Privacy Policy
This Privacy Policy explains how DDPP (Decentralized Digital Product Passport) uses personal data about the people it deals with: people who sign in to write product passports for an organization, people who scan and read passports, visitors to ddppeu.com and its earlier address dppeu.cloud, and people who write to us.
DDPP is a service for businesses. An organization records its products in the DDPP app and publishes a product passport for a model, a batch or a single item, which anyone can open by scanning its QR code or NFC tag.
In this policy, "you" means the person the data is about. An "organization" is a business set up in DDPP, and a "member" is a person with their own sign-in who acts for an organization. "We", "us" and "our" mean the two companies behind DDPP, ZincirX Inc. and ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş.; section 1 explains which of them is responsible for your data.
This policy gives the information required by Articles 13 and 14 of the EU General Data Protection Regulation (GDPR). If you are in Türkiye, our Turkish notice under Law No. 6698 (KVKK Aydınlatma Metni), at ddppeu.com/tr/kvkk, explains how ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş. processes your personal data and how to exercise your rights.
How organizations may use DDPP is set out in our Terms of Service.
1. Who is responsible for your data
ZincirX Inc., a corporation established in the State of Delaware, United States, with its address at c/o Legalinc Corporate Services Inc., 131 Continental Drive, Suite 305, Newark, DE 19713, United States, is the controller of the personal data this policy describes. For people in Türkiye, the controller is ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş., as explained below.
DDPP is operated for it by ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş., a joint-stock company established in Türkiye, at Gülbahçe Mah. Gülbahçe Cad. İYTE Sitesi No: 1/40 İç Kapı No: 51, 35430 Urla/İzmir, Türkiye. Its people build and run the service and can reach personal data in the course of that work, as a processor acting on ZincirX Inc.'s instructions. It does so under a data processing agreement between the two companies. The registration details of both companies are on our Legal Notice.
If you are in Türkiye, ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş. is the controller (veri sorumlusu) of your personal data under Türkiye's Law No. 6698 (KVKK), except for the records of the purchases of passport credits that ZincirX Inc. sells, which it keeps as the seller and controls. Our Turkish KVKK information notice (KVKK Aydınlatma Metni) sets this out. The two companies are separate controllers, not joint controllers.
Printed NFC cards and tags ordered from DDPP are sold to organizations in Türkiye by ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş., and to all other organizations by ZincirX Inc. Each keeps the records of the orders it sells, as the seller, and controls them. ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş. makes and sends all of them; for the orders ZincirX Inc. sells, it does so as the processor that operates DDPP for ZincirX Inc.
Onboarding packages for battery passports are sold in the same way: to organizations in Türkiye by ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş., and to all other organizations by ZincirX Inc. Each keeps the records of the orders it sells, as the seller, and controls them.
Passport credits bought on the web, in the Desk, are sold in the same way: to organizations in Türkiye by ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş., and to all other organizations by ZincirX Inc. Each keeps the records of the credits it sells, as the seller, and controls them.
For the content organizations put into DDPP, such as their products and passports, we act for the organization instead. Section 2 explains how.
For any question about this policy or your data, write to dpp@dppeu.cloud, call +90 536 587 41 81, or write to the address above. We have not appointed a data protection officer; privacy questions go to the people who handle them.
2. When we act for organizations
Organizations use DDPP to keep and publish their own product records: products and their data, passports, certifications and documents, events, with their descriptions, places, positions and photos, and the NFC tags and cards that lead to a passport.
The organization decides what goes into these records and what is published, so it is the controller of any personal data in them, and we process that data on its behalf, as its processor, under section 19 of our Terms of Service. We process it only to provide DDPP to the organization and on its instructions. We do not sell it, and we do not use it for purposes of our own.
The DDPP app uses your phone's camera, location and photos only with your permission:
- the camera, to scan codes and to take photos you add to an event;
- your location, only when you choose to add your current position to an event, and only at that moment;
- your photo library, only to open the photo you pick.
The photos and positions you add become part of the organization's records.
The app also uses NFC, and only when you choose to read a tag or card or to write a passport's link to one. When it writes a passport's link to a chip, or reads a passport card's chip to set the card up, DDPP records the chip's ID with the passport and the member who did it, as part of the organization's records.
If your personal data appears in an organization's records, for example because you appear in a photo or your name is in a document, the organization decides how it is used. Please contact that business. If you contact us instead, we will pass your request to it and help it respond.
