General Statements

Statement regarding the data controller:

Company: Vereniging TAPA EMEA

President & CEO: Thorsten Neumann

Address: Kanaalpark 140, 2321JV Leiden – The Netherlands

Contact the Data Protection Officer by sending us an email.

Scope of this Privacy Policy

This Privacy Policy applies to the digital services operated by TAPA EMEA, in particular: the website tapaemea.org; the TAPA EMEA Intelligence System (TIS) at database.tapaemea.org; the TAPA Upload Manager at uploads.tapaemea.org; and other digital services of TAPA EMEA. References to “our services” apply to all of the above unless stated otherwise.

General information about data processing

Affected data: Personal data is only collected if you inform us of this yourself. In addition, no personal data is collected. Any processing of your personal data that goes beyond the scope of the statutory permission is only possible on the basis of your express consent.

Processing purpose: The operation of the Association

Categories of recipients:

. Public authorities subject to priority legislation.
. External service providers or other contractors.
. Other external bodies as far as the data subject has given consent or a transmission of predominant interest is permitted.

Third-country transfers: Contractors from outside the European Union may be used to fulfil and implement contracts. Where personal data is transferred outside the European Economic Area, TAPA EMEA ensures appropriate safeguards are implemented, including Standard Contractual Clauses, adequacy decisions, or other approved transfer mechanisms.

Length of data storage: The duration of the data storage is for the lifetime of membership or the Association personnel are engaged with the Association unless impacted by local law. Personal data is retained for the duration of the membership relationship and thereafter only as long as required to comply with legal obligations, resolve disputes, enforce agreements, or maintain historical certification records.

Specific Information about the Website

Server logs

We collect data about access to the site and save it as ‘server log files’. The following data is logged:

. Visited site
. Time of day at the time of access
. Amount of data sent in bytes
. Source / link from which you came to the site
. Browser used
. Operating system used
. IP address used

Data collected is for statistical purposes only and is used to improve the website. However, the operator of the website reserves the right to retrospectively check the server log files in case of concrete evidence that points to unlawful use.

Use of a newsletter

As part of the registration to our newsletter, you provide us with your e-mail address and optional additional data. We use this information exclusively to send you the newsletter. Your data provided during the newsletter registration process remains with us until you unsubscribe from our newsletter. It is possible to unsubscribe at any time by using the link provided in the newsletter or by sending us a separate email. By unsubscribing, you deny us the right to use your e-mail address.

In addition, we use your e-mail address, which we receive in connection with the other communications we send out informing the members of our activities unless you have expressly objected to this type of usage. You may object to the use of your e-mail address at any time. Your objection (and thus the cancellation of our newsletter) can be submitted to us by sending an appropriate message by email.

Use of Google Analytics

This website uses Google Analytics, a web analytics service provided by Google Inc. (“Google”). Google Analytics uses so-called “cookies”, i.e. text files that are stored on your computer that allow for an analysis of your use of the website. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the United States and stored there. However, if IP anonymisation is activated on this website, your IP address will be shortened by Google beforehand within member states of the European Union or other parties to the Agreement on the European Economic Area. The complete IP address will only be sent to a Google server in the United States in exceptional circumstances and then shortened there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide other services related to website activity and internet usage to the website operator. The IP address provided by your browser as part of Google Analytics will not be merged with other Google data. You can prevent the storage of cookies by using the respective settings in your browser; however, please note that you may not be able to use all the features of this website if you decide to do so. In addition, you may prevent the collection of the data generated by the cookie that is related to your use of the website (including your IP address) as well as the processing of this data by Google by downloading and installing the browser plug-in available under the following link. Related to the discussion about the use of analysis tools with complete IP addresses, we would like to point out that this website uses Google Analytics with the extension “_anonymized ()”, therefore IP addresses are only processed in a shortened form to rule out a direct personal reference. For browsers on mobile devices, you can click this link to prevent the anonymous collection by Google Analytics on this website by means of a so-called “opt-out cookie”.

