General Terms and Conditions (Terms of Service)

These General Terms and Conditions (the Terms) govern the use of the Veridyn product passport service (the Service) between the Provider and the User (the User or Customer). The Service is a business (B2B) service provided primarily to companies (economic operators).

1. The Provider

Name: being finalised · Registered seat: being finalised
Company registration / registry number: being finalised · Tax number: being finalised
Representative: being finalised · Email: [email protected]

2. Definitions

• Service: the subscription-based online (SaaS) platform available at veridyn.eu for creating, managing and sharing digital product passports (EU DPP).
• User: the legal entity or business that registers for the Service, together with the users it authorises.
• Product passport: the publicly accessible digital data sheet created by the User and its associated QR code.
• Plan: the subscription tier chosen by the User, with its feature and quantity limits.
• Schedules: the Data Processing Agreement (DPA), the Service Level terms (SLA) and the Acceptable Use Policy (AUP), which form an integral part of these Terms once published.

3. Conclusion of the contract, registration

The contract is concluded by electronically submitting the registration and accepting these Terms and the Privacy Notice. The User must provide accurate data, keep its account credentials confidential, and is responsible for the conduct of the users it authorises.

4. The Service and the plans

The Service enables the creation of schema-driven product passports, their multilingual public display, a printable QR code, version tracking, bulk import and a developer API. The plans include different feature and quantity limits as stated on the pricing page. The Service is provided on an "as-is" basis; the Provider may continuously develop the System. If a revision materially reduces functionality, the User may terminate within 30 days of notice of the revision.

5. Fees, subscription, payment

The Service can be started with a free (Free) and trial plan. The fees and limits of paid plans are set out on the pricing page. A subscription runs for the chosen period and — unless agreed otherwise — renews automatically at the end of the period, unless either party gives written notice at least 30 days before the end of the period. If a plan quantity limit is exceeded, the excess usage is automatically charged at the applicable unit price. In the event of late payment, the Provider may suspend access; suspension does not relieve the payment obligation. During the beta the Service is free of charge; the detailed terms for payment, invoicing and the consumer right of withdrawal will become part of these Terms when paid subscriptions are introduced, of which we will give prior notice.

Unlimited batch and unit passports — fair use. Paid plans meter the number of model passports; the number of production-batch (GS1 AI 10) and individual-unit (AI 21) passports is unlimited, subject to the following fair-use conditions: (a) every batch and unit passport must correspond to a real physical product or an actual production batch, within the plan's model allowance; (b) document and storage limits, as well as per-minute API rate limits, apply per plan; (c) a soft threshold applies to scan traffic — if exceeded we notify you and propose a plan, we do not switch the Service off; (d) above 50,000 active child passports we agree on further expansion in advance; (e) automated bulk generation not linked to real products constitutes misuse, and the Provider may suspend the affected access.

6. The User's obligations and liability

• The User is solely responsible for the accuracy, completeness, currency and lawfulness of the product data it submits, whether directly or via the API, including conformity with the relevant EU product regulation (e.g. ESPR (EU) 2024/1781, Battery Regulation (EU) 2023/1542). The Provider supplies the technical tool, not a compliance guarantee.
• The User warrants that the uploaded content does not infringe third-party rights (e.g. intellectual property) and does not violate any law.
• Use of the Service is governed by the Acceptable Use Policy (AUP); scraping, reverse engineering, overloading or compromising the security of the system, and misuse of the API key are prohibited.

7. Data protection and processing

The Provider’s processor obligations — the subject matter, the sub-processors, the security measures and breach handling — are set out in the separate Data processing agreement, which forms part of this contract.

The Provider is the data controller for account and billing data. As regards the data the User enters into product passports — to the extent it contains personal data — the User is the data controller and the Provider acts as a data processor under the separate Data Processing Agreement (DPA). Details are in the Privacy Notice.

