1. Who is responsible
The Conforvia operator identified at the top of this page is the provider of this service and the controller of account, website, security, and commercial-contact data. For product, supplier, facility, and evidence data uploaded by a customer, the operator acts as a processor on that customer's instructions. Questions and rights requests can be sent to the verified contact published when self-service terms activate.
2. Data we process
- Account name, email address, authentication state, organization membership, and role.
- Organization profiles, product catalogs, bills of materials, supplier and facility records, contact details, and evidence files.
- Review decisions, audit events, technical files, passport revisions, support messages, and controlled-access activity.
- Billing identifiers and subscription status when paid billing is enabled. Conforvia does not store complete payment-card details.
- Limited request, device, and network information needed for authentication, fraud prevention, rate limiting, and incident investigation.
3. Why we process it
We process data to provide and secure the service, perform customer instructions, maintain traceable records, communicate about requests and incidents, administer subscriptions, meet legal obligations, and improve reliability. Depending on the context, the basis is contract, legitimate interests in operating a secure B2B service, legal obligation, or consent.
4. Public and controlled disclosures
A customer chooses what to publish in a Digital Product Passport. Public passport fields and signed revision history can be viewed by anyone with the public address. Original evidence, private supplier details, and internal review material are not made public. Expiring supplier and review links expose only the information needed for that workflow.
5. Service providers and transfers
Conforvia uses vetted infrastructure providers to deliver the service. Current providers and their purposes are listed on the subprocessor page. Data may be processed outside the customer's country where those providers operate. We use contractual and technical safeguards appropriate to the transfer and the data involved.
6. Retention and deletion
Customer content is kept while the workspace is active and according to its configured retention policy. Security, billing, audit, and legal records may be retained longer where necessary to establish a transaction, preserve an immutable decision history, prevent abuse, or comply with law. Controlled deletion removes eligible live files and verifies their removal from managed recovery copies. Deletion is not used to rewrite a lawfully retained fingerprint or audit fact.
7. Cookies and similar storage
Conforvia uses essential cookies and browser storage for authentication, security, preferences, and controlled-access capabilities. We do not currently use advertising cookies. Paddle may set checkout cookies when a customer opens its hosted payment interface.
8. Your choices and rights
Subject to applicable law, a person may ask to access, correct, delete, restrict, or receive their personal data, or object to certain processing. Supplier contacts should normally contact the customer that issued the request; we will assist that customer. You may also complain to the data protection authority available in your jurisdiction.
9. Security and changes
We use access controls, encrypted transport, private object storage, integrity checks, backups, and incident records. No service can guarantee absolute security. Material changes to this notice will be dated here and, when appropriate, communicated to affected customers.