Platform Privacy Policy

Original Creation AB, reg. no. 559370-8661. Registered address: Videvägen 19, 903 65 Umeå. Office address: Nygatan 18, 903 27 Umeå, Sweden. Email: info@originalcreation.se.

Within the platform, we operate under two distinct legal roles depending on the data category. This determines whom you should contact regarding your data:

• Data Controller for your personal user account — name, work email, job title, phone number, login timestamps, and security audit logs. We process this to deliver, authenticate, and safeguard the service.
• Data Processor for product information, documents, and supply chain data submitted by your employer. Your employer is the Data Controller, and we process this data in accordance with their documented instructions and our Data Processing Addendum (DPA). Questions regarding such content should be directed to your employer.

• Account Details: Name, work email address, job title, telephone number (where applicable), company affiliation, and assigned role permissions.
• Authentication Data: Passwords are never stored in plain text, only as secure cryptographic hashes. We also record failed login attempts and account lockouts to prevent unauthorized access.
• Technical & Usage Metadata: Login timestamps, IP addresses, browser user agent, and event logs via server and application telemetry.
• Platform Content: Product specifications, material declarations, and certificates. This data generally relates to products rather than individuals; however, free-text fields may contain names (see Section 7 on public passports).
• Supplier Requests: If a customer invites you as a supplier, we process your contact details to deliver the inquiry and receive your response.

• Create and administer your user account and access permissions
• Deliver platform functionality to your employer / organization
• Send necessary transactional service communications (invitations, email verification, password resets, supplier inquiries)
• Protect the service against unauthorized access, abuse, and investigate security incidents
• Maintain, troubleshoot, and improve the platform
• Comply with statutory and legal obligations

• Performance of Contract: Account processing is necessary to perform the agreement entered into with your employer and provide you access to the service.
• Legitimate Interests: Operating a secure and resilient platform, preventing fraud or abuse, and investigating incidents.
• Legal Obligations: Where statutory laws mandate data retention or disclosure.

Processing is not based on consent. To have your account removed, please request this via your organization administrator or by contacting us.

The platform uses a single essential authentication cookie: .AspNetCore.Identity.Application. This maintains your logged-in session and is strictly required for the platform to function.

We do not use analytics, tracking, or marketing cookies inside the authenticated platform. Because this cookie is strictly necessary, no cookie consent banner is displayed in the application.

Digital Product Passports (DPPs) are designed for public accessibility. Content published to a passport can be viewed by anyone scanning the assigned QR code without authentication.

We do not collect cookies, identifiers, or analytics from visitors viewing public passports. However, because several passport fields allow free-text input, avoid entering individual personal names or private contact info in batch or product descriptions. Use general role or department contact emails instead.

• Account information is retained as long as your account is active, and is deleted or anonymized following contract termination in accordance with our procedures and the customer agreement.
• Security and access logs are retained for a limited operational period to investigate potential incidents.
• Platform content entered by your organization is governed by the customer contract and DPA.

We do not sell personal data. We utilize trusted infrastructure vendors who process data on our behalf:

• Microsoft Azure (Sweden): Hosting of application, database, and automatic enrichment workers where account data resides.
• Vercel (Stockholm): Frontend application hosting and delivery.
• Microsoft Azure Communication Services Email (Europe): Delivery of transactional system emails (e.g. password resets and invitations).
• Azure OpenAI (Microsoft, Sweden): AI language model processing product and document text during import and enrichment, in Microsoft's Sweden Central region. This service is not intended to receive user account personal data, and the data is not used to train models.
• Sentry (Functional Software Inc., USA, EU data region): Error monitoring. Sending of personal data is disabled.

Core platform infrastructure, databases, and enrichment services reside within the EU/EEA. Where providers or affiliates process data outside the EU/EEA (e.g. Vercel, Sentry, Microsoft global support), appropriate safeguards are implemented, including EU Standard Contractual Clauses (SCCs).

Under the GDPR, you have the right to request access to, rectification, or erasure of your personal data, restrict or object to processing, request data portability, and lodge a complaint with your supervisory authority (in Sweden: Integritetsskyddsmyndigheten, IMY).

To exercise your rights regarding account data, contact us at info@originalcreation.se. For content uploaded by your employer, requests will be forwarded to your employer as Data Controller.

We implement reasonable technical and organizational measures to safeguard personal data against unauthorized access, loss, or alteration. All communication is encrypted via TLS, passwords are cryptographically hashed, data at rest is encrypted in our cloud environment, and access is restricted under least-privilege principles.

We may update this policy periodically. The active version is always available on this page with the latest revision date. Material modifications will be notified to customer organizations.