Use of own cookies

This website uses its own cookies to enhance user-friendliness (“cookies” are data records sent by the web server to the user’s browser for later retrieval). Our cookies do not store any personal data. You can generally prevent the use of cookies by prohibiting the storage of cookies in your browser. Please find more information about our cookies here.

Google Web Fonts

This website uses Google Web Fonts. When you access the page, fonts are retrieved from an external Google server in the United States to make the page more visually appealing when it is shown in your browser. Unfortunately, it is currently unknown whether Google logs this server request and continues to use the collected data. However, it can be assumed that the Google privacy policies apply. This means that your IP address will be stored for several months.

Fonts.net

On our site, JavaScript code is downloaded from Monotype Inc., Monotype, 600 Unicorn Park Drive, Woburn, MA 01801, USA (Fonts.net). This code is used to represent fonts. If you have activated JavaScript in your browser and have not installed a Java Script Blocker, your browser may transfer personal data to Fonts.net. We do not know what data Fonts.net associates with the data received and for what purposes Fonts.net uses that data. More information can be found in the Fonts.net privacy policy.

Specific Information about the AI-supported Assistant

AI-supported Assistant (Retrieval-Augmented Generation)

TAPA EMEA provides an AI-supported assistant within its digital services. The assistant uses retrieval-augmented generation: for your input, relevant excerpts from a knowledge base are identified and passed to a language model as context. The assistant draws on the following sources:

. publicly available content published by TAPA EMEA on tapaemea.org;
. a dedicated, curated document knowledge base maintained by TAPA EMEA;
. within the TIS (database.tapaemea.org), the TIS database, accessed via the Model Context Protocol (MCP).

AI features connected to the TIS are available to registered users only.

Content of the knowledge base: The website content and the curated document knowledge base are provided by TAPA EMEA. The TIS database accessed by the assistant stores no personal data relating to incidents; where TIS content is retrieved and passed to the language model as context, it therefore does not involve personal data. An exception to this is company data and any professional contact information contained in TAPA EMEA’s digital systems for the purpose of supply chains resilience. When relevant requests are made to the AI assistant, this data from the TIS database is also transferred to the LLM for processing.

Personal data processed: your inputs (prompts), the history of the respective conversation, and technical metadata (time of access, session identifier, and, where you are logged in, your user identifier). Users should avoid entering confidential, personal or sensitive information unless strictly necessary for their request.

Purpose: provision and improvement of the information and research service.

Legal basis: For registered users using AI features connected to the TIS, Art. 6(1)(b) GDPR (performance of the membership relationship); otherwise Art. 6(1)(f) GDPR (legitimate interest in an efficient information service). Where the active confirmation below is relied upon as consent, Art. 6(1)(a) GDPR applies instead.

Retention: conversation data is stored for operation and error analysis and is then deleted or anonymized.

Your inputs are processed via the providers’ commercial APIs and are not used to train their general AI models; this is contractually excluded.

Activation of AI features (active confirmation)

The AI assistant is deactivated by default. Wherever an AI assistant is offered, you must actively confirm before the AI features can be used. Until you provide this confirmation, no input is transmitted to the AI providers.

AI service provider (processor) and sub-processors

The assistant is provided and operated on behalf of TAPA EMEA by strandhütte GmbH, acting as a processor under Art. 28 GDPR. The agency makes the language models available within the system and is responsible for their procurement and billing.

To generate responses, the agency uses the application programming interfaces (APIs) of the following language-model providers as sub-processors (Art. 28(4) GDPR):

. Google (Gemini models) — Google Ireland Ltd. / Google LLC
. Anthropic (Claude models) — Anthropic PBC

These providers process your inputs strictly on our instructions and solely to answer your request. Data processing agreements are in place at each level (controller–processor and processor–sub-processor). On the API tiers used, your inputs are not used to train the providers’ models; this is contractually excluded.

