Effective: 1 October 2026 · The German version is the legally controlling version.
EPRORA Compliance UG (haftungsbeschränkt), Gildehauser Weg 114, 48529 Nordhorn, Deutschland. Email: compliance@eprora.com. Phone: +49 5921 819 480.
This privacy notice covers the public website, the 60-second check, checkout and account processes and the EPRORA Customer Office. Depending on use, we process business and contact data, account and authentication data, contract and billing data, EPR/LUCID information, product and packaging data, authorised marketplace connection data, documents, support communications and technical security/audit data.
Processing is carried out for pre-contractual steps and contract performance under Art. 6(1)(b) GDPR, compliance with legal obligations under Art. 6(1)(c), legitimate interests in secure, reliable and auditable platform operation under Art. 6(1)(f) and, where required, consent under Art. 6(1)(a).
When the website is accessed, IP address, time, requested resource, referrer, browser/device information and technical events may be processed for delivery, error analysis, abuse prevention, availability and IT security. Security-relevant logs are retained only as long as necessary for protection, analysis and evidence.
We process email address, organisation assignment, roles, login/session data, selected language, settings, security events and audit information to authenticate users, control permissions, provide the workspace and document changes.
Where the preview is performed locally in the browser, selected files are not permanently uploaded to EPRORA for the preview. Information entered in the productive check is processed to determine potential service requirements and show an appropriate offer or onboarding path.
Company, product, packaging, sales and registration data is processed to determine obligations, prepare mandate and registration workflows, produce packaging ledgers and reports, manage deadlines and archive evidence. If a customer appoints EPRORA as an authorised representative, the separate mandate defines the scope.
Amazon, Temu, Shopify, eBay, AliExpress, WooCommerce and other integrations are activated only after customer authorisation. OAuth tokens and technical credentials are protected and used only for the scopes needed by the selected integration. EPRORA is designed to minimise personal buyer data used for packaging compliance.
Payment status may be processed through Stripe; electronic signature workflows may use the configured signature provider; transactional emails and regulatory notifications are delivered through the configured communication provider. The applicable provider agreements are maintained in the internal vendor register.
Depending on enabled functions, recipients may include hosting and infrastructure providers, Cloudflare, payment and signature providers, communication providers, configured translation/AI service providers, connected marketplaces, authorities/registers and local EPR service partners. Access is limited to what is required for the respective purpose.
Where a provider processes data outside the EEA, EPRORA uses an applicable transfer mechanism such as an adequacy decision or standard contractual clauses and documents supplementary safeguards where required.
Technically necessary cookies or comparable storage may be used for authentication, session management, security, selected language, checkout and requested functions. Optional analytics or marketing technologies are activated only when configured and where any required consent has been obtained.
Data is retained for the business relationship and thereafter according to statutory commercial, tax, EPR, evidence and limitation periods. Data no longer required is deleted or anonymised unless retention obligations apply.
Where statutory conditions are met, data subjects may request access, rectification, erasure, restriction and portability, object to processing and withdraw consent with future effect. Complaints may be lodged with a competent data protection supervisory authority.
EPRORA may automatically classify data, identify potential obligations and recommend actions. These workflow recommendations do not by themselves constitute solely automated decisions producing legal or similarly significant effects within the meaning of Art. 22 GDPR.
Questions entered into the EPRORA Assistant are processed to provide product and compliance-navigation support. Known EPRORA topics are answered from controlled platform logic. If a server-side AI fallback is configured and a question cannot be answered unambiguously by that logic, the question, a limited summary of the current page/account status and a small number of recent conversation turns may be sent to the configured AI service provider. Passwords, API keys, private keys and recovery codes must not be entered into the Assistant.
EPRORA uses role-based access, TLS, protected secrets, audit logging, backups and technical and organisational safeguards. This notice is updated when providers, purposes or processing operations materially change.
Start with the products and packaging actually shipped. An Etsy shop, eBay business or small independent store can prepare the same core records without an enterprise IT project. Use the self-check to identify the relevant next step, not to assume that every service is required.
Manufacturers can connect product specifications, supplier evidence, batches, serial numbers and QR identifiers to a Digital Product Passport workflow. DPP scope and mandatory dates depend on the product category; voluntary preparation is not a claim that every product already needs a passport.
Explore the platformOne-time setup for a new German mandate: CHF 29.
Plus applicable VAT; system participation and selected add-ons are separate.
Separate free official LUCID registration, any required system participation and EPRORA service fees. Review the current price, included services, any setup fee, renewal and cancellation terms before subscribing. No purchase should be based on an assumed all-inclusive licence.
Check requirements →