Privacy Policy

1. Data Controller

Norruva Technologies ("Norruva", "we", "us") is the data controller responsible for processing your personal data. We are committed to protecting your privacy in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and applicable national data protection legislation.

2. Data Collected and Purposes

We collect and process:

• Account data (name, email, company) — to provide and manage your account
• Usage data (page views, feature interactions) — to improve the Service and user experience
• Product data (Digital Product Passport information) — to deliver the core platform functionality
• Technical data (IP address, browser type, device information) — for security monitoring and service optimization

We do not sell personal data to third parties.

3. Legal Basis for Processing

We process personal data under the following legal bases:

• Contract performance — processing necessary to deliver the Service you have subscribed to
• Legitimate interest — service improvement, security monitoring, fraud prevention
• Legal obligation — compliance with EU regulatory requirements
• Consent — where required for specific processing activities such as marketing communications

4. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements. Account data is retained for the duration of your subscription and for a reasonable period thereafter. Audit logs and compliance records may be retained longer where required by applicable regulation.

5. Your Rights

Under GDPR, you have the right to:

• Access — request a copy of your personal data
• Rectification — correct inaccurate or incomplete data
• Erasure — request deletion of your personal data
• Portability — receive your data in a structured, machine-readable format
• Restriction of processing — limit how we process your data
• Objection — object to processing based on legitimate interest

You can exercise these rights through our Data Subject Rights portal or by contacting us directly.

6. Data Transfers

All production data is stored within the European Union, hosted in our Frankfurt (eu-central-1) data center region. Where data transfers outside the EU are necessary for specific sub-processors, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission.

7. Contact

For privacy-related inquiries, please contact:

• Privacy team: privacy@norruva.com
• Data Protection Officer: dpo@norruva.com