3. Public passport pages
When an organization publishes a passport, anyone who scans its code, opens its link or looks it up by the product's GS1 identifiers can see its public part, as a web page and in machine-readable form. Fields the organization's data marks as restricted or authority-only are not shown there.
The public part is the manufacturer's own record of its product. Organizations must not publish the personal data of consumers, meaning the people who buy or use their products, without those people's explicit consent, and should keep other personal data, such as the names of individual workers or positions that reveal where someone lives, off the public part.
After a passport is published, changes to its data are added as new revisions and earlier revisions are kept, and its events can only be added to. Where personal data in a published passport has to be corrected or removed, including from its earlier revisions, the organization can ask us at dpp@dppeu.cloud and we will do it.
A published passport stays online until the organization withdraws it. Its address then shows only that it was withdrawn.
We do not record who opens a passport page beyond the ordinary server logs described in section 10, and passport pages set no cookies.
If you believe a passport page contains illegal content, use the "Report this page" link on it, or write to dpp@dppeu.cloud with the page's address. A person reviews every report. Our Terms of Service explain what happens next.
4. The personal data we collect
As controller, we collect the following:
- Account data: your name, your email address, your password, which we store only as a hash, your language, and your role in each organization you belong to.
- Sign-in data: if you sign in with Google or Apple, the account identifier that provider gives us and the email address and name it shares. For Sign in with Apple, we also keep the token Apple issues so that we can revoke the sign-in when you delete your account. The app stays signed in with a token issued to your device.
- Organization data: the details an organization gives, such as its name, legal name, country, address, website, GLN and EORI number. Most of this is about a business, but some of it, such as a sole trader's name, is personal data.
- Business check data: the documents an organization's owners and admins send so that DDPP can check the business before its passports go live, such as a tax certificate, a trade registry gazette or a registry extract, which may name the business's owners or directors; when each was sent and by whom; for a business in the EU, its VAT number and what the EU's VIES answered about it, with the registered name and address where the member state shares them; and DDPP's decisions about the business, its permanent passports and its certificates, with their reasons. These documents are seen only by the organization's owners and admins and by the people at DDPP who check them, and are never published.
- Purchase data: when an owner or admin buys passport credits for an organization, the organization, the member who bought them, the pack, its price and currency, the purchase's status and date, and the identifiers the payment service gives the payment. The card or other payment details, the billing details and the VAT number are entered on Stripe's own payment page and kept by Stripe; we never receive the card number, and we keep none of those details. For an organization in Türkiye, which buys from ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş. instead, also the details its invoice is made out to: the organization's registered name, its tax number (for a sole proprietor, their Turkish identity number), its tax office and its address; its card details are entered on iyzico's own page, and we never receive the card number. When credits are bought in the DDPP app, the App Store or Google Play takes the payment instead. We then keep, with the organization and the member, the pack, the purchase's status and date, the store's identifiers for the purchase (Apple's transaction number, or Google's order number and a fingerprint of its purchase token), the store's country or region, the quantity, whether it was a test purchase and, from Apple, the price and currency it charged. The payment details stay with Apple or Google; we never receive them.
- Print order data: when an owner or admin orders printed NFC cards or tags for an organization, the organization, the member who ordered them, the passport whose code they carry, what was ordered and how many, the languages, whether the chips are locked, the price and currency, the delivery address with the name, company, phone number and email address of the person who receives the parcel, any note for us, the order's status and dates, the carrier and tracking number, and the identifiers the payment service gives the payment. For an organization in Türkiye, which buys from ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş., also the details its invoice is made out to: the organization's registered name, its tax number (for a sole proprietor, their Turkish identity number), its tax office and its address. The payment details are entered on the payment service's own page, Stripe's or, for an organization in Türkiye, iyzico's; we never receive the card number.
- Onboarding order data: when an owner or admin orders an onboarding package for an organization, the organization, the member who ordered it, the package, its price and currency, how it is paid, the order's status and dates (paid, kickoff call, delivery, acceptance, refund), the identifiers the payment service gives the payment and, for a bank transfer, its reference; and which version of the onboarding terms was accepted, when and by whom (their name and email address). For an organization in Türkiye, also the details its invoice is made out to, as for print orders. The card details are entered on Stripe's or iyzico's own page; we never receive the card number.
