Privacy Policy

Last updated: September 7, 2026

1. Scope

This Privacy Policy applies to the dppcq.org website and all associated DPP-CQ verification services operated by the International Communication Organization (ICO). It describes what data we collect, how it is used, and the choices available to individuals.

2. Data We Collect

2.1 Website Analytics

This website uses minimal, privacy-respecting analytics. We do not use third-party tracking cookies. Collected data is limited to:

• Pages visited and referrer information
• Browser type and version (anonymized)
• Approximate geographic region (country level only)

2.2 Verification Service

When you use the DPP verification service, the system processes:

• Credential identifiers (DIDs, credential hashes) submitted for verification
• Timestamps of verification requests

The verification service operates on a zero-knowledge principle: it confirms the validity of a credential without storing or transmitting the underlying product data. Verification queries are processed in real time and are not persisted beyond operational logging (retained for a maximum of 90 days).

2.3 Communications

If you contact us via email (e.g., working group applications, public comment submissions), we retain the content of your message and your contact details for the purpose of responding and maintaining governance records.

3. Data We Do Not Collect

• We do not collect personal identifiers unless voluntarily provided
• We do not use advertising trackers or third-party data brokers
• We do not build user profiles for behavioral targeting
• We do not sell or share personal data with commercial third parties

4. Legal Basis

Data processing is based on: (a) legitimate interest in operating a public-interest technical standard and verification service; (b) consent, where applicable (e.g., working group participation); and (c) legal obligation, where required by applicable law.

5. Data Retention

• Analytics data: Retained for a maximum of 12 months
• Verification logs: Retained for a maximum of 90 days
• Email correspondence: Retained as needed for governance and legal compliance
• Governance records: Public comments and working group records retained per the ICO Governance Charter

6. Your Rights

You have the right to access, correct, delete, or restrict the processing of your personal data. To exercise these rights, contact us at [email protected].

7. International Transfers

ICO is registered in Colorado, United States. Data may be processed in jurisdictions outside your country of residence. All transfers comply with applicable data protection laws.

8. Changes to This Policy

This policy may be updated to reflect changes in the standard, verification services, or legal requirements. Material changes will be announced through the dppcq.org website and/or the community mailing list.

9. Contact

International Communication Organization (ICO)
Email: [email protected]
Web: www.icoun.org