see it. Each message is deleted after 30 days, when you report it, or when your registration ends.
If you message an owner about a product you found
When the owner of a product has marked it lost or stolen and lets finders message them, the product’s passport page has a button to send the owner a message. The form on app.dpphost.eu asks where the product is; you can also add your location (only if you choose to, and your browser asks you first), a way for the owner to reach you and a short message. We pass this on to the product’s registered owner only: all of it on their product page, and the place you typed on their wallet card; their email only says that a message came. The brand never sees your message, and it is used for nothing else. The brand is the data controller of its owner services, and DPP Host handles your message on its behalf (see "If you use a brand’s owner services"); the legal basis is the owner’s and your legitimate interest in getting the product back to its owner (GDPR Art. 6(1)(f)). Your message is deleted after 30 days, or earlier when the owner reports it or their registration ends.
To protect owners against misuse, DPP Host, as data controller, checks with Cloudflare Turnstile that a person sends the form, and limits how many messages one network address can send. For these limits we keep a keyed hash of your IP address, never the address itself: in our counters for at most a day, and with your message for as long as it is kept. If the owner reports your message, it is deleted, and messages from the same hashed address are refused for 7 days. Links are not allowed in messages. The form sets no cookies and keeps nothing in your browser. The legal basis is our legitimate interest in a safe service (GDPR Art. 6(1)(f)). To have your message deleted earlier, write to privacy@dpphost.eu with the product and the time you sent it.
Notices about content
If you report content with the form on the page about reporting content, we store what you write, the web address you report, your name and email address if you give them, and a keyed hash of your IP address. We use the notice to handle it and to meet our duties under the Digital Services Act (GDPR Art. 6(1)(c)). The organisation concerned never learns who sent the notice. We use the IP hash only to limit abuse of the form, which is our legitimate interest in keeping it usable for everyone (GDPR Art. 6(1)(f)). We delete the IP hash after 30 days. 3 years after our decision we delete your name, your email address and what you wrote; we keep only the reference, the dates, the category, the web address reported and the decision, as the record of how we handled the notice.
Where data is stored and who receives it
Our database, sign-in and server functions run at Supabase in Frankfurt, Germany. Cloudflare delivers our sites on its global network from the data centre nearest to you, keeps our stored files in the EU, and passes emails sent to hello@dpphost.eu and privacy@dpphost.eu to our mailboxes at Microsoft (Microsoft 365) and Google (Gmail). Resend sends our emails. Anthropic reads the files and pages you drop on New passport and the GS1 documents you add to GTIN claims, and writes the Guide's answers. Supabase, Cloudflare, Microsoft, Resend and Anthropic are our data processors. Stripe takes payments, as described above. All of them are US companies or part of US groups. Where personal data goes to the United States, or is accessed from outside the EU, the transfer to our data processors and to Stripe is covered by the European Commission's standard contractual clauses in each provider's data processing agreement and, for Cloudflare, Resend and Stripe, also by the EU-US Data Privacy Framework. You can ask us for a copy of these safeguards at privacy@dpphost.eu. Our list of sub-processors, with the day each new one starts, is at dpphost.eu/sub-processors (in English).
Other recipients: the EU's VIES register receives the VAT number of an organisation being checked; Google, Apple and Microsoft take part in sign-ins you start with them, as independent controllers; the providers of AI apps you connect receive what the app reads for you; brands receive what this notice says they see; and authorities receive data where the law requires it, for example the police under the Digital Services Act. We do not sell personal data.
Backups and exports
Every night we copy every published passport to separate storage at Cloudflare in the EU, so that passports can be restored; the copy holds only what the passport pages show. We keep each nightly copy for 35 days and one copy a month for 400 days. An organisation's admins can download its passports, drafts, supplier files, media and pages as ZIP files, which we delete after 7 days; such an export holds no member, owner, key or billing data. Deleted data can remain in the database's encrypted backups for up to 7 days before it is overwritten.
Your rights
You can ask us for access to your data, its correction or deletion, restriction of its use, or a copy in a machine-readable format, and you can object to processing based on our legitimate interest. Write to privacy@dpphost.eu. We answer within one month and may ask you to confirm who you are. Where a brand is responsible for your data (see "When a brand is responsible"), ask the brand, or write to us and we pass your request on. Apart from the automatic VIES check (see "Organisations, business checks and GTINs"), we make no decisions about you based solely on automated processing that have legal or similarly significant effects. You can also complain to the Danish Data Protection Agency (Datatilsynet, datatilsynet.dk) or to the data protection authority in the country where you live or work.
Changes to this notice
We update this notice when what we do with personal data changes. The date at the top shows when we last changed it.