Skip to content
EU Product Identity
Log inTry free for 30 days

Privacy policy

This information describes which personal data are processed when you use the EU Product Identity platform (euproductidentity.eu).

The platform is under development and operated in Early Access. Its scope of functions continues to grow; this information will be updated accordingly.

As of: October 2026

Controller

The controller for the processing is Fa. Com2u, owner Patrick Hess, Frohschammerstr. 6 RGB, 80807 München.

The detailed provider identification can be found in the legal notice.

Scope of this privacy information

When you use the platform, the following categories of personal data are processed:

  • Registration and account data: name, e-mail address and company or organisation.
  • Content data processed for passports: product and passport details as well as documents and evidence uploaded for data capture.
  • Usage data arising while working with the application.
  • Technical access data: IP address, time of access and server log files.

Legal bases

The processing is based on Art. 6(1) GDPR:

  • point (b) — performance of a contract: operating the account, creating passports and billing.
  • point (f) — legitimate interest: technical log files, operational security and prevention of misuse.
  • point (a) — consent, where consent is obtained; it can be withdrawn at any time.

Purposes

The data are processed for the following purposes:

  • Account management
  • Product and passport management
  • Billing and invoicing
  • Operational security and prevention of misuse

Hosting & processing on behalf

The platform is operated by Com2u on its own infrastructure.

For AI-supported data capture from documents the following applies: the processing remains on the platform infrastructure, customer documents do not leave the host. The generated suggestions are only transferred into the passport after human approval.

Payment service provider: the use of Stripe for payment processing is planned; no payment processing is currently activated. As soon as payments are handled via Stripe, the processing agreement with Stripe will apply.

Retention periods

Personal data are stored for as long as is necessary for the respective purpose. In detail:

  • Billing data and invoices: generally 10 years due to statutory retention periods (§ 14b UStG, German VAT Act).
  • Account data: until the account is deleted or until use ends.
  • Session data in the browser: until you sign out.

Your rights

You have the following rights:

  • Access (Art. 15 GDPR)
  • Rectification (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection (Art. 21 GDPR)
  • Withdrawal of consent given (Art. 7(3) GDPR)
  • Complaint to a data protection supervisory authority — for the registered office in particular the Bavarian Data Protection Authority (BayLDA).

Cookies and technically necessary storage

Cookies for advertising are not used. Technically necessary is the storage of the session token and the selected organisation in your browser’s local storage (localStorage). Your choice regarding the cookie notice is also kept in local storage (entry “dpp_consent_v1” with consent or refusal and the date); it is honoured for at most twelve months, after which you will be asked again. No cookie is set for this purpose.

Cookies and scripts for audience measurement are only used with your consent (see “Web analytics with Google Analytics (consent)”). Without your consent, no analytics trackers and no third-party scripts are loaded.

Web analytics with Google Analytics (consent)

With your consent we use Google Analytics (Google Analytics 4) to measure the reach of this website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Google LLC (USA) may be involved as a further recipient.

The purpose is audience measurement, i.e. evaluating how the website is used in order to improve content and offering. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG, German Telecommunications Digital Services Data Protection Act).

Timing: The Google script (gtag.js) is only loaded and Google Analytics only becomes active after you have chosen “Accept” in the cookie notice. Until then, and after “Decline”, no connection to Google is established and no analytics cookies are set.

In detail:

  • Data stored: pseudonymous usage data, for example pages viewed, time, approximate location (country or region), device, browser and operating system details, referring page, and a randomly assigned identifier in cookies (_ga and _ga_ with the measurement ID) used to recognise returning visits.
  • IP address: for technical reasons your IP address is transmitted to Google servers when the data are sent. According to Google, it is not logged or stored in Google Analytics 4.
  • Scope of consent: it covers audience measurement only (analytics storage). It is not given for advertising purposes (advertising storage, user data for advertising, personalised advertising); these settings remain “denied”.
  • Transfer to third countries: data may be transferred to Google LLC in the USA. This relies on the safeguards Google uses for this purpose (for example the European Commission’s adequacy decision on the EU-U.S. Data Privacy Framework or standard contractual clauses); details are set out in Google’s privacy information. Access by authorities in third countries cannot be ruled out completely.
  • Storage period: according to Google the cookies have a lifetime of up to two years. The retention period of the data in Google Analytics is configured in the Google Analytics account; the standard version of Google Analytics 4 allows a maximum of 14 months.
  • Measurement IDs: each website has its own measurement ID — euproductidentity.eu: G-2CXV1CMJ9L, batteryidentity.eu: G-188CCVWB4K.
  • Withdrawal: you can withdraw your consent at any time with effect for the future. To do so, reopen the cookie notice via “Cookie settings” in the footer and choose “Decline”; the analytics cookies of this website are then removed. The lawfulness of processing carried out before withdrawal remains unaffected (Art. 7(3) GDPR).
  • Further information: Google’s privacy information at https://policies.google.com/privacy and https://support.google.com/analytics/answer/6004245.

Contact for data protection enquiries

Please address data protection enquiries and the exercise of the rights listed above to the contact point stated in the legal notice: Fa. Com2u, owner Patrick Hess, Frohschammerstr. 6 RGB, 80807 München.

Please refer to the legal notice for the specific contact option.