Privacy policy

DPP Service, DPP Knowledge Base and DPP Linter · last updated 31 October 2026

1. Who is responsible

OwnYourData is a non-profit association. The legal notice is in our imprint.

2. What this policy covers

This policy covers the services OwnYourData operates around Digital Product Passports:

• the start page, the API and the API documentation at dpp-service.ownyourdata.eu;
• the DPP Knowledge Base at dpp-service.ownyourdata.eu/kb/;
• id.ownyourdata.eu, where product identifiers printed on products resolve to their passports;
• the DPP Linter at dpplint.ownyourdata.eu.

The results of the DPP Service Validator are published on GitHub Pages, and our source code is on GitHub and Docker Hub. When you follow a link there, the privacy policies of those providers apply.

3. Hosting and server logs

Our services run on servers rented from netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany, in its data centre in Vienna, Austria. netcup, and the companies of the Anexia group that work for it, process the data only on our behalf and under a data processing agreement (Art. 28 GDPR).

Every request to our servers is logged with your IP address, date and time, the requested address (including any product identifier in it), the HTTP status, the amount of data sent, and the referring page and browser identification your browser transmits. We need these logs to run the services, to find errors and to defend against attacks and abuse; the legal basis is our legitimate interest in secure and reliable operation (Art. 6(1)(f) GDPR).

The logs are kept in log files on these servers and in a central log system that we run on the same servers; they are not passed on to anyone. They are deleted after six weeks at the latest.

To protect the API from overload, it counts requests per IP address and minute. The counter covers the current minute only and is deleted shortly afterwards.

4. DPP Service API

Reading public passport data needs no account. Apart from the server logs (section 3), the API keeps nothing about people who read public data.

Users who identify themselves

Economic operators who create or change passports, and readers who have been granted access to restricted passport data, identify themselves with a decentralised identifier (DID) and signed tokens. For them the service stores:

• the DIDs of economic operators, the access policies and access grants they register, and for every change the token with which it was authorised (write evidence);
• a log of every access to restricted passport data and of every refused attempt (access log): when, which passport, the DID of the reader and the role under which access was granted or refused. The economic operator and the reader can retrieve the entries that concern them.

We process this data to identify users, to decide what they may read or change, and to be able to show who accessed or changed a passport. The legal basis is our legitimate interest, and that of the economic operators, in a secure service whose passports can be relied on (Art. 6(1)(f) GDPR); where an economic operator is a natural person using the service for itself, also the performance of the service it asked for (Art. 6(1)(b) GDPR).

Personal data in passports

The economic operator decides what a passport contains and is responsible for its content. Passports describe products, but may contain personal data, typically names and contact details of the economic operator, its representatives or other actors in the supply chain. We receive this data from the economic operator, or from the custodian that keeps the passport on its behalf, and use it only to keep and deliver the passport. The legal basis is the legitimate interest of the economic operator, and ours, in providing passports as EU product law requires (Art. 6(1)(f) GDPR). This section is our information under Art. 14 GDPR to the persons concerned; the economic operator may have to inform them as well.

Who can see the data

• The public part of a passport: anyone, without an account.
• The restricted part: only readers to whom the economic operator has granted access, in the role it granted.
• Write evidence and access log: the economic operator and the readers, each for the entries that concern them, and OwnYourData as operator.
• A custodian the economic operator chooses: it then stores the passport content, under its own terms and privacy policy.
• Our hosting provider (section 3), on our behalf.

How long the data is kept

• A passport is kept as long as the economic operator keeps it with this service. Its earlier versions, and its final version after deletion, remain archived; this service does not delete them.
• Write evidence is kept as long as the passport or one of its archived versions is kept. Evidence that concerns no passport, such as a refused attempt to create one, is deleted after two years.
• Access log entries are deleted two years after the access.

5. DPP Linter

When you enter a product identifier, the DPP Linter retrieves the passport behind it and checks it against open criteria. To do so, our server, not your browser, contacts:

• the DPP service that answers the identifier, which may be operated by a third party anywhere in the world; it sees the address of our server, not yours;
• the web addresses the passport links to (one short request each, to see whether they answer);
• DID Lint, also operated by OwnYourData, for the DIDs the passport names.

