This policy explains how TwoRocks OÜ, trading as Certus DPP, collects and processes personal data when you use certusdpp.com.
TwoRocks OÜ
Registry code: 16130561
Tartu mnt 67/1-13b, Kesklinna linnaosa, Tallinn, Harju maakond, 10115, Estonia
Contact: info@certusdpp.com
When you submit the enquiry form on this site, we collect:
We also collect basic analytics data (see Section 4) once you consent to it via the cookie banner.
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Responding to your enquiry, assessing which DPP requirements apply to you | Art. 6(1)(b) — steps taken at your request prior to a possible contract |
| Basic site analytics (post-consent) | Art. 6(1)(a) — consent |
| Legal and regulatory record-keeping | Art. 6(1)(c) — legal obligation, where applicable |
We use Google Analytics 4 to understand how visitors use this site. Analytics cookies are only set after you click "Accept" on the cookie banner. Google Consent Mode v2 is implemented: by default, analytics and advertising storage are set to "denied" until you actively consent. If you click "Decline", no analytics cookies are set; Google may still receive anonymised, cookieless ping data used solely for aggregate traffic measurement.
Your choice is stored locally in your browser (localStorage, key certusdpp-consent) so the banner does not reappear on future visits. You can clear this by clearing your browser's site data.
We share data with the following processors, each acting under a data processing agreement or, where applicable, Standard Contractual Clauses for transfers outside the EEA:
Certus DPP is a facilitation service: we help you prepare for and connect with accredited Digital Product Passport platform providers. Where you choose to proceed with onboarding to a specific provider, we will share the data necessary for that onboarding (typically your company and contact details, and product data you provide directly) with that provider, and will identify the specific provider and the data involved before any such transfer takes place. This paragraph does not itself constitute confirmation of an existing partnership; it is included so that our data-handling scope is clear in advance of any partnership being finalised.
Enquiry form data is retained for as long as necessary to respond to your enquiry and, where a business relationship follows, for the duration of that relationship plus applicable statutory retention periods. Analytics data is retained according to Google Analytics' default retention settings.
Under GDPR, you have the right to access, rectify, erase, or restrict processing of your personal data, the right to data portability, and the right to object to processing. To exercise any of these rights, contact us at info@certusdpp.com.
You have the right to lodge a complaint with a supervisory authority. As our controller is established in Estonia, the relevant authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), www.aki.ee.
We may update this policy from time to time. The "Last updated" date at the top reflects the most recent revision.
This policy is drafted to reflect our actual data processing as of the date above. It does not constitute legal advice.