GDPR & data overview

Traceable Digital Private Limited, established in India, operates as both a data controller and a data processor under the General Data Protection Regulation (GDPR, Regulation 2016/679). This page explains the data roles relevant to integration developers who send personal data to Traceable via the API.

Data roles

Traceable as data controller: Traceable acts as a data controller in respect of platform user account data (names, email addresses), platform usage data, and support communications. As a controller, Traceable determines the purpose and means of processing this data and is responsible for responding to data subject requests (access, rectification, erasure, portability) made by Traceable platform users.

Traceable as data processor: Traceable acts as a data processor in respect of product data that operator customers upload: the DPP product content, documents, and supplier information entered by an operator to create their Digital Product Passports.

In this role, Traceable processes data on behalf of the operator (the controller). The operator determines what data is entered and for what purpose. The operator is responsible for ensuring they have a lawful basis for processing any personal data within their product data, for example, if a document uploaded to Traceable contains individual names.

The data processing agreement between Traceable and operators is incorporated into the Terms of Service.

Data subjects in the Traceable context

The following categories of individuals may have data subject rights in relation to Traceable:

Data subject	Their data	Controller	Where to direct requests
Traceable platform users	Account data, email, login activity	Traceable	privacy@traceable.digital
Signatories named in uploaded documents	Name, job title	Operator customer	The operator organisation
Supplier contacts in supply chain data	Name, email, company	Operator customer	The operator organisation

Data residency

Customer data is stored in the EU. Traceable's personnel in India access it to operate and support the platform, under the Standard Contractual Clauses in the Data Processing Agreement. Each provider's location and transfer mechanism are on the Subprocessors page.

Guidance for integration developers

If your integration sends personal data to Traceable via the API (for example, if your PoLI access request includes a named individual's email address, or if you embed personal data in a field not intended for it) you should ensure:

1. You have a lawful basis for transferring that personal data to Traceable (typically contract performance or legitimate interest)
2. Data minimisation: only send the personal data actually required by the API field. The email in a PoLI access request should be a team or role address (e.g., dpp-access@acm.nl) rather than an individual's personal email where possible.
3. Your privacy notice informs affected individuals that their data may be processed by Traceable as part of your service
4. Data subject requests: if an individual asks you to delete their data, remember to also contact Traceable support to remove any data you shared with Traceable on their behalf

For questions about data processing and integration-specific GDPR obligations, contact privacy@traceable.digital.

GDPR data-subject API

For operators who fulfil data-subject requests programmatically, the Integration API exposes three endpoints under /api/v1/gdpr/*. They require the privileged gdpr:admin scope (minted only from the Company Portal, see Authentication → Privileged scopes) and are live mode only: a sandbox (pk_test_) key receives 403 CROSS_MODE_DENIED.

Right	Endpoint	Behaviour
Access (Art. 15)	GET /api/v1/gdpr/access	Returns the personal data held for a data subject
Erasure (Art. 17)	POST /api/v1/gdpr/erase	Accepts the request (202 Accepted). Erasure requests are given a deadline of one month from receipt.
Portability (Art. 20)	GET /api/v1/gdpr/portability	Returns the data subject's data in a portable format

Erasure deadline fields

The 202 answer to POST /api/v1/gdpr/erase carries the deadline in three fields:

Field	Meaning
deadlineAt	The deadline for answering the request: one calendar month from receipt, so a request filed on 31 January is due on 28 or 29 February. This is the authoritative deadline.
deadlineRule	How deadlineAt is computed. Its only value is one_calendar_month.
slaDays	Deprecated, kept for v1 compatibility. It is always 30, which is not the deadline: the days to deadlineAt can be 28 to 31. Read deadlineAt instead.

A person completes the request, so deadlineAt is a deadline, not a promise of when the erasure finishes. Filing again while a request is Pending returns the existing request with alreadyPending: true.

Legal entities and brands in the export and in erasure

A company's legal entities and brands are part of the personal data a company holds, because a legal entity's contact email can be a named person's email address.

• Access and portability. GET /api/v1/gdpr/access and GET /api/v1/gdpr/portability return company.legalEntities[] and company.brands[], archived ones included. A legal entity carries its legal name, address, contactEmail, website, gln, operator identifier and the isDefault, identityConfirmedAt and archivedAt values. A brand carries its name, operatorRole, legalEntityId, branding, the powered-by settings and isDefault. The user ids of the members who confirmed an identity or archived a record are not exported.
• Company export. The company export in the Company Portal lists the same records under legal_entities and brands.
• Erasure. When an erasure is completed for the only remaining member of a company, the contact email of every legal entity of that company, archived ones included, is cleared. The legal name and the address stay, because the legal entity is the economic operator a passport must name and the legal identity of a legal person is not that member's personal data. The number of entities cleared is recorded on the audit trail.

AI processing and consent

Traceable's Document AI feature (which extracts structured data from uploaded compliance documents) involves sending document content to a third-party AI provider for processing.

The AI processing consent setting has no effect on the public API. API calls to GET /api/dpp/{slug} and the PoLI endpoints do not involve AI processing. DPP data returned by the API is the data entered and published by the operator. No AI transformation is applied to API responses.

If you are building a platform integration that uses Traceable's Document AI capabilities, note:

• Document AI is a platform UI feature and is not available as a standalone API endpoint.
• AI processing consent is granted or revoked per user in the Operator Portal; each user manages their own consent rather than one Admin consenting for the whole account.
• Documents submitted for AI processing are not used to train AI models.