HomePrivacy Notice
Privacy Notice
How DPRQ processes personal data under the GDPR.
Last updated: 2026-09-03
1. Who we are
LUNELL PROFESSIONAL LIMITED ("DPRQ", "we", "us") operates the DPRQ platform at https://dprqtech.com.
For most account, product, and billing processing described below, LUNELL PROFESSIONAL LIMITED acts as data controller.
Contact: hello@dprqtech.com. Registered office: 2B Doughiska Road, Galway, H91 WY24, Ireland. CRO / Company Registration Number: 805373. Country of registration: Ireland.
DPRQ is primarily offered to business customers. Where your organisation uses DPRQ to manage product and passport information, your organisation may act as controller for much of that product data and DPRQ may act as processor — see our Data Processing Agreement.
2. Scope
This Privacy Notice describes personal data processed when you visit dprqtech.com, create an account, use the DPRQ dashboard, purchase a plan, upload documents, publish Digital Product Passports, or contact us.
It does not describe processing performed independently by Stripe or other providers under their own privacy notices when you interact directly with them outside DPRQ.
3. Categories of personal data
- Account information: name, email address, authentication identifiers, email verification status.
- Organisation/company profile: company name, legal name, address, VAT number, country, website, contact email.
- Product and Digital Product Passport information entered by you or your organisation, including manufacturer/economic operator details and product identifiers.
- Uploaded documents and evidence, which may contain personal data if you or your suppliers include it in uploaded files.
- Billing information: plan selection, Stripe customer/subscription identifiers, payment status, receipt metadata. Card details are processed by Stripe and are not stored by DPRQ.
- Support and contact communications you send to us.
- Technical and security data: IP address, browser/device information, request logs, timestamps, and security events generated when you use the service.
- Cookie and locale preference data as described in our Cookie Policy.
4. Purposes and lawful bases
Account and service delivery
Purpose: create and manage accounts, authenticate users, provide the DPRQ platform, publish passports, enforce plan limits, and maintain tenant isolation.
Lawful basis: performance of a contract (GDPR Article 6(1)(b)) and, where necessary, legitimate interests in operating a secure SaaS platform (Article 6(1)(f)).
Billing and payments
Purpose: process Single DPP purchases, subscriptions, receipts, storage add-ons, and billing support.
Lawful basis: performance of a contract (Article 6(1)(b)) and legal obligation for tax/accounting records where applicable (Article 6(1)(c)).
Security, fraud prevention, and service integrity
Purpose: protect accounts, investigate abuse, maintain logs, and secure the platform.
Lawful basis: legitimate interests (Article 6(1)(f)) and, where required, legal obligation.
Support and communications
Purpose: respond to enquiries, privacy requests, and service communications.
Lawful basis: performance of a contract, legitimate interests, and/or consent where applicable.
Locale preference
Purpose: remember your selected interface language.
Lawful basis: consent for non-essential storage where required by ePrivacy rules (Article 6(1)(a) GDPR for associated personal data).
5. Recipients and subprocessors
We use infrastructure and service providers that process personal data on our instructions or as independent controllers where applicable.
Our current subprocessors are listed at /subprocessors and include:
Supabase, Inc. — Authentication, PostgreSQL database, object storage, row-level security hosting.
Vercel, Inc. — Application hosting and content delivery.
Stripe, Inc. — Payment processing and subscription billing.
Resend, Inc. — Transactional email delivery.
We may disclose data where required by law, court order, or to protect rights, safety, and security.
6. International transfers
Some subprocessors may process data outside the European Economic Area. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms provided by those suppliers.
We do not publish specific hosting regions unless verified with the provider and documented in the Subprocessor List.
7. Retention
We retain personal data only as long as necessary for the purposes above. See our Data Retention page for category-specific retention criteria.
Billing records and receipts may be retained longer where required for tax, accounting, or legal claims.
Backups may retain deleted data for a limited provider retention window before overwrite.
8. Your GDPR rights
Submit requests via /data-rights or email hello@dprqtech.com. We may need to verify your identity and, for organisation accounts, confirm authority to act for the organisation.
- Right of access
- Right to rectification
- Right to erasure
- Right to restriction of processing
- Right to object
- Right to data portability
- Right to withdraw consent at any time where processing is based on consent
- Right to lodge a complaint with your supervisory authority
9. Automated decision-making
DPRQ performs automated validation and readiness scoring on product data you submit. These outputs are software-assisted checks to help you prepare passport data. They do not produce legal effects about you as an individual and do not replace human regulatory responsibility for product information.
10. Children
DPRQ is a business service and is not directed at children. We do not knowingly collect personal data from children.
11. Changes
We may update this Privacy Notice from time to time. The latest version will be published on this page with an updated date.