Privacy Policy
“Norruva.org gives you the knowledge. Norruva.com gives you the tools.”
1. Who we are
Norruva is a pilot-stage Digital Product Passport platform. We help brands prepare for the EU 2027 DPP mandates. The brand is operated by Norruva (legal entity TBD pending incorporation; registered office to be confirmed). The data controller for the purposes of GDPR is Norruva. You can reach us at privacy@norruva.com.
2. What we collect
Waitlist signups
When you join the pilot waitlist, we collect: first name, email, company name, your intent (the reason you’re applying), product category, and your timing (when you’re looking to roll out a DPP). This is held in our hosted application database.
Account data
If you sign up for the platform: full name, display name, email, company name, password (hashed), and last login timestamp. Authentication is handled by a managed identity provider on our behalf. You can also sign in with a third-party account instead of a password. If you choose that route, the provider you select shares your email address, name, and profile picture with us.
Support chat
Our virtual assistant Sena is powered by a third-party AI service. Messages you send to Sena are passed to that provider so it can generate a reply, and are subject to its own terms. We do not store these messages on our servers.
Cookies and similar technologies
See section 5 below.
IP address (hashed)
We hash your IP address (SHA-256, truncated) when you submit the waitlist form, only to prevent abuse via rate limiting. The hash cannot be reversed to your IP.
3. Why we use it
Our legal bases under GDPR Article 6:
- Performance of a contract — to deliver the platform and pilot program (Art. 6(1)(b))
- Consent — for analytics cookies and marketing communications (Art. 6(1)(a))
- Legitimate interest — to prevent abuse, secure our service, and improve the product (Art. 6(1)(f))
- Legal obligation — where we must respond to lawful requests (Art. 6(1)(c))
4. Who we share it with (sub-processors)
We rely on a small set of vetted service providers to run the platform. Each is bound by a written data processing agreement and receives only the data it needs:
- Cloud hosting and content delivery. Serves this site and the platform.
- Database and authentication. Stores your waitlist and account records, and keeps you signed in.
- Transactional email. Sends the emails you ask for, such as pilot confirmations.
- Product analytics. Measures page views, clicks, and scroll depth on our public pages, and only runs with your consent.
- AI services. Generates replies in our support assistant.
We list our providers by category. For the current named list, email privacy@norruva.com. Customers and pilot participants receive it with their data processing agreement.
We do not sell your data. We do not share it with advertising networks.
5. Cookies
| Name | Purpose | Lifetime | Category |
|---|---|---|---|
norruva_consent | Records your cookie choices so we can honour them | 180 days | Strictly necessary |
norruva_access | Pilot access gate | 7 days | Strictly necessary |
sidebar_state | Remembers if the dashboard sidebar is open or collapsed | 7 days | Functional |
| Authentication session cookies | Keeps you signed in | Session, rotated periodically | Strictly necessary |
| Analytics cookies | Measures page views, clicks, and scroll depth. See our cookie policy. | Up to 1 year | Analytics (set only with your consent) |
6. International transfers
Norruva is a European company and this service is operated from the EU. Where a provider processes personal data outside the European Economic Area, we rely on the European Commission’s Standard Contractual Clauses or an applicable adequacy decision.
7. How long we keep it
- Waitlist data: until the pilot ends or you ask us to delete it
- Account data: for the life of your account, plus 12 months for legal record-keeping
- Hashed IPs: 30 days for rate-limiting, then deleted
- Analytics data: up to 13 months
8. Your rights under GDPR
- Access — get a copy of your data
- Rectification — correct inaccurate data
- Erasure — request deletion
- Restriction — limit how we process your data
- Portability — get your data in a machine-readable format
- Objection — object to processing based on legitimate interest
- Withdraw consent — for anything you previously consented to
To exercise any of these, email privacy@norruva.com. We respond within 30 days. You also have the right to complain to your local supervisory authority — for users in Portugal, that’s CNPD.
9. Children
Our service is not directed to anyone under 16. We don’t knowingly collect data from children. If you believe we have, contact us and we’ll delete it.
10. Changes to this policy
If we update this policy, we’ll change the “Last updated” date below and, for material changes, notify you by email.
11. Contact us
Email: privacy@norruva.com
General contact: hello@norruva.com
Last updated: August 18, 2026