You can find the relevant terms of use of the language-model providers here

Third-country transfer for the AI service

Both providers used to operate the assistant are based in, and may process data in, the United States. Such transfers are safeguarded as follows:

. Google: on the basis of the EU Commission’s Standard Contractual Clauses (Art. 46(2)(c) GDPR) and, as Google is certified under the EU-US Data Privacy Framework, additionally on the basis of an adequacy decision (Art. 45 GDPR). Where technically configured, processing may take place in an EU region.
. Anthropic: on the basis of the EU Commission’s Standard Contractual Clauses (Art. 46(2)(c) GDPR) pursuant to Anthropic’s Data Processing Addendum.

Copies of the relevant safeguards are available on request.

Connection to internal systems (Model Context Protocol)

To answer requests within the TIS, the assistant accesses the TIS database via a standardised interface (the Model Context Protocol, MCP). Only the data necessary to handle your request is processed. Access to these functions requires authentication and is limited to registered users.

No solely automated decision-making

The assistant serves information purposes only. No solely automated decision producing legal effects within the meaning of Art. 22 GDPR takes place.

Data subject rights and deletion of conversation data

Your rights also apply to the data processed by the assistant. On request we will delete your stored conversation data. The knowledge base is not affected, as it contains no user data.

Note on accuracy of responses

The assistant’s responses are generated automatically and may be incomplete or incorrect. They do not replace binding information from TAPA EMEA. Responses do not constitute legal advice, certification decisions or official interpretations of TAPA standards.

Details of Other Data Processing Methods

Specific information on applications for admission

Affected data: Details of the company in the admission process

Processing purpose:

. Implementation of the admission process
. Administration of memberships

Categories of recipients:

. Public authorities subject to priority legislation
. External service providers or other contractors
. Other external bodies as far as the data subject has given their consent or a transmission of predominant interest is permitted.

Third-country transfers: Contractors from outside the European Union may be used to fulfil and implement contracts.

Duration of data storage: Application data will generally be deleted as soon as possible after membership of the Association or engagement with the Association has ended but within four months after notification of the decision, unless consent has been given for longer data storage, or a requirement of local law.

Specific information on account data

Affected data: Data provided to administrate accounts

Processing purpose:

. Setting up of accounts
. Administration of membership accounts

Categories of recipients:

. Public authorities subject to priority legislation
. External service providers or other contractors
. Other external bodies as far as the data subject has given their consent or a transmission of predominant interest is permitted.

Third-country transfers: Contractors from outside the European Union may be used to fulfil and implement contracts.

Duration of data storage: The duration of data storage depends on the duration of the existence of the account. After deleting the account all related data will also be deleted.

Specific information on data related to self-certifications

Affected data: Data provided for self-certification

Processing purpose:

Implementation & administration of self-certifications

Categories of recipients:

Public authorities subject to priority legislation
External service providers or other contractors
Other external bodies as far as the data subject has given their consent or a transmission of predominant interest is permitted.

Third-country transfers: Contractors from outside the European Union may be used to fulfil and implement contracts.

Duration of data storage: The duration of the data storage is for the life time of membership or the Association personnel are engaged with the Association unless impacted by local law.

Specific information on data related to incident reports

Affected data: Data provided in an incident report.

Processing purpose:

Addition of an incident to the incident database
Administration of incidents

Categories of recipients:

Public authorities subject to priority legislation
External service providers or other contractors
Other external bodies as far as the data subject has given their consent or a transmission of predominant interest is permitted.

Third-country transfers: Contractors from outside the European Union may be used to fulfil and implement contracts.

Duration of data storage: The duration of the data storage is for the lifetime of membership or the Association personnel are engaged with the Association unless impacted by local law.

Specific information on the TAPA Upload Manager (uploads.tapaemea.org)

The TAPA Upload Manager enables the exchange of documents between companies and TAPA EMEA, primarily for the purposes of TAPA membership and the issuance or renewal of TAPA certificates. It is developed and operated on behalf of TAPA EMEA.

