Privacy Policy

1. Controller

EAS International

Urs Zimmermann

Klybeckstr. 141

4057 Basel

Schweiz

E-mail: info@batteriepass-online.eu

We are not required to appoint a data protection officer under Art. 37 GDPR. Please send privacy requests to the e-mail address above.

1a. Representative in the EU (Art. 27 GDPR)

Urs Zimmermann

Eichacker 2

79418 Schliengen

Germany

E-mail: info@batteriepass-online.eu

Data subjects and supervisory authorities in the EU may contact the representative on all matters relating to processing; the representative acts on behalf of the controller.

2. Our role: controller or processor

For customer accounts, billing, security and the operation of the website we are the controller. This policy describes that processing.

The content of battery passports, uploaded documents, supplier contacts and access requests are entered into the software by our customers (the economic operators). For this data the respective customer is the controller and we are its processor under Art. 28 GDPR, based on our Data Processing Agreement (/avv). Data subjects should contact the economic operator named in the passport for this data; we forward requests.

3. Visiting the website

When you open our pages, our server processes your IP address, the requested address and the browser identifier (user agent) in order to deliver the page and to fend off attacks (Art. 6(1)(f) GDPR). Our upstream web server logs the IP address, time, requested address, status code and user agent in order to detect attacks and abuse; this server log is deleted automatically after seven days. Beyond that, the IP address is processed only in the rate-limit counters (section 5) and, truncated and hashed, in the access log for protected passport content (section 7).

We use no analytics trackers, no social media plugins and no external fonts. We use Google Ads to measure the success of our ads only with your consent (section 4).

4. Cookies

Technically necessary cookies and storage entries, for which no consent is required (Section 25(2) no. 2 TDDDG):

• bpo_session: login to the customer area; lifetime 30 days, deleted on logout.
• bpo_access: remembers an access grant for non-public passport content (legitimate interest or authority); lifetime according to the grant.
• bpo_consent (browser local storage): stores your cookie choice; lifetime 12 months.
• Google Ads (only with consent): if you agree in the cookie banner, we embed Google Ads conversion tracking (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Google sets cookies for this (such as _gcl_au, lifetime up to 90 days) and receives your IP address, pages visited, time and browser data in order to measure whether a click on our ad led to a sign-up or purchase. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Transfers to Google LLC in the USA are covered by the EU-US Data Privacy Framework. Without consent no Google code is loaded. You can withdraw your consent at any time with effect for the future via “Cookie settings” in the footer. Google privacy policy: https://policies.google.com/privacy

5. Customer account and organisation

On registration we process name, e-mail address, company and a password, which we store only as a hash (scrypt). For the organisation we store legal name, address, country, VAT identification number, EORI number and further company identifiers (such as trade register or LEI number) which the customer provides for passports and the EU registration, as well as plan and quotas. We also log the time of the last login and the language setting.

The purpose is to provide the customer area, to attribute passports to the economic operator and to bill. The legal basis is performance of the contract (Art. 6(1)(b) GDPR).

E-mail confirmations, login and password reset links are sent through the e-mail service of STRATO GmbH (Germany). We log sent e-mails with recipient, subject, content and delivery status in order to trace delivery problems; the log is deleted after twelve months.

To protect against abuse we limit login attempts, registrations and password resets per IP address and account. For this we store counters with the IP address for at most 24 hours (Art. 6(1)(f) GDPR). We log login attempts (successful and failed) with time, e-mail address, outcome, full IP address and user agent for 90 days in order to detect attacks on accounts and to tell them apart from a customer mistyping their own password. This log is seen only by the operator in the internal operator dashboard, hidden by default behind a reveal control there.

6. Payment and billing

Paid plans are processed through Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Dublin, Ireland. Stripe receives name, e-mail address, company address, VAT ID and the payment details; card and account data are collected exclusively by Stripe and never reach our servers. We store the Stripe customer ID, the subscription status and invoice data.

Stripe is an independent controller for payment processing; the Stripe privacy policy applies (https://stripe.com/privacy). Transfers to Stripe Inc. in the USA are covered by the EU-US Data Privacy Framework and standard contractual clauses.

The legal bases are performance of the contract (Art. 6(1)(b) GDPR) and our statutory retention obligations (Art. 6(1)(c) GDPR). We keep invoice data for ten years.

7. Public battery passports

Published battery passports can be accessed worldwide via their address (QR code). Which data is public, visible only to persons with a legitimate interest or only to authorities is prescribed by Annex XIII of Regulation (EU) 2023/1542; the software implements these levels technically. Public data includes the name and contact details of the economic operator; where this concerns a natural person, the economic operator is responsible for it.

We log access to non-public passport content for the customer with time, access level, truncated hashed IP address and user agent. This access log is deleted after 90 days.

Anyone requesting access to protected content as an authority or as a person with a legitimate interest provides e-mail address, organisation, role, purpose and, where applicable, evidence. The customer, who decides on the grant, sees this information; we process it on the customer’s behalf.

8. Supplier forms, API and webhooks

Customers can ask suppliers for product data via an e-mail link. For this we store the supplier e-mail address entered by the customer, the processing status and the submitted values, on the customer’s behalf.

For the API we store API keys only as a hash together with the time of last use. Webhook addresses and secrets are provided by the customer; secrets are stored encrypted. We log delivery attempts with time, status code and a response excerpt for 30 days.

9. Hosting and recipients

We use the following service providers, which process data on our behalf (Art. 28 GDPR):

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany: servers for the application, database and document storage in the Falkenstein and Nuremberg data centres.
• STRATO GmbH, Otto-Ostrowski-Str. 7, 10249 Berlin, Germany: sending of system e-mails.
• Stripe Payments Europe Ltd., Dublin, Ireland: payment processing (as independent controller, see section 6).

10. Transfers to third countries

We are established in Switzerland. The European Commission has recognised Switzerland as providing an adequate level of data protection (adequacy decision 2000/518/EC, confirmed 2024), so access from Switzerland to the data stored in Germany is permitted. Apart from payment processing through Stripe (section 6), no transfers to other third countries take place.

11. Retention periods

• Customer account and organisation data: until the account is deleted, then a 30-day blocking period; invoice data ten years.
• Login sessions: 30 days; login and reset links: up to 24 hours.
• Web server log: seven days. Rate-limit counters: 24 hours. Login log: 90 days. Access logs for protected passport content: 90 days. E-mail log: twelve months. Webhook delivery log: 30 days.
• Battery passports and documents: for the statutory retention period under Art. 77(8) Regulation (EU) 2023/1542. After the contract ends, passports remain in read-only mode for at least 15 years and beyond that until recycling is reported; deletion according to our Terms of Service (section 8).
• Change log (audit log) of the customer area: for the term of the contract, in order to prove the verification chain of the passports.

12. Security

All connections are encrypted with TLS. Passwords are stored as scrypt hashes, secrets encrypted. Access is role-based, login attempts are limited, and changes to passports are recorded in a hash chain. The database is reachable only from the private network. Backups are created daily and kept for 30 days.

13. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21). Please contact info@batteriepass-online.eu. We respond within one month.

You may lodge a complaint with a data protection supervisory authority, in Switzerland with the Federal Data Protection and Information Commissioner (FDPIC), in the EU with the authority of your place of residence or work.

We make no automated individual decisions and do not use your data for advertising without your prior consent.

14. Changes

We update this policy when our processing or the legal situation changes. The current version is always available at /datenschutz; we inform customers of material changes by e-mail.