Translation — review pending

Version for the trial phase – 6 October 2026 Legal review is pending. This provisional version will be replaced after review. Statutory rights remain unaffected. Translation – review pending SPV privacy notice, additional section / 6 October 2026

This version describes the SPV trial operation. Legal review and the specification of general retention periods will follow.

1. Controller and contact Controller: Dirk Zimmermann – SIGVORA, sole trader (autónomo), Cami Vell d'Alcudia, buzón n79, 07300 Inca, Illes Balears, Spain. NIE: X4992286K. Contact: info@sigvora.eu. SPV privacy enquiries: info@sigvora.eu.

2. Account and profile SPV uses a separate SPV account in its own database for sign-in. Data includes the account and SPV identifiers, email address, display name and language, plus country, occupations, skills and self-declared experience in the SPV profile. Password hashes and sign-in sessions belong exclusively to the SPV database; the personal SPV export excludes password hashes and session secrets. Acceptance of the SPV terms is recorded with its version, date and language. Acceptance of terms does not itself provide the legal basis for every processing activity.

3. Evidence, belongings and files For evidence management and verification, we process statements, evidence type, description, relevant dates, occupation/skill references, the basis for confirmation, issuer, responsible member, validity and status. Belongings also involve a category, title, description, images and identifiers such as a VIN or serial number. Lists mask identifiers; full values remain stored for authorised detail views. Self-declarations are labelled as unverified. Evidence files, images and organisation documents are stored encrypted in the database. Access is limited to the holder and authorised organisation members involved in the relevant verification process; authorised administrators also review organisation documents. Encryption is server-side, not end-to-end. Not all text and metadata fields are individually encrypted. Avoid unnecessary health information, identity document copies and information about uninvolved people.

4. Insurance folder Stored data includes the insurer, insurance type, policy number, validity, document and optional links to belongings. Policy numbers are encrypted and masked in views. An optional reminder is scheduled 30 days before expiry; the worker also handles policies within the remaining 30-day window that have not yet received a reminder. SIGVORA does not arrange insurance or provide insurance advice.

5. Issuers and waiting list Issuer data includes the organisation's name, country, registration number/type, sector, website, responsible account, role, supporting documents, member permissions and review decisions. Private signing keys remain encrypted on the server. Reviewing an organisation does not guarantee the accuracy of every statement. The waiting list stores email addresses and consent with its text version and date. Joining it is based on consent, which can be withdrawn for future processing. Its purpose is to provide information about SPV for issuers. Consent can be withdrawn by contacting info@sigvora.eu.

6. Sharing and verification The holder selects credentials, individual fields and an expiry date. Anyone with a valid link can view the selected information and forward the link. The holder's name is not preselected; date of birth and address are not disclosed by default. Sharing can be withdrawn. Unselected information is not delivered to a verifier as readable text or disclosure data. Public technical signature/status information is separate and may contain technical references. SPV stores share records, expiry, withdrawal and view events with the time and verification result. spv_share_views does not permanently store IP addresses. Temporary limits help prevent token guessing; infrastructure and access logs require a separate assessment. Withdrawing a link does not remove copies already saved by a recipient. The recipient decides how to use the evidence; SIGVORA does not assess people.

7. Purposes, legal bases and recipients Purposes include account access, requested evidence management and confirmation, holder-initiated sharing, organisation review, abuse prevention and accountability for approval, suspension and revocation.

Recipients include issuers chosen by the holder, authorised organisation members and administrators, and people with a sharing link. The tested SPV workflow has no referral to commercial or recruitment partners; this draft does not authorise such referrals. Transactional messages are sent through the OVH mail service. OVHcloud also provides hosting and the PostgreSQL database.

8. Retention and deletion The prototype retains regular SPV data until user deletion or the relevant feature action; general automatic retention periods are not implemented. An expired or withdrawn link becomes unusable; this does not automatically remove every underlying record. Deleting an SPV profile removes its belongings, requests, encrypted holder files, shares/view events and insurance documents. Issued credentials belonging to that profile are revoked; personal SD-JWT content and the confirmation basis are removed. Minimal issuer/revocation/status references remain. Audit records are pseudonymised, which does not mean fully anonymous. Organisation records/documents and membership references follow a separate lifecycle; memberships are suspended. The separate SPV account, password data, verification tokens and sessions are deleted. Demo records expire after 24 hours and are deleted by the worker; resetting deletes them immediately. The public demo does not send messages to external recipients. The separate Preview mail catcher is used only for tests.

9. Your rights Depending on the applicable conditions, rights include access, rectification, erasure, restriction, objection and portability; consent can be withdrawn for future processing. You may complain to the competent data protection authority, including the Agencia Española de Protección de Datos (AEPD), https://www.aepd.es/. Export and SPV deletion are available in the account area; send other requests to the contact above.

Editorial sources: GDPR, particularly Articles 6, 13, 17, 20, 25, 32 and Chapter V: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679; EDPB rights guidance: https://www.edpb.europa.eu/sme/be-compliant/respect-individuals-rights_en