Privacy Policy — Kinset Connected Labels and Digital Product Passports 

1. Who We Are

This privacy policy applies to the Connected Labels and Digital Product Passports (“DPPs”) powered by Kinset Limited (“Kinset”, “we”, “us”, “our”), a company incorporated in Ireland.

Kinset operates a Connected Product Platform through which brands and manufacturers publish product information by means of Connected Labels and Digital Product Passports. When you scan a Connected Label or DPP, Kinset processes limited access data solely for the purpose of delivering and maintaining the platform. Where we process data on behalf of the brand publishing a Connected Label or Digital Product Passport, we act as a data processor on their behalf.

For any queries relating to this privacy policy, contact us at privacy@kinset.com.

2. What Data We Collect and Why

When you scan a Kinset Connected Label or Digital Product Passport, we automatically collect the following access data:

  • Date and time of scan
  • IP address
  • Device model and operating system
  • Browser type and version
  • Language settings

We collect this data for the following purposes:

  • To deliver the correct Connected Label or DPP experience to your device
  • To monitor platform performance, stability, and load
  • To detect and prevent abuse or misuse of the platform
  • To generate aggregated, anonymised scan analytics for the brand that published the Connected Label or DPP

The legal basis for this processing is our legitimate interest in operating and maintaining a reliable and secure platform, in accordance with Article 6(1)(f) of the GDPR.

We do not collect your name, email address, or any other information that directly identifies you. IP addresses are processed transiently for the purposes described above and are not retained in a form that allows individual identification beyond a period of five weeks, after which log data is aggregated and anonymised.

3. Aggregated Analytics

Kinset provides brands with aggregated, anonymised scan data, including total scan volumes, geographic distribution, and device type breakdowns. This data cannot be used to identify you as an individual. Individual scan data is never shared with brands or any other third party.

4. No Cookies or Tracking

Kinset does not use cookies, pixels, or any other tracking technologies on its connected labels or Digital Product Passports. No data is collected for advertising or profiling purposes.

5. Third-Party Sub-Processors

Kinset uses Amazon Web Services (“AWS”) to host the platform infrastructure. AWS acts as a data processor on our behalf under a data processing agreement incorporating EU Standard Contractual Clauses, ensuring that any data processed via AWS infrastructure is protected to the standard required under the GDPR.

Kinset does not share your data with any other third-party partners, advertisers, or analytics providers.

6. How Long We Retain Your Data

Access log data, including IP addresses, is retained for a maximum of five weeks from the date of collection. After this period, log data is aggregated and anonymised and can no longer be attributed to an individual. Aggregated analytics data may be retained indefinitely as it does not constitute personal data.

7. How We Protect Your Data

Kinset takes the security of your data seriously. All connections to the Kinset platform are encrypted in transit via SSL (HTTPS). Data stored on our infrastructure is encrypted at rest. Access to personal data is restricted to a limited number of authorised personnel under Kinset’s internal access control policy.

8. Your Rights Under GDPR

As a data subject under the General Data Protection Regulation (GDPR), you have the following rights in respect of your personal data:

  • Right of access — you have the right to request a copy of the personal data we hold about you.
  • Right to rectification — you have the right to request correction of inaccurate or incomplete data.
  • Right to erasure — you have the right to request deletion of your data where it is no longer necessary for the purpose for which it was collected, or where you object to its processing.
  • Right to restriction — you have the right to request that we restrict the processing of your data in certain circumstances.
  • Right to object — you have the right to object to processing carried out on the basis of our legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your rights.
  • Right to data portability — you have the right to receive your personal data in a structured, commonly used, machine-readable format.
  • Right to lodge a complaint — you have the right to lodge a complaint with a supervisory authority. In Ireland, the relevant authority is the Data Protection Commission (DPC), contactable at www.dataprotection.ie.

Please note that exercising certain rights, such as access or erasure of IP address data, may require you to provide evidence that a particular IP address was assigned to your device at a given point in time.

To exercise any of your rights, contact us at privacy@kinset.com.

9. Contact Details

Questions or requests relating to this Policy or to Kinset’s processing of Personal Data may be directed to:

Kinset Limited

15 Sandymount Road, Dublin 4, D04 X9K4, Ireland

Email: privacy@kinset.com

10. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our platform, legal obligations, or data processing practices. The date at the top of this policy reflects when it was last updated. We encourage you to review this policy periodically.

Last Updated: June 2026