Trust

Trust and security

The questions procurement teams ask us, answered with what is in place today.

Last checked 22 October 2026

Who acts for you

EPR EU Rep (epreurep.com): the platform, filing in countries without a local service, and checkout. Operated from Madrid, Spain; the legal entity is in the legal notice.
Germany: EPRGermanyRep GbR, named as your representative in LUCID, under its own terms on eprgermanyrep.com.
France: EPRFRANCEREP SAS, 10 rue de la Paix, 75002 Paris (SIREN 131 583 072), signs your mandate and is named as your mandataire.
Spain and Italy: the local services on eprspainrep.com and epritalyrep.com, each naming the entity that signs your mandate.
Other countries: where a local representative is required and we have no entity there, a partner established there, quoted before you commit.

Sign-in by single-use email link, valid for one hour. No passwords to leak.
Session cookies are host-only, secure and HTTP-only; every response is sent over HTTPS with HSTS.
Administrator rights are rechecked on every request, so a removed administrator loses access at once.
A partner or adviser sees your account only after you approve it, and you can revoke that at any time.
Personal API credentials for AI assistants expire after 90 days.

From connected shops we keep counts only: units per product, month and delivery country. No customer names, emails or addresses are stored.
Shop access tokens are encrypted (AES-256-GCM) and never reach a browser. Shop connection data is backed up daily, encrypted, and kept for 30 days.
Documents download as attachments with protective headers, so a file can't run in your browser.
Supplier evidence collected for your PPWR declarations is stored in your portal and shown only to you, advisers you have approved, and us.
Our contract for data processing: data processing agreement.

Registrations and identifiers are in your name and stay yours.
You can download your documents at any time.
If you leave, we hand your scheme memberships over to you or to your next representative.
Disconnecting a shop deletes its data, except figures already used in a filed declaration, which the law requires us to keep with it.

We are not owned or controlled by any scheme or producer responsibility organisation. Scheme memberships we hold under your mandate are for you, and we pick the scheme that fits each client in each country.

Each local service names the entity that acts for you and signs your mandate. Details of our professional liability cover will be published once the policy is issued.

Registrations, numbers, mandates, declarations and deadlines live in your portal, not in someone's inbox, so the record of your compliance does not depend on one person.

Our last internal security review was on 21 October 2026; its findings on sign-in, partner access, connections and document downloads were fixed the same day.
We do not claim any certification such as ISO 27001 or SOC 2.