Privacy Policy

1. Data Controller

AI Group LTD

Registered in the Republic of Bulgaria

Email: legal@d-pass.eu

Data Protection contact: privacy@d-pass.eu

2. What Data We Collect

▸

Account data — email address, full name, hashed password, company name, and your tenant's region and plan.

▸

Usage data — audit log entries (actions performed, timestamps), IP addresses, and browser user-agent strings.

▸

DPP content — product information you enter into the platform. You own this data; we process it only to provide the service.

▸

Payment data — billing is handled by Stripe. We receive only transaction confirmation and invoice details. We never store card numbers.

▸

Contact form — name, email, company, and message when you reach out to us.

3. Legal Basis for Processing

Processing purpose	GDPR basis
Account creation and platform access	Art. 6(1)(b) — Contract performance
Billing and invoicing	Art. 6(1)(b) — Contract performance
Security audit logs	Art. 6(1)(f) — Legitimate interest
Product improvement and analytics	Art. 6(1)(f) — Legitimate interest
Marketing communications	Art. 6(1)(a) — Consent

4. Your Rights Under GDPR

You have the following rights regarding your personal data. To exercise any of these rights, contact us at privacy@d-pass.eu. We will respond within 30 days.

Right of access

Request a copy of all data we hold about you.

Right to rectification

Request correction of inaccurate personal data.

Right to erasure

Request deletion of your data ('right to be forgotten').

Right to restriction

Request that we limit how we use your data.

Right to portability

Receive your data in a machine-readable format.

Right to object

Object to processing based on legitimate interest.

5. Data Retention

We retain personal data for as long as your account is active or as required by law. Specific retention periods:

▸ Audit logs — 5 years (EU regulatory traceability requirements)
▸ Account data — until account deletion, then anonymised within 90 days
▸ Access requests — 3 years after resolution
▸ DPP data — retained for the full product lifecycle as legally required

6. Cookies

We use strictly necessary cookies for authentication only. We do not use tracking, profiling, analytics, or marketing cookies of any kind.

See our Cookie Policy for full details.

7. Third-Party Processors

Processor	Purpose	Location
Hetzner Cloud	Hosting & storage	Germany 🇩🇪
Stripe	Payment processing	EU (Dublin)
Resend	Transactional email	EU region
Cloudflare	CDN, DDoS protection	EU PoPs

8. International Transfers

All personal data is stored and processed within the European Union. We do not transfer data to third countries outside the EU/EEA without appropriate safeguards.

9. Changes to This Policy

We may update this Privacy Policy. We will notify registered users of material changes via email. Continued use of the platform after notification constitutes acceptance.