Privacy Policy

1. Controller

Email: info@dpp-polymer.de

2. Visiting this website

This website and the DPP-Polymer platform are hosted by Vercel Inc. When you open a page, the hosting provider processes technically necessary connection data: IP address, date and time of the request, requested URL, referrer and browser information. This is required to deliver the website securely and to detect abuse (Art. 6(1)(f) GDPR). Vercel acts as our processor under a data processing agreement; transfers to the United States are covered by the safeguards in that agreement.

We do not use analytics, advertising or tracking tools, and fonts are served from our own domain.

3. Cookies and local storage

• dpp_session: a strictly necessary, HTTP-only cookie set only when you sign in. It keeps you signed in for up to 12 hours and is deleted when you sign out (Art. 6(1)(b) GDPR, § 25(2) TDDDG).
• Language preference: the language you choose is stored in your browser's local storage and is never sent to us.

No consent banner is shown because no cookies requiring consent are used.

4. Platform accounts and passport data

For signed-in users (administrators, auditors, customers and supplier contacts) we process name, business email address, organisation, role and an audit record of the actions performed. This is necessary to provide the platform under the contract with your organisation (Art. 6(1)(b) GDPR) and to keep a tamper-evident compliance record (Art. 6(1)(c) and (f) GDPR). Passwords are stored only as salted hashes.

Platform data is stored in a managed PostgreSQL database hosted in Frankfurt, Germany. Because compliance records are designed to be immutable, passport and audit entries are revoked or superseded rather than deleted; personal data in them is kept for as long as the related product records must be retained.

5. Pilot requests and email contact

If you contact us by email, for example to request a pilot, we use your details only to answer your request and, where a pilot follows, to prepare it (Art. 6(1)(b) GDPR). We delete the correspondence when it is no longer needed, unless statutory retention periods apply.

6. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing based on Art. 6(1)(f) GDPR (Art. 15–21 GDPR). To exercise them, contact us at the address above. You may also lodge a complaint with a data protection supervisory authority, for example the authority of the German federal state of North Rhine-Westphalia (LDI NRW).