Conditions d'utilisation

Effective Date: October 10, 2026 Last Updated: October 10, 2026 Version: 2.0

These Terms of Service ("Terms") form a legally binding agreement between you ("Customer," "you," or "your") and PassportCraft LLC, a New York limited liability company ("PassportCraft," "we," "us," or "our"), governing your access to and use of the PassportCraft platform, website, and related services (collectively, the "Service").

By creating an account, accessing, or using the Service, you agree to be bound by these Terms. If you do not agree, do not use the Service.

1. Scope and Acceptance

1.1 Business Use Only

The Service is designed exclusively for business-to-business ("B2B") use. By accepting these Terms, you represent and warrant that:

(a) You are acting on behalf of a business entity, not as a consumer.

(b) You have the legal authority to bind that entity to these Terms.

(c) Your use of the Service is for commercial or professional purposes related to product compliance, supply chain management, or regulatory obligations.

These Terms do not create any consumer rights or obligations. If you are a natural person acting outside the scope of a trade, business, craft, or profession, you may not use the Service.

1.2 Acceptance

These Terms become effective when you first create an account, click "I agree," or otherwise access the Service — whichever occurs first. If you are accepting on behalf of an organization, "Customer" refers to that organization. Acceptance is given by the Customer's explicit, affirmative action (such as creating an account or clicking "I agree").

By that explicit action, the Customer acknowledges that it has read, understood, and specifically accepts each of the following provisions, which the Customer recognizes as significant terms allocating risk and rights between the parties: Section 3.3 (Modifications to the Service); Section 3.4 (Beta and Preview Features, including the liability cap in Section 3.4(c)); Section 5.2(d) (failed payments); Section 5.4 (Price Changes); Section 5.6 (What a Plan Counts); Section 5.10 (Chargebacks and Payment Disputes); Section 5.12 (Battery Units); Section 5.13 (When the Plan Rules Apply); Sections 10.1 and 10.2 (limitation and exclusion of liability); Section 12.1 (Plan Term and Renewal, including automatic renewal); Sections 12.4 and 12.7 (Termination and Suspension by PassportCraft); Section 12.6(b) (fees due on termination); Sections 13.5(d) and (e) (when we may unpublish a passport, and when these Terms end); Section 13A(g) (Early termination fee); Section 17 (Modifications to These Terms); and Sections 18.2 and 18.3 (arbitration and choice of jurisdiction). Where the mandatory law of the Customer's country of establishment (for example, Articles 1341 and 1342 of the Italian Civil Code) requires that designated clauses of this kind be specifically approved, the Customer's explicit acceptance of these Terms, which separately identifies and approves the provisions listed in this Section 1.2, constitutes that approval to the extent permitted by that law. This Section operates together with Sections 18.4 and 19.2, and any provision that remains unenforceable under such mandatory law is treated as provided in those Sections.

1.3 Additional Agreements

Certain features of the Service may be subject to additional terms, including but not limited to:

A Data Processing Agreement ("DPA"), which governs the processing of personal data on the Customer's behalf.
Service-specific terms published on our website.

Where additional terms conflict with these Terms, the additional terms prevail for the relevant feature or service.

1.4 Order of Precedence

In the event of a conflict between documents, the following order of precedence applies (highest to lowest):

Data Processing Agreement (DPA)
An applicable order form, with respect to the commercial terms (such as price, plan, and scope) it expressly sets out
These Terms of Service
The Acceptable Use Policy and other service-specific terms or policies published on the website

1.5 Public Passport Pages and Visitors

The Service hosts publicly accessible DPP pages (Section 3.1(b)) that anyone may view, including by scanning a printed QR code. For the avoidance of doubt:

(a) Individuals who view or scan a publicly hosted DPP page are visitors, not "Customers," Authorized Users, or parties to these Terms. No account is created, and no agreement under these Terms is formed, by merely viewing a passport page. This is consistent with the business-only representation in Section 1.1.

(b) A visitor's interaction with a public DPP page is governed by our Privacy Policy, not by these Terms. The handling of any data collected when a visitor views or scans a public DPP page — including the limited, non-identifying scan analytics described in Section 2.8 of the Privacy Policy — is described in our Privacy Policy, available at https://passportcraft.com/privacy.

(c) The content of each DPP page is supplied and controlled by the publishing brand (the Customer), which is solely responsible for its accuracy, quality, legality, and completeness (Section 6.4). PassportCraft does not verify or validate that content.

(d) A visitor who believes a DPP page contains unlawful or infringing content may report it as described in Section 9.3.

2. Account Registration

2.1 Eligibility

To create an account, you must:

(a) Be at least 18 years of age.

(b) Provide accurate, current, and complete registration information.

2.2 Account Security

You are responsible for:

(a) Maintaining the confidentiality of your account credentials.

(b) All activity that occurs under your account, whether or not authorized by you, except for unauthorized activity to the extent it results from PassportCraft's own breach of its security obligations (including a security failure for which PassportCraft is responsible under Section 10.7); this exception does not apply to activity by your Authorized Users (Section 2.3), for which you remain responsible.

(c) Notifying us promptly at security@passportcraft.com if you become aware of any unauthorized access to or use of your account.

(d) Promptly reporting to security@passportcraft.com any suspected security vulnerability, data breach, or credential compromise affecting the Service or your account that you become aware of.

(e) Not conducting any security, penetration, or vulnerability testing of the Service or its infrastructure without our prior written authorization. This obligation complements, and does not limit, the prohibition on unauthorized access in Section 9.1(e).

We are not liable for any loss or damage arising from your failure to secure your account credentials or from your misconfiguration of the Service or your own systems.

2.3 Customer Users

You may authorize individuals within your organization to access the Service under your account ("Authorized Users"). You are responsible for ensuring that all Authorized Users comply with these Terms and for any actions they take through the Service.

2.4 Partners

A partner is a business that resells the Service, or manages workspaces for its clients, under a partner agreement with us. Where a partner manages your workspace or pays for your plan:

(a) Its staff are your Authorized Users. The partner's staff seated in your workspace are your Authorized Users under Section 2.3. Your owners and administrators can see them and remove any of them, or end the partner's access, in the Service at any time, and we act on your instructions about the partner's access as your processor.

(b) The partner is not our agent. The partner cannot bind us, change these Terms or the DPA, or give you rights beyond them.

(c) Payments to the partner are not payments to us. Amounts you pay the partner are not payments to us. We are not liable for the partner's acts or omissions, including its own services to you, and we have no duty to intervene in your dealings with it, except to act on your instructions under paragraph (a).

(d) Our obligations stay ours. Whoever pays, our obligations for the Service are those in these Terms and the DPA, and you claim them from us, not from the partner.

3. Service Description

3.1 Overview

PassportCraft provides a software-as-a-service platform that enables brands to create, manage, and host Digital Product Passports ("DPPs") in preparation for compliance with the EU Ecodesign for Sustainable Products Regulation ("ESPR") and related delegated acts. The Service includes:

(a) DPP Creation Tools — Structured data entry for product-level sustainability, compliance, and circularity information.

(b) Hosted DPP Pages — Publicly accessible product passport pages hosted on PassportCraft infrastructure.

(c) GS1 Digital Link QR Codes — Generation of QR codes conforming to GS1 Digital Link standards, linking to hosted DPP pages.

(d) Compliance Tools — Readiness assessments, data validation, and formatting tools to help structure DPP data in line with current regulatory guidance.

(e) Reporting and Analytics — Dashboards and reports on DPP page performance, scan activity, and data completeness.

(f) AI-Assisted Tools — Optional features that use artificial intelligence to help you draft and structure DPP content (for example, sustainability-claim rewriting and care-symbol suggestions). AI output is a suggestion that you must review before use, is provided without warranty as to accuracy, and is neither used to train our models nor used by our AI provider to train its models by default. See our Privacy Policy for details on how data submitted to these features is processed.

(g) AI Act and Transparency. The AI-Assisted Tools incorporate a third-party general-purpose AI model. The general-purpose AI model embedded in these tools is supplied by a third-party model provider that is itself subject to the provider-side obligations for general-purpose AI models under the EU Artificial Intelligence Act (Articles 53 and 55), applicable since 2 August 2025; as between the parties, PassportCraft acts as a downstream deployer and integrator of that model and is not the provider of a general-purpose AI model, and any provider-side obligations — including provider-side marking of synthetic output in a machine-readable format — rest with the model provider, not with PassportCraft. As between the parties, you act as the deployer and publisher of any DPP content you create with these tools, and you are solely responsible for any transparency, labelling, disclosure, or human-oversight obligations applicable to that content under the EU Artificial Intelligence Act (Regulation (EU) 2024/1689), including the transparency obligations in Article 50 that apply from 2 August 2026. This includes any duty to disclose AI generation or manipulation, to exercise human review and editorial control over the content before publication, and any requirement that synthetic output be marked in a machine-readable format. PassportCraft makes no representation that AI output is, or is not, marked as synthetic, and you must not rely on the Service to satisfy any provider-side marking obligation. This Section 3.1(g) does not limit, and is in addition to, the prohibitions in the Acceptable Use Policy.

3.2 Service Availability

We use commercially reasonable efforts to make the Service available on a continuous basis. However, the Service may be temporarily unavailable due to scheduled maintenance, unscheduled emergency maintenance, or events beyond our control. We will make reasonable efforts to provide advance notice of planned downtime.

PassportCraft does not provide a binding uptime service-level commitment, and the availability efforts described in this Section are a target, not a warranty. Any liability of PassportCraft for unavailability of the Service is subject to Sections 10.1, 10.2, and 10.5 and (for Customers in the European Economic Area) Section 10.7, and PassportCraft has no obligation to provide service credits.

3.3 Modifications to the Service

We may update, modify, or discontinue features of the Service from time to time. If we make a material reduction in the core functionality of the Service that adversely affects your use, we will provide at least 30 days' prior notice. Such changes do not affect your rights under the termination provisions in Section 12.

3.4 Beta and Preview Features

From time to time we may make features available that are identified as "beta," "preview," "alpha," "early access," or by a similar designation ("Beta Features"). Beta Features are provided to give you early access to functionality that is still under development.

(a) Beta Features are provided "as is" and "as available," without warranties of any kind, and are excluded from the Service availability commitment in Section 3.2, the material-reduction notice requirement in Section 3.3, the warranties referenced in Section 10.5, PassportCraft's indemnification obligations in Section 11.2 (including the IP indemnity), and any support obligation. Your indemnification obligations in Section 11.1 continue to apply to your use of any Beta Feature.

(b) We may modify, suspend, or discontinue any Beta Feature at any time, with or without notice, and without liability.

(c) Subject to Sections 10.3 and 10.7, and to the maximum extent permitted by applicable law, PassportCraft's total aggregate liability arising out of or related to your use of any Beta Feature shall not exceed one thousand US dollars (USD $1,000). The exceptions in Section 10.3 do not lift this Beta cap; for Beta Features, this $1,000 cap controls, except that (i) it does not limit liability that cannot be limited under applicable law (Section 10.3(b)(vi)), including the matters made unlimited for Customers in the European Economic Area under Section 10.7, and (ii) it does not cap your own indemnification obligations under Section 11.1, which remain uncapped. Where a Customer is on the Free Plan, the $100 limit in Section 10.1 applies in the aggregate, and the $1,000 Beta limit in this Section 3.4(c) operates only as a ceiling and does not increase the $100 aggregate limit applicable to a Free-Plan Customer.

(d) AI-Assisted Tools (Section 3.1(f)) that are not designated as Beta Features remain governed by the no-warranty terms in Section 3.1(f); where an AI-Assisted Tool is designated as a Beta Feature, this Section 3.4 also applies.

