OneTrueTag Privacy Policy

Version: [[VERSION]] · Effective date: [[EFFECTIVE_DATE]] · Last updated: 2026-10-22 (draft)

This policy explains how personal data is handled on OneTrueTag. It has two parts:

• Part A covers data for which OneTrueTag is the controller: people who use the brand panel for a business ("sellers" and their team members), visitors to our website, people who contact our support, and the login of an optional customer account.
• Part B covers people who scan a product's code ("end customers"). For that data the brand that made or sells the product is the controller and OneTrueTag processes it on the brand's behalf. A short version of Part B is the end-customer privacy notice.

Part C (rights, transfers, children, changes, contact) applies to both.

Cookies are described in the cookie policy. The providers we use are listed in sub-processors.

1. Who we are

1.1 The controller for Part A is [[ENTITY_NAME]], [[ADDRESS]], registration number [[REGISTRATION_NUMBER]] ("OneTrueTag", "we").

1.2 Contact for privacy matters: [[PRIVACYEMAIL]]. Data protection officer or person responsible: [[DPOCONTACT]].

1.3 Representatives, where required by law:

• EU representative (Art. 27 GDPR): [[EU_REPRESENTATIVE]]
• UK representative (Art. 27 UK GDPR): [[UK_REPRESENTATIVE]]
• Turkey, data controller representative (KVKK) and VERBIS registration: [[TRDATACONTROLLER_REPRESENTATIVE]]

Part A: OneTrueTag as controller

2. Data about sellers and team members

2.1 What we collect

2.2 Why we use it and on what basis

In the UAE, Saudi Arabia, Qatar, Bahrain, Kuwait and Oman we rely on the equivalent grounds in each law: performance of a contract with you, compliance with a legal obligation, our legitimate interests where the law recognises them, and your consent where no other ground applies.

2.3 Who can see it. Your name and photo are visible to the members of the teams you belong to. Your phone number is shown only to you. Team admins see your role and seat status. Our staff access account data only to provide support, secure the Service or meet a legal obligation. If your Account was created through another Account's referral link, that Account sees your first brand's name (or the initials of your team's name until you add a brand), when you signed up, whether you are paying and the commission it earned, but never your email address, your name or your Plan.

3. Website visitors

3.1 When you visit our website or panels, our servers process your IP address, browser type and the pages requested to deliver the pages, keep them secure and apply rate limits (legitimate interests; KVKK Art. 5(2)(f)). We do not use advertising or cross-site tracking cookies on the website or in the panels. The cookies each one sets are listed in the cookie policy.

3.2 The website's contact form and partner form ask for your name, email address and message, and the partner form also for your company, country and type of partnership. We use them to answer you (steps before a contract or legitimate interests; KVKK Art. 5(2)(c) and (f)). A message is kept in the website's administration area and sent to our team's inbox. To stop abuse, the website counts the messages sent from one network address in an hour; it keeps only a keyed hash of the address, never the address itself, and forgets it after that hour.

3.3 If you open a partner's referral link and say yes to marketing in the cookie banner, the website asks our servers to check its code, keeps the answer in the ott_ref cookie for 30 days and passes it on to the sign-up page; if you say no, nothing is kept. If you then create an Account in the same browser, it is recorded as that partner's referral (your consent to the cookie; legitimate interests in running the referral program; KVKK Art. 5(2)(f)). Openings of a link are counted per code and day, without your network address.

4. Support contacts

4.1 If you write to us (help center, email), we use your name, contact details and the content of your request to answer it and keep a record of it (contract or legitimate interests).

5. Customer accounts (login only)

5.1 People who scan a code may create an optional customer account on the OneTrueTag address to see their requests across brands under My requests. For the account itself (name, email, password hash or Google sign-in, optional profile photo, session data) we are the controller, on the basis of the contract with you (Art. 6(1)(b) GDPR; KVKK Art. 5(2)(c)).

5.2 The requests in the account (tickets, repair requests, warranty registrations) belong to the brand that received them; Part B applies to them.

5.3 You can delete the customer account from its profile page. Your requests are then unlinked from you; each brand keeps the requests it is handling, as its own record (Part B).

6. Retention (Part A)

7. Recipients (Part A)

7.1 Our hosting, storage and email providers, as listed in sub-processors.

7.2 Paddle, which sells paid plans as merchant of record and is an independent controller for the payment and tax data it collects at checkout (see Paddle's own privacy notice).

7.3 Google, if you choose to sign in with Google (Google's own terms and privacy notice apply).

7.4 Authorities, courts or advisers where the law requires it or to defend legal claims; a successor in a merger or sale of our business, under the same protections.

