Privacy policy

Last updated: 14 November 2026

Who is responsible for your data

• Owner: [pending registration] (full name or company name)
• Tax ID (NIF/CIF): [pending registration]
• Address: [pending registration]
• Email: hello@reduceeprcosts.com
• Website: reduceeprcosts.com

What data we process and why

• Your account: your email address, company name, sign-in links and a session cookie, your purchases, plans and credits, and, for partners, your clients' names and tax IDs, your brand name and logo. We use them to give you access to what you bought. Legal basis: contract (Art. 6(1)(b) GDPR).
• Your check: your email, company name, the declaration files you upload and the figures in them, and the result of the comparison. We use them to calculate and show your comparison. Legal basis: steps taken at your request before or under a contract (Art. 6(1)(b) GDPR).
• Payment and invoicing: name, email, billing address, tax ID and payment status, handled through Stripe. We never see or store your full card number. Legal basis: contract (Art. 6(1)(b)) and our legal tax and accounting obligations (Art. 6(1)(c)).
• Fee alerts: the markets, EPR categories and PROs you choose, to email you verified fee publications. Only for Full access and Partner plans; you can change or remove your alerts at any time in your dashboard. Legal basis: contract (Art. 6(1)(b)).
• Contact form: name, email, company and message, to answer you. Legal basis: your request (Art. 6(1)(b)) and our legitimate interest in replying (Art. 6(1)(f)).
• Security logs: IP address and technical request data kept by our hosting provider to protect the service. Legal basis: legitimate interest (Art. 6(1)(f)).

Partners and their clients. When a partner uploads a client's declaration, the partner decides what is uploaded and why; for any personal data in it, the partner is the controller and we process it on the partner's behalf, only to produce the comparison. Partners must have the right to share those documents with us.

Declarations usually contain company data rather than personal data, but they can include the name of the person who signed them. Please upload only what is needed for the comparison.

Automatic reading of your declaration

To save you typing, your files are read automatically by an AI model running on Cloudflare's infrastructure to extract the weights per material. You review and can correct every figure before the comparison is made. The comparison itself is a fixed calculation with published tariffs. No decision with legal effects on you is taken automatically.

Who receives your data

• Cloudflare, Inc. (hosting, file storage, database, AI processing and sending our emails), as our processor.
• Stripe Payments Europe, Ltd. (payments), which also acts as an independent controller for its own legal obligations.

These providers may process data outside the European Economic Area, including in the United States. Such transfers are covered by the EU-US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses. We do not sell your data or use it for advertising.

How long we keep it

• Uploaded declaration files are deleted automatically 30 days after upload. The figures you confirmed and your results stay in your account.
• Checks not linked to any account (no purchase, no sign-in) are deleted after 30 days.
• Your account, checks and results are kept while you use the service and for 12 months after your last plan or purchase ends, unless you delete checks yourself or ask us to delete your account earlier.
• Invoices and payment records are kept for as long as Spanish tax and commercial law requires (generally 6 years).
• Sign-in links expire after 30 minutes (24 hours for the link sent after a payment); sessions after 30 days.
• Contact messages are kept for 12 months.

Your rights

You can ask for access, correction, deletion, restriction, portability or object to processing by emailing hello@reduceeprcosts.com. Where processing is based on consent you can withdraw it at any time. You can also complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es).