4. Free Tier and Trial

4.1 Free Tier

PassportCraft offers a free tier of the Service ("Free Plan") with limited functionality, including a restricted number of SKUs and features. The Free Plan is:

(a) Available indefinitely, subject to these Terms.

(b) Provided "as is" without any service level commitments.

We reserve the right to modify or discontinue the Free Plan with 90 days' prior notice to affected accounts. Published passports stay online (Section 13.5(b)).

4.2 Premium Trial

We may offer a 14-day trial of premium features ("Trial Period"). During the Trial Period:

(a) You have access to premium features at no charge.

(b) The Trial Period does not automatically convert to a paid subscription. At the end of the Trial Period, premium features will become inaccessible unless you explicitly subscribe to a paid plan. Published passports stay online (Section 13.5(b)).

(d) We will notify you before the Trial Period expires so you can decide whether to subscribe.

4.3 No Dark Patterns

We do not engage in deceptive subscription practices. We will never:

(a) Automatically convert a trial into a paid subscription without your explicit consent.

(b) Make it unreasonably difficult to cancel, downgrade, or export your data.

5. Subscription and Billing

5.1 Subscription Plans

Paid access to the Service is available through subscription plans as described on our pricing page at https://passportcraft.com/pricing. Every paid plan runs for twelve (12) months (a "Plan Term"), paid in advance. An upgrade starts a new Plan Term. Section 12.5 applies in Germany.

5.2 Fees and Payment

(a) Fees for your selected plan are due in advance, as specified at the time of purchase.

(b) All fees are stated exclusive of applicable taxes unless otherwise indicated.

(d) If a payment fails, we notify you. Until it is paid, you cannot create or rotate live API keys, but you can always revoke one. If the payment is still unpaid seven (7) days after the charge first failed, these also pause until it is paid: publishing and republishing passports, further languages, connecting a brand domain, filings through the Service, and requests made with your live API keys. Nothing else pauses: your published passports stay online, and you can correct and export your data. If the payment is still unpaid when our payment processor stops retrying, your paid plan ends as a cancellation (Section 12.3(a)), and you owe nothing for the Plan Term that payment was for.

(e) All fees are quoted and payable in the currency shown at checkout or on the applicable order form (currently euro (EUR)), and that currency controls. The US-dollar amounts elsewhere in these Terms (the Beta liability cap in Section 3.4(c) and the liability caps in Section 10.1, including the aggregate USD $25,000 ceiling and the Free-Plan cap) are stated for the limited purpose of denominating those liability limits only; they are not the billing currency.

(f) Late payment. Without limiting our other rights, any amount not paid when due accrues interest from the due date until paid at the lower of one and one-half percent (1.5%) per month or the maximum rate permitted by applicable law. You are responsible for all reasonable costs we incur in collecting overdue amounts, including reasonable attorneys' fees and collection-agency costs, to the extent permitted by applicable law. For Customers established in the EU/EEA, interest on overdue amounts and recovery of reasonable collection costs apply at least as provided by Directive 2011/7/EU as implemented in the Customer's member state. Interest and collection costs under this paragraph are themselves payment obligations under Section 5. We will not apply default interest under this paragraph to an amount that you are disputing reasonably and in good faith within the period and on the terms set out in Section 5.10(f) for so long as that dispute remains open.

5.3 Taxes

You are responsible for all applicable taxes, levies, and duties imposed by taxing authorities in connection with your subscription, excluding taxes on PassportCraft's net income. If we are required to collect or remit taxes on your behalf, those amounts will be invoiced and added to your payment.

5.4 Price Changes

We may change subscription pricing with at least 30 days' prior notice. Price changes take effect at the start of your next Plan Term following the notice period. If you do not agree with a price change, you may cancel your plan before the new pricing takes effect, or close your account without fee (13A(g)) within 30 days of our notice.

5.5 Refunds

All payment obligations are non-cancelable and all fees paid are non-refundable, except:

(a) Where required by applicable law.

(b) Where you terminate for PassportCraft's uncured material breach under Section 12.2(a), in which case PassportCraft will refund the prepaid fees covering the remainder of the then-current term after the effective date of termination.

(c) Pro-rated refunds may be issued at our discretion for annual subscriptions terminated early for cause by the Customer.

(d) Where PassportCraft terminates for convenience under Section 12.4(d), in which case PassportCraft will refund the prepaid fees covering the remainder of the then-current term after the effective date of termination.

Re-performance or a refund offered for a performance or availability failure that does not result in termination is governed by the sole-and-exclusive-remedy provision in Section 10.8; this does not reduce the refund payable under Section 5.5(b) where you terminate for PassportCraft's uncured material breach under Section 12.2(a).

5.6 What a Plan Counts

(a) Count. Each plan allows a number of published Digital Product Passports (its "count"), shown on our pricing page or order form. One passport is one product, including its sizes and colours. On Scale you may add blocks of 3,000 places to your count at any time. A block added during a Plan Term is charged pro rata to the end of that term and then renews with your plan; adding one does not start a new Plan Term. You may remove blocks from the end of a Plan Term, as with a downgrade (Section 5.9(b)).

(b) Places used. A workspace's places used are its passports online, plus places not yet freed under paragraph (c). It is over its count while its places used exceed its count. While its places used equal its count, it cannot publish a passport that needs a new place.

(c) When a place frees. On a paid plan, a place freed by unpublishing or deleting a passport frees at the start of your next Plan Term. A passport unpublished or deleted within seven (7) days of its first publication frees its place at once. A passport republished before its place frees takes that place back and needs no new one. Places not yet freed free when a paid plan ends without a move to another paid plan. On the Free Plan, a place frees at once.

(d) One count per workspace. Each workspace's places used are compared with its own plan's count.

(e) Over the count. While a workspace is over its count, its published passports stay online (Section 13.5(b)) and you can correct their data. You cannot change a published passport's name or barcode, or publish a passport that needs a new place.

(f) After a cancellation. After a cancellation (Section 12.3(a)), until the workspace buys a paid plan, it also cannot publish or republish passports, create passports, add battery units, write through the API, or make filings through the Service.

(g) No overage fees. We charge nothing for places above your count. Being over it is neither a breach nor a ground for suspension.

5.7 Usage Verification

To confirm that your usage is consistent with your subscribed plan, we may measure your usage of the Service through the platform's own metering and may ask you to confirm your usage figures or provide a brief written self-certification of relevant usage records. You agree to respond to any such reasonable request within a reasonable period. This is a lightweight, self-service confirmation right and does not entitle us to access your premises or systems.

5.8 Value Added Tax (VAT)

This Section supplements Section 5.3 with respect to VAT for Customers established in the European Union or the European Economic Area ("EU/EEA").

(a) All fees are stated exclusive of VAT.

(b) If you are a business established in the EU/EEA, you must provide a valid VAT identification number for your member state and keep it accurate and current.

(c) Where you are a VAT-registered business established in a member state other than the one from which the supply is treated as made, the supply is made under the reverse-charge mechanism: we will invoice you without VAT, and you are responsible for self-accounting for VAT in your member state at the applicable rate.

(d) If you do not provide a valid VAT identification number, or where the reverse-charge mechanism does not apply, we may charge, collect, and remit any VAT we are required to apply, and those amounts will be added to your invoice in accordance with Section 5.3.

(e) You authorize us to collect and process your VAT identification number for the purpose of correctly invoicing your subscription, as also described in our Privacy Policy.

(f) Withholding tax gross-up. All fees are payable in full without deduction or withholding of any kind, other than taxes on PassportCraft's net income (which remain PassportCraft's responsibility under Section 5.3). If you are required by law to withhold or deduct any amount from a payment to PassportCraft, you will increase the amount payable so that, after the required withholding or deduction, PassportCraft receives and retains the full amount it would have received had no withholding or deduction been required. You will provide PassportCraft with official receipts evidencing any amounts withheld and remitted, and will reasonably cooperate to enable PassportCraft to claim any available credit or refund.

5.9 Plan Changes (Upgrades and Downgrades)

If you change subscription plans during a billing cycle, the following applies, in line with how plan changes are processed through our payment processor:

(a) Upgrades. An upgrade takes effect when its invoice is paid, and its new Plan Term runs from the moment you confirmed it. If that invoice is not paid within the time the Service shows, the upgrade lapses and your plan stays as it was. We credit the unused part of what you paid for the old Plan Term against that invoice; the credit counts as plan fees you prepaid for the new Plan Term. It is never paid out in cash, except as part of a refund of prepaid plan fees under these Terms. Instalments of the old Plan Term not yet due are cancelled. Before you confirm, the Service shows the new end date, the credit and the amount you will be charged.

(b) Downgrades. A downgrade to a lower-priced plan takes effect at the end of your Plan Term. Because all fees are paid in advance and are non-refundable (Section 5.5), a downgrade does not entitle you to a refund or credit of fees already paid for the current term. PassportCraft may, in its discretion, apply any unused prepaid value from the higher tier as a credit toward future invoices, but is not obligated to do so.

(c) Relationship to other provisions. This Section addresses the money treatment of a plan change. The functional effect of a downgrade on your published DPP pages is governed by Section 13.5(b), which never takes a published passport offline. Price changes initiated by PassportCraft (as distinct from a plan change you choose) are governed by Section 5.4.

5.10 Chargebacks and Payment Disputes

This Section applies to fees that are validly due. It is subject to the European Economic Area mandatory-rights provisions in Section 10.7 and does not purport to override any non-waivable consumer or statutory right.

(a) Contact us first. You agree to contact us at support@passportcraft.com to resolve any billing concern before initiating a chargeback, payment reversal, or dispute with your card issuer or bank.

(b) Chargebacks as a breach. A chargeback, payment reversal, or similar dispute initiated against fees validly due is a breach of your payment obligations under Section 5.2. A reversal of this kind is distinct from a genuine payment failure: the seven-day period in Section 5.2(d) applies only to genuine payment failures, not to the reversal of a payment that previously succeeded.

(c) Immediate suspension. Pending resolution of a chargeback or payment reversal on fees validly due, we may suspend your access immediately under Section 12.7(a)(ii), without the seven-day period in Section 5.2(d). The effect of such a suspension on the continued public availability of your published DPP pages is governed by Section 13.5(d), which never takes a published passport offline, even if the dispute is resolved against you.

(d) Your continued liability. You remain liable for the reversed amount, together with any dispute, representment, or processing fee that our payment processor charges us in connection with the chargeback or reversal.

(e) Dispute handling. You authorize us to share relevant account and usage information with our payment processor and your issuing bank as necessary to investigate and contest the dispute.

(f) Time to dispute. You must notify us in writing of any good-faith dispute regarding an invoice or charge within sixty (60) days of the date we first bill that amount. After that period, the charge is presumed correct, and you bear the burden of demonstrating that an amount is not owed; this presumption does not extinguish, and is without prejudice to, any non-waivable statutory right you have to recover amounts that were not in fact owed or that were paid without legal cause. We will not treat the withholding of a charge that you are disputing reasonably and in good faith, and as to which you are cooperating diligently to resolve, as a chargeback or breach under this Section, provided you raised the dispute within the 60-day period. Default interest under Section 5.2(f) does not accrue on such a disputed amount while the dispute remains open.

5.11 Plans a Partner Pays For

While a partner (Section 2.4) pays for your plan:

(a) You pay us nothing for that plan. The partner pays us under its partner agreement, which governs the price, term, payment, renewal and cancellation of your plan, in place of Sections 5.1 to 5.5, 5.9, 12.1 and 13A(g). For a plan a partner pays for, its Plan Term is the billing period the partner bought. We send invoices and billing notices for your plan to the partner.

