Your information.
Handled with care.

1. Who is responsible and how to contact us

DAC Exports operates this marketplace and determines how platform account, review and transaction records are used. Its displayed business name is DAC EXPORTS LTD. Verification of the full legal controller identity and address is outstanding and will be added here once confirmed.

DAC's published business contact is contact@dacexports.com. Use the subject “Privacy request” and identify the account or business concerned. Confirming delivery to a monitored, appropriately restricted privacy contact is an outstanding operational action. Please do not email passwords, full card details or identity documents. If further identity evidence is necessary, DAC should request it through a secure route and only to the extent needed.

Any legally required EU/EEA or UK representative, or data protection officer and their contact details, must be confirmed by the controller. No such appointment is represented as verified here.

2. Information we collect and why

Business records can contain personal data about sole traders, directors, employees and other contact people. We collect information you submit, information provided by an authorised company representative or trading counterparty, records generated as you use DAC, payment and email delivery events from service providers, and relevant public official-source information. Existing supplier profiles and catalogue content may also have been migrated from the earlier DAC platform.

Accounts and company contacts

Names, usernames, business email, phone, role, company details and country; password hashes, activation and recovery records. Used to create and secure accounts, identify the company represented, and provide the marketplace. The relevant basis is performance of a contract or requested pre-contract steps where you are personally a contracting party; otherwise DAC's legitimate interests in administering business relationships and authorised access.

Onboarding, KYC and compliance

Business registration, EORI, relevant licences and certificates, uploaded evidence, route and product information, review outcomes, expiry dates and reviewer records. Used to assess eligibility and applicable trade requirements. Bases are legitimate interests in trustworthy and compliant trade, contractual necessity where applicable, and compliance with a specific legal obligation where one actually applies. The applicable obligation must be identified for the particular record; DAC does not assume every check is legally mandatory. Submit only relevant evidence, with unnecessary personal details removed where permitted.

Supplier profiles and products

Supplier contact details, descriptions, images, product specifications, availability and prices. Approved public profiles and listings are visible to visitors and business buyers. Used to help businesses discover and evaluate supply, on the basis of contractual necessity where applicable and legitimate interests in operating the business marketplace. Private compliance uploads are distinct from public catalogue material.

Orders, payments and billing

Buyer and seller identities, contact details, order lines, amount, currency, destination, approval and shipment records; Stripe customer, Checkout, payment and event references and reconciliation results. Used to administer transactions, account history, payment reconciliation and disputes. Bases are contractual necessity where applicable, legitimate interests in commercial administration and fraud prevention, and applicable accounting or other legal obligations. Card entry is handled by Stripe Checkout; DAC does not collect full card numbers or card security codes through its forms.

Communications and support

Account and service messages, recipients, message content, delivery attempts, bounces, suppression records and support correspondence. Used to deliver secure account links, communicate reviews and orders, resolve issues and honour privacy requests. Bases are the relevant service relationship and legitimate interests in reliable communications; legal obligations apply to rights requests where required.

Technical, audit and security records

Session and request information, network addresses where recorded, authentication attempts, permission checks, audit actions, timestamps, upload scan results and operational errors. Used to protect accounts, investigate incidents, prevent abuse and maintain service availability. Basis: legitimate interests in security and accountability, and specific legal obligations where applicable. Access to private records is restricted by role.

Mandatory form fields and required evidence enable the relevant account, review or transaction stage. Without them, DAC may be unable to activate an account, approve a product, accept an order or permit shipment. Optional route details help prepare requirements earlier. Shipment-only evidence is requested at the relevant later stage.

Where consent is required for a separate optional activity, it must be obtained separately and can be withdrawn without affecting prior lawful processing. Using the platform or reading this notice is not blanket consent to all processing. DAC must assess and document its legitimate interests and balance them against individuals' rights.

3. AI-assisted compliance research

DAC uses the OpenAI Responses API with web research to prepare trade requirements from role, origin, destination, product category and compliance stage. The current research prompt does not include account email, company contact identity or uploaded documents. Route/category fields are free text, so avoid entering personal information there.

Official-source findings and research outcomes are stored as part of the route checklist. Automated preparation is advisory. Insufficient evidence or a research failure leads to manual review rather than regulatory approval. Product, company and trade approvals remain subject to their existing checks; payment does not authorise shipment. You may ask DAC to review inaccurate information or a decision affecting you. Provider-side retention, contractual controls and transfer terms for this API usage are still being verified.