The identifier and the result are processed only to show you the result. The DPP Linter does not store them; the identifier appears only in the server logs (section 3), and in the address of the result page if you share that link. Passports you upload for a check are processed in memory and not stored. Please do not enter identifiers or upload passports that contain personal data you are not allowed to pass on.

6. Knowledge Base and API documentation

The Knowledge Base consists of static pages. Its search runs entirely in your browser: the search index is loaded from our server, and what you type is neither sent to us nor to anyone else. The Knowledge Base and the API documentation load all their files from our own server, including fonts.

7. Newsletter

If you subscribe to “Get notified about new Delegated Acts” on the start page, we store your email address and the language you choose. Subscription works in two steps (double opt-in): we send you an email with a link, and only after you have confirmed on the page it leads to will you receive notifications. A subscription that has not been confirmed is deleted after 7 days. To be able to show that you subscribed, we record when you requested and when you confirmed the subscription. We store no IP address and no other data with your subscription; to protect the form from abuse, it counts sign-ups per IP address and hour, and the counter is deleted shortly afterwards.

The legal basis is your consent (Art. 6(1)(a) GDPR). Every email contains a link to unsubscribe; you can also write to us. When you unsubscribe, your address is deleted immediately. Our emails are plain text and contain no tracking.

The emails are sent through Microsoft 365. Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, processes your address on our behalf under a data processing agreement (Art. 28 GDPR) and keeps delivery logs for up to 90 days. Data may be transferred to Microsoft Corporation in the USA, which is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR).

8. Conversion tracking with Google Ads

As a non-profit association, OwnYourData advertises these free tools with Google Ads. To know which ads are useful, we would like to measure whether a visit that started with one of our ads leads to one of these actions: on this site, opening “Getting started” or the DPP Manager on Docker Hub, opening one of our repositories on GitHub, or confirming a newsletter subscription; in the DPP Linter (dpplint.ownyourdata.eu), completing a check of a product identifier.

Only with your consent. On your first visit, a banner asks whether you agree. Until you accept, nothing is loaded from Google and no request is sent to a Google domain. If you accept, your browser loads the Google Ads tag (gtag.js) from Google, which receives your IP address and browser details. We use the tag only for conversion measurement: no Google Analytics, no remarketing, no personalised advertising, and no reports of the pages you view.

What is processed. Only when one of the actions above takes place does your browser send a conversion to Google: your IP address, information about your browser and device, the address and title of the page you are on, including the ad click identifier if the address contains one, the time, and which action took place. With the first conversion, Google stores a cookie on our domain, _gcl_au, typically for 90 days, and may read or set cookies on its own domains. In our Google Ads account we see only aggregated figures, not individual visitors.

In the DPP Linter. The DPP Linter at dpplint.ownyourdata.eu asks for your consent with its own banner, and your choice there applies to the DPP Linter only. With your consent, a conversion is sent each time a check you started has finished. It contains the address of the DPP Linter’s start page, including the ad click identifier if the address contains one, but not the product identifier you entered, and of the page you came from only its domain. The result of the check is not sent. Without your consent, the DPP Linter loads nothing from Google; its API documentation loads no fonts or other resources from Google either. You can change your choice under “Cookie settings” at the bottom of the DPP Linter’s page.

Legal basis. Your consent (Art. 6(1)(a) GDPR; for storing and reading information on your device, § 165(3) of the Austrian Telecommunications Act 2021, TKG 2021).

Recipient and transfer to the USA. The recipient is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR). More in Google’s privacy policy and at business.safety.google.

Your choice and how to change it. Your choice is stored in your browser (local storage) for twelve months, so that the banner does not appear on every page; this entry is not sent to us or to Google. You can withdraw your consent at any time, with effect for the future, under “Cookie settings” at the bottom of each page. When you decline, the _gcl_ cookies on our domain are deleted and the tag is no longer loaded.

9. Your rights

You have the right of access to your personal data (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), where applicable to data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21). You can withdraw a consent at any time, without affecting the lawfulness of processing before the withdrawal (Art. 7(3)). Write to office@ownyourdata.eu.

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR. Whether a reader may see restricted passport data follows from the access rights the economic operator has granted, not from an assessment of the person.

If you believe that the processing of your data violates data protection law, you can lodge a complaint with the supervisory authority. In Austria this is the Österreichische Datenschutzbehörde (Austrian Data Protection Authority), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.