Terms of service

Business use, authority and accounts

The service is intended for professional organizations and their authorised users. A person accepting an order or creating an organization account confirms that they have authority to bind that organization. Accounts are individual and may not be shared; customers are responsible for invitations, role assignments, identity-provider configuration and activity performed through their accounts.

The customer must keep contact and billing information current and notify the operator promptly of suspected compromise. Access through an API key, supplier link or integration is treated as customer-authorised until it is revoked or expires.

Acceptable use

Customers must not use the service to break the law, infringe rights, distribute malware, probe or bypass security, disrupt other tenants, scrape protected areas, misrepresent certification, publish deceptive product claims, or upload content they are not entitled to process. Rate limits and technical safeguards may be applied to protect availability and tenant isolation.

The service must not be used as the sole control for emergency response, life-critical decisions or any activity where an unavailable or incorrect result could reasonably cause death, personal injury or severe environmental harm.

Customer data, instructions and confidentiality

The customer keeps ownership of its product data, documents and other customer content. It grants the operator the limited right to host, copy, transform, transmit and display that content only as needed to provide, secure and support the service and comply with law. The Data Processing Agreement published at dppshield.com/en/dpa forms part of these terms and governs the processing of personal data on the customer's behalf.

Each party should protect the other party's non-public business, security and technical information using reasonable care. Information is not confidential if it is or becomes public without breach, was already lawfully known to the recipient, or is independently developed. A party compelled by law to disclose gives prior notice where lawful and discloses only what is required. Feedback about the service may be used to improve it without obligation.

Digital Product Passport responsibilities

DPP Shield structures evidence, evaluates configured rules and supports controlled publication. It is not a regulator, notified body, laboratory, legal adviser or certification body. A score, finding, AI suggestion, template or publication status is not a legal compliance certificate.

The customer remains responsible for product scope, applicable law, identifier rights, data accuracy, evidence authenticity, translations, access classifications, claims and the decision to publish. Product-specific rules and official guidance must be checked before relying on a passport.

Exports, switching and exit assistance

Customers can use available exports and APIs to retrieve supported customer data. Where the switching rules of the EU Data Act apply, the API reference and knowledge base describe the exportable data and formats, and the operator assists with the switch and applies only the charges that Act permits.

Deletion or portability requests must be made before the contractual exit window closes. The operator is not required to disclose its own protected software, security material, trade secrets or third-party assets, and those limits never prevent the export of customer data that the law or contract makes portable.

Regulation (EU) 2023/2854 (Data Act), Chapter VI ↗

Third-party services and integrations

Identity providers, payment services, email delivery, external registries, AI endpoints and customer-configured integrations are governed by their own terms and availability. The operator is responsible for its integration layer, not for a third party's independent service, decisions or content.

Customers must obtain any third-party licences and credentials they need and verify outputs before use. An external link or integration does not mean the operator endorses the provider or guarantees continued compatibility.

Suspension, termination and changes

Access may be restricted where reasonably necessary to address a security threat, unlawful use, material breach, unpaid undisputed fees or risk to other tenants. Except in urgent cases or where prohibited, the operator gives notice and a reasonable opportunity to cure first.

Subscription term, renewal and cancellation are those of the plan or order form the customer accepts. Customers should export their data before the service ends; customer data is then deleted as described in the Data Processing Agreement. Material changes to these terms are announced at least 30 days before they take effect, and an order form or negotiated agreement prevails over conflicting online terms.

Warranty, liability and governing law

Service levels, credits, warranties and indemnities apply only where an accepted order form or master agreement states them; otherwise the service is provided as described in its documentation, without further warranties to the extent the law allows. Unless such an agreement says otherwise, neither party is liable for indirect or consequential loss, and each party's total liability is limited to the greater of the fees paid in the twelve months before the claim and EUR 100. Nothing in these terms excludes or limits liability that cannot legally be excluded or limited.

Unless an order form or master agreement provides otherwise, these terms are governed by the law of the governing jurisdiction shown in the legal notice, whose competent courts hear disputes. Mandatory rights and rules that cannot be varied by contract remain unaffected.