- Correspondence and requests: what you tell us by email or phone, and reports of illegal content, with a name and email address if you choose to give them.
- Technical data: the IP address and the browser or device details sent with each request to ddppeu.com (or its earlier address dppeu.cloud) and to the DDPP app's server, which we use to deliver the service, keep it secure and fix faults.
We use no advertising tools. Google Analytics runs only if you accept analytics cookies; section 14 says what it collects.
5. Where the data comes from
Most of it comes from you, when you sign up, set up an organization or write to us. Technical data is collected automatically with each request. If you sign in with Google or Apple, that provider gives us an account identifier and, depending on your settings, your email address and name. When an organization buys credits, Stripe or, for an organization in Türkiye, ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş.'s payment page at zincirx.com tells us whether the payment went through, and whether it was later refunded or disputed. When credits are bought in the app, Apple or Google confirms the purchase to us, and tells us if it is later refunded or revoked. When an organization in Türkiye pays for a print order, ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş.'s payment page at zincirx.com tells us whether the payment went through. For a business in the EU, the European Commission's VIES service tells us whether its VAT number is registered and, where the member state shares them, under which name and address. The delivery details of a print order come from the member who places it, who may name someone else as the person who receives the parcel. When an organization pays for an onboarding package, Stripe or, for an organization in Türkiye, ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş.'s payment page at zincirx.com tells us whether the payment went through and whether it was later refunded or disputed; a bank transfer is recorded by our staff when it arrives.
6. Why we use it and on what legal basis
For each purpose we give the legal basis under the GDPR and the processing condition under Article 5 of the KVKK.
- Creating and running accounts, signing you in and providing DDPP: GDPR Article 6(1)(b), the contract under our Terms, or Article 6(1)(f), our legitimate interest in providing the service your organization uses. KVKK Article 5(2)(c), or 5(2)(f).
- Checking the businesses that publish on DDPP, and reviewing their permanent passports, certificates and analysis reports: GDPR Article 6(1)(f), our legitimate interest in keeping DDPP free of businesses that are not who they say they are, and in what passports say being backed by the documents behind it. KVKK Article 5(2)(f).
- Selling passport credits, taking payment through Stripe, iyzico, the App Store or Google Play, and invoicing: GDPR Article 6(1)(b), the contract under which your organization buys the credits, or Article 6(1)(f), our legitimate interest in selling them to the business you act for; for invoices and the records tax and accounting law requires, Article 6(1)(c) where EU or Member State law requires it, otherwise 6(1)(f). KVKK Article 5(2)(c) and 5(2)(ç).
- Making, sending and invoicing printed cards and tags: GDPR Article 6(1)(b), the contract under which your organization buys them; for the details of a person who receives the parcel for the organization, Article 6(1)(f), our legitimate interest in delivering what it ordered; for invoices and the records tax, accounting and customs law requires, Article 6(1)(c) where EU or Member State law requires it, otherwise 6(1)(f). KVKK Article 5(2)(c), 5(2)(ç) and 5(2)(f).
- Performing and invoicing an onboarding package: GDPR Article 6(1)(b), the contract under which your organization buys it, including the record of who accepted its terms; for keeping that record after the member who accepted them has left, Article 6(1)(f), our legitimate interest in proving the contract; for invoices and the records tax and accounting law requires, Article 6(1)(c) where EU or Member State law requires it, otherwise 6(1)(f). KVKK Article 5(2)(c), 5(2)(ç) and 5(2)(e).
- Sending service emails, such as email confirmation and password reset: GDPR Article 6(1)(b) or 6(1)(f). KVKK Article 5(2)(c) or 5(2)(f).
- Answering questions and requests: GDPR Article 6(1)(b) where the request concerns our contract, otherwise Article 6(1)(f), our legitimate interest in answering the people who contact us. KVKK Article 5(2)(c) or 5(2)(f).
- Handling privacy requests, including account deletion, and revoking a Sign in with Apple authorization on deletion: GDPR Article 6(1)(c), because the GDPR requires us to act on them, and 6(1)(b). KVKK Article 5(2)(ç) and 5(2)(c).
- Keeping DDPP and its accounts secure, preventing misuse and fixing faults: GDPR Article 6(1)(f), our legitimate interest in protecting the service and the people who use it. KVKK Article 5(2)(f).
