Digital Projects EU OÜ (“we”, “us”, “our”) respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store, share, and protect personal data when you:

• visit VerifiedItem.com (the “Website”);
• create or use an account on our traceability platform (the “Platform”);
• scan a QR code or access a digital product or traceability record;
• provide product, supplier, batch, certification, provenance, or supply-chain information;
• communicate with us; or
• otherwise use our services.

This Privacy Policy also explains your rights under applicable data protection legislation, including the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018, where applicable.

For the purposes of applicable data protection law, the data controller is:

Digital Projects EU OÜ
Tornimäe tn 5, 10145 Tallinn, Harju maakond, Estonia

In some circumstances, particularly where we process personal data on behalf of a business customer using the Platform, that customer may be the data controller and we may act as its data processor.

Where we act solely as a processor, the relevant customer is responsible for determining how and why the personal data is processed.

Depending on how you interact with the Website or Platform, we may collect the following categories of personal data.

Account and Identity Information. This may include:

• name;
• username or account identifier;
• job title;
• employer or organisation;
• business contact details;
• account permissions and roles; and
• authentication and login information.

Contact Information. This may include:

• email address;
• telephone number;
• business address; and
• other information provided when you contact us.

Traceability and Supply-Chain Information. Users may submit information concerning products, materials, batches, suppliers, manufacturers, distributors, logistics providers, certifications, production processes, or other supply-chain activities.

Most traceability information may relate to businesses or products rather than identifiable individuals. However, where such records contain names, contact information, signatures, identification details, or other information relating to an identifiable person, that information may constitute personal data.

QR Code and Product Record Interactions. Where you scan a QR code or access a traceability or digital product record, we may collect information such as:

• date and time of access;
• the QR code, product, or record accessed;
• IP address;
• approximate location derived from an IP address, where applicable;
• browser and device information; and
• information about how you interact with the relevant page.

We will not collect precise device location through a QR-code interaction unless this functionality is specifically provided, you are informed about it, and any permission required by law is obtained.

Technical and Usage Information. We may automatically collect:

• IP address;
• browser type and version;
• device type;
• operating system;
• login activity;
• pages or features accessed;
• timestamps;
• error and diagnostic information;
• security logs; and
• other information about use of the Website or Platform.

Communications. If you contact us, we may collect your name, contact information, the content of your communication, and any related correspondence.

Payment Information. Where paid services are provided, we may collect billing information and transaction details.

Payment card information may be processed directly by a third-party payment provider. Where this is the case, we do not normally store complete payment card details.

We may collect personal data:

• directly from you;
• from your employer or organisation;
• from another Platform user;
• from suppliers, manufacturers, distributors, logistics providers, or other supply-chain participants;
• automatically when you use the Website or Platform;
• when you scan or interact with a QR code or digital product record;
• through cookies and similar technologies;
• through systems integrated with the Platform; and
• from publicly available or lawfully accessible sources.

Where another organisation provides your personal data to us, that organisation is responsible for ensuring it has an appropriate lawful basis for doing so.

We may use personal data to:

• create and administer user accounts;
• authenticate users and manage permissions;
• provide and operate the Platform;
• create, maintain, and display traceability records;
• record batch information on a public blockchain (see section 9);
• associate authorised users with organisations, products, batches, or supply-chain records;
• process and display information submitted by customers and suppliers;
• provide QR-code and digital product record functionality;
• communicate with users and respond to enquiries;
• provide technical and customer support;
• monitor performance and improve the Website and Platform;
• analyse how our services are used;
• detect, investigate, and prevent fraud, misuse, and security incidents;
• maintain audit and security records;
• administer subscriptions, billing, and payments;
• comply with legal, regulatory, and contractual obligations;
• establish, exercise, or defend legal claims; and
• send marketing communications where permitted by law.

We will not use personal data for purposes that are incompatible with the purposes for which it was collected unless permitted or required by law.

Under UK data protection law, we must have a lawful basis for processing personal data. Depending on the circumstances, we may rely on:

Contract – where processing is necessary to provide services you have requested or to perform a contract with you.

