Privacy Policy of Transpareo AG

How Transpareo AG processes and protects personal data.

1. Controller

The controller for data processing within the meaning of the GDPR and the Swiss Data Protection Act (nDSG) is:

Transpareo AG
Tech Cluster Zug
Oberallmendstrasse 18
6300 Zug
Switzerland

Company ID: CHE-220.381.580
Commercial register: CH-170.3.047.128-7 (Canton of Zug)
Represented by: Günter Reichelt, Chairman of the Board of Directors

Email:

2. Our Two Roles: Controller and Processor

When you use the platform, two kinds of data arise that we treat differently in law:

As a controller, we process the data that arises when you visit our website, register your account and are billed (Sections 3 to 9). For this data, we determine the purposes and means of processing ourselves.

As a processor, we process the product and passport data - and any personal data contained therein - that you as a customer enter, import or transmit via the interfaces into the platform (Section 5). Here you are the controller; we act exclusively on your instructions on the basis of a data processing agreement (DPA) under Section 14 of the Terms of Service.

For suppliers passing a request on to their own suppliers through the supplier page, we likewise process the links passed on and the answers to them as a processor, on the basis of our data processing agreement (Section 6).

3. What Data We Collect

As a controller, we collect personal data in the following situations:

Website use: When you visit our website, technical access data (IP address, browser type, timestamp) is logged. These server logs are deleted after 14 days. The geographic lookup of the IP address is performed via a local database on our own server; no data is transmitted to third parties in the process.

Registration & use of the platform: When you register, we collect your name, email, company name and country. Payment is handled by our payment service provider (Section 7); card details are entered directly with them and are not stored by us.

Contact form: For enquiries via the contact form, we process the contact details you provide in order to respond to your enquiry.

Newsletter: When you subscribe to the newsletter, we store your name, email address, language and, if given, your company, as well as the country we derive from your IP address. The subscription takes effect only once you click the link in our confirmation email. Every newsletter email carries an unsubscribe link.

Service catalogue: You request the confidential part of our service catalogue with your email address, name and company. We send you the confidentiality agreement and a personal link that works for eight days. The link opens a page where one click accepts the agreement and opens the catalogue. We store your details, your language and when we sent the link. If you accept the agreement, we record the acceptance (name, company, email address, time, version of the agreement) and every access to confidential content with its time, kind (link, page, spreadsheet, PDF) and language, as Section 9 of the agreement provides. We store no IP address for this. Afterwards we write to you only if you ask us to on the catalogue page.

4. Purposes & Legal Bases

Insofar as we act as a controller, we process your data on the following legal bases:

  • Performance of a contract (Article 6(1)(b) GDPR): providing the platform, managing your account and billing
  • Legitimate interests (Article 6(1)(f) GDPR): operating and securing the website, including the server logs kept for 14 days to detect and prevent abuse
  • Legal obligations (Article 6(1)(c) GDPR): statutory retention obligations for invoicing and accounting data
  • Consent (Article 6(1)(a) GDPR): marketing communications such as the newsletter, where you have agreed to them
  • Service catalogue: sending the link and giving access to the catalogue at your request (Article 6(1)(b) GDPR); the record of the acceptance and of the accesses as evidence under the confidentiality agreement, our legitimate interest (Article 6(1)(f) GDPR). A message to you when you ask for one rests on your consent (Article 6(1)(a) GDPR)

As a Swiss company, Transpareo AG is also subject to the revised Swiss Data Protection Act (nDSG); its requirements are met in parallel with the GDPR.

5. Processing on Behalf of Our Customers

The product and passport data that our customers place in the platform is processed by us as a processor, exclusively on their instructions. Where this data contains personal data (for example the name of a responsible person), the respective customer is the controller for it. The basis is the data processing agreement under Section 14 of the Terms of Service.

We store, process, translate and sign this data technically and make published Digital Product Passports publicly accessible via their permanent URL. Published passports are therefore publicly and permanently retrievable; for a passport registered in the EU register, the published versions additionally remain in an immutable archive for ten years (see Section 10 of the Terms of Service).

Data subjects whose data is contained in a product passport should exercise their rights with the respective customer as the controller. On the customer’s instructions, we support them in handling such requests.