(b) If the partner does not pay. If the partner's payment for your plan fails, we notify the partner, and you as paragraph (d) provides. Section 5.2(d) then applies to your workspace as if the failed payment were yours, except that you owe nothing, each pause also ends when you take over billing, and Section 12.3(a) sets when a cancellation takes effect.

(c) Taking over billing. You may take over billing at any time, as the Service describes. Your own billing starts no earlier than the end of the last period the partner paid for. If the partner stops paying for your plan, for any reason, we offer you direct billing: after a failed payment, when our payment processor stops retrying; otherwise, before the last period the partner paid for ends. This paragraph continues to apply after the partner stops paying.

(d) Notices. Until your workspace has an owner or administrator of its own, notices we send the partner for you under these Terms or the DPA are notices to you. We also send notices of a personal data breach, of a new sub-processor, of a material change to these Terms or the DPA, and about payment for your plan, to the notices contact you or your partner gave us. After the partner stops paying, and until your workspace has an owner or administrator of its own, that notices contact (an email address for our notices) is your address for notices under these Terms and the DPA.

(e) Refunds and the liability cap. A refund that these Terms or the DPA give for a period the partner paid for is paid to the partner, and that payment discharges it. For the cap in Section 10.1, the fees paid by you include the fees the partner paid us for your plan.

(f) Published passports. As Section 13.5(b) provides, we never unpublish your published Digital Product Passports because a partner stopped paying for your plan, for any reason, including when your plan moves to the Free Plan as a result. This paragraph continues to apply after the partner stops paying.

5.12 Battery Units

(a) Each plan includes the number of battery units shown on our pricing page for each Plan Term, counted across your whole workspace, whatever the status of their passports. On the Free Plan and during a trial, that number is a total, not a number for each Plan Term. Units recorded in an earlier Plan Term do not count. A unit counts when you record it, even if you later delete it. Units your plan includes are used first, and any it does not use end with the Plan Term. When you reach the limit, you cannot add units until you buy more units (Section 5.12(b)), move to a larger plan or start your next Plan Term. Units already recorded stay as they are.

(b) We may offer more units in prepaid bundles. Before you buy a bundle, we tell you its size and price. Units you buy never expire while your account is open. Units you buy are not refunded, including any left unused when these Terms end, except where the law requires a refund, or where your paid plan or these Terms end because we end them under Section 11.4(c), 12.4(c), (d) or (e) or 12.5, or you end them under Section 12.2(a) or 17.2(b). A refund covers the units from that bundle you have not used, in proportion to the price you paid for the bundle.

(c) After a cancellation, you cannot add units (Section 5.6(f)). Units you bought and have not used stay on your account for a later paid plan.

5.13 When the Plan Rules Apply

Sections 5.1, 5.2(d), 5.6(b) to (f), 5.9(a), 5.12 and 13A(g) apply to an account created on or after October 10, 2026 from its creation. They apply to an earlier account from its first paid checkout on or after October 10, 2026, where it accepts them. Until then, the version of those Sections it last accepted applies. The rest of the new Section 5.6 replaces the old Section 5.6 for every account from October 10, 2026, so no account keeps overage fees or the old ground for suspension.

6. Customer Data Ownership

6.1 Your Data Belongs to You

You retain full ownership of all data, content, and materials that you or your Authorized Users upload, submit, or input into the Service ("Customer Data"). This includes all product information, supply chain data, sustainability metrics, compliance documentation, and any other content provided by you for the purpose of creating Digital Product Passports.

Nothing in these Terms transfers ownership of Customer Data to PassportCraft.

6.2 Limited License to PassportCraft

You grant PassportCraft a limited, non-exclusive, non-transferable license to use, process, store, and display Customer Data solely as necessary to:

(a) Operate, maintain, and provide the Service to you.

(b) Generate, host, and serve your DPP pages and QR codes.

(d) Comply with applicable law or respond to valid legal process.

(e) Detect, prevent, investigate, and respond to security incidents, fraud, abuse, and violations of these Terms or the Acceptable Use Policy (Section 9 and Section 12.7), and otherwise protect the security, integrity, and operation of the Service, other customers, and third parties.

This license is:

Not perpetual — it terminates when your account is closed and your data has been deleted in accordance with Section 13.
Not irrevocable — you may revoke it by terminating your account.
Not transferable — we may not sublicense Customer Data to third parties except to sub-processors necessary for providing the Service, as documented in our DPA.

6.3 No Other Use of Customer Data

We will not:

(a) Sell, rent, or trade Customer Data to any third party.

(b) Use Customer Data for advertising, profiling, or marketing purposes.

(d) Re-identify any aggregated or de-identified data derived from Customer Data, or sell or otherwise make available any identifiable Customer Data. The permitted use of aggregated and de-identified data is described in Section 6.5.

6.4 Data Accuracy and Customer Backups

You are solely responsible for the accuracy, quality, legality, and completeness of Customer Data. PassportCraft does not verify or validate the substantive accuracy of data entered into Digital Product Passports.

You are also responsible for maintaining your own current backup copies of any Customer Data you regard as critical, using the export tools described in Section 13.1 or other means of your choosing. The Service is not a system of record or your sole repository for Customer Data. This responsibility is the backup obligation referred to in Section 10.7(d).

6.5 Service Data and Aggregated Data

PassportCraft may generate and use aggregated and de-identified data derived from use of the Service, provided that such data does not identify you, any individual, or any specific product. We may use this aggregated and de-identified data for any business purpose, both during and after the term of these Terms, including to operate, secure, analyze, and improve the Service and to create and publish benchmarks, statistics, insights, and reports. This Section 6.5 does not change our commitments in Section 6.3(a) (we do not sell or trade Customer Data) or in Section 3.1(f) (Customer Data is not used to train our models or our AI provider's models), which remain in full effect. This Section does not apply to data in a battery passport, which we process only as Article 78(d) of Regulation (EU) 2023/1542 allows.

6.6 AI Output

This Section applies to output generated for you by the AI-Assisted Tools described in Section 3.1(f) ("AI Output").

(a) Ownership. As between you and PassportCraft, and subject to your compliance with these Terms and the Acceptable Use Policy, PassportCraft assigns to you all of its right, title, and interest (if any) in and to the AI Output generated for you. The qualifier "if any" reflects that AI Output may not attract intellectual property protection. Once AI Output is incorporated into your DPP content, it is treated as Customer Data under this Section 6. Nothing in Section 7.1 reserves to PassportCraft any ownership of AI Output, as distinct from the underlying models, algorithms, and Service.

(b) Non-uniqueness. Due to the nature of machine learning, AI Output is not unique. Other customers may submit similar input and receive the same or substantially similar output, and PassportCraft makes no representation that AI Output is original or exclusive to you. You are responsible for ensuring that any AI Output you publish does not infringe a third party's rights.

(c) Operational data about the AI-Assisted Tools. Nothing in this Section limits PassportCraft's right under Section 6.5 to use aggregated and de-identified data about the operation and performance of the AI-Assisted Tools (such as acceptance, rejection, latency, and error signals) to operate, secure, and improve those tools. This does not permit, and is subject to, the prohibition in Section 3.1(f) on using Customer Data to train PassportCraft's or its AI provider's models.

7. Intellectual Property

7.1 PassportCraft IP

PassportCraft owns and retains all rights, title, and interest in the Service, including but not limited to:

(a) The platform software, algorithms, interfaces, and infrastructure.

(b) The PassportCraft name, logo, trademarks, and brand elements.

(d) DPP page templates, layouts, and formatting (but not the Customer Data displayed within them).

No rights to PassportCraft's intellectual property are granted to you except the limited right to access and use the Service as described in these Terms.

7.2 Customer IP

You retain all intellectual property rights in Customer Data and any pre-existing materials you provide. PassportCraft claims no ownership over your product data, brand assets, or other proprietary content uploaded to the Service.

7.3 Feedback

If you provide suggestions, ideas, or feedback about the Service ("Feedback"), you grant PassportCraft a non-exclusive, perpetual, irrevocable, worldwide, royalty-free, fully transferable and sublicensable license to use, copy, modify, distribute, and otherwise exploit the Feedback for any purpose, including to develop, improve, and commercialize the Service and other products, without restriction and without any obligation, attribution, or compensation to you. Feedback does not include Customer Data.

7.4 Product Identifiers, QR Codes, and Resolvable URLs

The Service generates GS1 Digital Link QR codes that resolve to your hosted DPP pages (Section 3.1(c)).

(a) Your identifiers. You retain all rights in the GTINs and other product identifiers you use in, or supply for, the GS1 Digital Link. PassportCraft claims no ownership of those identifiers.

(b) License to QR artwork. PassportCraft grants you a non-exclusive, royalty-free, worldwide license to reproduce and use the QR code artwork generated for you on and in connection with your products, packaging, and related materials, for as long as the corresponding DPP page is hosted through the Service. This license is consistent with, and additional to, your limited right to use the Service in Section 7.1.

(c) Resolvable URL is not portable. The resolvable URL that a PassportCraft-generated QR code encodes points to PassportCraft infrastructure and is provided as part of the Service. It is not portable: PassportCraft does not currently offer a way to redirect, transfer, or self-host that exact URL after the Service ends, and a QR code encoding a PassportCraft URL will cease to resolve to live DPP data once the page is unpublished by you or under 13.5(d) or (e). A QR code on your own brand domain resolves to wherever you point that domain. You should take this into account before printing PassportCraft-generated QR codes on physical products. Your Customer Data and product identifiers remain exportable under Section 13, and you may generate new QR codes resolving to your own or another provider's infrastructure for any reprint.

8. Data Processing

8.1 Data Roles

With respect to Customer Data that contains personal data (as defined under the EU General Data Protection Regulation, "GDPR"):

(a) You are the data controller. You determine the purposes and means of processing personal data within Customer Data.

(b) PassportCraft is the data processor. We process personal data in Customer Data solely on your documented instructions and as necessary to provide the Service.

8.2 Data Processing Agreement

The processing of personal data under these Terms is governed by our Data Processing Agreement ("DPA"), which is incorporated by reference and available at https://passportcraft.com/dpa. The DPA includes:

(a) The nature, purpose, and duration of processing.

(b) The types of personal data and categories of data subjects.

(d) Sub-processor management and notification procedures.

(e) Data subject rights assistance obligations.

8.3 Sub-Processors

A current list of our sub-processors is maintained at https://passportcraft.com/dpa#annex-c--sub-processor-list. We will notify you of any changes to our sub-processor list at least 30 days before a new sub-processor begins processing Customer Data. You may object to a new sub-processor in accordance with the procedure set out in the DPA.

8.4 EU Representative

PassportCraft is a US-based company that offers services to EU businesses and processes personal data of EU residents, and is therefore subject to Article 27 of the GDPR. PassportCraft has appointed Data Protection Representative Limited (trading as DataRep) as its Data Protection Representative under Article 27 of the EU GDPR (for the EU/EEA) and under the UK GDPR and the Data Protection Act 2018 (for the UK). Individuals in the EU/EEA or the UK may contact DataRep about our processing of their personal data by email at datarequest@datarep.com (quoting "PassportCraft LLC" in the subject line), via the online form at www.datarep.com/data-request, or by post addressed to "DataRep" (not PassportCraft LLC) at any of its local offices across the EU/EEA and the UK (registered office: 77 Camden Street Lower, Dublin D02 XE80, Ireland). For questions about the PassportCraft product or your account, please contact us at privacy@passportcraft.com rather than DataRep. Full contact details are also set out in our Privacy Policy.

9. Prohibited Uses

9.1 General Restrictions

You may not use the Service to:

(a) Violate any applicable law, regulation, or third-party rights.