- Handling reports of illegal content: GDPR Article 6(1)(c), because the EU Digital Services Act requires hosting services to act on such reports, otherwise 6(1)(f). KVKK Article 5(2)(f).
- Complying with orders from courts and authorities, and establishing, exercising or defending legal claims: GDPR Article 6(1)(c) where EU or Member State law requires it, otherwise 6(1)(f). KVKK Article 5(2)(ç) and 5(2)(e).
Where we rely on legitimate interests, you can object, as section 12 explains. We make no decisions about anyone based solely on automated processing.
7. What you have to give us
To open an account you must give your name, an email address and a password, or sign in with Google or Apple. To set up an organization you must give its name and country, because every passport names the organization as the business responsible for the product. Without these we cannot provide DDPP. Everything else is optional.
8. Who we share it with
- ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş., in Türkiye, which operates DDPP for us and whose people can reach personal data in the course of that work, on our instructions and under a contract that binds them to it.
- Hostinger, which provides the servers DDPP runs on, in Lithuania, a second server in France that keeps an encrypted copy of our backups, and our email service.
- Stripe, which takes payment when an owner or admin of an organization outside Türkiye buys passport credits on the web Desk. We send it the buyer's email address, the organization's name, and the pack and its price; on its own payment page it collects the card or other payment details, the billing details and the VAT number. It keeps a customer record, takes the payment, and raises and sends the invoice for us. It receives this data so that we can perform the contract for the credits and meet our legal obligations to invoice and keep records. When an owner or admin of an organization outside Türkiye pays for a print order, Stripe also receives the order's reference, what was ordered and its price, which appear on the payment and the invoice, and the delivery address with the name and phone number of the person who receives the parcel, which appear on the payment. We never receive the card number.
- ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş. and iyzico, when an owner or admin of an organization in Türkiye pays for a print order. The A.Ş., which sells it, takes the payment on its payment page at zincirx.com through iyzico (iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş., a payment institution in Türkiye). We send that page the order's reference, what was ordered and its total, the buyer's name and email address, and the details the invoice is made out to. iyzico receives the buyer's name and email address, the IP address they pay from, what was ordered and its total and, on its own page, the card details; we never receive the card number. The A.Ş. issues the invoice under Turkish law, and the invoice is reported to the Turkish Revenue Administration.
- For onboarding packages, the same as for print orders: when an organization outside Türkiye pays, Stripe receives the buyer's email address, the organization's name, the order's reference, the package and its price; when an organization in Türkiye pays by card, ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş.'s payment page and iyzico receive what is described above for print orders, with the package in place of the cards and tags. The A.Ş. invoices the packages it sells under Turkish law.
- For passport credits, the same as for print orders: when an owner or admin of an organization in Türkiye buys credits on the web Desk, ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş.'s payment page and iyzico receive what is described above for print orders, with the pack of credits in place of the cards and tags. The A.Ş. invoices the credits it sells under Turkish law.
- Couriers, such as DHL Express, UPS, FedEx, PTT, Yurtiçi Kargo, Aras Kargo and MNG Kargo, when we send printed cards or tags: the name, company, address, phone number and email address of the person who receives the parcel, and what it contains and is worth. They use them to deliver the parcel and to tell the recipient about it, under their own terms. For now, we send them only to addresses in Türkiye.
- Apple and Google, through the App Store and Google Play, when an owner or admin buys passport credits in the DDPP app. The purchase is made with Apple or Google under their own terms; they take the payment and send the receipt. With each purchase the app gives them an identifier we assign to the organization, which tells them nothing about it by itself, so that they can tell us which organization the purchase was for. We send them nothing else about you; we ask them to confirm each purchase, and they tell us about refunds.
- The European Commission, through its VAT Information Exchange System (VIES), when a business in the EU asks DDPP to check it: we send it only the business's VAT number, to learn whether it is registered. The Commission handles it under its own rules.
- Google and Apple, if you choose to sign in with them. They confirm your identity to us and learn that you are signing in to DDPP. When you delete an account that signs in with Apple, we tell Apple to revoke that sign-in.
- Google LLC (USA), for Google Analytics 4, only if you accept analytics cookies in the cookie notice: the address of the pages you visit on the site and on the Desk's sign-in and sign-up pages, the page you came from, your browser and device details and your IP address, and that an account was made and how (section 14). They go from your browser to Google, which uses them to give us usage statistics.
