DPP

Privacy Policy

Last updated: 15 October 2026

This policy explains what personal data we collect through our website, customer panel and product passport pages, why we use it, who we share it with and the rights you have under UK data protection law.

1. Who we are

INFODA ERP & SOFTWARE LTD (company number 16743432), trading as DPP ("DPP", "we", "us"), runs the DPP website, the customer panel and the public product passport pages. We are the controller of the personal data described in this policy. You can contact us at info@infoda.co.uk (subject "Privacy") or at Unit 27, 1st Floor, Stort Mill River Way, Harlow, Essex, CM20 2SN, United Kingdom.

Where our customers put personal data into the platform (for example the details of their own staff and dealers), the customer is the controller and we process it on their behalf. Their own privacy notice applies to that data.

2. What we collect

  • Account details: your name, work email address, company, role and password (stored only in encrypted, hashed form), and the version and date of the terms you accepted.
  • Billing details: your company's billing name, address and VAT number, plan and invoices. Payments are handled by Stripe; we never see or store your full card number.
  • Use of the panel: sign-ins, failed sign-in attempts and the changes you make (for example products added or QR codes generated), kept as an activity record for security and support.
  • Messages you send through the panel's chat or by email, and files you upload.
  • Technical data: your IP address, browser type and the pages requested, recorded in our server logs for security.
  • Passport visitors: when someone scans a QR code we count the visit for the brand. We do not identify visitors, use advertising or tracking cookies, or build profiles. Our server logs record IP addresses for security, as for any website visit.

3. Why we use it and our lawful bases

  • To provide the service you signed up for, manage your account and plan, and give support: performance of a contract.
  • To keep the platform secure, prevent misuse and fraud, and improve the service: our legitimate interests in running a safe and reliable business.
  • To send you service messages (for example about your trial, payments or changes to our terms): performance of a contract and our legitimate interests.
  • To keep accounting and tax records: legal obligation.
  • To send you news about our products, only where you have agreed or are an existing customer and have not opted out; you can unsubscribe at any time: consent or legitimate interests.

4. Who we share it with

  • Stripe, which processes payments as an independent controller under its own privacy policy.
  • Service providers that host our servers, deliver email and provide IT support, under contracts that require them to protect your data and use it only on our instructions.
  • Your organisation's administrators and, for messages, the people you write to.
  • Professional advisers, auditors and, where required by law, public authorities.
  • A buyer or successor if our business is reorganised or sold, under equivalent protection.

We do not sell personal data.

5. International transfers

Our service providers may process data outside the United Kingdom. Where that happens we make sure appropriate safeguards are in place, such as a UK adequacy decision or the UK International Data Transfer Agreement or Addendum. Contact us for details.

6. How long we keep it

  • Account details: while your account is active and up to 6 years afterwards where needed for legal claims.
  • Billing and invoice records: 6 years after the end of the financial year they relate to, as UK tax law requires.
  • Activity records: for the life of the account, so changes can be traced; failed sign-in records for up to 2 years.
  • Server logs: up to 90 days, unless needed to investigate a security incident.
  • Published passports: as described in our Terms of Service.

7. Security

We protect data with measures such as encrypted connections (HTTPS), hashed passwords, access limited to each organisation's own data, a permanent activity log, and restricted access to our servers. No system is completely secure; if a breach affects your personal data we will tell you and the Information Commissioner's Office where the law requires.

8. Your rights

You have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, to data portability and to withdraw consent where we rely on it. To use these rights, email us. If the data belongs to a customer's account, we may refer your request to that customer as the controller.

If you are unhappy with how we handle your data, please contact us first. You also have the right to complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).

9. Children

Our panel is for businesses and is not intended for anyone under 18. Passport pages do not collect personal data from visitors of any age.

10. Changes to this policy

We may update this policy. The date of the latest version is shown at the top of this page, and we will tell account holders about significant changes.