(b) Upload, store, or transmit any content that is unlawful, harmful, threatening, defamatory, obscene, or otherwise objectionable.

(c) Upload or process special categories of personal data as defined in Article 9 of the GDPR (data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data, health data, or data concerning sex life or sexual orientation).

(d) Impersonate any person or entity, or misrepresent your affiliation with any person or entity.

(e) Interfere with, disrupt, or attempt to gain unauthorized access to the Service, its infrastructure, or other users' accounts.

(f) Use automated means (bots, scrapers, crawlers) to access the Service except through published APIs in accordance with our API documentation.

(g) Reverse-engineer, decompile, disassemble, or otherwise attempt to derive the source code of the Service; provided that this paragraph (g) does not prohibit, and does not apply to, any act of decompilation, reproduction, translation, observation, study, testing, back-up, or error correction that you are entitled to perform under mandatory law that cannot be excluded by contract, including Articles 5(2), 5(3), and 6 of Directive 2009/24/EC (and the national laws implementing them), and only to the extent such law renders the restriction unenforceable.

(h) Resell, sublicense, or redistribute the Service to third parties without our prior written consent.

(i) Use the Service for benchmarking or competitive analysis without our prior written consent.

(j) Upload content that infringes any third party's intellectual property rights.

9.2 Enforcement

We may investigate suspected violations and may suspend or terminate accounts that violate these Terms, with or without notice depending on the severity of the violation. Any action under this Section will be on objective grounds (an actual or reasonably suspected violation) and, for Customers established in the European Economic Area, proportionate to the violation; this is subject to the suspension safeguards in Section 12.7 (including notice where practicable, restoration, and reactivation) and does not affect PassportCraft's liability for a wrongful suspension or unpublication under Section 13.5(f). Section 13.5(d)(v) governs a published passport that does not describe a real product.

9.3 Reporting Infringing or Unlawful Content

Because the Service hosts publicly accessible DPP pages containing Customer Data (Section 3.1(b)), we provide a channel for third parties to report content they believe is infringing or unlawful.

(a) How to report. If you believe content hosted through the Service infringes your intellectual property rights or is otherwise unlawful, send a notice to abuse@passportcraft.com or legal@passportcraft.com that identifies the content (including the URL of the relevant DPP page), describes the basis for your complaint, and provides your contact details.

(b) Our response. We may remove or disable access to reported content, and we may scope any such action to specific Customer Data, DPP pages, or content in accordance with Section 12.7(a). We may forward the substance of a complaint to the affected Customer.

(c) Repeat infringers. We will, in appropriate circumstances and at our discretion, suspend or terminate the accounts of Customers who are repeat infringers of intellectual property rights, in accordance with Sections 12.4 and 12.7.

(d) EU Digital Services Act representative. For the EU/EEA, PassportCraft has appointed Data Protection Representative Limited (trading as DataRep) as its legal representative under Article 13 of the Digital Services Act (Regulation (EU) 2022/2065). Recipients of the Service, members of the public, and authorities may also contact that representative on matters arising under that Regulation, including reports of allegedly illegal content; its contact details are set out in our Legal Notice.

9.4 DMCA Notices (United States)

For copyright matters arising under United States law, PassportCraft has designated a copyright agent to receive notifications of claimed infringement under the US Digital Millennium Copyright Act (17 U.S.C. § 512(c)). Notices of claimed copyright infringement should be sent to:

Copyright Agent, PassportCraft LLC 418 Broadway, Ste N, Albany, NY 12207, United States Email: legal@passportcraft.com

The agent's complete contact details, including telephone number, are also listed in the US Copyright Office's DMCA Designated Agent Directory.

(a) Required contents. To be effective under 17 U.S.C. § 512(c)(3), your notice must be a written communication that includes substantially the following: (i) a physical or electronic signature of a person authorized to act on behalf of the owner of an exclusive right that is allegedly infringed; (ii) identification of the copyrighted work claimed to have been infringed; (iii) identification of the material claimed to be infringing that is to be removed or access to which is to be disabled, with information reasonably sufficient to permit us to locate it (including the URL of the relevant DPP page); (iv) information reasonably sufficient to permit us to contact you, such as an address, telephone number, and email address; (v) a statement that you have a good-faith belief that use of the material in the manner complained of is not authorized by the copyright owner, its agent, or the law; and (vi) a statement that the information in the notification is accurate, and under penalty of perjury, that you are authorized to act on behalf of the owner of an exclusive right that is allegedly infringed.

(b) Our response and counter-notification. On receipt of a valid notice, we may remove or disable access to the material as described in Section 9.3(b) and will, where appropriate, notify the affected Customer. A Customer whose material has been removed or disabled may submit a counter-notification under 17 U.S.C. § 512(g). Repeat infringers are handled as described in Section 9.3(c).

10. Liability Limitation

10.1 Liability Cap

To the maximum extent permitted by applicable law, PassportCraft's total aggregate liability to you for all claims arising out of or related to these Terms or the Service, whether in contract, tort (including negligence), strict liability, or otherwise, shall not exceed the lesser of (i) the total fees paid by you to PassportCraft during the 12 months immediately preceding the event giving rise to the claim, or (ii) twenty-five thousand US dollars (USD $25,000).

For Customers on the Free Plan who have not paid any fees, PassportCraft's total aggregate liability shall not exceed one hundred US dollars (USD $100).

10.2 Exclusion of Certain Damages

To the maximum extent permitted by applicable law, neither party shall be liable to the other for any indirect, incidental, special, consequential, or punitive damages, including but not limited to:

(a) Loss of profits, revenue, or business.

(b) Loss of data (except PassportCraft's obligations regarding Customer Data as set out in these Terms and the DPA).

(d) Cost of procurement of substitute services.

(e) Regulatory fines or penalties imposed on the Customer by any authority.

(f) Loss of use of the Service or of any data.

(g) Business interruption.

This exclusion applies regardless of whether the party was advised of the possibility of such damages and regardless of the legal theory on which the claim is based.

10.3 Exceptions

This Section allocates which of the limitations in Section 10.1 (the monetary cap) and Section 10.2 (the exclusion of indirect and consequential damages) apply to the categories below. It distinguishes the cap from the exclusion: lifting the exclusion for a category does not, by itself, lift the cap. (The separate Beta cap in Section 3.4(c) is governed by that Section, not by this Section 10.3.)

(a) Exclusion lifted; cap continues to apply (PassportCraft-side). The exclusion of damages in Section 10.2 does not apply to, but the monetary cap in Section 10.1 continues to apply to:

(i) PassportCraft's liability arising from its own gross negligence; and
(ii) PassportCraft's indemnification obligations under Section 11.2.

(b) Both the cap and the exclusion lifted (Customer-side and non-excludable). Neither the limitation in Section 10.1 nor the exclusion in Section 10.2 applies to:

(i) your payment obligations under Section 5;
(ii) your indemnification obligations under Section 11.1;
(iii) your breach of Section 9 (Prohibited Uses) or the Acceptable Use Policy;
(iv) liability for a party's willful misconduct or fraud;
(v) liability for death or personal injury caused by a party's negligence; and
(vi) any other liability that cannot be limited or excluded under applicable law (including, for Customers in the European Economic Area, the matters listed in Section 10.7(a)).

(c) No double recovery. Where a single liability falls within more than one paragraph of this Section, it is treated under the paragraph most favorable to the claiming party, and amounts recovered for the same loss are not duplicated.

10.4 Basis of the Bargain

The limitations and exclusions in this Section 10 reflect a reasonable allocation of risk between the parties and form an essential basis of the bargain between you and PassportCraft. The Service would not be provided without these limitations.

10.5 Disclaimer of Warranties

Except as expressly stated in these Terms, the Service is provided "as is" and "as available," without warranties of any kind, whether express, implied, or statutory. To the maximum extent permitted by applicable law, PassportCraft disclaims all implied warranties, including the implied warranties of merchantability, satisfactory quality, fitness for a particular purpose, reasonable care and skill, title, non-infringement, and quiet enjoyment, and any warranties arising from course of dealing or usage of trade. PassportCraft does not warrant that the Service will be uninterrupted, error-free, or secure, or that it will meet your requirements. PassportCraft further makes no warranty as to the results that may be obtained from use of the Service, or as to the accuracy, completeness, reliability, or fitness for any regulatory or compliance purpose of any data, content, output (including AI Output), report, or assessment generated by, entered into, or obtained through the Service; the allocation of responsibility for such matters is set out in Sections 6.4, 14, and (for AI Output) 3.1(f) and 6.6. Except as expressly provided in the Data Processing Agreement and Section 10.7(d), PassportCraft does not warrant that Customer Data will be secure or will not otherwise be lost or altered. The availability efforts in Section 3.2 are a target and not an express warranty for purposes of this Section. Nothing in this Section excludes any warranty or right that cannot be excluded or limited under applicable law, including the mandatory statutory rights of Customers in their jurisdiction of establishment.

10.6 Third-Party Services

The Service may interoperate with, or link to, third-party services, websites, or resources that PassportCraft does not control (for example, sign-in identity providers or services you choose to connect). PassportCraft is not responsible for the availability, accuracy, content, or practices of any third-party service, and your use of any third-party service is governed by that third party's own terms and privacy policy. The sub-processors PassportCraft engages to provide the Service are addressed in our Data Processing Agreement and Sub-processor list.

10.7 Liability — Customers in the European Economic Area

This Section applies to and prevails over the rest of this Section 10 (including Sections 10.1, 10.2, and 10.3) and over the Beta cap in Section 3.4(c), for Customers established in the European Economic Area (including Germany), to the extent those provisions would otherwise be invalid under the mandatory law applicable to such Customers. It does not extend PassportCraft's liability beyond what that law requires.

(a) Unlimited liability. PassportCraft's liability is unlimited for: (i) intent (Vorsatz) and gross negligence (grobe Fahrlässigkeit); (ii) injury to life, body, or health; (iii) defects fraudulently concealed; (iv) any express guarantee given by PassportCraft; and (v) claims under the German Product Liability Act (Produkthaftungsgesetz) or other applicable mandatory product-liability law.

(b) Cardinal duties (slight negligence). For damage caused by slight (ordinary) negligence, PassportCraft is liable only for breach of an essential contractual obligation — that is, an obligation whose fulfilment makes the proper performance of these Terms possible at all and on whose fulfilment the Customer may regularly rely (a wesentliche Vertragspflicht or Kardinalpflicht). In that case, PassportCraft's liability is limited to the foreseeable damage typical for this type of contract. The fixed monetary cap in Section 10.1 does not further reduce that amount: liability under this paragraph (b) is limited to the foreseeable typical damage and is not additionally capped at the Section 10.1 figure.

(d) Loss of data. Liability for the loss or corruption of Customer Data caused by PassportCraft's breach is not excluded, but is limited to the cost of restoring the data from the Customer's most recent backup — that is, the data the Customer would have had if it had maintained backups consistent with its backup responsibility under Section 6.4.

(e) Relationship to the cap and to Section 10.3. For Customers to whom this Section 10.7 applies, the liability result is determined by paragraphs (a) through (d) of this Section, and the monetary cap in Section 10.1 and the exclusions in Section 10.2 continue to apply only to the extent they are not displaced by those paragraphs. The exceptions in Section 10.3 do not separately enlarge PassportCraft's liability beyond what paragraphs (a) through (d) of this Section provide; in particular, PassportCraft's indemnification obligations under Section 11.2 are subject to the same graduated limits as the rest of its liability under this Section (unlimited only for the matters in paragraph (a), limited to the foreseeable typical damage for the cardinal-duty matters in paragraph (b), and otherwise subject to the cap in Section 10.1), and your indemnification obligations under Section 11.1 remain uncapped as provided in Section 10.3(b). Where both this Section and Section 10.1 would limit the same liability, the more specific limit in this Section governs, and no amount is counted twice. Nothing in this Section limits the mandatory statutory rights referred to in Section 10.5.

