Legal

Terms of service

The agreement between your company and ours. Short where it can be, precise where it matters — especially about what happens to your passports when you stop paying.

Last updated 2026-09-21 · Privacy statement

1. Who this is between

These terms apply to every use of OrigoPass, operated by Twenty9 Solutions (“we”, “us”), by you as a customer (“you”).

OrigoPass is a business service. We contract with companies and other organisations, not with consumers, and the statutory consumer rules — including the 14-day right of withdrawal — do not apply. If you are signing up as a private individual, do not use the service.

Your own purchasing or general terms do not apply, even if you refer to them, unless we have accepted them in writing.

2. What the service is

OrigoPass publishes digital product passports and seals every record in an append-only register that anyone can verify. It provides the console, the hosted passport pages, the QR data carriers, the access tiers of Article 77, the API and the exports described on our website.

What it is not: we are not your compliance. Responsibility for a product passport — its content, its accuracy, and whether it satisfies the regulation for your product — rests with the economic operator placing the product on the EU market. That is you, not us. We provide infrastructure that makes your record permanent, attributable and verifiable; we do not check whether what you publish is true or complete, and nothing in our software or documentation is legal advice.

3. Your account

• You are responsible for everything that happens under your accounts and API keys. Keep them secret; rotate a key the moment you suspect it leaked — one click in the console.
• Each person gets their own account. Shared logins break the audit trail, which is the thing you are paying for.
• You give each user the role they need and no more, and you keep that current: someone who leaves your company should lose access the same day.
• Tell us promptly if you suspect unauthorised access.

4. Free trial

A new account gets 30 days with one product and one passport, no payment details required. Everything you seal during the trial is a real, permanent record — that is the point — so do not publish test data as if it were a live product. When the trial ends without a plan the account becomes read-only; passports sealed in it stay online.

5. Plans, quota and extra passports

Prices exclude VAT. What is in each plan is on the pricing page; that page prevails over this table if the two ever disagree.

• The quota is new passports per calendar month — on a yearly plan as well. Unused quota does not roll over.
• Beyond the quota you may buy extra passports at the rate of your plan. They stay available while your plan runs.
• Updating passports, granting access and exporting are unlimited in every plan. You pay for new passports, not for keeping them alive.
• Upgrading takes effect immediately and unused days of the old plan are credited. A downgrade takes effect at the end of the running period.
• We may change prices with two months’ notice by e-mail. If you do not accept the change you may end the agreement before it takes effect; a yearly plan already paid for keeps its price until the end of its period.

6. Invoicing and payment

• Invoices are issued by Twenty9 Solutions and are payable within 30 days. Every invoice is in your console.
• You can pay by iDEAL, card or bank transfer. Paying online also sets up a mandate so renewals are charged automatically; you can withdraw it at any time and switch to bank transfer.
• VAT follows your country and VAT number. With a valid EU VAT number outside the Netherlands we invoice with VAT reverse-charged; we check the number against the European Commission’s VIES service.
• An invoice past its due date is followed by reminders. If it stays unpaid we may suspend the console after a written warning. Suspension never takes published passports offline — it stops you adding or changing things until the invoice is settled.
• Setting off against, or suspending, payment is not permitted. Statutory commercial interest and reasonable collection costs may be charged on late payment.

7. Your data, and what happens when you leave

Your product data stays yours. We use it only to provide the service. We do not sell it, we do not mine it, and we do not use it to train anything.

This is the part most software contracts are vague about, so we are not:

• Every passport sealed during a paid period stays online and verifiable for 15 years from sealing, at no further cost, whether or not you are still a customer. A printed QR code outlives a contract, and breaking it would make the passport worthless exactly when someone needs it.
• When you cancel, your account becomes a read-only archive: nothing can be added or changed, everything published stays reachable.
• At any time you can export a signed archive: static pages you can host yourself, plus every sealed record with its ledger proof. Because your QR codes point at your own hostname, you can move away from us without breaking a single printed code.
• We will never hold your data hostage to get an invoice paid: the export stays available.

8. The register cannot be rewritten — including by you

Records are added, never edited or deleted; the database itself refuses. That guarantee is the product, and it cuts both ways:

• A mistake is corrected by publishing a new version next to the old one. The old version stays visible, with its timestamp.
• A product that should no longer be on the market can be withdrawn: the passport says so, and the record of it having existed remains.
• We cannot delete a sealed record for you, and neither can anyone else — not our staff, not a database administrator. Please do not publish anything you would want erased later; the preview in the console exists for that reason.
• Personal data does not belong in passport content. If you put it there anyway, you are the controller of it and you carry the consequence that it cannot be removed.

9. Personal data (processor terms)

Where we process personal data on your behalf — accounts of your users, access requests from repairers and recyclers, supplier contacts — we act as processor and you as controller. This section is our processing agreement under Article 28 GDPR:

• We process that data only on your instructions and to provide the service, and we keep it confidential.
• We take appropriate technical and organisational measures; the privacy statement describes them.
• Sub-processors: our hosting and Mollie for payments. All processing takes place within the European Union. We tell you before adding a sub-processor, and you may object on reasonable grounds.
• We help you, as far as we reasonably can, with requests from data subjects, with security incidents and with impact assessments, and we report a personal data breach to you without undue delay.
• On termination we delete or return the personal data we hold for you — except what is sealed in the register, which cannot be deleted and which the privacy statement describes.
• You may audit our compliance once a year, at your cost, with reasonable notice and subject to confidentiality.

10. Acceptable use

Do not use OrigoPass to publish unlawful content, to make false claims about a product’s compliance, to impersonate another company, or to attack the service or anyone else through it. Automated use of the API within your plan is fine; deliberately overloading the service is not.

We may suspend an account that is clearly abusing the service, after warning you where circumstances allow. Even then, published passports stay online: the public record is not a lever.

11. Availability

Public passport pages are served from more than one node, so a single machine failing does not take a QR code offline. The console runs on one node and can be briefly unavailable during maintenance; we avoid business hours where we can.

We aim for high availability and we deliberately do not print a percentage here. If you need a service level with agreed response times, ask us for a separate agreement — we would rather sign something we can keep than publish a number we cannot.

12. Liability

We are liable only for direct damage, and only up to the amount you paid us in the twelve months before the event, with a maximum of € 25.000 per year. We are not liable for indirect or consequential damage, including lost profit, lost data beyond restoring from our backups, fines imposed on you, or damage caused by your own data being wrong.

Nothing here limits our liability for intent or deliberate recklessness on our part, or for anything that cannot be limited under Dutch law.

You indemnify us against third-party claims arising from what you published through the service.

Neither party is liable for failures caused by circumstances beyond its reasonable control, including failures at hosting providers, certificate authorities or payment providers.

13. Term and ending it

• A monthly plan runs per month and can be cancelled at any time, taking effect at the end of the running month.
• A yearly plan runs for a year and can be cancelled up to the end of that year.
• You cancel in the console; we confirm by e-mail. There is no notice period and no cancellation fee.
• We may end the agreement with two months’ notice, or immediately if you seriously breach these terms and do not fix it after a written warning. In every case section 7 stays: your passports stay online.

14. Changes to these terms

We may change these terms with two months’ notice by e-mail to the address on your account. If a change is materially to your disadvantage you may end the agreement before it takes effect, and we refund anything paid for the period after that date.

15. Law and disputes

Dutch law applies. If we cannot resolve something between us, the dispute goes to the competent court in the district where we are established. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

Questions about these terms: info@origopass.eu.