Privacy Policy

DPP Global Ltd. ("we", "us") operates the factory-side EU Digital Product Passport platform at dppbangladesh.com. This policy explains what personal data we process, why, and the rights you have under the EU GDPR and the Bangladesh Data Protection Act (DPDPA 2023).

1. Data we collect

• Account data — name, work email, phone, factory name and role, used to create and secure your account.
• Product / DPP data — the compliance data you enter (fibre composition, carbon figures, certifications, chemical declarations). This is your data; we act as processor.
• Usage data — log records, IP address and device information for security and service reliability.

2. Why we process it

To provide the DPP service, secure accounts, meet ESPR record-keeping obligations, communicate service updates, and comply with law. We do not sell personal data and do not use it for advertising.

3. Storage & retention

All data is stored in the EU (AWS eu-central-1, Frankfurt), encrypted at rest (AES-256) and in transit (TLS 1.3). DPP records are retained for the product lifetime plus 10 years per ESPR; account data is deleted within 90 days of account closure unless legally required otherwise.

4. Your rights

• Access, rectify, export (JSON-LD) or erase your data.
• Object to or restrict processing, and lodge a complaint with a supervisory authority.
• Withdraw consent at any time.