Legitimate interests – where processing is necessary for our legitimate business interests or those of a third party, provided those interests are not overridden by your rights and interests. This may include operating and improving the Platform, maintaining security, preventing fraud, supporting customers, and administering business relationships.

Legal obligation – where processing is necessary to comply with a legal or regulatory requirement.

Consent – where you have given us consent to carry out specific processing. Where processing is based on consent, you may withdraw that consent at any time.

Where required, we will provide further information about the specific lawful basis applying to particular processing activities.

We only use cookies that are strictly necessary to make the Website and Platform work, such as keeping you signed in, remembering you if you ask us to, and protecting our forms from misuse.

We do not use analytics, advertising, or tracking cookies, and no third party sets cookies through our Website. Because strictly necessary cookies do not require consent, we do not ask for it before setting them.

We use Cloudflare Web Analytics to count visits and measure page performance. It does not use cookies or similar storage on your device, and does not track you across websites.

If we ever introduce cookies that are not strictly necessary, we will ask for your consent before setting them and update this policy first.

Each cookie we use, what it does, and how long it lasts is listed in section 21.

We may share personal data with:

• companies within our corporate group, where applicable;
• hosting and cloud infrastructure providers;
• IT, security, and technical support providers;
• website service providers;
• communications providers;
• payment processors;
• professional advisers, including lawyers, accountants, insurers, and auditors;
• customers, suppliers, manufacturers, logistics providers, certification bodies, or other supply-chain participants where required to provide traceability functionality;
• regulators, law-enforcement agencies, courts, or government authorities where required by law; and
• prospective buyers, investors, or advisers in connection with a merger, acquisition, financing, restructuring, or sale of all or part of our business.

The service providers we currently use include:

• Amazon Web Services, which hosts the Website and Platform and stores the data and files held in them;
• Cloudflare Turnstile, which checks that the registration and contact forms are being completed by a person rather than an automated program;
• Cloudflare Web Analytics, which counts visits to the Website, Platform and public trace pages, and measures how quickly pages load, so we can see how they are used and improve them. It does not use cookies or identify individual visitors; and
• CARTO and OpenStreetMap, which supply the map images shown on location maps.

When your browser loads content from these providers, they receive your IP address and basic browser information, as they would for any website you visit.

We require service providers processing personal data on our behalf to protect that information and process it only in accordance with our instructions and applicable law.

We do not sell personal data.

Certain traceability information may be intentionally made publicly accessible, for example through a QR code attached to a product.

Where a traceability record is public, users responsible for submitting information must ensure that personal or confidential information is not included unless there is a lawful and appropriate reason for publishing it.

Public records may be accessible to anyone who has the relevant link, identifier, or QR code and may potentially be indexed, copied, or shared by third parties depending on how the service is configured.

Blockchain records. When a batch is created or updated on the Platform, we record a summary of it on the Electroneum blockchain, a public blockchain network. This gives the batch a permanent, independently checkable history. Each record contains:

• the batch ID;
• coded reference numbers for the product, the brand, and the location the batch was recorded at (not their names or addresses);
• the production step, such as Harvested, Bottled, or Packaged;
• the IDs of any batches it was made from; and
• the date and time it was recorded.

Blockchain records do not contain your name, email address, telephone number, or any address. We submit each record ourselves; it is not linked to any wallet or account of yours.

Anyone can view blockchain records, for example through a public blockchain explorer, and the public trace page for a batch links to them.

Blockchain records are permanent. Once recorded, they cannot be changed or deleted by us or anyone else. A correction is recorded as a new update; the original record remains visible.

Some of our service providers or business partners may process personal data outside the United Kingdom.

Where personal data is transferred internationally, we will take appropriate measures to ensure the transfer complies with applicable data protection law. Depending on the destination and circumstances, these measures may include:

• transferring data to a country recognised as providing an adequate level of protection;
• using approved contractual safeguards, such as the UK International Data Transfer Agreement or an applicable UK Addendum; or
• relying on another legally permitted transfer mechanism.

Blockchain records (see section 9) are copied to computers that run the Electroneum network, which may be located in any country.

You may contact us for further information about the safeguards used for international transfers.

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including to satisfy legal, accounting, regulatory, security, and contractual requirements.