10.8 Sole Remedy for Service or Availability Failure

To the maximum extent permitted by applicable law, where PassportCraft materially fails to provide the Service as described, your sole and exclusive remedy, and PassportCraft's entire liability, is, at PassportCraft's option, re-performance of the affected Service or a refund of the fees paid for the affected period. This Section is without prejudice to, and does not limit, the rights preserved in Sections 10.5 and 10.7. It is also subject to Section 13.5(f), and does not cut down PassportCraft's liability under Section 13.5(f) for a wrongful suspension or unpublication that was not attributable to your breach. This Section applies only to a failure of performance or availability of the Service; it does not apply to, and does not limit your remedies for, PassportCraft's gross negligence or willful misconduct under Section 11.2(b). This Section does not apply to Sections 13, 13A or the DPA.

11. Indemnification

11.1 Customer Indemnification

You agree to indemnify, defend, and hold harmless PassportCraft and its officers, directors, employees, and agents from and against any third-party claims, damages, losses, liabilities, costs, and expenses (including reasonable attorneys' fees) arising out of or related to:

(a) Customer Data, including any claim that Customer Data infringes or misappropriates a third party's intellectual property or other rights.

(b) Your use of the Service in violation of these Terms or applicable law.

(d) Any dispute between you and your end users, customers, or supply chain partners concerning DPP content.

(e) Any third-party claim by a consumer who viewed or scanned a published DPP page, or any action, investigation, or proceeding by a competent authority (including market-surveillance, consumer-protection, and greenwashing or unfair-commercial-practices enforcement) that names PassportCraft as host, arising out of or relating to the content, accuracy, legality, or substantiation of your published DPP data. This paragraph is the affirmative counterpart to the exclusion of regulatory fines and penalties in Section 10.2(e) and is consistent with Sections 6.4 and 14.2 and with the Acceptable Use Policy. This indemnity applies regardless of any allegation of PassportCraft's concurrent fault, except: (i) to the extent the claim is for death or personal injury (or, for Customers in the EEA, injury to life, body, or health) caused by PassportCraft's own negligence, this paragraph (e) does not apply and your obligation is excluded to that extent, consistent with Section 10.3(b)(v) and Section 10.7(a)(ii); and (ii) for any other claim, to the extent it is finally determined to have been caused by PassportCraft's own gross negligence or willful misconduct, in which case Section 11.2(b) governs that portion and your obligation under this paragraph (e) is reduced proportionally. Nothing in this paragraph (e) requires you to indemnify PassportCraft against liability that cannot be limited, excluded, or shifted under applicable law. For the avoidance of doubt, the personal-injury exclusion in this paragraph (e)(i) and the preceding non-excludable-liability sentence apply to the whole of this Section 11.1, and nothing in subparts (a) through (d) requires you to indemnify PassportCraft for death or personal injury (or, for Customers in the EEA, injury to life, body, or health) caused by PassportCraft's own negligence.

11.2 PassportCraft Indemnification

PassportCraft agrees to indemnify, defend, and hold harmless you and your officers, directors, employees, and agents from and against any third-party claims, damages, losses, liabilities, costs, and expenses (including reasonable attorneys' fees) arising out of or related to:

(a) A claim that the Service (excluding Customer Data and AI Output) infringes or misappropriates a third party's intellectual property rights.

(b) PassportCraft's gross negligence or willful misconduct in providing the Service.

For the avoidance of doubt, the indemnity in Section 11.2(a) does not apply to any claim arising out of or relating to AI Output (as defined in Section 6.6), whether or not it has been incorporated into Customer Data, which is addressed solely by Sections 3.1(f), 6.6, and 11.1(a).

PassportCraft's liability under this Section 11.2 is subject to the monetary cap in Section 10.1 as provided in Section 10.3(a), except that liability for PassportCraft's willful misconduct or fraud is not capped (Sections 10.3(b)(iv) and 10.3(c)), and, for Customers in the European Economic Area, the graduated limits in Section 10.7 apply (including unlimited liability for the matters in Section 10.7(a)). Your indemnification obligations under Section 11.1 are not subject to that cap, as provided in Section 10.3(b).

11.3 Indemnification Procedures

The indemnified party must:

(a) Promptly notify the indemnifying party in writing of the claim.

(b) Grant the indemnifying party sole control over the defense and settlement of the claim.

(d) Settlement consent. The indemnifying party may not, without the indemnified party's prior written consent, enter into any settlement or compromise that (i) imposes any monetary or non-monetary obligation, liability, injunctive relief, or restriction on the indemnified party, (ii) includes any admission of fault, wrongdoing, or liability by the indemnified party, or (iii) does not include an unconditional release of the indemnified party from all liability on the claim. Consent may not be unreasonably withheld only as to clause (i) monetary terms that the indemnifying party funds in full.

(e) PassportCraft's control of proceedings against it. Notwithstanding paragraph (b), where a claim is an action, investigation, or proceeding by a competent authority that names PassportCraft as a respondent or addressee, or where joint defense is required by law, PassportCraft may assume or retain control of its own defense using counsel of its choice. In that case the Customer continues to bear all reasonable costs and any resulting liability for which it is the indemnifying party, and the parties will cooperate and not impair each other's defenses. PassportCraft will keep the Customer reasonably informed of the status of the proceeding and consult with the Customer in good faith on material decisions. PassportCraft will not, without the Customer's prior written consent (not to be unreasonably withheld, conditioned, or delayed), enter into any settlement or compromise that imposes any monetary or non-monetary obligation or liability on the Customer, except for settlement terms that PassportCraft funds in full. Costs and liability borne by the Customer under this Section 11.3(e) are limited to those reasonably and proportionately incurred.

Failure to provide prompt notice does not relieve the indemnifying party of its obligations, except to the extent it is materially prejudiced by the delay.

11.4 IP Infringement Remedies

If the Service becomes, or in PassportCraft's reasonable opinion is likely to become, the subject of an intellectual property infringement claim, PassportCraft may, at its option and expense:

(a) Procure the right for you to continue using the Service.

(b) Replace or modify the Service to make it non-infringing while maintaining substantially equivalent functionality.

(c) If neither (a) nor (b) is commercially reasonable, end your paid plan and refund the prepaid plan fees for the unused part of the Plan Term. We end these Terms under this paragraph only for an account with no published passport.

The remedies in this Section 11.4, together with the indemnity in Section 11.2(a), are PassportCraft's entire liability and your sole and exclusive remedy for any claim that the Service infringes or misappropriates third-party intellectual property rights.

12. Termination

12.1 Plan Term and Renewal

(a) Each paid plan renews for a further Plan Term unless you cancel it before the renewal date, you give notice under Section 13A, or we give notice of non-renewal at least 30 days before the renewal date. Each renewal term is at PassportCraft's then-current rates for the applicable plan. If the renewal rate is higher than your current rate, the 30-day notice and your right to cancel before the increase takes effect under Section 5.4 apply, and for Customers established in Germany or the EEA the protections in Section 12.5 continue to apply.

(b) Non-renewal ends the plan only.

12.2 Termination for Cause

Either party may terminate these Terms immediately by written notice if the other party:

(a) Materially breaches these Terms and fails to cure such breach within 30 days after receiving written notice specifying the breach.

(b) Becomes insolvent, files for bankruptcy, or has a receiver or liquidator appointed.

We do not end these Terms, under this Section or any other, for a billing reason (Section 13.5(b)). We do not end these Terms under (b) or (c) while you, or an administrator or liquidator acting for you, still exists. If you cease to exist without a successor, we may end them under (b) or (c) on 30 days' notice.

12.3 Termination by Customer

(a) What a cancellation is. A "cancellation" is the end of a paid plan, for any reason including a final failed payment, without a move to another paid plan. Neither the end of a trial, nor our notice of non-renewal under Section 12.1(a), nor our ending of a paid plan under Section 11.4(c), 12.4(d) or 12.5, is a cancellation. When a paid plan ends without a move to another paid plan, your workspace moves to the Free Plan, and these Terms, the DPA and your published passports continue, subject to Section 5.6. Where a partner paid for the plan, the cancellation takes effect at the later of the end of the last period the partner paid for and 30 days after we offer you direct billing (Section 5.11(c)), unless you have accepted that offer.

(b) Cancelling your plan. You may cancel your paid plan at any time, in your account settings or by email to support@passportcraft.com. It ends at the end of its Plan Term, and the fees for that term remain payable. What a final failed payment costs is governed by Section 5.2(d) alone.

12.4 Termination by PassportCraft

PassportCraft may terminate or suspend your access:

(a) Immediately, for violations of Section 9 (Prohibited Uses) that pose a risk to the Service, other users, or third parties.

(b) [Not used.] Non-payment never ends these Terms.

(c) With 90 days' notice, if we decide to discontinue the Service entirely. We refund the prepaid plan fees for the rest of the Plan Term and cancel instalments not yet due.

(d) For convenience, on at least 90 days' prior notice. If PassportCraft terminates for convenience under this Section 12.4(d), we refund the prepaid plan fees for the rest of the Plan Term and cancel instalments not yet due. Where these Terms end under this paragraph, Sections 13.2, 13.3 and 13.5(e) apply. Termination for convenience under this Section 12.4(d) does not trigger the acceleration of fees in Section 12.6(b). Where your account has a published passport on the date the ending would take effect, we end only your paid plan under this paragraph, with the refund above; your workspace moves to the Free Plan, and these Terms continue. We do not use this paragraph to end these Terms for an account on the Free Plan; paragraph (e) alone covers that.

(e) Dormant Free accounts. We may end these Terms for an account on the Free Plan that has no published passport, and in which nobody has signed in or used its API keys for 24 months, on 90 days' notice. The notice lapses if anyone signs in before it ends. We never end a Free Plan account that has a published passport under paragraph (d) or (e).

12.5 Germany-Specific Provisions

For Customers established in Germany: after its first Plan Term, your plan extends month to month. You may end the plan at any time on one month's notice; we may end it on one month's notice to the end of a calendar month. For Sections 5.6(c) and 13A(g), each monthly extension counts as a Plan Term; and the renewal reminder in Section 12.1(c) is sent only before the first Plan Term ends. For Section 5.12, each twelve months of monthly extensions count as one Plan Term. Ending the plan does not end these Terms; Section 13A governs closing your account. This provision complies with Section 309 No. 9 of the German Civil Code (BGB) and takes precedence over Sections 12.1 and 12.3(b) for German Customers.

For Customers established in Germany or elsewhere in the European Economic Area, the following also applies to changes to these Terms under Section 17, and prevails over Section 17 to the extent of any conflict: (a) PassportCraft will only make changes that are objectively justified, such as changes required by a change in law or regulation, the introduction of new or modified features, or reasons of security; changes to the core commercial terms (such as price, which is governed by Section 5.4) or that materially shift the balance of rights and obligations to your disadvantage take effect for your paid plan only from the start of your next Plan Term that begins after the notice period, and are not made by deemed acceptance for an account on the Free Plan; and (b) for any such material change, the deemed-acceptance mechanism in Section 17.2 applies only together with the 30-day notice and your rights under Section 17.2(b), and PassportCraft will draw your attention in the change notice to your right to object and to the consequence of not objecting.

12.6 Effects of Termination

Upon termination or expiration of these Terms:

(a) Your right to access and use the Service ceases immediately (except export during the retrieval period).

