GDPR & data protection
How we comply with GDPR, CCPA, and global data protection laws. Clear, documented, and auditable.
Last updated: October 28, 2026
1. Our compliance commitment
Patchwise is committed to complying with the EU General Data Protection Regulation (GDPR), the UK Data Protection Act, the California Consumer Privacy Act (CCPA), and other applicable data protection laws. This page explains how we meet those obligations. If you need a signed Data Processing Agreement (DPA) for enterprise or regulated engagements, contact us and we will provide one.
2. Our role: data controller and processor
When you use our website and submit a scan or order, we act as a data controller — we determine the purposes and means of processing your personal data. When we process customer site data as part of a paid engagement, we act as a data processor on your behalf — you are the controller for your site's data. Our responsibilities differ in each role, and we document them in our engagement letters and DPAs.
3. Legal bases for processing
We process personal data under the following GDPR legal bases: Article 6(1)(b) — performance of a contract (delivering the service you ordered). Article 6(1)(c) — legal obligation (retaining tax and accounting records for 7 years). Article 6(1)(f) — legitimate interests (responding to inquiries, improving our service, preventing fraud). Article 6(1)(a) — consent (passive scans, marketing emails, non-essential cookies). Consent can be withdrawn at any time.
4. Data subject rights
Under GDPR Article 15–22, you have the right to: access your personal data, rectify inaccurate data, erase your data (right to be forgotten, subject to legal retention), restrict processing, data portability, object to processing, and not be subject to automated decision-making. Under CCPA, California residents have the right to know, delete, and opt out of the sale of personal information — we do not sell personal information. To exercise any right, email us. We respond within 30 days.
5. Data minimization and purpose limitation
We collect only the data necessary for the specific purpose stated at the point of collection. We do not repurpose data for unrelated uses. Scan data is used only to deliver and report on the scan. Order data is used only to deliver the service, process payment, and meet tax obligations. We do not aggregate or anonymize customer data for secondary products.
6. International data transfers
Our infrastructure (Supabase) may process data in regions outside the EU/UK. We rely on Standard Contractual Clauses (SCCs) as the legal mechanism for transfers. Our sub-processors are required to maintain equivalent safeguards. If you need specifics about transfer mechanisms for your engagement, contact us.
7. Sub-processors
We use the following sub-processors: Supabase (database, authentication, edge functions, hosting), PayPal (payment processing), and our email provider (transactional and marketing email). Each is bound by data processing agreements. We do not use additional sub-processors for customer site data without notifying enterprise customers in advance. A full sub-processor list is available on request.
8. Data breach response
In the event of a personal data breach, we will: contain and assess the breach within 24 hours, notify affected customers without undue delay, and notify the relevant supervisory authority within 72 hours where required by GDPR Article 33. We maintain an incident response plan and conduct periodic reviews of our security posture. Our audit log records all admin actions for forensic review.
9. Data retention
Lead and scan data: 12 months. Order and payment data: 7 years (tax/accounting legal obligation). Account data: 90 days after account closure. Communication data: 24 months. These retention periods are documented in our Privacy Policy. Data is deleted or anonymized at the end of its retention period.
10. Security measures
Row-level security on all database tables. Server-only credential storage with no browser exposure. HTTPS for all connections. Role-based access control with admin actions re-verified server-side on every request. Audit logging of all administrative actions. Named engineer access — no shared accounts. See our Security page for more details.
11. Data Protection Officer
We are not required to appoint a formal Data Protection Officer under GDPR Article 37, but we have designated an internal data protection contact. For data protection questions, email us at the address on our contact page with "Data Protection" in the subject line.
12. Supervisory authority
You have the right to lodge a complaint with your local supervisory authority if you believe our processing of your data infringes applicable law. We encourage you to contact us first so we can address your concern directly.