Privacy policy
Last updated 2026-10-04
Who we are
fiorgo.com and the Fiorgo client workspace are operated by Fiorgo OÜ, a private limited company registered in Estonia (registry code 12267139, Viru pst 25-56, 40233 Sillamäe, Estonia; info@fiorgo.com). Fiorgo OÜ is the controller of the data described here. This policy does not cover product passports that clients publish through the platform.
Analytics cookies
With your consent (Art. 6(1)(a) GDPR) we use Google Analytics (GA4) to understand aggregate visitor behaviour on our public pages: page views, clicks on the "Apply" button and the steps of the application form, but never what you type into it. The analytics script only loads after you accept the cookie banner; if you reject or ignore it, no analytics cookie is set. You can withdraw consent at any time with "Cookie settings" at the bottom of every public page; this deletes the analytics cookies on our site. Google retains event data for 2 months and user-level data for 14 months, after which it is deleted automatically.
Language preference
When you choose a language in the language menu or with the language links at the bottom of a public page, we store that choice for up to one year in a cookie named fiorgo_locale, so that fiorgo.com opens in the same language on your next visit. It contains only the language code and is not used for analytics or advertising. Because it is strictly necessary to provide the language setting you asked for, it does not require your consent. Without this cookie, fiorgo.com opens in the language your browser prefers if we offer it, and otherwise in English. You can delete the cookie at any time in your browser settings.
Pilot application
When you submit the application form we process the company and contact details you provide to reply to your application and, at your request, to prepare a possible pilot (Art. 6(1)(b) GDPR, steps prior to entering into a contract). Company, name, work email and product category are needed to reply; the other fields are optional. We send you a confirmation email. This data is never added to a product passport. It is kept for up to 365 days and can be deleted earlier on request. Together with the application we receive the first page you opened on our site and where you came from (the referring website's domain and any campaign tags in the link, such as utm_source). This is held only in the page's memory, not in cookies or storage on your device, and is used to see which channels bring applications; it is kept with the application.
Protection against automated submissions
To keep the form free of spam and abuse, each attempt to submit it is logged with the IP address, browser identifier (user agent), the entered work email and form content, including unsuccessful attempts. The basis is our legitimate interest in protecting the service (Art. 6(1)(f) GDPR). The log is only visible to Fiorgo staff and is kept without a fixed expiry; you can ask us by email to delete your entries.
Email updates
Next to the DPP data map template you can ask us to email you when we update the template or when EU rules on the digital product passport change. For these emails only, we process your email address, language, the page where you signed up and the times of sign-up and confirmation, on the basis of your consent (Art. 6(1)(a) GDPR). We first send a confirmation link; until you open it you receive nothing else, and an unconfirmed address is deleted after 7 days. Every email contains an unsubscribe link: unsubscribing deletes your address at once. You can also withdraw consent by writing to info@fiorgo.com. The emails are sent through Resend.
Client workspace accounts
If your organisation gives you access to the Fiorgo client workspace, we process your email, name, role, a hash of your password (never the password itself), your sign-in sessions (valid for up to 30 days) and the time of your last sign-in, to provide access to the workspace and keep it secure (Art. 6(1)(b) and (f) GDPR). While you are signed in, the session is kept in a strictly necessary cookie (dpp_refresh) that page scripts cannot read and that is sent only to our sign-in service, and your browser notes that you are signed in; both are removed when you sign out and need no consent. Account data is kept while your organisation uses the workspace; ask us to delete it when access is no longer needed.
Who receives your data
We do not use advertising or marketing cookies and we do not sell your data. We share it only with service providers that process it on our behalf: DigitalOcean (hosting in Frankfurt, Germany), Resend (sending application emails), Zoho (our email inbox) and Google Analytics (the analytics above, only with your consent). Application and account data is stored on our server in Frankfurt (EU); Resend, Zoho and Google may process data outside the EU, including in the United States. Such transfers rely on the safeguards in these providers' data processing terms, such as the European Commission's standard contractual clauses; email us for details.
Your rights
You can ask us for access to your data, its correction or deletion, restriction of processing and a copy in a portable format. You can object at any time to processing based on our legitimate interest, and withdraw consent at any time without affecting processing before the withdrawal. We do not make automated decisions or profile you. Write to info@fiorgo.com. You also have the right to lodge a complaint with a supervisory authority, in Estonia the Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee), or the authority in your country.