(b) You must pay all fees accrued or payable as at the termination date. If PassportCraft terminates for cause under Section 12.2(a) or 12.4(a), all fees for the remainder of your then-current committed subscription term become immediately due and payable, to the extent permitted by applicable law. Such accelerated amount represents the committed fees you agreed to pay and is reduced by (i) a reasonable discount to reflect the accelerated, lump-sum payment and (ii) any costs and expenses PassportCraft reasonably saves, or could with reasonable effort save, as a result of not performing for the remainder of the term. You may show that PassportCraft's actually saved costs and expenses, or its actual loss, are lower than the accelerated amount, and PassportCraft will credit any amount so shown. This Section is intended as a genuine estimate of PassportCraft's loss and not as a penalty or forfeiture. Endings you start follow 13A(g). In no event does termination relieve you of any obligation to pay fees for the period before the effective date of termination.

(d) Sections that by their nature should survive termination will survive, including Section 5 (with respect to fees accrued or payable as at termination and Section 5.10), Sections 6 (Customer Data Ownership), 7 (Intellectual Property), 9 (Prohibited Uses) and the Acceptable Use Policy, 10 (Liability Limitation), 11 (Indemnification), 13 (with respect to the export window and deletion obligations), 14 (No Compliance Guarantee), 15 (Confidentiality), 18 (Governing Law and Disputes), and 19 (Miscellaneous), and Sections 9.3, 12.7(a) and 13.5 while pages stay online, and 13A(d)–(g), together with the Beta liability cap in Section 3.4(c) and any other provision that by its nature should survive.

12.7 Suspension of Access

In addition to, and as a less drastic alternative to, the termination rights above, we may suspend all or part of your access to the Service. A suspension may be scoped to your entire account, to an individual Authorized User, or to specific Customer Data, DPP pages, or content.

(a) Grounds for suspension. We may suspend access immediately, and without prior notice, where:

(i) there is a material violation of Section 9 (Prohibited Uses) or the Acceptable Use Policy, including a violation that poses a risk to the Service, other users, or third parties (consistent with Section 12.4(a));
(ii) there is a security risk, fraud, or other threat to the Service, our infrastructure, or other users, including where credentials may have been compromised;
(iii) your usage is anomalous or abusive in a way that degrades or threatens the stability, performance, or integrity of the platform, even where it does not constitute a breach of these Terms; or
(iv) suspension is required to comply with applicable law or a binding order, request, or requirement of a competent authority.

(b) Non-payment suspension. Suspension of paid features for non-payment follows Section 5.2(d) and does not require the grounds in Section 12.7(a). It never reaches published passports.

(c) Notice. Where practicable and not inconsistent with the grounds above or any legal requirement, we will give you notice of a suspension and an opportunity to address the cause.

(d) Effect during suspension. Suspension does not relieve you of your payment obligations, and fees continue to accrue during any suspension that is not attributable to a failure of the Service on our part.

(e) Restoration. We will promptly restore suspended access once the cause of the suspension has been resolved to our reasonable satisfaction.

(f) Escalation to termination. If the cause of a suspension is not resolved within a reasonable period, we may end these Terms under 12.2(a) or 12.4(a), never for a billing reason (Section 13.5(b)); 13.2 and 13.5(e) apply.

(g) No liability for lawful suspension or termination. PassportCraft will not be liable to you for any suspension or termination of access carried out in accordance with Section 12.4, Section 12.7, or Section 5.2(d) (a "permitted action"), and a permitted action is not a breach of these Terms by PassportCraft. This paragraph does not limit your remedies for a suspension or termination that is not a permitted action, which remain governed by Section 10 (and, for Customers in the European Economic Area, Section 10.7), and does not affect the chargeback carve-out protecting public pages in Section 13.5(b).

(h) No suspension blocks export, except while an (a)(ii) threat makes it unsafe.

13. Data Portability and Exit

13.1 Your Right to Export

You may export Customer Data at any time while these Terms are in force, with or without a paid plan, using the self-service export tools provided in the Service.

13.2 Post-Termination Export Window

When these Terms end (a plan's end does not end them):

(a) We will provide 30 days (the "retrieval period"), while published passports stay online, during which you can access and export your Customer Data through the Service's export functionality or by request to support@passportcraft.com.

(b) During this window, your access is limited to data export — you may not use other features of the Service.

13.3 Data Deletion After Export Window

After the 30-day export window:

(a) We will permanently delete all Customer Data from our active systems within 30 days.

(b) Customer Data may persist in encrypted backups for up to an additional 90 days, after which it will be permanently deleted.

(d) Notwithstanding the foregoing, PassportCraft may retain (i) Customer Data to the extent required to comply with applicable law, tax, or accounting obligations; (ii) information reasonably necessary to establish, exercise, or defend legal claims, or subject to a legal hold (Privacy Policy Section 7.2); (iii) records necessary to enforce these Terms or investigate fraud, abuse, or security incidents; and (iv) residual copies in routine backups until overwritten in the ordinary backup-rotation cycle. For personal data, this paragraph is subject to and consistent with Article 11 of the DPA, which prevails under Section 1.4; accordingly, the discretionary bases in clauses (ii) and (iii) apply to non-personal Customer Data and apply to personal data only where an exception under Article 17(3) of the GDPR independently applies. Any retained data remains subject to the confidentiality and security obligations of these Terms and the DPA and will not be used for any other purpose.

13.4 Transition Assistance

If you are migrating to another DPP provider, we will provide reasonable cooperation to facilitate the transition, including:

(a) Exporting data in standard formats compatible with common data exchange standards.

(b) Providing documentation of the data schema and export format.

Section 13A(f) governs charges.

13.5 Published Passports

This Section governs when a published Digital Product Passport, including each size, colour and battery unit, is shown publicly. It prevails over Sections 4, 5, 9 and 12, subject to Sections 13.6 and 16. It states what we will and will not do. It does not guarantee availability (Section 3.2).

(a) Only published pages are public. A DPP page is publicly viewable only while it is in a "published" state. Pages that are in draft, unpublished, suspended, deactivated, or any other non-published state are not served publicly. This behavior is designed to fail closed: where the Service cannot confirm that a page is published, the page is not shown publicly.

(b) No billing reason takes a passport offline. A published passport is never taken offline for a billing reason, including when a plan ends or changes or a payment fails. A "billing reason" is any of these events in your own account, or in a partner's payment for it:

a plan is cancelled, downgraded or not renewed, or it ends;
a trial ends;
the workspace is over its count;
a payment fails, is late or is disputed;
a partner stops paying;
the Free Plan changes or ends.

For a billing reason, we never unpublish a published passport, and we never place a paywall, redirect or other barrier in front of it. Keeping a published passport online never requires a paid plan.

(c) What an unpublished page shows. When a DPP page is unpublished (by you, by us under paragraph (d) or (e), or otherwise), the page no longer displays your DPP data. In its place, the URL serves a neutral notice that the passport is no longer available, and the page is de-indexed from search engines. The URL is not turned into a generic error and does not continue to serve live DPP data.

(d) When we may unpublish. We may unpublish only:

(i) on your instruction;
(ii) on a ground in Section 12.7(a)(i), (ii) or (iv), or under Section 9.3, and never for a billing reason. This is limited to the passports concerned, and they are restored once the cause is resolved. Item (v) alone governs a passport's failure to describe a real product;
(iii) under paragraph (e);
(iv) under Section 13.6;
(v) under Section 2.1 of the Acceptable Use Policy, where a passport does not describe a real product. We do so only after we have told you and given you fourteen (14) days from your receipt of our notice to correct it, and only for that passport. This is never for a billing reason, and the rule is the same on every plan. A passport's failure to describe a real product, including test data, a placeholder or an invented detail it shows, is not by itself a ground to unpublish it sooner, to suspend your account or to end these Terms, under any Section. This does not limit action on any other ground, including fraud, a scam or phishing (the second paragraph of Section 2 of the Acceptable Use Policy), a security threat, other prohibited content, or where the law or a competent authority requires us to act sooner (Sections 9.3, 12.7(a)(ii) and (iv)).

(e) When these Terms end. Your published passports stay online until the retrieval period ends (Section 13.2), unless you unpublish them or paragraph (d)(ii) or (d)(v) applies. We remind you seven (7) days before they go offline. They are then unpublished. We offer no option, paid or free, to keep them online after that. To keep them online, keep your account on the Free Plan instead of closing it. We never end these Terms for not paying (Section 12.4(b)), or for our convenience while your account has a published passport, on any plan (Section 12.4(d) and (e)).

(f) Your responsibility for ongoing ESPR availability. You, not PassportCraft, are the economic operator and the party responsible for ensuring that a Digital Product Passport remains available for as long as required under the ESPR and any applicable delegated act (see Section 14.5). You are solely responsible for maintaining ESPR-compliant availability of your DPP data after your access to PassportCraft-hosted pages ends — for example, by exporting your Customer Data within the window in Section 13.2 and arranging a backup copy or alternative means of making the passport available (such as through another provider). The risk and consequences of any public DPP page or resolvable URL ceasing to be available are allocated to you, consistent with Sections 6.4 and 14.2. The allocation in this paragraph (f) does not apply to unavailability caused by PassportCraft's wrongful suspension or unpublication of a page that was not attributable to your breach; PassportCraft's liability for any such unavailability is governed by Section 10 (and, for Customers in the European Economic Area, Section 10.7).

(g) Republishing. You may republish a passport you unpublished, subject to your count. After a cancellation, you also need a paid plan (Section 5.6(f)). We restore passports unpublished under (d)(ii) once the cause is resolved, whatever your plan. You may republish a passport we unpublished under (d)(v) on the same terms, once it describes a real product. If we unpublished it in error, we restore it, whatever your plan.

13.6 Business Continuity and Wind-Down

This Section describes what we will endeavor to do if PassportCraft itself decides to cease operations, or becomes insolvent or subject to receivership. It supplements, and does not replace, your standing export rights in Sections 13.1 through 13.4 and your termination rights in Section 12.2.

(a) Advance notice and export window. If we make a decision to cease operating the Service, or on our insolvency or the appointment of a receiver, we will use commercially reasonable efforts to give you as much advance notice as is practicable in the circumstances and to keep the self-service export described in Sections 13.1 and 13.2 available for the export window before the Service is shut down, so that you can retrieve your Customer Data and product identifiers.

(b) Automatable export path. We maintain a documented, automatable bulk-export path for Customer Data and product identifiers that is designed to be operable with minimal staffing, so that export remains practical even during a wind-down.

(c) No escrow. PassportCraft does not provide source-code escrow or data escrow, and does not warrant that the Service or hosted DPP pages will remain available following our cessation of operations or insolvency. Consistent with Section 13.5(e) and (f), there is no paid continued-hosting option, the resolvable URL is not portable (Section 7.4(c)), and you remain solely responsible for ensuring the ongoing ESPR availability of your DPP data after the Service ends — including by exporting your Customer Data in good time and arranging an alternative means of making the passport available.

(d) Insurance. PassportCraft does not warrant that it maintains any specific cyber, errors-and-omissions, or technology-liability insurance coverage. Each party is responsible for maintaining whatever insurance it considers appropriate for its own business and risks.

13A. Closing Your Account and Switching Provider

This Section gives effect to Chapter VI of Regulation (EU) 2023/2854 (the "Data Act"). It applies on every plan, including Free, whoever pays. It prevails over Sections 5.5, 12 and 13.1 to 13.5.

(a) Notice. You may close your account, ending these Terms, at any time by notice to support@passportcraft.com. Your notice states whether you will:

(i) switch provider, naming it where it needs access from us;
(ii) move your data to your own systems; or
(iii) have it erased.

