This is where we explain which personal data we process when you use epc.is, sign in at auth.epc.is or open a Digital Link address under epc.is or id.epc.is. We use terms such as "processing" and "controller" as Art. 4 of the General Data Protection Regulation (GDPR) defines them.
1. Controller
benelog GmbH & Co. KG, Maarweg 133, 50825 Köln, Germany
E-mail: info@benelog.com, phone: +49 221 472540 001
Represented by the managing director Thomas Hirsch
For questions about data protection you can reach Sven Böckelmann at sboeckelmann@benelog.com.
2. Visiting the website and server logs
With every page request our servers log the IP address, date and time, the requested address, the status code, the amount of data transferred, the referrer and the browser identifier. A website cannot be delivered without this data; we also use it to find errors and fend off attacks. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest being secure and stable operation. We delete the logs after 30 days at the latest. Only when we have to investigate a specific security incident do we keep the entries concerned for longer.
3. Cookies and local storage
We use no cookies for analytics, advertising or tracking and embed no third-party services, so no analytics tools, no maps, no videos and no external fonts. Everything your browser loads comes from our own servers.
A few cookies we do need, and only once you sign in or are on the way there:
- a session cookie of epc.is that keeps you signed in;
- a cookie that remembers for at most ten minutes which page to return to after sign-in;
- the session and language cookies of the sign-in service auth.epc.is (Keycloak) for sign-in, registration and sign-out.
These cookies are strictly necessary for the service you explicitly want to use (§ 25(2) no. 2 of the German TDDDG) and therefore need no consent. The subsequent processing is based on Art. 6(1)(b) GDPR.
4. Registration and user account
For your account we store your username, e-mail address, first and last name, your password as a hash, your preferred language, the time you accepted the terms of use and the information about your company that you choose to give. After registration we send you an e-mail with which you confirm your address. The legal basis is Art. 6(1)(b) GDPR, the agreement on using the beta. The data stays stored until you have your account deleted or the beta ends.
5. Applying for access to a tenant
When you apply for access for your company, we process the information in the application: the company's name and address, the GS1 company prefix you claim, a GTIN or GLN as evidence and the status of the review. The colleagues who review the application receive an e-mail about it; you receive one as soon as we have decided.
If you provide an access key from GS1 Germany, we transmit it to GS1 Germany GmbH, Maarweg 133, 50825 Köln, Germany, to establish which number ranges belong to your company. What stays with us is the result of that check; the key itself is discarded after the query.
The legal basis is Art. 6(1)(b) and (f) GDPR; our legitimate interest is that only authorised persons publish data under a company's GS1 numbers. We keep the application data for as long as the account exists.
6. Data in your tenant and its publication
The content of your tenant, that is product, location and company data, events and links, is primarily business data. Where it contains business contact details, such as a contact person, we store and publish them the way you have configured (Art. 6(1)(b) GDPR). What you mark as public can be retrieved worldwide. We register links for your GS1 numbers with the GS1 registry; GS1 receives the number, the target address and the type of link.
7. Visits to public product pages and scans
When someone opens a public Digital Link address, for example by scanning a QR code, we count that request for the statistics of the company concerned. What we store for this is the requested number, the time and the country we derive from the connection. The IP address and any identifier of the device or person stay out of it. To estimate unique visits we use a method with a key that is held only in memory and never written to disk. Very small counts are left out of the statistics. The legal basis is Art. 6(1)(f) GDPR.
8. Contact by e-mail
If you write to us, we process your information to answer the request (Art. 6(1)(b) or (f) GDPR) and delete it as soon as it is no longer needed for that and no statutory retention period stands in the way. We keep reports of illegal content and objections to a suspension for as long as we need to be able to trace the decision, at most twelve months after the case is closed.
9. Suspension of accounts
If an account breaches the terms of use, we process the data we need for that: the account, the content concerned, times and our reasons. This serves to protect the platform and third parties (Art. 6(1)(f) GDPR) and to meet our obligations under Regulation (EU) 2022/2065 (Art. 6(1)(c) GDPR).
10. Hosting, recipients and third countries
epc.is runs on servers in Cologne, Germany. We operate the platform ourselves, including sending e-mail. We pass personal data to the recipients named above, that is GS1 Germany for the check and the GS1 registry for links, and to authorities where the law obliges us to. We transfer no data to countries outside the EU and the EEA.
11. Security
All connections are encrypted with TLS. Sign-in runs on OpenID Connect with PKCE, and tenants are separated from each other. Beyond that we take the technical and organisational measures that Art. 32 GDPR requires.
12. Your rights
You have the right to
- access (Art. 15 GDPR),
- rectification (Art. 16 GDPR),
- erasure (Art. 17 GDPR),
- restriction of processing (Art. 18 GDPR),
- data portability (Art. 20 GDPR), and
- object to processing we base on Art. 6(1)(f) GDPR on grounds relating to your particular situation (Art. 21 GDPR).
An e-mail to info@benelog.com is enough for that. You may also lodge a complaint with a supervisory authority; the one responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (www.ldi.nrw.de).
13. Obligation to provide data, no automated decisions
Without the account data we cannot create an account, and without the application data we cannot grant access; everything else is voluntary. Applications are decided by people. There is no automated decision-making within the meaning of Art. 22 GDPR.
14. Changes
When the platform or the law changes, we update this policy. The current version is always at epc.is/privacy.
The German version of this policy is authoritative.
Version: 8 October 2026