Privacy Policy

Tracetil is the project name for a pre-launch textile Digital Product Passport research website published at tracetil.de. The site is operated by Illia Tatarchenko as a private individual—not as a registered business or legal entity.

The data controller responsible for personal data processing within the meaning of the GDPR is:

• Illia Tatarchenko (private individual)
• Email: info@tracetil.de

Illia Tatarchenko is committed to handling personal data collected through tracetil.de responsibly. When you visit the site, join the waitlist, book a research call, or otherwise get in touch, your personal data is processed for these main purposes:

• Improving the experience on tracetil.de by understanding visitor needs and interests.
• Responding to enquiries and scheduling research conversations.
• Developing and validating the textile DPP research concept with interested contacts.
• Carrying out pre-launch marketing and research activities related to the Tracetil project.

Personal data is handled with respect for privacy and security. Processing follows applicable data protection law, including the GDPR. Appropriate measures are taken to protect data against unauthorised access, disclosure, alteration, and destruction.

There is no designated Data Protection Officer (DPO). If you have questions or need further information about how personal data is managed, contact the data controller at info@tracetil.de.

Personal data is processed transparently and with your security in mind. This commitment extends to third-party providers that process data on the controller's behalf—for example when sending waitlist updates, hosting the website, or providing scheduling tools. All such processing is carried out in compliance with applicable data protection laws.

This Privacy Policy is designed to protect the personal data of website visitors, newsletter subscribers, waitlist contacts, and research participants who interact with tracetil.de. Whether you browse the site, join the waitlist, subscribe to updates, or take part in research and validation activities, your personal data is processed in accordance with high data protection and security standards. This Privacy Policy sets out our practices and your rights regarding personal data.

Our commitment to transparency and privacy extends to how we collect and use your personal data. We collect personal data when you interact with the website, join the waitlist, request information, subscribe to project updates, book a research call, or participate in research and validation activities related to the pre-launch textile Digital Product Passport (DPP) research initiative—or when you provide information to us directly.

We may process the following types of personal data:

• Email address and/or telephone number.
• First and last name.
• IP address.
• Browser information and language.
• Operating system and version.
• IP-based approximate location.
• Interaction logs (for example clicks and time spent on pages).

We only process information that is necessary for the pre-launch project, to comply with legal obligations, or to improve your experience on the website. Your privacy comes first, and we are committed to handling your personal data responsibly and in accordance with all applicable laws.

The data we collect serves several purposes related to the pre-launch research and validation project. Key purposes include:

• Content delivery.
• Communication efforts.
• Analytics and performance tracking.
• Research and development.
• Compliance with legal obligations.
• Project communication and audience engagement.
• Informational communications and project updates.

We process your personal data transparently, in line with your preferences and applicable data protection laws. Your data is used only for the purposes for which it was collected and in ways you have authorised.

We process personal data on the following legal bases under Art. 6 GDPR, where applicable:

• Art. 6(1)(a) GDPR — consent (for example waitlist, newsletter, or cookie preferences where consent is required).
• Art. 6(1)(b) GDPR — steps at your request prior to entering into a contract (for example responding to early-access or research enquiries).
• Art. 6(1)(f) GDPR — legitimate interests in operating, improving, and developing the pre-launch project and website (for example aggregated analytics, security, and communication about the research initiative), where those interests are not overridden by your rights.

Where we rely on legitimate interests, you may object under Art. 21 GDPR. Where we rely on consent, you may withdraw it at any time.

Personal data is processed using the third-party providers listed in this policy. The marketing website is hosted via Railway. Waitlist and newsletter data is processed by Kit (ConvertKit) in the United States. Analytics are processed via Umami Cloud in the United States. Scheduling via Cal.com may process data in the United States. Depending on provider infrastructure, data may also be processed in other countries where those providers operate.

Where personal data is transferred outside the EU/EEA, we rely on appropriate safeguards as required by applicable law—for example Standard Contractual Clauses or equivalent mechanisms offered by the provider.

Data hosting partners: We work with reputable hosting providers committed to state-of-the-art security measures. These partners are selected based on their compliance with strict data protection standards.

Encryption: We use robust encryption technologies to protect data in transit and at rest where applicable.

We are committed to protecting your personal data and ensuring it is treated with the utmost respect. This commitment extends to how we share and disclose your data.

Third-party service providers: We may share your data with third-party providers that perform tasks on our behalf in connection with the pre-launch project. These trusted parties may access personal data on a need-to-know basis and are contractually obliged to treat your data confidentially. They may not use your personal data for purposes other than supporting the Tracetil research project, and must maintain the confidentiality of your data.

• Railway (Railway Corp.) — purposes: website hosting, compliance with legal obligations. Data types: IP address, browser information and language, interaction logs. Privacy policy
• Kit / ConvertKit (Kit, Inc., United States) — purposes: communication, informational project updates, project communication and audience engagement. Data types: email address and/or telephone number, interaction logs. Privacy policy
• Cal.com (Cal.com, Inc., United States) — purposes: communication and scheduling, research and development. Data types: first and last name, email address and/or telephone number, interaction logs. Privacy policy
• Umami Cloud (Umami Software, Inc., United States) — purposes: analytics and performance tracking, research and development. Data types: IP address, browser information and language, operating system and version, IP-based approximate location, interaction logs. Privacy policy

When we share your data with third-party providers, we do so under data processing agreements that ensure your information is managed in accordance with the GDPR and other applicable data protection laws. These agreements require third parties to implement appropriate technical and organisational measures to safeguard your data.