4. Recipients, providers and international processing

Authorised DAC staff access records needed for their responsibilities. Trading counterparties see information needed for their transaction. Approved supplier and product information is public. Authorities, professional advisers or other recipients may receive information where required by applicable law or necessary to establish or defend claims, subject to appropriate controls.

• Railway: application hosting, PostgreSQL database and private file storage. Current production deployment is in Amsterdam. This location alone does not establish where every provider support or telemetry operation takes place.
• Hetzner: encrypted disaster-recovery storage in HEL1, Helsinki, as recorded in DAC's operational evidence. Backup access and recovery keys are separately controlled.
• Postmark: transactional account and service email, delivery events and suppression handling. External customer delivery is still subject to production acceptance.
• Stripe: hosted buyer payment processing, customer and payment references, and payment events. Stripe may act as a processor or an independent controller for different activities; applicable account terms and Stripe's own notice govern those roles.
• OpenAI: AI-assisted official-source compliance research described above.
• Hostinger: existing DAC business mail service, separate from Postmark. DAC-owned mailbox transition, access and final contract details are being confirmed.
• GitHub: source control and build/deployment workflows. This is not a customer document-upload destination; repository access and any operational evidence retained there require access and retention review.

Upload malware checks use DAC's privately hosted ClamAV service within Railway, rather than an external public scanning service. Cloudflare DNS is prepared for a manual domain cutover; it is not represented here as an active proxied application or analytics service.

International businesses, recipients and provider operations may involve processing outside your country or the EU/EEA. Hosting in Europe is not a guarantee that every processing activity stays there. DAC must verify the actual recipients and countries and document the applicable transfer basis, such as an applicable adequacy decision or appropriate contractual safeguards with any necessary supplementary measures. Executed agreements, provider subprocessors and transfer assessments are outstanding legal/operational confirmations. No unverified transfer mechanism is asserted to be in force. You may request information about confirmed safeguards and how to obtain a copy through the privacy contact.

5. How long information is kept

Retention must reflect the purpose of each record, the duration of the business relationship, applicable accounting and trade obligations, certificate validity, unresolved disputes and proportionate security needs. Account and company information is needed while the relationship is active; order and billing evidence may need to survive account closure. Compliance evidence should be reviewed when it expires or is superseded. Security, communication and backup records need separately justified limits.

An approved schedule with category-specific periods and a verified deletion process is still outstanding. Account closure or certificate expiry does not currently establish automatic deletion. Audit records include append-only protections, and backup rotation is not equivalent to immediate erasure from every recovery copy. The controller must confirm appropriate restriction, deletion or anonymisation procedures, legal holds, provider deletion and how erasures are reapplied after recovery. DAC will not promise a fixed period that has not been established.

6. Your rights and complaints

Depending on the law applicable to you and the processing concerned, you may request access, correction, erasure, restriction or portability, object to processing based on legitimate interests, and withdraw consent where processing relies on it. These rights have conditions and exceptions. You can raise concerns about automated processing and ask for human review. DAC may need proportionate identity verification before disclosing or changing records.

For GDPR requests, the usual response period is one month; where a permitted extension is necessary, the reasons and extension must be communicated within that first month. You may complain to a competent data protection authority. EU/EEA users may in particular approach the authority in their habitual residence, place of work or place of the alleged infringement. Other jurisdictions may provide additional local rights and complaint routes. You do not have to complain to DAC first.

7. Cookies and external services

The current DAC application uses essential session cookies for sign-in and CSRF cookies to protect forms. Default browser lifetimes in the current application are two weeks for the session cookie and approximately one year for the CSRF cookie; browser settings, logout and renewal can affect these. Blocking essential cookies may prevent sign-in or secure form submission. The reviewed application templates contain no advertising trackers or optional analytics scripts, so no optional analytics consent is claimed.

Following a link to Stripe Checkout or another external website brings you under that service's cookie and privacy information. If DAC later introduces optional analytics or tracking, it must update this notice and implement any required choices before use.

8. Changes and outstanding confirmations

The publication date above identifies this version. Material changes to processing should be communicated through an appropriate channel. Before public customer onboarding opens, DAC's owner must confirm the controller identity and contact, privacy-request handling, retention schedule, provider agreements, transfer safeguards and any required representative or data protection officer. These are specific follow-ups, not assumptions that have been treated as completed.