GDPR Implementation
Traceable is designed and operated in compliance with Regulation (EU) 2016/679 (General Data Protection Regulation). This page describes how Traceable implements data subject rights, the lawful bases for processing, and how data retention works.
This page covers Traceable's own GDPR obligations as a data controller and processor. For DPP-specific data privacy concerns — such as what personal data appears in product passports and how it is handled — see the GDPR and Data section of the Developer Guide.
Roles: Controller and Processor
Traceable operates in two capacities depending on the context:
| Context | Role | Description |
|---|---|---|
| Account holder and user data | Controller | Traceable determines how user account data, login credentials, and company profiles are processed. |
| DPP product data | Processor | Operators are the controller of the DPP data they create. Traceable processes it on their instructions. |
As a processor of DPP data, Traceable enters into a Data Processing Agreement (DPA) with operators. Contact privacy@traceable.digital to request a DPA.
Lawful Basis for Processing
| Data type | Lawful basis | Notes |
|---|---|---|
| User account data (name, email, password hash) | Contract (Article 6(1)(b)) | Necessary to provide the service the user signed up for |
| Company profile data | Contract (Article 6(1)(b)) | Required to operate a Traceable account |
| Usage analytics and error logging | Legitimate interests (Article 6(1)(f)) | Error monitoring (Sentry) and platform stability; minimised data collection |
Data Subject Rights
Article 15 — Right of Access
Users can request a copy of all personal data Traceable holds about them. To make a request, contact privacy@traceable.digital with the subject line "Data Access Request". Where Traceable is the controller, it responds to data subject requests without undue delay and in any event within one month of receipt. That period may be extended by two further months where necessary, taking into account the complexity and number of requests. The data subject is told of any extension, and the reasons for it, within the first month (GDPR Article 12(3)).
Operators using the platform can also export their own account data directly via Account Settings → Privacy & data → Export My Data.
For developers integrating data portability into their own systems, see the GDPR and Data section of the Developer Guide.
Article 17 — Right to Erasure
Users can request deletion of their personal data. Dedicated endpoints accept subject access, data portability and erasure requests. The deadline for an erasure request is one month from receipt, extendable by up to two further months where the law allows.
Audit records are retained when an account is erased. Personal fields in them can be redacted by an administrator without deleting the record.
To request erasure: contact privacy@traceable.digital with the subject line "Erasure Request".
Article 20 — Right to Portability
Users can request an export of their personal data in a machine-readable format (JSON). This is available via:
- Self-service: Account Settings → Privacy & data → Export My Data
- Request: Contact privacy@traceable.digital with the subject line "Data Portability Request"
For developers integrating data portability into their own systems, see the GDPR and Data section of the Developer Guide.
AI Processing Consent
Document AI (automated extraction of compliance data from uploaded documents) is an optional feature that involves processing document content with an AI model. AI features that send customer content to an AI provider are used at the user's initiative. Consent is recorded per user, not at account level.
Where to manage consent: Company Portal → Settings → Privacy & data → AI Data Processing
What happens when consent is withdrawn: Document AI processing stops immediately. Previously extracted data remains in the DPP records; it is not automatically deleted. Operators can manually review and update AI-extracted fields.
Data Retention
| Data type | Retention period | Deletion trigger |
|---|---|---|
| User account data | Until a deletion request is completed | Account deletion request (the deadline is one month from receipt, extendable by up to two further months where the law allows) |
| DPP product data | Until a deletion request is completed | Operator deletion request |
| Audit logs | One year. Records that support published passports and regulatory filings are kept for longer | Retention window expiry |
| Uploaded documents | Duration of operator relationship | Account deletion or explicit document deletion |
| AI data (usage records, values AI read from documents, reused corrections, Bulk AI batches) | At most 90 days; Bulk AI uploads that never became a product, 30 days. The record of which fields AI filled in a published passport is kept with that passport as part of its audit trail | Automated daily cleanup |
| Error logs (Sentry) | 90 days | Sentry retention policy |
| Session tokens | Access tokens last 1 hour and are refreshed automatically. | Token expiry |
Automated deletion jobs run on a regular schedule to enforce retention windows.
Data Processing Agreement
Traceable offers a standard DPA for operators who require one for their own GDPR compliance. The DPA covers:
- The scope and nature of processing
- Types of personal data and categories of data subjects
- Technical and organisational security measures
- Sub-processor obligations
- Incident notification commitments (notification to operators of breaches without undue delay)
- Data return and deletion on termination
To request a DPA: privacy@traceable.digital
Further Reading
| Page | Contents |
|---|---|
| Infrastructure | Hosting providers and EU data residency |
| Sub-processors | Full sub-processor register |
| Data Encryption | Encryption at rest and in transit |
| Developer — GDPR and Data overview | GDPR implementation in the API |