DigiProdPass Limited — Privacy Notice

This Privacy Notice explains how DigiProdPass Limited (“DPPL”, “we”, “us” or “our”) collects, uses and otherwise processes personal data when you visit digiprodpass.com (the “Website”), engage with us as a prospective or existing customer, or otherwise interact with our products and services.

DPPL is the controller of the personal data described in this Notice. We process personal data in accordance with the United Kingdom General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 (“DPA 2018”), the Data Use and Access Act (2025) and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”). Where we process the personal data of individuals located in the European Economic Area, we also comply with Regulation (EU) 2016/679 (“EU GDPR”).

This Notice should be read together with our Cookie Policy, which sets out in detail how we use cookies and similar technologies on the Website.

Depending on how you interact with us, we may process the following categories of personal data:

Lawful Bases for Processing:

We will only process (use) your personal information under the following legal bases: 

    a. Consent

• What is it?

o Consent is defined in Article 4(11):
any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

o Article 6(1)(a)
the data subject has given consent to the processing of his or her personal data for one or more specific purposes;

    b. Contract

• What is it?

o Contract is the lawful basis we rely on where processing is necessary for the performance of a contract with you, or to take steps at your request before entering into a contract.

o Article 6(1)(b)
processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

    c. Legal Obligation

• What is it?

o Legal obligation is the lawful basis we rely on where processing is necessary for compliance with a legal obligation to which we are subject.

o Article 6(1)(c)
processing is necessary for compliance with a legal obligation to which the controller is subject;

    d. Vital Interests

• What is it?

o Vital interests is the lawful basis we rely on where processing is necessary in order to protect someone’s life.

o Article 6(1)(d)
processing is necessary in order to protect the vital interests of the data subject or of another natural person;

    f. Legitimate interests

• What is it?

o Legitimate interests is the lawful basis we rely on where processing is necessary for our legitimate interests or those of a third party, unless there is a good reason to protect your personal data which overrides those interests.

o Article 6(1)(f)
processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

In accordance with Article 13(1)(c)-(d) UK GDPR, the table below sets out, for each processing purpose, the categories of data we use, the lawful basis we rely on, and (where the basis is legitimate interests) the specific interest pursued.

To help explain the terms used in the table above: “online identifiers” means information such as your IP address, cookie identifiers and similar device or browser identifiers that can be used to recognise your device; “usage data” means information about how you interact with the Website, such as pages viewed, clicks, session duration and referral source; and “behavioural signals” means patterns of interaction (for example, mouse movements, scroll behaviour and form-completion patterns) used to distinguish genuine users from automated bots. None of these are used to identify you by name, and non-essential trackers are only used where you have given consent.

Where we rely on legitimate interests (Article 6(1)(f) UK GDPR), we have completed a Legitimate Interests Assessment (LIA) for the relevant activity. You may request a summary of the relevant LIA by contacting our DPO. An LIA has been completed for each processing activity in the table above that relies on legitimate interests as its lawful basis (including responding to enquiries, spam and abuse prevention, hosting and securing the Website, establishing or defending legal claims, and hosting our TOMs documentation for due diligence).

Cookies and similar technologies (collectively, "trackers") used on the Website are described in detail in our Cookie Policy. The Cookie Policy is the authoritative source for the categorisation, retention and provider of every tracker we use on the Website.

In summary:

Strictly necessary trackers (those required to deliver an information society service explicitly requested by you, within the meaning of Regulation 6(4) PECR) are loaded by default. These are limited to trackers required for the operation, security and accessibility of the Website.

All other trackers - including analytics, heat-mapping, session-recording, advertising and tag-management - are non-essential. They are blocked by default and only load after you have given affirmative consent through the cookie consent banner. The “Reject all” option is presented with the same prominence as “Accept all” on the first layer of the banner.

You can change your preferences at any time using the cookie preferences link in the Website footer. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

We share personal data only with the categories of recipient set out below.

We retain personal data for no longer than is necessary for the purposes for which it was collected, in accordance with Article 5(1)(e) UK GDPR. The principal retention periods are:

Where the periods above use the phrase “last meaningful interaction”, this means the most recent substantive contact between you and DPPL - for example, replying to an email, opening a marketing message, downloading a resource, or attending a meeting. Inactivity beyond the relevant period will trigger review and, where appropriate, deletion or anonymisation of the data.