7.5 When we pay a referral commission, the payout details go to our bank and the receiving bank; for a payment in USDT, the wallet address and the amount are recorded on the public TRON blockchain, where anyone can see them.

7.6 We do not sell personal data.

Part B: People who scan a code (end customers)

8. Who is responsible

8.1 When you scan a product's code, open its pages, fill in a form, write to a brand's chat bot or receive its messages, the brand is the controller of your data. OneTrueTag runs the pages, bots and storage for the brand as its processor, under a data processing agreement, and uses your data only on the brand's instructions.

8.2 The brand's name is shown on every page. Where the brand has given one, its own privacy notice is linked at the bottom of the page and on its forms. Ask the brand first about how it uses your data.

8.3 Each brand's data is kept separate. If you scan products of two brands, each brand has its own record and sees only what happened with its own products.

9. What is collected

9.1 When you scan a code on the web

• the time, the code and product, and the result of the check;
• your country and city, looked up from your network address in a location database that runs on our own servers (no data is sent to the database's maker);
• your device type and operating system (for example "mobile, iOS"), read from your browser's user agent;
• a random visitor id kept in a cookie (ott_visitor, up to two years), so that a second scan from the same browser is recognised as the same visitor. We store only a keyed hash of it, not the id itself.

Your network address and the full user agent are used during the request and are not stored in the scan history. There is no browser fingerprinting and no account is needed to scan.

9.2 Why: to tell you whether the unit is genuine, to warn when a unit was checked before by someone else ("needs review"), to protect the brand and other buyers against copied codes, and to give the brand statistics about where and on what devices its products are scanned.

9.3 When you fill in a form (warranty registration, a question to the brand, a repair request, a report of a suspicious product) the brand receives what you enter: typically name, email, phone, purchase details, any answers to the brand's own questions, and files such as an invoice or photos. A repair request can include a pickup address and an optional map pin. You get a tracking code to follow the request.

9.4 When you use a brand's chat bot (Telegram or WhatsApp), the chat itself identifies you. The brand's record can hold your messenger profile name, public username, profile photo (only if your messenger privacy settings show it to bots), your phone number (on WhatsApp it is part of the chat; on Telegram only if you choose to share it), your language, and the messages and files you send. Telegram or Meta (WhatsApp) also process these messages under their own terms.

9.5 News and offers. A brand may send you news or offers only if you agreed: by pressing "Get news" in its bot, by starting a chat with its bot where the brand uses that setting, or by ticking the (never pre-ticked) offers box on the brand's web warranty form and then confirming with the link we email to that address — nothing is sent to it until you do, and the link expires after 48 hours. Agreeing is never a condition of the warranty. You can stop at any time with /stop, "stop" on WhatsApp, the Unsubscribe button under every message, or the one-tap unsubscribe link (or your mail app's Unsubscribe) in every offer email. Every consent and withdrawal is recorded with the text you saw, its version, where you gave it, your language and the time. Offer emails are sent from "<brand> via OneTrueTag"; replies go to the brand. We do not track whether you open them. Messages about a product you registered (such as an important safety notice) can be sent without marketing consent.

9.6 The brand's AI assistant. If the brand turned it on, your question, the product name and the brand's guides and FAQ are sent to the AI provider the brand chose, using the brand's own account with that provider. The chat is kept in temporary memory for 2 hours of inactivity and then forgotten, unless you hand it to the brand's team as a ticket, in which case the transcript becomes part of the ticket.

9.7 The brand's other systems. A brand may have the Service push your name, email, phone, country and city, purchase channel, SKU, warranty status and news consent to its CRM (HubSpot, Salesforce or GoHighLevel). Chat ids, photos, addresses, messages and notes are never pushed.

9.8 Uploaded images are re-drawn from their pixels, which removes hidden metadata such as GPS location and camera details.

10. Legal basis (Part B)

The brand decides the basis. Usually: the contract or pre-contract steps with you (warranty, repairs, answering your question); the brand's legitimate interests (authenticity checks, preventing counterfeits, statistics); a legal obligation (for example safety recalls); and your consent (news and offers, and anything else the brand asks consent for). Where Turkish law applies, a brand that relies on explicit consent (açık rıza) must ask for it separately from other terms. The brand's own privacy notice gives its exact bases.

11. Retention (Part B)

11.1 The brand decides how long it keeps your data, within these limits set by the Service:

• On some plans, a customer with no scan, chat, registration, ticket or repair for 12 months is deleted automatically with their contact details, chats, warranties, tickets, repairs and files, unless a warranty is still running.
• On other plans, data is kept while the brand's account exists, until you or the brand ask for deletion.
• If the brand stops paying, everything is kept for a grace period of 3 or 12 months; then the 12-month rule above applies.
• If the brand deletes its account, your data held for that brand is deleted 30 days later.
• AI assistant chats: 2 hours of inactivity unless handed over as a ticket.
• The visitor cookie: up to two years in your browser; you can delete it at any time.