If your notice does not say, we ask within ten working days, and the notice period then runs until at least ten working days after we ask, but never beyond two months from our receipt of your notice. If you have not answered by the end of the notice period, (iii) applies. A notice under Section 12.2 is also a notice under this paragraph. A notice under this paragraph stops your plan from renewing. If its Plan Term ends before these Terms end, your plan continues until they end, at its price on the day we received your notice, charged pro rata for each day.

(b) Notice period. These Terms continue for one month from receipt, or for a longer period you choose, up to two months. If you end them under Section 12.2, 16.3 or 17.2, or DPA Article 5.2(b) or 6.5, you may choose a shorter period. We confirm receipt within ten working days.

(c) Transitional period. Under (i) or (ii), the switch runs for up to 30 days after the notice period, and you may extend it once. If 30 days is technically unfeasible, we explain why within 14 working days and name a period of up to seven months. Your plan keeps working throughout. We assist you and third parties you authorise, keep the Service running with due care, tell you of known risks to continuity, keep your data secure, and support your exit plan.

(d) End and erasure. These Terms end when you tell us the switch is complete, or when the transitional period, as extended, ends, whichever comes first. Under (iii), they end when the notice period ends. We confirm the end in writing. Sections 13.2 and 13.5(e) then apply. When the retrieval period ends, we erase all exportable data and digital assets you generated or that relate to you directly (Section 13.3).

(e) What you can take. You can take these, in structured, commonly used, machine-readable formats:

passports in any status, with their fields, translations, sizes, colours, barcodes and history;
battery units and readings;
original uploaded files, and the values drawn from them;
custom fields;
identifiers, QR codes and passport addresses;
France filing records;
publish approvals;
scan statistics;
workspace settings, including manufacturer defaults and the EU responsible person;
your brand-domain setup;
users and roles.

We do not export our templates, scoring logic, AI instructions or credentials, because they are trade secrets or security risks. Formats are listed at https://passportcraft.com/switching. We send on request, within 20 working days, the data you cannot export yourself through the Service. A notice under (i) or (ii) counts as a request for all of it. We send that data before the transitional period ends, and we erase nothing while a request is open.

(f) No switching charges. Switching, export, transfer and the assistance in (c) are free. Other work costs only a price agreed in advance.

(g) Early termination fee. If these Terms end under this Section before a Plan Term ends, the fee is the fees for the term's remaining whole months, less 10% for the costs we save. You may show that we save more, and we then reduce the fee by the difference. If you prepaid the Plan Term, we keep the fee from what you prepaid for the part of the term not yet used, and refund the rest of that amount within 30 days. The fee is never more than that amount. Otherwise the fee is due at the end, and later instalments are cancelled. No fee is due where:

you end these Terms under Section 12.2, 16.3 or 17.2, or under DPA Article 5.2(b) or 6.5;
you give notice within 30 days of our notice under Section 3.3 or 5.4;
a partner pays for your plan.

Section 12.6(b) does not apply.

(h) Our infrastructure. Its location, and how we guard non-personal data in the Union against unlawful foreign government access, are described at https://passportcraft.com/infrastructure.

14. No Compliance Guarantee

14.1 Tools, Not Legal Advice

The Service provides tools and templates to help you structure product data for Digital Product Passports. The Service does not constitute legal, regulatory, or compliance advice. PassportCraft is not a law firm, consultancy, or notified body, and no attorney-client or advisory relationship is created by your use of the Service.

14.2 Regulatory Compliance Is Your Responsibility

While PassportCraft strives to align the Service with current ESPR requirements and published guidance, we do not and cannot guarantee that your use of the Service will result in full compliance with the ESPR, any delegated act, the EU General Product Safety Regulation (Regulation (EU) 2023/988) (the "GPSR"), or any other product or product-safety regulation. Specifically:

(a) EU regulatory requirements for Digital Product Passports are still evolving. Delegated acts for specific product categories may not yet be finalized.

(b) Compliance depends on the accuracy and completeness of the data you provide.

(d) You should seek qualified legal counsel in the relevant jurisdictions for compliance advice.

(e) The Service hosts a digital information layer (the hosted DPP page and its GS1 Digital Link QR code). A Digital Product Passport, hosted page, or QR code does not by itself satisfy, and is not a substitute for, any physical product-labelling, marking, safety-warning, instruction, traceability, or responsible-person/economic-operator obligation that applies to your products under the GPSR, the ESPR or its delegated acts, or other applicable product law. You remain solely responsible for meeting all such physical and operational obligations.

14.3 Regulatory Changes

We make commercially reasonable efforts to update the Service to reflect published regulatory changes. However, we do not guarantee that the Service will be updated within any specific timeframe after a regulatory change is published. We will communicate known regulatory developments that affect the Service through our blog, email notifications, or in-platform notices.

14.4 Decision-Support Only — No Critical Reliance

The Service, including any output generated by the AI-Assisted Tools (Section 3.1(f)), is a decision-support tool only. It is not a substitute for independent verification or for qualified legal, regulatory, or compliance counsel.

(a) You must not rely on the Service or any AI output as the sole or final basis for any regulatory submission, public Digital Product Passport, legal determination, or other decision with legal or regulatory consequences.

(b) Before relying on any output, you must independently review and verify it and, where appropriate, seek qualified legal counsel in the relevant jurisdictions (consistent with Section 14.2(d)).

(c) You assume all risk arising from your reliance on the Service or any AI output. This Section reinforces the exclusion of regulatory fines and penalties in Section 10.2(e) and the disclaimers in Section 10.5.

14.5 ESPR Roles

With respect to Digital Product Passports created, managed, or hosted through the Service:

(a) You are the economic operator. You (or the entity on whose behalf you act) are the economic operator — the manufacturer, importer, authorised representative, or other responsible party — for each product for which a Digital Product Passport is created through the Service. You are the sole party responsible for compliance with the ESPR and any applicable delegated act, including for the accuracy, completeness, currency, legality, and ongoing availability of DPP content.

(b) PassportCraft is a software and hosting provider. PassportCraft provides software and hosting tools that enable you to create, manage, and host Digital Product Passports. PassportCraft is not, and does not assume the role or obligations of, an economic operator, responsible person, or other party with primary regulatory responsibility under the ESPR.

(c) Allocation of the "DPP service provider" role. As between the parties, the Customer is the economic operator and bears all primary regulatory responsibility under the ESPR, and PassportCraft acts only as the Customer's software and hosting provider. To the extent any function PassportCraft performs causes it to be treated as a "digital product passport service provider" within the meaning of Article 2(32) of the ESPR (an independent third party authorised by the economic operator to process DPP data in order to make it available), PassportCraft performs that function solely as the Customer's contractor on the Customer's instructions, and the Customer remains responsible for all economic-operator obligations and indemnifies PassportCraft under Section 11.1(e). This allocation between the parties applies regardless of how that role is characterised under applicable law.

(d) Data use. PassportCraft will not sell DPP data or reuse it beyond what is necessary to provide the Service to you. This paragraph is consistent with Sections 6.3 and 6.5.

15. Confidentiality

15.1 Definition

"Confidential Information" means any non-public information disclosed by one party ("Disclosing Party") to the other party ("Receiving Party") that is designated as confidential or that a reasonable person would understand to be confidential, including but not limited to:

(a) Customer Data.

(b) Business plans, pricing, product roadmaps, and financial information.

(d) The terms of any order or agreement between the parties (but not the existence of the relationship).

15.2 Obligations

The Receiving Party agrees to:

(a) Use Confidential Information only for the purposes of fulfilling its obligations under these Terms.

(b) Protect Confidential Information with at least the same degree of care it uses for its own confidential information, and in no event less than reasonable care.

(c) Limit access to Confidential Information to employees, contractors, and agents who need to know it and who are bound by confidentiality obligations at least as protective as those in this Section.

(d) Not disclose Confidential Information to any third party without the Disclosing Party's prior written consent, except as permitted under the DPA for sub-processors.

15.3 Exceptions

Confidential Information does not include information that:

(a) Is or becomes publicly available through no fault of the Receiving Party.

(b) Was already known to the Receiving Party before disclosure, without any obligation of confidentiality.

(d) Is rightfully received from a third party without restriction on disclosure.

15.4 Required Disclosures

The Receiving Party may disclose Confidential Information if required by law, regulation, or court order, provided it:

(a) Gives the Disclosing Party prompt notice (to the extent legally permitted) so the Disclosing Party may seek a protective order.

(b) Discloses only the minimum information required.

15.5 Duration

Confidentiality obligations survive termination of these Terms for a period of three (3) years, except that: (a) Confidential Information that constitutes a trade secret remains protected for as long as it qualifies as a trade secret under applicable law; and (b) Customer Data, and any personal data within Confidential Information, remain protected under this Section for as long as they remain non-public, consistent with PassportCraft's confidentiality and security obligations for personal data under the DPA (including DPA Articles 5.3 and 11), which prevail under Section 1.4.

16. Force Majeure

16.1 Excused Performance

Neither party shall be liable for any failure or delay in performing its obligations under these Terms (other than payment obligations) to the extent that such failure or delay is caused by events beyond the party's reasonable control ("Force Majeure Events"), including but not limited to:

(a) Natural disasters, fires, floods, earthquakes, or severe weather events.

(b) Epidemics, pandemics, or public health emergencies.

(d) Labor disputes or strikes (other than those involving the affected party's own employees).

(e) Failure of third-party telecommunications or power infrastructure.

(f) Government actions, regulations, or embargoes enacted after the date of these Terms.

(g) Cyberattacks or distributed denial-of-service attacks, provided the affected party maintained commercially reasonable security measures.

16.2 Obligations During Force Majeure

The affected party must:

(a) Notify the other party promptly of the Force Majeure Event and its expected duration.

(b) Use commercially reasonable efforts to mitigate the impact and resume performance.

16.3 Extended Force Majeure

If a Force Majeure Event prevents performance for more than 90 consecutive days, either party may terminate the affected portion of these Terms by written notice, with a pro-rated refund of any prepaid fees for the period of non-performance.

17. Modifications to These Terms

17.1 Changes by PassportCraft

We may modify these Terms from time to time. For material changes, we will:

(a) Provide at least 30 days' prior notice via email to the address associated with your account.

(b) Clearly identify what has changed and when the changes take effect.

17.2 Your Right to Object

If you do not agree with a material change, you may:

(a) Object in writing within 30 days of receiving notice.

(b) End these Terms or cancel your plan before the change takes effect, without fee. We refund prepaid plan fees for the rest of the Plan Term and cancel instalments not yet due.

If you do not object or terminate within the 30-day notice period and continue using the Service after the changes take effect, you are deemed to have accepted the updated Terms. We will include a reminder of this consequence in the change notification.

17.3 Non-Material Changes

We may make non-material changes (such as correcting typographical errors, updating contact information, or clarifying existing provisions) at any time by posting the updated Terms on our website.

18. Governing Law and Disputes

18.1 Governing Law

These Terms are governed by and construed in accordance with the laws of the State of New York, United States, without regard to its conflict of laws principles, and subject to Section 18.4 (Local Mandatory Law and Savings of Limitations). The United Nations Convention on Contracts for the International Sale of Goods (CISG) does not apply to these Terms.

18.2 Dispute Resolution — United States Customers

For Customers domiciled in the United States:

(a) Informal Resolution. Before initiating formal dispute resolution, both parties agree to attempt to resolve any dispute informally by contacting each other in writing and negotiating in good faith for at least 30 days.

