Privacy Policy
v1.1 – effective 1 November 2026 · fingerprint b7993b98c838
Download PDFPrivacy Policy
Website and Platform — GDPR Notice
iTraceiT srl | Rue de Rodeuhaie 4, 1348 Louvain-la-Neuve, Belgium | BE 0770.300.358
INTRODUCTION
This Privacy Policy explains how iTraceiT srl ("iTraceiT", "we", "us", "our") collects, uses, stores, and protects personal data in connection with the itraceit.io website and the iTraceiT Platform. It applies to visitors to our website, prospective customers, and registered users of the Platform.
We are committed to protecting your personal data in compliance with Regulation (EU) 2016/679 (GDPR) and applicable Belgian data protection legislation. This policy is written in plain language. If you have any questions, contact our Data Protection Officer at the address below.
1. DATA CONTROLLER AND DPO
The data controller is:
Company: iTraceiT srl
Address: Rue de Rodeuhaie 4, 1348 Louvain-la-Neuve, Belgium
Registration: 0770.300.358
VAT: BE 0770.300.358
Website: itraceit.io
Data Protection Officer: Guy De Smet —
You may contact our DPO at any time on matters relating to the processing of your personal data or to exercise your rights under this policy.
2. PERSONAL DATA WE COLLECT
2.1 Data you provide to us
When you register for an account, contact us, or use the Platform, we may collect: your name, professional email address, job title, company name, telephone number, and the content of communications you send us (including support requests).
2.2 Data collected automatically
When you visit our website or use the Platform, we automatically collect: IP address, browser type and version, operating system, pages visited and time spent, session identifiers, referring URL, and access timestamps. This data is used to operate and secure the Platform and to understand how our services are used.
When you accept contract documents online on behalf of a Customer (for example when subscribing through itraceit.lk), we record evidence of that acceptance: your name, professional email address, role and company, the date and time of each step (server timestamp), your IP address and user agent, and the versions and fingerprints (hashes) of the documents you opened, read, accepted or acknowledged. See Section 3 for the legal basis and retention period.
2.3 Customer Data (Platform users)
Registered users of the Platform submit data as part of their traceability and digital product passport workflows. This data is processed by iTraceiT as a Processor on behalf of the Customer (as Controller) and is governed by the DPA, not by this Privacy Policy. Individuals whose data is submitted to the Platform by a Customer should contact that Customer for information about how their data is handled.
2.4 Payment data
Payment processing is handled by Stripe. iTraceiT does not store payment card numbers or full payment credentials. We retain transaction identifiers and invoicing data for legal and accounting purposes.
3. PURPOSES AND LEGAL BASIS FOR PROCESSING
4. COOKIES AND TRACKING TECHNOLOGIES
4.1 Essential cookies
Essential cookies are required for the Platform to function. They manage user sessions and authentication. These cannot be disabled. They do not track you across other websites and do not require your consent.
4.2 Analytics cookies
We may use analytics tools to understand how our website and Platform are used (page views, user flows, feature adoption). Analytics data is aggregated and used solely for internal product improvement. We will request your consent for non-essential analytics cookies through our cookie consent banner.
4.3 Advertising and remarketing cookies
iTraceiT may use advertising and remarketing technologies — including Meta (Facebook and Instagram) Pixel and similar tools operated by third-party advertising platforms — to display iTraceiT advertising to audiences on those platforms.
These advertising technologies are not currently active on itraceit.io. When they are activated, this Privacy Policy will be updated, our cookie consent banner will reflect the change, and we will request your prior consent where required by applicable law. You will be able to withdraw consent at any time through our cookie settings.
4.4 Managing cookies
You can manage or withdraw consent for non-essential cookies at any time through the cookie settings accessible in the footer of our website. You may also control cookies through your browser settings; note that disabling essential cookies may affect the functioning of the Platform.
5. SHARING PERSONAL DATA
We do not sell personal data. We share personal data only in the following circumstances:
Sub-processors: we engage carefully selected technology providers (hosting, payment processing, support tooling) and, outside Europe, local partners providing support, to help us deliver the Services. All sub-processors are contractually bound to process data only on our instructions and in accordance with the GDPR. The current list of sub-processors is published at itraceit.io/sub-processors.
Legal requirements: we may disclose personal data where required to comply with applicable law, regulation, judicial process, or a valid request from a competent authority.
Business transfers: in the event of a merger, acquisition, or sale of substantially all of iTraceiT's assets, personal data may be transferred to the acquiring entity, subject to equivalent data protection commitments.
With your consent: we may share personal data with third parties where you have given explicit, informed, and freely given consent.
6. INTERNATIONAL TRANSFERS
We host personal data within the European Economic Area (EEA), in the Amazon Web Services Frankfurt region (Germany), with copies of monthly backups in the AWS Ireland region. Members of our team in Sri Lanka and, where applicable, our local partners providing support outside Europe may access personal data remotely, only with our authorisation and where necessary for support, maintenance or development. As Sri Lanka is not covered by an adequacy decision of the European Commission, these transfers are governed by the Standard Contractual Clauses adopted by the European Commission (Decision (EU) 2021/914), together with additional security measures. Where any other sub-processor is located outside the EEA, we ensure that appropriate safeguards are in place, such as an adequacy decision or Standard Contractual Clauses. You may request a copy of the applicable safeguards by contacting our DPO.
7. SECURITY
We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include encryption of data in transit and at rest, role-based access controls, audit logging, and regular security reviews. For full details, see our DPA (itraceit.io/dpa).
No transmission over the internet or electronic storage is fully secure. While we take every reasonable precaution, we cannot guarantee absolute security. In the event of a personal data breach, we will notify you and the competent supervisory authority in accordance with our legal obligations.
8. YOUR RIGHTS
As a data subject under the GDPR, you have the following rights regarding personal data we hold about you:
Right of access (Art. 15): you may request a copy of the personal data we hold about you.
Right to rectification (Art. 16): you may ask us to correct inaccurate personal data.
Right to erasure (Art. 17): you may ask us to delete personal data in certain circumstances.
Right to restriction (Art. 18): you may ask us to restrict processing in certain circumstances.
Right to data portability (Art. 20): where processing is based on consent or contract and carried out by automated means, you may ask for your data in a structured, machine-readable format.
Right to object (Art. 21): you may object to processing based on legitimate interests at any time on grounds relating to your particular situation. You may also object to direct marketing at any time, unconditionally.
Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, contact our DPO: Guy De Smet — . We will respond within thirty (30) days. You also have the right to lodge a complaint with the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit) at .
9. RETENTION
We retain personal data only for as long as necessary for the purposes described in this policy, or as required by applicable law. The retention periods set out in Section 3 apply. When personal data is no longer required, we securely delete or anonymise it.
10. CHANGES TO THIS POLICY
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the features of our Services. The current version is always available at itraceit.io/privacy, together with the date of last update. Where changes are material, we will notify registered users by email or through the Platform at least thirty (30) days before the change takes effect.
11. CONTACT
For any questions about this Privacy Policy or about how we process your personal data:
Email:
DPO: Guy De Smet
Website: itraceit.io
Address: Rue de Rodeuhaie 4, 1348 Louvain-la-Neuve, Belgium
Version 1.1 — November 2026 (effective 1 November 2026) | iTraceiT srl | Rue de Rodeuhaie 4, 1348 Louvain-la-Neuve, Belgium | itraceit.io/privacy