- The services that hold a passport you scan. The DDPP app reads a passport from the service that holds it, without signing in and without anything that identifies your account. A link to a DDPP passport goes to DDPP. A link on zincirx.com, or a ZincirX passport code, goes to ZincirX's public service at zincirx.com. Another brand's GS1 Digital Link goes only to that brand's resolver, and the brand's own pages open in your browser only if you choose to open them. A GS1 code with no web address in it, such as a GS1 DataMatrix, is looked up first with DDPP's own resolver, then with ZincirX's public service, and last with GS1's global resolver at id.gs1.org, until one of them knows it. Each service receives the code and, as with any connection, your device's IP address; DDPP and ZincirX also receive the app's language. ZincirX, GS1 and other brands handle what they receive under their own terms.
- Other members of an organization you belong to, who see your name, email address and role.
- The public, who see what organizations publish on their passport pages.
- Professional advisers, such as lawyers and accountants, when they need it to advise us.
- Courts, authorities and other public bodies, when they order us to act or to provide information, where the law otherwise requires it, or where we need it to establish or defend a legal claim. Under the EU Digital Services Act, we must tell the authorities if we learn of information giving rise to a suspicion of a criminal offence that threatens someone's life or safety.
If you ask, we will tell you the names of the specific recipients of your personal data.
9. International transfers
ZincirX Inc. is in the United States, ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş. and the people who operate DDPP are in Türkiye, and DDPP's servers are in the European Union: in Lithuania, with an encrypted copy of the backups in France. Neither the United States nor Türkiye is in the European Economic Area, and the European Commission has adopted no general adequacy decision for either.
Where the GDPR applies, a transfer of personal data out of the European Economic Area is subject to Chapter V of the GDPR. When you sign in with Google or Apple, your data goes between your device and those companies under their own terms; Google LLC and Apple Inc. are certified under the EU–US Data Privacy Framework, for which the Commission adopted an adequacy decision in Implementing Decision (EU) 2023/1795. If you accept analytics cookies, Google Analytics data goes from your browser to Google LLC, which may process it in the United States (sections 8 and 14). When you buy credits for an organization outside Türkiye, your payment details go from your browser to Stripe, and the details section 8 lists go from us to Stripe. Stripe, Inc. is in the United States. Stripe's own privacy policy, at stripe.com/privacy, explains how Stripe handles payment details, the safeguards it uses when it transfers them and how long it keeps them. When you buy credits in the app, the purchase goes between your device and Apple or Google under their own terms, and Apple Inc. or Google LLC, both certified under the EU–US Data Privacy Framework, confirms it to us.
Personal data reaches Türkiye, where ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş. operates DDPP for us, and the United States, where ZincirX Inc. is.
Transfers of personal data out of Türkiye are subject to Article 9 of the KVKK, and we do not rely on your explicit consent for regular transfers abroad.
You can ask for details of these transfers by writing to dpp@dppeu.cloud.
For now, printed cards and tags are sent only to addresses in Türkiye, so their delivery details do not leave Türkiye.
10. How long we keep it
- Account data: for as long as the account exists. Section 11 explains deletion.
- Sign-in tokens: until you sign out, the token expires after a year, or the account is deleted.
- The Sign in with Apple token: until you delete your account, when we revoke it with Apple and delete it.
- Password reset and email confirmation links: 60 minutes.
- Organization data and content: for as long as the organization keeps it in DDPP. Published passports stay online until they are withdrawn or erased.
- Business check documents and decisions: the documents for as long as the organization is in DDPP, and DDPP's decisions as its record of them. An owner or admin can remove a document until the business is sent for the check.
- Purchases of credits: for as long as the organization is in DDPP; if the member who bought them deletes their account, the record no longer names them. For credits ZincirX Inc. sells on the web, Stripe keeps the payment and the invoice, with the buyer's email address, in our Stripe account, as the record of a sale that tax and accounting law requires us to keep. For credits ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş. sells, the A.Ş. keeps the invoice and its record of the payment, and iyzico its own record of the payment, for as long as Turkish tax and commercial law requires. For a purchase made in the app, Apple or Google keeps the payment and the receipt under its own terms.