(b) Binding Arbitration. If informal resolution fails, any dispute, controversy, or claim arising out of or relating to these Terms shall be settled by binding arbitration administered by the American Arbitration Association ("AAA") under its Commercial Arbitration Rules then in effect. The arbitration shall:

Be conducted by a single arbitrator.
Take place in New York County, New York, or remotely by agreement of the parties.
Be conducted in English.
Result in a written award that includes findings of fact and conclusions of law.

(c) Arbitration Award. The arbitrator's award shall be final and binding. Judgment on the award may be entered in any court of competent jurisdiction.

(d) Class Action Waiver. To the maximum extent permitted by applicable law, you agree that any dispute resolution proceedings will be conducted only on an individual basis and not in a class, consolidated, or representative action.

(e) Exceptions to Arbitration. Either party may seek injunctive or other equitable relief in any court of competent jurisdiction to prevent the actual or threatened infringement, misappropriation, or violation of intellectual property rights or confidentiality obligations.

(f) Small Claims Carve-Out. Notwithstanding the agreement to arbitrate, either party may bring an individual claim in a small claims court of competent jurisdiction if the claim qualifies for that court and is brought on an individual (non-class, non-representative) basis.

(g) Right to Opt Out of Arbitration. You may opt out of the agreement to arbitrate in Section 18.2(b) and the class action waiver in Section 18.2(d) by emailing legal@passportcraft.com with the subject line "ARBITRATION OPT-OUT" within 30 days after you first accept these Terms. Your notice must include your name, account email, and a clear statement that you wish to opt out of arbitration. A timely opt-out does not affect any other provision of these Terms, and any dispute will instead be resolved in the courts identified in Section 18.3(b). For this purpose, the forum-selection, consent-to-jurisdiction, and venue-waiver provisions of Section 18.3(b)–(c) apply to you as if set out in this Section 18.2, notwithstanding the chapeau of Section 18.3.

(h) Costs for small-value claims. For any claim seeking less than ten thousand US dollars (USD $10,000), the arbitration will, at your election, be conducted on a documents-only basis or by telephone or videoconference without an in-person hearing, and PassportCraft will pay any AAA filing and administrative fees and arbitrator compensation that exceed the filing fee you would have paid to commence the same claim in a court of competent jurisdiction, except where the arbitrator determines the claim is frivolous or brought for an improper purpose. This paragraph does not affect the class action waiver in Section 18.2(d).

18.3 Dispute Resolution — International Customers

For Customers domiciled outside the United States:

(a) Informal Resolution. The parties agree to attempt to resolve any dispute informally by negotiating in good faith for at least 30 days.

(b) Jurisdiction. If informal resolution fails, then, subject to Section 18.4 (Local Mandatory Law and Savings of Limitations): (i) any dispute that PassportCraft brings against you shall be subject to the exclusive jurisdiction of the state and federal courts located in New York County, New York, United States, to the extent such an exclusive choice of court is permitted by the law applicable to you (including, where applicable, Article 25 of Regulation (EU) No 1215/2012 (Brussels Ia) and the 2005 Hague Convention on Choice of Court Agreements); and (ii) any dispute that you bring against PassportCraft shall be subject to the non-exclusive jurisdiction of those same courts. This Section does not purport to override Article 25 of Brussels Ia, the Hague Convention, or any mandatory rule that entitles you to bring proceedings, or requires proceedings against you to be brought, in the courts of your country of establishment; where such a rule applies, New York is an additional permitted forum to the extent that rule allows.

(c) Consent to Jurisdiction. You consent to the personal jurisdiction of the courts identified in paragraph (b) and waive any objection to venue in those courts, to the extent permitted by the law applicable to you.

18.4 Local Mandatory Law and Savings of Limitations

(a) Nothing in this Section 18 limits any rights that Customers established in the European Union, the European Economic Area, the United Kingdom, or Switzerland may have under mandatory provisions of the law of their country of establishment that cannot be waived by contract.

(b) Where any limitation, exclusion, jurisdiction, arbitration, modification, or renewal provision in these Terms is unenforceable, deemed unwritten, or otherwise invalid under the mandatory law of the Customer's country of establishment — including, by way of example, the Unfair Contract Terms Act 1977 (United Kingdom), Articles 1171 and 1245 of the Code civil (France), Articles 1341 and 1342 of the Civil Code (Italy), and the Code of Obligations (Switzerland) — that provision applies only to the maximum extent that mandatory law permits, and the remainder of these Terms continues in full force and effect.

(c) In particular, where a limitation of liability or an exclusion of damages in Section 10 would be invalid as written under such mandatory law but a more limited restriction would be enforceable, the provision is to be read down and applied to the maximum extent that law permits, rather than disregarded in its entirety. This paragraph supplements the severability provision in Section 19.2 and, for Customers in the European Economic Area, operates alongside Section 10.7. Where, however, the applicable mandatory law voids such a provision in its entirety rather than permitting it to be partially upheld — for example, under the Unfair Contract Terms Act 1977 (United Kingdom), or where a clause is réputée non écrite (deemed unwritten) under French law — the read-down in this paragraph does not apply to that provision, and the fallback limitation in Section 18.4(d) applies instead.

(d) Fallback limitation. As a separate and severable term, and only where and to the extent the primary limitations and exclusions in Section 10 are held wholly unenforceable (and not merely read down) under the mandatory law applicable to you, PassportCraft's total aggregate liability to you for all claims arising out of or related to these Terms or the Service is instead limited to the greatest sum that is enforceable under that law, and in any event PassportCraft is not liable for the categories of indirect and consequential damages described in Section 10.2, in each case except for liability that cannot be limited or excluded under applicable law (including, for Customers in the European Economic Area, the matters in Section 10.7(a)). This paragraph is intended to operate as an independent term distinct from Section 10, so that the invalidity of a provision in Section 10 does not affect this paragraph.

18.5 Locating the Customer

(a) The dispute-resolution tracks in Sections 18.2 and 18.3 are determined by where the Customer is domiciled. The mandatory-law and savings provisions in Sections 18.4, 10.7, and 12.5 are determined by the Customer's country of establishment. A Customer may be domiciled in one country and established in another.

(b) Tie-break. A Customer that is both domiciled in the United States and established in the European Union, the European Economic Area, the United Kingdom, or Switzerland is treated as a United States Customer for purposes of Section 18.2 (and is therefore subject to the arbitration agreement in Section 18.2), except that the mandatory rights preserved by Section 18.4(a) and any liability provisions required by Section 10.7 continue to apply to that Customer according to its country of establishment. For the avoidance of doubt, a Customer that is domiciled in the United States is treated as domiciled in the United States for purposes of Section 18.2, whether or not it is also domiciled or established elsewhere; a Customer is treated as domiciled outside the United States under Section 18.3 only if it has no domicile in the United States.

19. Miscellaneous

19.1 Entire Agreement

These Terms, together with the DPA, the Acceptable Use Policy, and any applicable order forms or service-specific terms, constitute the entire agreement between you and PassportCraft with respect to the Service. They supersede all prior or contemporaneous communications, proposals, and agreements, whether oral or written, relating to the subject matter hereof.

Non-reliance. You acknowledge that, in entering into these Terms, you have not relied on any representation, statement, warranty, or assurance — whether in marketing materials, the website, sales communications, demonstrations, or otherwise — that is not expressly set out in these Terms, and any implied or extra-contractual warranty is disclaimed to the maximum extent permitted by law. This Section does not exclude or limit any liability for fraud or fraudulent misrepresentation, or any other liability that cannot be excluded or limited under applicable law (including the mandatory statutory rights referred to in Section 10.5).

19.2 Severability

If any provision of these Terms is held to be invalid, illegal, or unenforceable by a court of competent jurisdiction, that provision shall be modified to the minimum extent necessary to make it valid and enforceable, or if modification is not possible, severed from these Terms. The remaining provisions shall continue in full force and effect.

19.3 Waiver

The failure of either party to enforce any right or provision of these Terms shall not constitute a waiver of that right or provision. Any waiver must be in writing and signed by the waiving party.

19.4 Assignment

You may not assign or transfer these Terms, or any rights or obligations hereunder, without PassportCraft's prior written consent. PassportCraft may assign these Terms to an affiliate or in connection with a merger, acquisition, reorganization, or sale of all or substantially all of its assets, provided the assignee agrees to be bound by these Terms. Any attempted assignment in violation of this Section is void.

19.5 Notices

All notices under these Terms must be in writing and delivered by email:

To PassportCraft: legal@passportcraft.com
To Customer: The email address associated with your account.

A notice sent by email is deemed received on the day it is sent if sent on a business day before 5:00 p.m. in the recipient's time zone, and otherwise on the next business day, provided the sender does not receive an automated bounce or non-delivery message. However, for a Customer established in the European Economic Area, this deeming does not apply to notices of a price change (Section 5.4), of a material modification to these Terms (Section 17), or of termination or suspension (Sections 12.2, 12.4, and 12.7), or of a finding under Section 2.1 of the Acceptable Use Policy; any time period that runs from such a notice runs from the Customer's actual receipt of it. Day-sent deeming applies only to routine operational notices. The sender bears the burden of proving transmission (for example, by a sent-mail record); a delivery or read receipt is not required.

19.6 Independent Contractors

The parties are independent contractors. Nothing in these Terms creates a partnership, joint venture, agency, or employment relationship between the parties.

19.7 No Third-Party Beneficiaries

These Terms are for the benefit of the parties and their permitted successors and assigns only. Nothing in these Terms confers any rights on any third party, except that the indemnified parties identified in Section 11 (each party's officers, directors, employees, and agents) are intended third-party beneficiaries of the indemnities in Section 11 and may enforce them.

19.8 Language

These Terms are drafted in English. If these Terms are translated into any other language, the English version controls in the event of any discrepancy or inconsistency.

19.9 Export Compliance and Sanctions

You agree to comply with all applicable export control and trade sanctions laws and regulations in your use of the Service. In addition, you represent, warrant, and covenant that you and your Authorized Users:

(a) are not located in, ordinarily resident in, or organized under the laws of any country or territory that is the subject of comprehensive economic sanctions or trade embargoes;

(b) are not identified on, and are not owned (50% or more) or controlled by any person identified on, any restricted-party list maintained by the United States (including the U.S. Treasury Department's Office of Foreign Assets Control (OFAC) Specially Designated Nationals and Blocked Persons List and the U.S. Commerce Department's Bureau of Industry and Security Entity List), the European Union, the United Kingdom, or the United Nations;

(c) will not export, re-export, or otherwise provide access to the Service, directly or indirectly, to any such person, jurisdiction, or territory; and

(d) will not use the Service for any end-use prohibited by applicable export control or sanctions laws.

A breach of this Section 19.9 is a material violation of these Terms and entitles us to suspend or terminate your access under Section 12.7 and Section 12.4.

19.10 Government Use

If you are a government entity, additional terms may apply. Contact us at legal@passportcraft.com before using the Service.

19.11 Publicity

You grant PassportCraft a limited, non-exclusive, royalty-free, worldwide license to use your name and logo solely to identify you as a customer of PassportCraft on our website and in our marketing materials. This license is subject to your published trademark-usage guidelines, and all goodwill arising from such use inures to your benefit. This Section does not permit us to use any Customer Data, or to publish any quotation, testimonial, or case study about you, without your separate prior written consent. You may opt out of, or revoke, this use at any time by emailing legal@passportcraft.com, and we will discontinue the relevant use within a reasonable period. This Section is consistent with, and does not override, the confidentiality carve-out for the existence of the relationship in Section 15.1(d).

20. Contact Information

If you have questions about these Terms, contact us at:

PassportCraft LLC 418 Broadway, Ste N Albany, NY 12207 United States

Email: legal@passportcraft.com Website: https://www.passportcraft.com