E
EuFSI DPP

Privacy Policy

Last updated: March 2026

1. Data Controller

European Frontier for Sustainability and Innovation BV ("EuFSI", "we", "us") is the data controller for personal data processed through the EuFSI DPP Platform. We are registered in the Netherlands and comply with the EU General Data Protection Regulation (GDPR).

2. Data We Collect

We collect personal data you provide when registering an account (name, email, company information), data generated through platform usage (product data, supply chain information), and technical data (IP address, browser type, access logs).

3. Legal Basis

We process personal data on the basis of: (a) contract performance — to provide the DPP Platform services; (b) legitimate interest — to improve our services and ensure security; (c) legal obligation — to comply with EU regulations including ESPR and GDPR; (d) consent — for optional communications.

4. Data Processing Agreement

A Data Processing Agreement (DPA) is included with all subscription plans. The DPA governs our processing of your company's product and supply chain data in accordance with GDPR Article 28.

5. Your Rights

Under GDPR, you have the right to access, rectify, erase, restrict processing, data portability, and object to processing of your personal data. You may also withdraw consent at any time. To exercise these rights, contact us at privacy@eufsi.com.

6. Data Retention

We retain personal data for as long as your account is active or as needed to provide services. Upon account deletion, personal data is erased within 30 days, subject to legal retention requirements.

7. Sub-processors

We engage the following sub-processors to deliver the platform. Each one operates under a GDPR Art. 28 Data Processing Agreement and an appropriate transfer mechanism (EU adequacy, Standard Contractual Clauses, or both). The canonical list is maintained in our internal sub-processor register and synchronised here quarterly.

  • DigitalOcean LLC — production VPS + Spaces object storage (EU, Frankfurt fra1).
  • Resend (RT Labs Inc) — transactional email delivery (US/EU edge).
  • Sentry (Functional Software, Inc.) — error monitoring with PII scrubbing (EU project).
  • OpenAI, LLC — AI document extraction, opt-in only per controller consent (US, with EU Data Residency add-on).

The full list with DPA URLs and transfer mechanisms is available on request to privacy@eufsi.com.