- Print orders: for as long as the organization is in DDPP, as the record of the sale and of where it was sent; if the member who ordered deletes their account, the order no longer names them as its buyer, but its delivery details stay with it. For an order ZincirX Inc. sells, Stripe keeps the payment and the invoice, as for credits. For an order ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş. sells, the A.Ş. keeps the invoice and its record of the payment, and iyzico its own record of the payment, for as long as Turkish tax and commercial law requires. The courier keeps its own record of the delivery under its terms. The phone number and email address of whoever receives the parcel are erased 30 days after the order is sent, cancelled or refunded.
- Onboarding orders: like other order and invoice records, for as long as the organization is in DDPP, as the record of the sale and of the terms accepted; if the member who ordered deletes their account, the order keeps their name and email address as the record of who accepted the terms. Stripe, ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş. and iyzico keep their records of the payment and the invoice as for print orders.
- Correspondence and reports: as long as we need them to deal with the matter and any follow-up.
- Server and application logs: 14 days.
- Backups: 14 days, after which deleted data no longer exists in them.
11. Deleting your account
You can delete your account in the DDPP app (open More, choose Delete my account and confirm) or on the web (the Desk, then Your account). The account is deleted at once. If you can use neither, write to dpp@dppeu.cloud from the email address of the account, and we will delete it within 30 days and confirm by email. The steps are also at ddppeu.com/delete-account.
When an account is deleted, we remove its name, email address, password, Google and Apple sign-in links, sign-in tokens, password reset links and memberships, and we revoke its Sign in with Apple authorization with Apple. Records the account created in an organization's content, such as products, passports, events and files, stay with the organization but no longer name the account.
Some records are kept:
- the organizations you belonged to, with their products and passports, which belong to the organization. If you were an organization's only owner, it stays in DDPP, and we can hand it to a person the business names;
- published passports, which stay online until the organization withdraws them;
- purchases of credits you made for an organization, which stay with it but no longer name you, and the payment and invoice Stripe keeps, the invoice and payment records ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş. and iyzico keep, or the record Apple or Google keeps of a purchase made in the app, as section 10 describes;
- print orders you placed for an organization, which stay with it but no longer name you as the buyer, with their delivery details, as section 10 describes;
- onboarding orders you placed for an organization, which stay with it and keep your name and email address as the record of who accepted their terms, as section 10 describes;
- logs and backups, until they expire as section 10 describes.
12. Your rights
Depending on the law that applies to you, you have the right to:
- access the personal data we hold about you and get a copy of it;
- have inaccurate or incomplete data corrected;
- have your data erased (for an account, as section 11 describes);
- restrict our use of your data, for example while we check a complaint that it is inaccurate;
- receive the data you gave us in a structured, machine-readable format, which we send as JSON on request;
- object, on grounds relating to your situation, to processing based on our legitimate interests;
- complain to a data protection supervisory authority, in particular in the EU Member State where you live or work or where you believe the problem arose, and, under the KVKK, to the Personal Data Protection Board, as section 13 explains.
To use any of these rights, write to dpp@dppeu.cloud or call +90 536 587 41 81. You can write in English, Turkish, German, Spanish, French, Italian, Dutch or Polish. We answer free of charge and without undue delay: under the GDPR within one month, which we may extend by two further months for complex requests, telling you why within the first month, and under the KVKK within 30 days. We ask for proof of identity only if we have reasonable doubts about who is asking. If we do not do what you ask, we tell you why and that you can complain to a supervisory authority or go to court.
For data an organization controls, such as the contents of a passport, we pass your request to that organization and help it respond.
13. Your rights under the KVKK
Under Article 11 of the KVKK, you have the right to:
- learn whether your personal data is processed, and request information about it if it is;
- learn why it is processed and whether it is used for that purpose;
- know the third parties in Türkiye or abroad to whom it is transferred;
- have it corrected if it is incomplete or inaccurate;
- have it deleted or destroyed once the reasons for processing it no longer apply;
- have corrections and deletions notified to the third parties who received the data;
- object to a result against you that arises from analysis of your data exclusively by automated systems;
- claim compensation if unlawful processing causes you damage.
You can apply in writing to the address in section 1, or by email to dpp@dppeu.cloud from the address you registered with us. We conclude applications free of charge within 30 days at the latest; if an action has a separate cost, we may charge the fee set by the Personal Data Protection Board. If we reject your application, you find our answer inadequate or we do not answer in time, you can complain to the Board within 30 days of learning of our answer, and in any case within 60 days of your application.