11.2 Codes, product units and anonymous scan counts are kept so that printed codes keep working. They do not identify you.

12. Your rights and how to use them (Part B)

12.1 Your rights against the brand are listed in Section 13. To use them:

(a) use the privacy request (Your data) on the scan page or in your customer account to ask the brand to export or delete your data. From the scan page you confirm it with a one-time link we email to the address you gave the brand (valid for 60 minutes; the page answers the same whether or not the brand holds that address); in your customer account your confirmed email is enough. The brand is notified and has 30 days to answer; its answer (your data deleted, a copy of your data as a file, or a refusal with its reason) is emailed to you, after which we no longer keep the address with the request;

(b) or contact the brand through its privacy notice or its support channel.

12.2 If you write to us about data a brand controls, we will pass your request to the brand without delay and help the brand answer it. We cannot decide on the request for the brand.

12.3 You can also delete the cookies on the scan pages in your browser, and your optional customer account from its profile page.

Part C: Rights, transfers and other matters

13. Your rights in each jurisdiction

For Part A, send requests to [[PRIVACY_EMAIL]]. For Part B, send them to the brand (Section 12). We may ask you to confirm your identity. We answer within 30 days, or within the shorter period the law sets; where the law allows an extension for complex requests we tell you within the first period.

Automated decisions. The "needs review" result on a scan is an automated warning that a unit was checked before by someone else. It does not refuse you a warranty or any other right by itself; the brand decides. You can ask the brand for human review.

14. International transfers

14.1 Our servers and providers are in [[HOSTING_REGION]] (see sub-processors). Using the Service can transfer personal data outside your country. Where it does, we use the safeguards each law requires:

(a) EU/EEA: an adequacy decision of the European Commission, or the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) with supplementary measures where needed.

(b) UK: UK adequacy regulations, or the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

(c) Turkey: under KVKK Art. 9 as amended, an adequacy decision of the Board; failing that, appropriate safeguards, in particular the standard contracts published by the Board, notified to the Authority within five business days of signature, or binding corporate rules or a written undertaking approved by the Board; and only failing those, one of the incidental-transfer exceptions in Art. 9(6), such as explicit consent.

(d) UAE: transfers to countries with adequate protection, or under the conditions in Art. 22 and 23 of the PDPL (such as a contract that requires the recipient to apply the PDPL's protections, or the data subject's express consent). Data under the DIFC or ADGM regimes is transferred under those regimes' own transfer rules.

(e) Saudi Arabia: the Regulation on Personal Data Transfer outside the Kingdom: an adequacy decision, or appropriate safeguards such as SDAIA's standard contractual clauses, binding common rules or certification, with a transfer risk assessment where the regulation requires it, and only the data needed for the purpose.

(f) Qatar, Bahrain, Kuwait and Oman: the conditions of each law for cross-border transfers, including contractual safeguards, the authority's list or approval where required, and consent where that is the applicable ground.

14.2 You can ask for a copy of the safeguards we use at [[PRIVACY_EMAIL]].

15. Security

We protect personal data with technical and organisational measures that include: encryption in transit (HTTPS with HSTS); encryption of stored credentials (bot tokens, store, CRM and AI keys, webhook secrets, two-factor secrets); one-way hashing of passwords, API keys and refresh tokens; strict separation between teams; role-based permissions; short-lived download links (about 5 minutes) for stored files; safety checks on every uploaded file; and rate limits. The full list is in Annex 2 of the data processing agreement. No system is perfectly secure; if a breach affects you, we (or, for Part B, the brand) will tell you where the law requires.

16. Children

16.1 The brand panel is for businesses and is not for children.

16.2 Scanning a code needs no account and collects no name. Forms, chat bots and customer accounts are not directed at children. A customer account is for people aged 16 or over, or the higher age of digital consent where they live; in Saudi Arabia and other countries where a minor's data needs a guardian's consent, a guardian must act for the minor. If you believe a child has given us personal data without the required consent, contact [[PRIVACY_EMAIL]] (Part A) or the brand (Part B) and it will be deleted.

17. Changes

We will publish changes to this policy at [[LEGALBASEURL]] and update the version and date above. For material changes to Part A we will tell sellers by email or in the panel before they take effect.

18. Contact

[[ENTITYNAME]], [[ADDRESS]] · [[PRIVACYEMAIL]] · Data protection contact: [[DPO_CONTACT]].