Retention periods may vary depending on the type of information and our relationship with you. In determining appropriate retention periods, we may consider:

• the amount, nature, and sensitivity of the data;
• the purpose for which it is processed;
• legal and regulatory requirements;
• contractual obligations;
• security and fraud-prevention requirements; and
• whether the information forms part of a traceability, audit, or compliance record that needs to be retained.

When personal data is no longer required, we will delete or anonymise it in accordance with our retention procedures, unless continued retention is required or permitted by law.

Blockchain records (see section 9) are kept permanently and cannot be deleted.

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. Measures may include, where appropriate:

• access controls and user permissions;
• authentication controls;
• encryption;
• logging and monitoring;
• backups;
• vulnerability management; and
• organisational security procedures.

Although we take reasonable steps to protect personal data, no internet-based service can guarantee absolute security.

Users are responsible for keeping their account credentials secure and should notify us promptly if they believe their account or credentials have been compromised.

Depending on the circumstances and applicable law, you may have the right to:

• access personal data we hold about you;
• rectify inaccurate or incomplete personal data;
• erase your personal data in certain circumstances;
• restrict how we process your personal data;
• object to certain processing, including processing based on legitimate interests;
• data portability for certain information;
• withdraw consent where processing is based on consent; and
• object to direct marketing at any time.

These rights are not absolute and may be subject to legal exceptions.

Blockchain records (see section 9) cannot be changed or erased, so the rights to rectification and erasure cannot be applied to them. Where you exercise those rights, we will act on the information held in our own systems; the blockchain record will remain, but it contains only reference numbers rather than your personal details.

To exercise your rights, write to us at Digital Projects EU OÜ, Tornimäe tn 5, 10145 Tallinn, Harju maakond, Estonia.

We may need to verify your identity before responding to a request.

Where we process your personal data solely on behalf of one of our business customers, we may refer your request to the relevant customer or assist them in responding to it.

We do not currently use personal data to make solely automated decisions that produce legal effects or similarly significant effects on individuals, unless otherwise disclosed to you.

If this changes, we will provide the information required by applicable data protection law.

Where permitted by law, we may use your contact information to send information about our products, services, or relevant business updates.

You may opt out of marketing communications at any time by:

• using the unsubscribe link contained in an email; or
• contacting us at contact@verifieditem.com.

Opting out of marketing communications will not prevent us from sending necessary service, security, account, or contractual communications.

The Platform is primarily intended for businesses and is not designed for use by children.

We do not knowingly collect personal data directly from children through account registration.

If you believe a child has provided personal data to us inappropriately, please contact us so that we can investigate and take appropriate action.

The Website or Platform may contain links to third-party websites or integrate with external services.

We are not responsible for the privacy practices of third parties acting independently as data controllers.

We recommend reviewing the privacy policy of any third-party service before providing personal data to it.

We maintain procedures for identifying, investigating, and responding to personal data breaches.

Where a personal data breach creates a risk to individuals and notification is required by law, we will notify the relevant supervisory authority.

Where a breach is likely to result in a high risk to an individual's rights and freedoms, we will also notify affected individuals where required by law.

If you have concerns about how we process your personal data, please contact us first at contact@verifieditem.com.

You also have the right to make a complaint to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection. You can find information about the ICO and your data protection rights at www.ico.org.uk.

If you are located outside the UK, you may also have the right to complain to the relevant data protection authority in your jurisdiction.

We may update this Privacy Policy periodically to reflect changes to our services, technology, legal requirements, or data-processing activities.

When we make material changes, we will take reasonable steps to bring them to your attention.

The latest version will be published on the Website with the updated “Last Updated” date.

The cookies we use, and what we use them for, are listed in the table below. All of them are strictly necessary.

You can block cookies by activating the setting on your browser that allows you to refuse the setting of all or some cookies. However, because all of our cookies are strictly necessary, blocking them may stop you from signing in or using parts of the Website.

For questions, requests, or concerns regarding this Privacy Policy or our handling of personal data, please contact:

Digital Projects EU OÜ Tornimäe tn 5, 10145 Tallinn, Harju maakond, Estonia