Privacy Policy

1. Controller

Norruva Technologies ("Norruva") is the controller of your personal data and processes it under Regulation (EU) 2016/679 (GDPR) and the national law of the Member State in which it is established. Norruva operates a Digital Product Passport platform for the European Union framework, in particular the Ecodesign for Sustainable Products Regulation (EU) 2024/1781.

2. Data and purposes

Norruva processes account data (your name, email address and company) to provide and administer your account; product data, meaning the Digital Product Passport records you create, to deliver the Service itself; usage data to maintain and improve it; and technical data such as IP address, browser and device information for security monitoring.

Norruva does not sell personal data.

3. Legal bases

Norruva relies on performance of the contract for the processing needed to deliver the Service you subscribed to; on legitimate interests for security monitoring, fraud prevention and service improvement; on legal obligation for processing required by Union law; and on consent where consent is required, including marketing communications, which you may withdraw at any time.

4. Retention

Personal data is kept only as long as needed for the purpose it was collected for, and thereafter as required to meet legal obligations, resolve disputes and enforce agreements. Account data is retained for the term of your subscription and a reasonable period after it. Audit and compliance records may be kept longer where Union or national law requires it.

5. Your rights

Under the GDPR you may request access to your personal data, its rectification or erasure, its portability in a structured machine-readable format, restriction of processing, and you may object to processing based on legitimate interests. Exercise these rights through the Data Subject Rights portal or by writing to the addresses below. You may also lodge a complaint with your national supervisory authority.

6. Location

Production data is stored in the European Union, in the Frankfurt (eu-central-1) region. Where a sub-processor requires a transfer outside the Union, Norruva applies the Standard Contractual Clauses approved by the European Commission.

7. Contact

Privacy team: privacy@norruva.com. Data Protection Officer: dpo@norruva.com.