8. Intellectual property

The Service, its software, visual identity, schemas and templates are the intellectual property of the Provider (or its licensors). Content uploaded by the User remains the property of the User; the User grants the Provider a non-exclusive licence necessary to provide the Service, display the passport and ensure statutory availability. The Provider may freely use any feedback provided by the User.

9. Confidentiality

Each party keeps confidential information received from the other confidential, does not disclose it to third parties, and uses it only to perform the contract. Publicly available information and information required to be disclosed by law are not confidential. This obligation survives termination of the contract.

10. Warranty, liability, availability

The Provider provides the Service on an "as-is" and "as-available" basis, excluding to the fullest extent permitted by law all express or implied warranties (merchantability, fitness for a particular purpose, non-infringement), and does not warrant that the Service will be uninterrupted or error-free, nor that a given passport meets any specific legal or regulatory requirement. During the beta and until payment is introduced, the Service is provided on a best-effort basis, without an availability guarantee; availability will subsequently be governed by a separate SLA published when paid subscriptions are introduced.

The Provider is not liable for indirect, consequential, special or punitive damages (lost profit, data loss caused by the User, regulatory fines due to the User's data). The Provider's aggregate liability — within the limits of the law — is limited to the amount actually paid in the 12 months preceding the event giving rise to the claim. This limitation does not apply to damage caused intentionally or by gross negligence, or to damage to life, bodily integrity or health.

11. Indemnification

The User indemnifies the Provider against any claims, damages and costs (including reasonable legal fees) arising from the content of the data uploaded by the User, its infringement, a breach of these Terms or the AUP, or the non-conformity of the product data (e.g. a regulatory fine due to the User's data).

12. DPP-specific provisions

• Registry: the Provider may perform technical registration in the central EU DPP registry on the User's behalf, once the registry enables provider-side registration.
• Verified operator / EORI: obtaining the "verified economic operator" status, the eIDAS identification and the EORI identifier is the User's responsibility; the Provider is not liable for consequences arising from their absence.
• Retention: access to the public passport page is free while the Service operates (including on the Free plan); retention beyond that required by law [~10 years / the product life cycle, even without an active account] is provided by the Provider as a separate, paid archival service.

13. Availability of the product passport — what happens to a printed QR code

A product passport URL is printed on the physical product, and the product may be scanned years after purchase. The rules below therefore apply retroactively to products the User has already sold — which is exactly why we state them up front, unambiguously.

• Late payment, suspension: if the subscription lapses or the account is suspended, passports already published remain publicly available — a scanner gets the same passport. In that state the User cannot create new passports or start imports. This is deliberate: a QR code in a buyer’s hands does not depend on whether an invoice happens to be settled.
• Expiry of the trial period: the same rule: existing passports remain available, no new passport can be created.
• Closing the account: closing the account makes the public product passports unavailable, and QR codes already printed will no longer open. The User should weigh this before closing: if products were placed on the market, the statutory availability obligation rests with the User, not the Provider. Internal data is kept for 30 days after closure so the User can export or change their mind; after that it is permanently deleted.
• Switching providers, portability: the Service is built so that the User can leave: passport data is exportable in the form it was entered, and if the User uses their own domain for the QR, the printed code stays theirs after a switch. Where a GTIN exists, the canonical URL uses the GS1 Digital Link form, not the Provider’s internal identifier.
• Archiving and withdrawal: archiving is not the same as withdrawing a product: an archived passport stays available, and the page states that the product is no longer manufactured while the passport remains as a reference. Archiving creates no new data version, because it is a visibility change, not a data change. If the User must withdraw a passport under law, they should signal that separately — archiving alone is not withdrawal.

