Privacy notice

DRAFT – for legal review. The platform is English only; a Bulgarian version is kept for the lawyer in docs/legal/.

Who we are

The provider of the Battery Compliance platform (the "Provider", "we"; details under "Legal information") is the controller of the personal data described below for its website, its platform accounts and its communication with customers. Privacy requests go to the e-mail address under "Legal information".

A company using the platform (the "Customer") is the controller of the data it enters or collects through the platform: passports, models, documents and their reading by AI, supplier requests and its decisions on access requests to its passports. We process that data as the Customer's processor under the "Data processing agreement". Questions about it go to the Customer; we forward requests we receive.

What we process, why and for how long

• Accounts: name, business e-mail, role, company, password hash (Argon2id), two-factor settings, single sign-on identifier, time of last sign-in. Purpose: sign-in and use of the platform. Basis: our legitimate interest in performing the contract with the Customer (Art. 6(1)(f) GDPR). Retention: while the account is active; a disabled account is anonymised after 1 year, and audit entries remain without personal data.
• Company registration: company details, legal representative, contact person, signed authorisation, IP address and time of acceptance of the legal documents. Purpose: checking the company, concluding the contract and proving it. Basis: legitimate interest (Art. 6(1)(f)). Retention: for the term of the contract and the limitation period after it; rejected registrations – 1 year; unfinished registrations – 90 days.
• Support tickets: subject, messages and attached files, author and company. Purpose: answering questions and fixing problems. Basis: legitimate interest (Art. 6(1)(f)). Retention: [period – to be completed].
• Service e-mails: we send e-mails about the account, security, plan limits, invoices, tickets and changes to the legal documents as part of the service. We send no marketing e-mails without consent.
• Invoices and payments: company details, the person who receives invoices, payments. Basis: legal obligation under accounting and tax law (Art. 6(1)(c)). Retention: 10 years.
• Access requests to non-public passport data: organisation, business e-mail, role, purpose, justification, permit or national register number (if given), the declarations and the version of the terms accepted, and evidence. The request is shared with the operator of the battery, which decides; we decide for regulated roles where the Regulation allows. Basis: Regulation (EU) 2023/1542 and legitimate interest. Retention: rejected – 1 year; approved – while the access lasts.
• Logs: log of access to non-public data (who, when, what) – 2 years; audit log – 10 years; web server access logs (IP address, time, address requested, browser type) – [period – to be completed]. Purpose: security and evidence of access (Art. 6(1)(f), Regulation (EU) 2023/1542).
• Security tokens and codes: deleted 30 days after use or expiry.
• Contact form: name, company, e-mail and message, sent to our mailbox and not stored on the platform. Basis: legitimate interest in answering. Retention: [period – to be completed].
• Notices of illegal content: name, e-mail, the notice and the decision. Basis: Regulation (EU) 2022/2065 (Art. 6(1)(c)). Retention: 2 years after the decision.
• Supplier requests (as processor for the Customer): the supplier's company, the business e-mail the link is sent to and, optionally, the name of the person who sends the data. Retention: 1 year after the request is closed or expires.
• AI reading of documents (as processor for the Customer): only the files a user selects, and only when the user starts it, are sent to our AI provider in the European Union. The provider may not use them to train its models.
• Backups: daily copies are kept 35 days and monthly copies 400 days; deleted data leaves the backups when these periods end.

Providing account and registration data is necessary for the contract; without it we cannot open an account. We take no decisions based solely on automated processing that have legal or similarly significant effects on you.

When you open a passport or QR page

Reading a public passport, a QR page or the public passport API needs no account. For each opening the platform adds one to a daily counter by country, device type and format, without storing your IP address or any identifier of you. To protect the service, the web server keeps access logs with your IP address for a short period (see "Logs"), and a hashed form of the IP address is used for a few minutes to limit abuse.

Published passports and documents

Passports, QR pages and their documents are published by the economic operator of the battery, our Customer, which is the controller of their content. They contain no personal data of end users or battery owners. They show the business contact details of the economic operator and, where EU law requires it, the name and function of the person who signed a document, such as the EU declaration of conformity. This data stays public for the period required by Regulation (EU) 2023/1542 and cannot be erased earlier while the law requires it (Art. 17(3)(b) GDPR). Requests about it go to the economic operator named in the passport.

Recipients

Our sub-processors for hosting, document and backup storage and AI reading of documents, which process data in the European Union, and our e-mail provider, all listed in the "Switching and data portability information"; the Customer for the data it controls; our accountant and bank; authorities where the law requires.

We send e-mail through Google Workspace. Google may process these messages, including the recipient's name and e-mail address and the content of the message, outside the European Union, including in the United States. These transfers rely on an adequacy decision of the European Commission, the standard contractual clauses or another mechanism permitted by Chapter V GDPR, under Google's data processing terms; you can ask us for a copy of the safeguards. We do not otherwise transfer personal data outside the European Union.

Cookies

We use only cookies that are strictly necessary for the service; we therefore do not ask for consent. We use no analytics, advertising or tracking cookies.

• Sign-in session (`authjs.session-token`): keeps you signed in; 8 hours, deleted when you sign out.
• Sign-in security (other cookies starting with `authjs.`): protect sign-in against forged requests and return you to the page you opened; they may also be set when you visit public pages; until you close the browser.
• Two-factor step (`bcp_login_pending`): keeps the result of the password step until you enter your code; a few minutes.
• Language (`NEXT_LOCALE`): remembers the language of the interface; 1 year.

Your rights

You may request access, rectification, erasure, restriction and portability, and you may object at any time to processing based on our legitimate interest, on grounds relating to your situation. You can download your account data from "Profile → Personal data". We answer within one month; for complex requests we may extend this by two months and tell you why. You may lodge a complaint with the Bulgarian Commission for Personal Data Protection (www.cpdp.bg) or with the authority of the Member State where you live or work.

Changes

Each version of this notice is published with its date. We inform account owners of material changes by e-mail.