We believe in transparency and your control over your personal data. You will be informed of any material changes to our sharing practices and, where applicable, given the opportunity to consent to such changes.

If you have questions or concerns about the sharing and disclosure of personal data, contact us at info@tracetil.de.

We recognise and respect your rights regarding your personal data in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws. Your rights include:

• Right of access (Art. 15 GDPR): You may request access to the personal data we hold about you and information about how we process it.
• Right to rectification (Art. 16 GDPR): You may request correction or completion of inaccurate or incomplete personal data.
• Right to erasure / right to be forgotten (Art. 17 GDPR): You may request deletion of your personal data when it is no longer necessary for the purposes for which it was collected, among other grounds.
• Right to restriction of processing (Art. 18 GDPR): You may request that we restrict processing of your personal data under certain conditions.
• Right to data portability (Art. 20 GDPR): You may receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller.
• Right to object (Art. 21 GDPR): You may object to processing of your personal data under certain conditions, including processing for direct marketing.
• Right to withdraw consent (Art. 7(3) GDPR): Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR): You may complain to a supervisory authority if you believe our processing violates applicable data protection laws.

To exercise any of these rights, contact us at info@tracetil.de. We will respond in accordance with applicable data protection laws and within the timelines prescribed by those laws. We may need to verify your identity in some cases to protect the security of your personal data.

We value your privacy and are committed to transparency about our use of cookies and similar technologies on tracetil.de. These technologies help ensure smooth operation of the website, improve your experience, and provide aggregated insights that help us improve the project.

Cookies are small files placed on your device that allow us to store your preferences and collect information about your use of the website. Tracking technologies such as web beacons and pixel tags help us understand how you interact with our website and which pages you visit.

• Essential cookies: Required for website functionality, such as security and locale preference. They do not require consent.
• Performance and analytics cookies: Collect aggregated information about how visitors use our website. These help us understand and improve the site. We use Umami for this purpose.
• Functional cookies: Enable enhanced functionality such as storing your preferences where strictly necessary.

We do not currently use advertising, retargeting, or social-media marketing pixels (for example Meta Pixel, LinkedIn Ads, or Google Ads remarketing).

If a cookie consent banner is shown, you can accept or reject non-essential categories, or customise your preferences. We may update our use of cookies and tracking technologies to improve the project or meet legal requirements. We will inform you of material changes and, where required, obtain your consent.

For more detail on cookies we use, their purposes, and how to manage settings, see our Cookie Policy.

If you have questions about our use of cookies and tracking technologies, contact us at info@tracetil.de.

We may transfer your personal data to locations outside your country of residence, including countries where data protection laws may differ from those in your jurisdiction. Such transfers are carried out with care and in compliance with applicable data protection regulations, including the GDPR, using appropriate safeguards such as Standard Contractual Clauses where required.

With your consent where required, we may use your personal data to send informational communications about the Tracetil research project—for example waitlist updates, newsletter content, research progress, and invitations to validation activities. We do not sell products or operate a commercial SaaS service at this pre-launch stage.

• Opt-in consent: We obtain your explicit consent before sending project communications where required by law.
• Unsubscribe option: Every message includes clear instructions on how to opt out. You may unsubscribe at any time and we will promptly honour your request.
• We may send project communications via email.
• You control what you receive. Manage preferences using the unsubscribe link in our emails.

We take proactive measures to secure your personal data. If a personal data breach occurs that poses a risk to your rights and freedoms, we have procedures to promptly identify, assess, and mitigate the impact. Our breach notification procedures comply with applicable data protection laws, including the GDPR.

• Detection and assessment: We use security measures and monitoring to detect potential breaches. After discovery, we assess the nature and scope of the breach, including the types of data affected and potential impact on individuals.
• Reporting obligations: Where required by law, we will notify the competent supervisory authority within the timelines required by applicable law (including, where applicable, without undue delay and, where feasible, not later than 72 hours under Art. 33 GDPR).
• Affected individuals: If a breach poses a significant risk to your rights and freedoms, we will notify you within the timelines required by applicable law with clear information about the breach, the types of data affected, and steps you can take to protect yourself.
• Notification channels: Email notification using contact details you have provided, where possible and appropriate; and/or a notice on our website or other channels accessible to affected individuals.
• In the event of a breach, we will provide support and guidance to affected individuals, including steps to mitigate potential risks.

If you have questions about a data breach or believe you may be affected, contact us immediately at info@tracetil.de.

We are committed to keeping you informed about how we handle your personal data and any changes to our privacy practices. We may update this Privacy Policy from time to time to reflect changes in legal requirements, industry standards, or project development activities. Updates will be communicated transparently and in compliance with applicable data protection laws.

Notification process: For material changes that may affect your rights or how we handle your personal data, we will notify you by common means such as email, a notice on the website, or other appropriate channels. We will also indicate the effective date of the updated policy at the top of this document.

Reviewing changes: We encourage you to review this Privacy Policy regularly. Continued use of the website after a change constitutes acceptance of the updated terms where permitted by law.

If you have questions or concerns about this Privacy Policy or its updates, contact us at info@tracetil.de. We are here to answer your questions and help you understand how your personal data is handled.