6. Supplier Page

On the supplier page, suppliers answer requests for information about products and components and pass parts of them on to their own suppliers. The page opens with a link and a PIN and requires no account. The Supplier Terms of Use apply to its use.

On whose behalf we process. We process an answer on behalf of whoever made the request: the customer whose workspace it comes from, or the supplier that passed it on. When a supplier passes a request on, we process the links passed on, the answers to them and its review of those answers on its behalf. The respective principal is the controller; please address requests concerning your rights to them. We are ourselves the controller for the server logs and for preventing abuse, based on our legitimate interest in secure operation (Article 6(1)(f) GDPR).

What we store:

  • the link and its settings: the questions asked, the expiry date and the sender’s comment, for a request passed on also the recipient’s name and the name the supplier passing it on gives itself
  • the PIN, encrypted. A PIN issued by the sender can be shown to the sender again; a PIN you choose yourself is shown to nobody by the platform
  • when the link was opened and answered, wrong PIN entries and locks
  • your answer, the pictures sent without metadata and the machine translations of your texts
  • for a request passed on, the answers of your own suppliers, your decisions on them and your remarks
  • which version of the supplier terms, the privacy policy and, where applicable, the data processing agreement you accepted with an answer or a request passed on, and when
  • a log with time, action (opening, unlocking, choosing the PIN, sending, uploading, passing on, new PIN, revocation, feedback, locking) and IP address

In your browser. The page sets a technically necessary session cookie. It records which links you have unlocked in this browser, each for twelve hours, and which language you read the page in; it ends when you close the browser. What you enter in the answer form is stored locally by your browser so that a reload loses nothing. We receive this draft only when you send it; your browser then deletes it. Pictures are uploaded to us as soon as you choose them.

Who sees what:

  • The customer whose workspace a request comes from sees the answer with the pictures, when the link was opened and answered, and the log entries with IP address.
  • Of requests a supplier passes on, the customer sees only their number. The log entries on them are hidden from the customer. They serve as evidence should a dispute arise over a request passed on.
  • The supplier that passed a request on sees the answers of its suppliers and the state of their links.
  • DeepL SE receives your written texts for translation (Section 7).

How long:

  • Log entries: five years
  • Pictures that no waiting answer names and no record has adopted: seven days after upload; pictures of a rejected answer are deleted immediately
  • Link, answers, translations and decisions: according to the controller’s instructions, without instructions for as long as the workspace the request comes from exists (Annex II Part B of the data processing agreement)
  • Backups: 90 days
  • Server logs: as in Section 3

7. Recipients and Processors

We share personal data only where this is necessary to perform the contract or where you have consented. We use the following carefully selected processors, with each of whom a data processing agreement is in place:

  • Hetzner Online GmbH (Germany): hosting and object storage. All platform servers and stored data are located in Germany.
  • KeyCDN (proinity LLC, Switzerland): delivery of the website and the public product passport pages via a content delivery network. In this context, visitors’ connection data (in particular the IP address) is processed at globally distributed edge servers.
  • Stripe (Stripe Payments Europe Ltd. / Stripe, Inc.): payment processing and invoicing. In this context, payment data is processed in the USA (see Section 8).
  • Kreativmedia (Kreativ Media GmbH, Switzerland): dispatch of system and notification emails via an SMTP relay.
  • DeepL SE (Germany): machine translation of content within the EU data zone.

8. International Data Transfers

Our entire hosting infrastructure and all data stored on it are located in Germany and thus within the EU/EEA data zone.

For delivery via the KeyCDN content delivery network (reachable at cdn.transpareo.com), visitors’ requests may be processed at edge servers outside the EU/EEA. Only publicly accessible content is delivered via the network; the master data stored in Germany is not affected by this. Any such transfers are safeguarded under Chapter V GDPR in the data processing agreement we concluded with the operator of KeyCDN.

A transfer to the USA takes place exclusively in the context of payment processing via Stripe. This transfer is safeguarded by the European Commission’s Standard Contractual Clauses and by Stripe’s participation in the EU-U.S. Data Privacy Framework.

Transpareo AG is domiciled in Switzerland. For transfers from the EU to Switzerland, an adequacy decision of the European Commission is in place; the Swiss level of data protection is deemed equivalent.

