Política de privacidad

Last updated: 15 July 2026

1. About this Privacy policy

This Privacy policy explains how Ecocitizenz collects, uses, stores, shares and protects personal information when you use our websites, Shopify store, TrustOps services, ECZ-ID products, Resolver, applications, support services and related systems.

2. Data controller and contact details

The data controller is:

Ecocitizenz
86–90 Paul Street
London
EC2A 4NE
United Kingdom

Privacy and support email: support@ecocitizenz.com

3. Personal information we may collect

Depending on how you interact with us, we may collect the following categories of personal information.

Identity and contact information:

(a) name;

(b) business or organisation name;

(d) email address;

(e) billing or service address; and

(f) other contact details you provide.

Account and authentication information:

(a) account identifiers;

(b) login and authentication records;

(d) security and account-recovery information.

Order and subscription information:

(a) products selected;

(b) order numbers;

(d) payment status;

(e) cancellation, refund and renewal records;

(f) transaction references; and

(g) information required to administer the contract.

We do not ordinarily receive or store complete payment-card details. Payments are generally processed by Shopify or another authorised payment provider.

Business, agent and service information:

(a) information about a business, principal, operator, agent, API, system, product, service or counterparty;

(b) authority, ownership, control or relationship information;

(d) information and evidence submitted for activation or review;

(e) product eligibility and parent-tier information; and

(f) service lifecycle and status information.

Public verification information:

Some ECZ-ID information is intended to be publicly verifiable.

This may include identifiers, subject or organisation information, product or scope information, current status, effective dates, expiry or re-check information, reason codes and references designed for public verification.

We seek to minimise personal information displayed publicly and do not intend public verification surfaces to expose raw private evidence, payment-card information, passwords or unnecessary sensitive information.

Communications and support information:

(a) emails and support requests;

(b) feedback and complaints;

(d) records of communications with us.

Technical and usage information:

(a) IP address;

(b) browser and device information;

(d) timestamps;

(e) pages and features used;

(f) referring pages;

(g) cookie and consent choices;

(h) diagnostic and performance information; and

(i) security, fraud-prevention and audit logs.

Agentic and automated interaction information:

Where you use an AI agent, automated system or agentic shopping channel, we may receive order instructions, product selections, referral information, technical metadata or other information that the channel provides to complete the requested interaction.

The AI channel, Shopify or another platform may process information independently under its own privacy notice.

4. How we collect personal information

We may collect information:

(a) directly from you;

(b) from a person, business or authorised agent acting for you;

(d) through Shopify and payment providers;

(e) from our websites, applications, logs and security systems;

(f) from public registers, websites or other public sources where lawful and relevant;

(g) from service providers supporting our operations; and

(h) from systems involved in activation, entitlement, lifecycle management and public verification.

5. How we use personal information

We use personal information to:

(a) provide our websites, store, products and services;

(b) process orders, subscriptions, billing, cancellations and refunds;

(d) complete activation, configuration, binding and service delivery;

(e) create and maintain ECZ-ID records and Resolver-verifiable state;

(f) manage entitlement, renewal, expiry, downgrade, suspension and revocation;

(g) provide support and respond to enquiries;

(h) prevent fraud, misuse, security incidents and unauthorised access;

(i) maintain audit, evidence and transaction records;

(j) monitor, test and improve reliability, usability and performance;

(k) comply with legal, regulatory, tax, accounting and law-enforcement requirements;

(l) establish, exercise or defend legal claims;

(m) communicate service, security, billing and policy information; and

(n) send marketing communications where permitted.

6. Lawful bases for processing

We rely on one or more of the following lawful bases.

Contract:

We process information where it is necessary to enter into or perform a contract with you, including processing orders, supplying services, managing subscriptions, providing support and administering activation and lifecycle events.

Legal obligation:

We process information where necessary to comply with legal duties, including tax, accounting, fraud-prevention, sanctions, consumer-protection and lawful disclosure obligations.

Legitimate interests:

We process information where necessary for legitimate interests pursued by us or another party, provided those interests are not overridden by your rights.

These interests may include:

(a) operating and improving our services;

(b) preventing fraud and abuse;

(d) maintaining accurate records;

(e) protecting ECZ-ID and Resolver integrity;

(f) supporting customers;

(g) understanding service use; and

(h) establishing or defending legal claims.

Consent:

We rely on consent where required, including for certain marketing, cookies or optional processing.

You may withdraw consent at any time. Withdrawal does not affect processing that occurred lawfully before withdrawal.

7. Special category and sensitive information

We do not intentionally request special category personal information unless it is necessary, lawful and specifically identified.

Do not submit information about health, ethnicity, religion, political opinions, trade-union membership, sexual life, biometric identification, criminal allegations or other highly sensitive matters unless we have specifically requested it through an approved process and you have lawful authority to provide it.

Do not submit passwords, private cryptographic keys, full payment-card details or unrelated confidential information.

8. Public Resolver information

Certain information is processed for public verification.

Where a service is activated, authorised public information may be displayed through the Resolver or another approved verification surface.

Public state can change following cancellation, refund, expiry, failed renewal, correction, suspension, revocation, supersession or restoration.

Historical event references may be retained where necessary to preserve auditability, prevent misleading gaps and protect the integrity of lifecycle records.

Where personal information is involved, we seek to limit public display to what is necessary for verification.