Under the UK GDPR you have the following rights in relation to your personal data. The exercise of these rights is free of charge in most cases and we will respond to a valid request within one month, in accordance with Article 12(3) UK GDPR. The period may be extended by up to two further months where necessary,

DPPL does not make decisions that produce legal effects concerning you, or similarly significantly affect you, based solely on automated processing within the meaning of Article 22 UK GDPR. Where this position changes, this Notice will be updated and (where required) your prior consent will be obtained. To be clear, we do not carry out any solely automated decision-making that produces legal or similarly significant effects for you, and so the safeguards in Article 22(3) UK GDPR (such as a right to human intervention) do not currently apply. The limited profiling described below is used only to deliver and measure advertising and does not produce any legal or similarly significant effect on you.

Some of our marketing tools (for example, behavioural advertising trackers) involve a limited form of profiling based on online behaviour. These trackers operate only after you have given consent through the cookie consent banner, and you can withdraw your consent at any time.

DPPL provides business-to-business services. The Website and our products are not directed at children. We do not knowingly collect personal data from anyone under the age of 18. (Where a UK information society service is offered directly to a child, the age at which a child can consent on their own behalf is 13 under section 9 of the DPA 2018; below that age we would require parental consent. Because our services are business-to-business, we do not rely on children's consent.) If you believe that a child has provided personal data to us, please contact our DPO so that we can investigate and, where appropriate, delete the data.

Where you have agreed to receive marketing from us, we may contact you by email to send newsletters, product updates, event invitations and other information about our products and services. Our marketing emails are sent using Mailchimp.

Lawful basis: We send marketing on the basis of your consent (Article 6(1)(a) UK GDPR) and in accordance with Regulation 22 PECR. Where the “soft opt-in” under Regulation 22(3) PECR applies – that is, where we obtained your contact details in the course of a sale or negotiations for a sale of our products or services, the marketing relates to our own similar products or services, and you were given a simple means to opt out at the time – we may rely on that soft opt-in instead of express consent.

How to opt out: You can opt out of marketing at any time, free of charge, by clicking the “unsubscribe” link in any marketing email, by adjusting your preferences where available, or by contacting us at contact@digiprodpass.com or our DPO at dpo@digiprodpass.com. Opting out of marketing will not affect the lawfulness of any marketing carried out before you opted out.

Service communications: Even if you opt out of marketing, we may still send you non-promotional service or administrative messages where these are necessary – for example, messages about your account, security or important changes to our terms or this Notice. These are not marketing messages and cannot be opted out of while you use the relevant service.

DPPL has implemented appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage, in accordance with Article 32 UK GDPR. These measures include access controls, encryption in transit and at rest where appropriate, secure hosting, vulnerability and patch management, logging and monitoring, secure software development practices, vendor due-diligence and personnel training.

DPPL operates an Information Security Management System aligned with ISO/IEC 27001. Our technical and organisational measures (TOMs) are summarised on the Drata Trust Center and are available on request to customers and prospective customers under appropriate confidentiality terms.

We may update this Privacy Notice from time to time to reflect changes in our processing activities, applicable law, or regulatory guidance. The version number, issue date and “Last reviewed” date in the document control box at the top of this Notice (and in the footer) will always show the current version. Where the changes affect processing carried out on the basis of your consent, we will obtain fresh consent from you where required.

We recommend that you review this Notice periodically. Material changes will, where reasonably practicable, be brought to your attention by email or by a notice on the Website.

In this Notice:

“Personal data” means any information relating to an identified or identifiable natural person, as defined in Article 4(1) UK GDPR.

“Processing” has the meaning given in Article 4(2) UK GDPR.

“Controller” and “Processor” have the meanings given in Article 4(7) and 4(8) UK GDPR respectively.

“Special category data” means personal data within Article 9(1) UK GDPR.

“Tracker” means any technology - including cookies, unique identifiers, web beacons, pixels, embedded scripts, e-tags and fingerprinting - that enables the tracking of users by accessing or storing information on the user’s device.

“UK GDPR” means the UK General Data Protection Regulation as defined in section 3(10) DPA 2018.

“PECR” means the Privacy and Electronic Communications (EC Directive) Regulations 2003 (SI 2003/2426), as amended.

“ICO” means the Information Commissioner’s Office, the UK supervisory authority for data protection.

‍Your consent preferences for tracking technologies can be managed through the cookie preferences link in the Website footer.