Affected data: the files and data you upload. These may contain personal data (e.g. names and contact details of employees or auditors). Users should avoid uploading unnecessary personal information.

How it works: TAPA staff generate an upload link with a configurable validity period. Via this link, you can upload the required data. Uploaded data is stored temporarily and can be downloaded and further processed by TAPA staff.

Processor / hosting: Uploaded data is stored within the EU under Art. 28 GDPR; a data processing agreement with our hosting partner is in place. The hosting region determines whether a third-country transfer occurs: an EU region requires no additional mechanism; a US (or other non-EEA) region requires Standard Contractual Clauses and/or the EU-US Data Privacy Framework. DPO to confirm region and the DPA with the provider.

Legal basis: Art. 6(1)(b) GDPR (initiation and performance of the membership or certification relationship) and, where applicable, Art. 6(1)(f) GDPR.

Retention: uploaded data is removed from the Upload Manager after a maximum storage period of 90 days.

Security: Data is transmitted via an encrypted connection (HTTPS/TLS). Access is controlled via links with a limited, configurable validity period.

Additional Information and Contacts

In addition, you may invoke your rights to rectification or cancellation at any time, or to restrict the processing or exercise of your right to object to the processing and the right to data portability. Here you have the option to contact us by email. You also have the right to contact the data protection supervisory authority in case of any complaints.

A full list of TAPA EMEA General Data Protection Procedures can be downloaded using this link.

TAPA EMEA implements appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

TAPA EMEA Cookie Policy

TAPA EMEA uses cookies on tapaemea.org. By using the Service, you consent to the use of cookies. Our Cookies Policy explains what cookies are, how we use cookies, how third-parties we may partner with may use cookies on tapaemea.org and your choices regarding cookies.

What cookies are

Cookies are small pieces of text sent by your web browser by a website you visit. A cookie file is stored in your web browser and allows the website or a third-party to recognize you and make your next visit easier and the website more useful to you.

Cookies can be “persistent” or “session” cookies.

How TAPA EMEA uses cookies

When you use and access our website, we may place a number of cookies files in your web browser. We use cookies for the following purposes:

To enable certain functions of the website
To provide analytics

We use session and persistent cookies on tapaemea.org and we use different types of cookies to run the website.

Essential cookies

We use essential cookies to authenticate users:

Names: CraftSessionId and CRAFT_CSRF_TOKEN

Purpose: Contains an anonymous user id to enable the website to assign your browsers requests to the same HTTPS-session.

Expires: When you close your browser / end of the session

Name: Randomly-generated-string_username and randomly-generated-string_identity

Purpose 1: A user session identifier cookie used to enable user preferences to be stored (e.g. log-in credentials, so you do not have to log in to every single page) contains anonymous data.

Purpose 2: A user session identifier for admins used to enable working in the backend of the website, contains anonymous data.

Expires: After 1 year + 1 day

Third-party cookies

In addition to our own cookies, we use third-parties cookies to report usage statistics of the website:

Name: _ga

Purpose: Used to distinguish users for website analytics

Expires: After 2 years

Names: _gid Cookie 7 and _gat_gtag_UA_43372658_1

Purpose: Used to distinguish users for website analytics

Expires: After 24 hours

What are your choices regarding cookies

You can use your web browser to delete, block or allow all cookies. You can also block third-party cookies or clear all cookies when you close the browser. Most also browsers have a “private” or “incognito” mode, which allows you to browse the internet without storing local data.

If you would like to delete cookies or instruct your web browser to delete or refuse cookies, please visit the help pages of your web browser:

. Chrome cookies information
. Firefox cookies information
. Safari cookies information
. Opera cookies information

Please note, however, that if you delete cookies or refuse to accept them, you might not be able to use all of the features we offer, you may not be able to store your preferences, and some of our pages might not display properly. not be able to store your preferences, and some of our pages might not display properly.