14. Third parties: supplier data requests and outbound notifications

• Supplier data request: if the User requests data from a supplier, the request is sent by the Provider on the User’s instruction, to the email address the User supplied. The User warrants that they are entitled to supply that address and that they inform the supplier about the processing. The Provider uses supplier data solely to merge the requested fields; the merge creates a new data version, so it is traceable and reversible. Responsibility for the accuracy of submitted data rests with the User and their supplier.
• Outbound notifications (webhooks): if the User configures a notification endpoint, the Provider sends data to that address on their instruction. The User alone is responsible for the endpoint’s security and availability and for what happens to the data once delivered. The Provider retries delivery at most six times with increasing back-off (1 minute to 6 hours); after that the delivery is treated as permanently failed. The delivery log is available for 90 days, and the User can also resend manually. At most ten endpoints may be configured per tenant.
• Access links: the User may issue an expiring link that opens a narrower data tier without sign-in (for a party with legitimate interest or an authority). The User is responsible for distributing the link. It can be revoked at any time, and the system tracks how often and when it was used so that a leaked link becomes detectable. If the User sets no expiry, the link never expires — the system warns about this at issuance.
• Uploaded documents: the User may attach certificates and other records to a passport (PDF or image, at most 8 MB; the Provider verifies the type from the file’s contents). The contents of the document — including trade secrets and third-party data — are the User’s responsibility, and the User chooses the visibility tier. Upon a report of unlawful content the Provider may make the document unavailable and will notify the User.

15. Changes to the machine interface and the end of the beta period

• Schema and API changes: a category’s field list moves with the legislation. The Provider signals every change to the machine contract (field, type, requiredness, enumerated values, access tier, unit of measure) with a version and a fingerprint on the schema endpoint; rewording a label or help text does not count as a change. For backwards-incompatible changes the Provider sends Deprecation and Sunset signals and allows at least 30 days to migrate.
• End of the beta period: during the beta the full functionality of the Service is available free of charge, with a defined passport allowance. The Provider announces the end of the beta in advance, followed by a 45-day grace period; only after it expires do beta accounts move to the free tier. During the grace period the User may pick a plan or export. The founder discount offered to beta participants remains in force on the announced terms.
• Plan allowance and limits: plans meter the number of model passports; production-batch and individual-unit passports are unlimited on every paid plan (subject to fair use). Once the allowance is reached no new model passport can be created while existing ones are untouched; the allowance can be extended with extra passports. Technical limits apply to imports and the machine interface (upload at most 16 MB, uncompressed workbook at most 32 MB, per-plan request limits), which the Service reports in an explanatory error message.
• Support access to the account: for troubleshooting and support, Provider staff may enter the User’s account. The Provider records every such access in an append-only log, and the log is also visible to the User in Settings (when, for how long). Every data version saved by Provider staff during such access is marked in the change history.

16. Term and termination

The User may terminate its account at any time. The Provider may terminate the contract or suspend the account in the event of a material breach of the Terms. Data portability (no export lock-in): the User may export its product data — during the entire subscription and for 30 days after termination — at any time in standard, machine-readable form (JSON-LD, GS1 Digital Link). After termination the Provider deletes the data unless the DPP retention obligation requires further storage. Continuity (the QR does not break): if the Service is permanently discontinued, the Provider gives at least 90 days' prior notice, ensures a full data export, and keeps the already-issued public passport URLs accessible for at least 24 months after shutdown, or redirects them to a new resolver designated by the User — so the QR codes on physical products do not become dead links. Where the User uses its own domain, portability is complete: by redirecting DNS, the printed QR can be moved to any resolver.

17. Amendment of the Terms

The Provider may amend the Terms; it informs the User of the change in an appropriate manner (by email or in the interface). The version in force at any given time is available on this page, with the date of the update.

18. Governing law, dispute resolution

These Terms are governed by Hungarian law. The parties settle their disputes primarily by amicable means. In the event of a consumer dispute, the User may turn to the conciliation body competent for its place of residence, or to the European Commission's Online Dispute Resolution (ODR) platform. The Schedules (DPA, SLA, AUP) form an integral part of these Terms once published.