GDPR Implementation
Traceable is designed and operated in compliance with Regulation (EU) 2016/679 (General Data Protection Regulation). This page describes how Traceable implements data subject rights, the lawful bases for processing, and how data retention works.
This page covers Traceable's own GDPR obligations as a data controller and processor. For DPP-specific data privacy concerns — such as what personal data appears in product passports and how it is handled — see the GDPR and Data section of the Developer Guide.
Roles: Controller and Processor
Traceable operates in two capacities depending on the context:
| Context | Role | Description |
|---|---|---|
| Account holder and user data | Controller | Traceable determines how user account data, login credentials, and company profiles are processed. |
| DPP product data | Processor | Operators are the controller of the DPP data they create. Traceable processes it on their instructions. |
As a processor of DPP data, Traceable enters into a Data Processing Agreement (DPA) with operators. Contact support@traceable.digital to request a DPA.
Lawful Basis for Processing
| Data type | Lawful basis | Notes |
|---|---|---|
| User account data (name, email, password hash) | Contract (Article 6(1)(b)) | Necessary to provide the service the user signed up for |
| Company profile data | Contract (Article 6(1)(b)) | Required to operate a Traceable account |
| DPP product data | Legal obligation (Article 6(1)(c)) | Processing required to fulfil EU Battery Regulation / ESPR compliance obligations on behalf of operators |
| AI document extraction | Consent (Article 6(1)(a)) | Each user must explicitly consent to AI processing in Privacy & Consent settings before Document AI is available to them; consent is recorded per user |
| Usage analytics and error logging | Legitimate interests (Article 6(1)(f)) | Error monitoring (Sentry) and platform stability; minimised data collection |
Data Subject Rights
Article 15 — Right of Access
Users can request a copy of all personal data Traceable holds about them. To make a request, contact support@traceable.digital with the subject line "Data Access Request". Traceable will respond within 30 days with a structured export of all personal data associated with the requesting individual's account.
Operators using the platform can also export their own account data directly via Account Settings → Privacy & Consent → Export My Data.
For developers integrating data portability into their own systems, see the GDPR and Data section of the Developer Guide.
Article 17 — Right to Erasure
Users can request deletion of their personal data. Traceable processes erasure requests within 30 days of receipt. On erasure:
- The user account is permanently deleted
- All personal data associated with the account (name, email, login history) is removed
- DPP product data belonging to the operator account is handled per the Data Processing Agreement — by default, product data is retained for the retention period specified unless the operator requests deletion
- Audit log entries referencing the deleted user are pseudonymised (the user identifier is replaced with a tombstone reference)
To request erasure: contact support@traceable.digital with the subject line "Erasure Request".
Article 20 — Right to Portability
Users can request an export of their personal data in a machine-readable format (JSON). This is available via:
- Self-service: Account Settings → Privacy & Consent → Export My Data
- Request: Contact support@traceable.digital with the subject line "Data Portability Request"
For developers integrating data portability into their own systems, see the GDPR and Data section of the Developer Guide.
AI Processing Consent
Document AI (automated extraction of compliance data from uploaded documents) is an optional feature that involves processing document content with an AI model. Traceable requires each user's explicit consent before Document AI is available to that user; consent is recorded per user, not at account level.
Where to manage consent: Company Portal → Settings → Privacy & Consent → Document AI Processing
What happens when consent is withdrawn: Document AI processing stops immediately. Previously extracted data remains in the DPP records; it is not automatically deleted. Operators can manually review and update AI-extracted fields.
Data Retention
| Data type | Retention period | Deletion trigger |
|---|---|---|
| User account data | Duration of account + 30 days | Account deletion request |
| DPP product data | Duration of operator relationship + configurable retention window | Operator deletion request or subscription termination |
| Audit logs | 7 years (configurable) | Retention window expiry |
| Uploaded documents | Duration of operator relationship | Account deletion or explicit document deletion |
| Email logs | 90 days | Automated cleanup on a regular schedule |
| Error logs (Sentry) | 90 days | Sentry retention policy |
| Session tokens | 24 hours (access token) / 7 days (refresh token) | Token expiry |
Automated deletion jobs run on a regular schedule to enforce retention windows. Manual deletion requests are processed within the 30-day GDPR response window.
Data Processing Agreement
Traceable offers a standard DPA for operators who require one for their own GDPR compliance. The DPA covers:
- The scope and nature of processing
- Types of personal data and categories of data subjects
- Technical and organisational security measures
- Sub-processor obligations
- Incident notification commitments (72-hour notification to operators of breaches)
- Data return and deletion on termination
To request a DPA: support@traceable.digital
Further Reading
| Page | Contents |
|---|---|
| Infrastructure | Hosting providers and EU data residency |
| Sub-processors | Full sub-processor register |
| Data Encryption | Encryption at rest and in transit |
| Developer — GDPR and Data overview | GDPR implementation in the API |