9. Automated processing

Some service checks, eligibility rules, fraud controls, routing decisions and status calculations may be automated.

We do not intend to make solely automated decisions that produce legal or similarly significant effects on individuals unless the processing is permitted by law, necessary for a contract, or based on explicit consent and appropriate safeguards are provided.

You may contact us to request information about or human review of a significant automated decision where applicable.

10. Sharing personal information

We may share personal information with:

(a) Shopify and associated commerce services;

(b) payment processors and financial-service providers;

(d) email, communications and customer-support providers;

(e) security, fraud-prevention, logging and monitoring providers;

(f) professional advisers, including lawyers, accountants and insurers;

(g) contractors and service providers acting under appropriate confidentiality and data-protection obligations;

(h) regulators, courts, law-enforcement bodies or public authorities where required or permitted by law;

(i) a buyer, investor or successor in connection with a genuine business restructuring, financing, merger, acquisition or sale; and

(j) another party where you have instructed or authorised us to do so.

We do not sell personal information for money.

Service providers may only use information for the authorised purpose and according to applicable contractual and legal safeguards.

11. Shopify, payment providers and AI channels

When you purchase through Shopify, Shopify and its payment or commerce partners may process personal information under their own terms and privacy notices.

When you interact through ChatGPT, Microsoft Copilot, Shop or another AI or agentic channel, that channel may independently collect and process your information.

Ecocitizenz is not responsible for the independent privacy practices of those third parties.

You should review their privacy information before using their services.

12. International transfers

Some service providers may process personal information outside the United Kingdom.

Where required, we use appropriate safeguards for international transfers, such as adequacy regulations, approved contractual clauses, contractual protections and supplementary security measures.

You may contact us for further information about safeguards relevant to your information.

13. Data retention

We retain personal information only for as long as reasonably necessary for the purposes described in this policy, including legal, accounting, security, contractual, audit and dispute-resolution requirements.

Typical retention periods or criteria include:

(a) order, billing, contract and tax records: normally up to six years after the end of the relevant relationship or financial period;

(b) account, activation and service records: while the service is active and normally up to six years afterwards where needed for legal claims, audit or contract administration;

(c) support communications: normally up to three years after the enquiry is closed, unless longer retention is necessary;

(d) technical and security logs: normally up to 12 months, or longer where required to investigate an incident, fraud or legal claim;

(e) marketing records: until you unsubscribe or withdraw consent, with a limited suppression record retained to respect your preference; and

(f) Resolver and lifecycle records: for as long as necessary to preserve accurate current state, legitimate audit history, fraud prevention and the integrity of authoritative records.

We may retain information for longer where required by law, litigation, an investigation, security needs or another legitimate and documented reason.

Information may be anonymised and retained in a form that no longer identifies an individual.

14. Security

We use reasonable technical and organisational measures designed to protect personal information against unauthorised access, alteration, disclosure, loss and destruction.

Measures may include access controls, authentication, encryption, monitoring, logging, backups, data minimisation, environment separation and security testing.

No internet or information-storage system is completely secure. You are responsible for maintaining the security of your accounts, devices and credentials.

Please notify us promptly at support@ecocitizenz.com if you believe information or an account has been compromised.

15. Cookies and similar technologies

We and our service providers may use cookies, pixels, local storage and similar technologies to:

(a) operate essential website and checkout functions;

(b) remember preferences;

(d) understand use and performance; and

(e) provide analytics or marketing where permitted.

You can manage non-essential cookies through the available cookie banner or privacy controls and through your browser settings.

Disabling essential cookies may prevent parts of the website or checkout from working.

16. Marketing

We may send marketing communications where you have consented or where another lawful basis permits them.

You can unsubscribe using the link in the communication or by contacting support@ecocitizenz.com.

We may continue to send essential service, security, order, renewal and account communications.

17. Your data-protection rights

Depending on the circumstances, you may have the right to:

(a) be informed about how your personal information is used;

(b) request access to your personal information;

(d) request deletion of your information;

(e) request restriction of processing;

(f) object to processing based on legitimate interests or direct marketing;

(g) request data portability;

(h) withdraw consent;

(i) request safeguards relating to significant automated decisions; and

(j) complain to a data-protection authority.

These rights are not absolute. We may need to retain or continue processing information where permitted or required by law, including for legal claims, fraud prevention, security, contractual administration or the integrity of authoritative records.

To exercise a right, email support@ecocitizenz.com.

We may need to verify your identity before acting on a request.

We normally respond within one month, subject to any lawful extension.

18. Complaints

Please contact us first so that we can investigate and try to resolve your concern.

You also have the right to complain to the United Kingdom Information Commissioner’s Office.

19. Children

Our services are intended for adults and business users.

We do not knowingly offer accounts or paid services directly to children under 18.

If you believe a child has provided personal information without appropriate authority, contact support@ecocitizenz.com.

20. Third-party links

Our websites and services may link to third-party websites or services.

We are not responsible for their privacy practices, security or content.

Review the relevant third-party privacy notice before submitting information.

21. Changes to this Privacy policy

We may update this Privacy policy to reflect changes to our services, legal requirements or processing activities.

The current version will be published with the updated date.

Where appropriate, we will notify users of material changes.

22. Contact

Questions, requests or complaints about privacy should be sent to:

Ecocitizenz
86–90 Paul Street
London
EC2A 4NE
United Kingdom

Email: support@ecocitizenz.com