9. Retention Period

We store personal data only for as long as is necessary for the respective purposes:

  • Server logs: 14 days
  • Backups: 90 days, after which they are permanently deleted within a further 30 days
  • Account data: for the duration of the contractual relationship
  • Invoice data: 10 years (statutory retention obligation)
  • Support enquiries: 3 years after the enquiry is closed
  • Marketing consents: until withdrawn
  • Newsletter subscriptions never confirmed: 30 days
  • Service catalogue: requests without an accepted confidentiality agreement 30 days after the last link; accepted accesses, with the record of the acceptance and the accesses, five years after the last access, for as long as the duties under the agreement run
  • Supplier page: see Section 6

Product and passport data that we process on behalf of our customers is stored according to their instructions; published and registered passport versions are subject to the ten-year archive period under Section 10 of the Terms of Service.

10. Cookies & Tracking

We use only technically necessary cookies to operate our website (e.g. login session). We do not use analytics or tracking cookies.

When you open the confidential service catalogue, the same session cookie records that you may read it in this browser. It ends when you close the browser.

We deliberately avoid third-party tracking technologies (Google Analytics, Facebook Pixel, etc.). Our internal statistics are privacy-compliant and do not capture personal profiles.

11. Data Subject Rights

As a data subject, you have the following rights towards Transpareo:

  • Access (Article 15 GDPR): you can request information about the data stored about you at any time.
  • Rectification (Article 16 GDPR): you can request the correction of inaccurate data or the completion of incomplete data.
  • Erasure (Article 17 GDPR): you can request the erasure of your data, provided no statutory retention obligations prevent this.
  • Restriction of processing (Article 18 GDPR): under certain conditions you can request that the processing of your data be restricted.
  • Data portability (Article 20 GDPR): you can receive your data in a structured, commonly used format or have it transferred directly to another controller.
  • Objection (Article 21 GDPR): you can object to processing based on legitimate interests.
  • Withdrawal of consent (Article 7(3) GDPR): you can withdraw consent you have given at any time with effect for the future.
  • Complaint (Article 77 GDPR): you can lodge a complaint with a data protection supervisory authority (see Section 14).

No automated decision-making, including profiling within the meaning of Article 22 GDPR, takes place.

12. Data Security

We use technical and organisational measures to protect your data:

  • Encryption of all data in transit (TLS)
  • A database of its own for each customer
  • Credentials and other secrets stored encrypted in the database, with a separate key for each workspace
  • Encrypted backups
  • Hosting with an ISO 27001-certified provider in Germany
  • Continuous monitoring of our systems and regular security updates and hardening

13. Data Protection Officer and EU Representative

We have appointed an external data protection officer:

DGD Deutsche Gesellschaft für Datenschutz
Prof. Dr. h.c. Heiko Jonny Maniero
Franz-Joseph-Str. 11
80801 Munich, Germany

Email:
Phone: +49 (0)178 6264376

As a controller established outside the EU, we have designated a representative in the EU pursuant to Article 27 GDPR. This function is performed by the DGD Deutsche Gesellschaft für Datenschutz named above.

14. Contact

For questions about data protection and to exercise your rights, please contact:

Data protection contact at Transpareo AG
Email:

You also have the right to lodge a complaint with a data protection supervisory authority - in Switzerland with the Federal Data Protection and Information Commissioner (FDPIC), and in the EU with the supervisory authority of your member state.

Our detailed transparency document, covering all our processing activities in full, is available for download here: Transparency document (PDF)

Last updated: 29 October 2026

Definitions

This policy uses the terms of the GDPR. The most important ones in brief:

  • Personal data: any information relating to an identified or identifiable natural person.
  • Data subject: the natural person whose personal data is processed.
  • Processing: any operation performed on personal data (e.g. collection, storage, alteration, transmission, erasure).
  • Restriction of processing: marking stored data to limit its future processing.
  • Profiling: automated processing to evaluate personal aspects of a person.
  • Pseudonymisation: processing such that the data can no longer be attributed to a person without additional, separately kept information.
  • Controller: the party that alone or jointly determines the purposes and means of the processing.
  • Processor: the party that processes personal data on behalf of the controller.
  • Recipient: any party to which data is disclosed, whether a third party or not; authorities acting under a specific inquiry are not recipients.
  • Third party: any party other than the data subject, controller, processor and persons acting under their authority.
  • Consent: the freely given, specific, informed and unambiguous agreement of the data subject to the processing.