14. Cookies and storage on your device
You can change or withdraw your choice at any time with Cookie settings, a link at the bottom of every page of the site and of the Desk's sign-in and sign-up pages.
Strictly necessary (no consent needed)
- ddppeu.com and its earlier address dppeu.cloud set one cookie of their own, zx_consent, which remembers your choice in the cookie notice: its version, its date and whether you allowed analytics. It is kept for 6 months, after which we ask again. If you dismiss the note offering another language, your browser's local storage remembers that you did.
- Passport pages, GS1 Digital Links, the passport search at /find and the app's server set no cookies.
- The web Desk (/desk) and the account pages where you confirm your email address or choose a new password set two cookies: a session cookie (ddpp-session), which holds your session, including your sign-in to the Desk, and ends after eight hours without activity or when you sign out; and XSRF-TOKEN, which protects the forms and lasts as long as the session.
- If you tick "Stay signed in on this browser" on the Desk, or sign in to it with Google or Apple, a remember cookie (remember_web_…) keeps you signed in on that browser for up to 400 days, or until you sign out.
- While you sign in to the Desk with Google or Apple, a cookie (ddpp_handshake) holds, encrypted, the values that tie the provider's answer to your sign-in, for ten minutes at most.
- The payment page you reach when you buy credits or pay for a print order is Stripe's own or, for an organization in Türkiye, ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş.'s page at zincirx.com and iyzico's. Their own cookie rules apply there. The same pages take the payment for an onboarding package.
- The DDPP app keeps your sign-in token in your phone's secure storage and your settings and saved products on your phone. It contains no analytics or advertising tools.
We rely on the exemption for storage that is strictly necessary to provide the service you asked for.
Analytics, only with your consent
Only if you choose "Accept analytics" in the cookie notice, or switch Analytics on under Preferences, do the site's pages, the Desk's sign-in and sign-up pages and the page where a new account names its organization load Google Analytics 4, provided by Google LLC (USA), to count visits and see how they are used. It sets the cookies _ga and _ga_WM7TQV23M5, which are kept for up to 2 years. Google receives the address of the page you visit (without its query string, apart from campaign tags such as utm_source), the page you came from, your browser and device details and your IP address; if you create an account on the Desk, also that an account was made and how (email, Google or Apple), never your name or email address. Google may process this data in the USA; Google LLC is certified under the EU–US Data Privacy Framework. The measurements are kept in Google Analytics for at most 14 months. Without your consent the Google Analytics script is not loaded at all and nothing is sent to Google. Passport pages, the passport search at /find, GS1 Digital Links and the Desk's pages that show an organization's records never load it.
The legal basis for analytics cookies is your consent (GDPR Article 6(1)(a); for people in Türkiye, explicit consent under KVKK Article 5(1)). Withdrawing it is as easy as giving it: choose "Reject analytics" under Cookie settings, and Google Analytics stops and the _ga cookies we can reach are deleted. You can also delete cookies in your browser's settings. We use no advertising or marketing cookies.
15. Security
We protect personal data with measures that include encrypted connections (HTTPS, with TLS 1.3 and post-quantum key exchange where your browser supports it), passwords stored only as hashes, sign-in tokens that can be revoked, access limited by each member's role, a SHA-256 fingerprint on every uploaded file, a server environment separated from other services, and daily backups, with an encrypted copy on a second server in France. No system is completely secure. If you think your account has been misused, write to dpp@dppeu.cloud straight away.
16. Children
DDPP is a service for businesses and is not meant for children. We do not knowingly collect children's personal data. If you believe a child has given us personal data, please write to dpp@dppeu.cloud.
17. Changes to this policy
This version takes effect on 19 September 2026 and was last updated on 6 November 2026. We update the policy when DDPP or the law changes, and the date at the top shows the version in force. Before a significant change takes effect, we tell members by email. Before we use personal data for a new purpose, we will tell you.
18. Contact us
For questions about this policy or your personal data, write to dpp@dppeu.cloud or call +90 536 587 41 81. By post: ZincirX Inc., c/o Legalinc Corporate Services Inc., 131 Continental Drive, Suite 305, Newark, DE 19713, United States, or, in Türkiye, ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş., Gülbahçe Mah. Gülbahçe Cad. İYTE Sitesi No: 1/40 İç Kapı No: 51, 35430 Urla/İzmir, Türkiye. Our full company details are on our Legal Notice.