A mattress product passport contains core product information: material composition, origin, repair and recycling instructions, and data about the manufacturer or importer. Personal data about the buyer does not normally belong there. The regulation is written to track a mattress as a product, not to register who sleeps on it.
Yet the question is justified, because once a company starts managing the passport, personal data does come into view: the contact person managing the account, and sometimes customer or warranty data that a company itself links to a mattress. That touches the General Data Protection Regulation, but through a different route than the passport itself.
What is actually in the passport
The passport is built around the product: the mattress model, the batch or unique serial number, the materials used, whether it contains hazardous substances, how the mattress can be repaired or recycled, and who the manufacturer or importer is. These are data about a thing, not data about a person. Which categories are mandatory is stated in the regulation itself and in the delegated act that follows for each product category; for mattresses it has not yet been published. the regulation explained by subject in the knowledge base indicates for each concept what is already established at this moment and what is still to come.
Where personal data enters the picture
As soon as your company creates an account to have passports drawn up and hosted, you usually provide a contact person: a name, a function, a business email address. These are personal data, even though the account itself is linked to the legal entity, with Chamber of Commerce and VAT number, and not to a single private person. How a platform handles that data, how long it is retained and who has access to it, is precisely what GDPR is about. how data and privacy are handled describes that for matrapas.eu.
The business account and GDPR
A business account does not change your company's GDPR obligations as a controller or processor; which role applies depends on the situation. The regulation for mattresses governs the product. GDPR separately governs how your company handles data about people, including your own employees who manage the passport. Both regulations exist side by side and do not replace each other.
What if you link customer data to the passport
Some companies want to go further than the regulation requires: linking a serial number to a purchase date, a warranty period, or the buyer's name, for example for complaint handling or a hotel that registers mattresses by room. That is a choice of the company, not an obligation from the mattress regulation. Once that happens, a new processing of personal data arises for which the ordinary GDPR rules apply: a legal basis, a retention period, and clarity about who has access to it. Whether that applies to your company, you can first explore for yourself with a few questions. How you set up such a link in detail is best discussed with a lawyer or your own data protection officer.
Where responsibility lies
The regulation sets out which product data must at minimum be in a passport and who may supply them: the manufacturer or importer. They remain responsible for the accuracy of that data, even if a third party hosts the passport. For everything else in terms of personal data processing, the normal division from GDPR between controller and processor applies. Which role your company plays in this is not the same in every case and is for you or your adviser to determine.
Supervisory authorities on the mattress regulation look at the product data in the passport; the Personal Data Authority looks at the handling of personal data. These are two separate supervisory lines that run independently of each other.
Would you like to first read carefully how other concepts from the regulation fit together before taking further steps? read the frequently asked questions about the mattress passport provides a good starting point for that, as does a non-binding look at your own situation via the free quick-scan.