DPP Host Terms of Service

Version of 29 October 2026 (2026-10-29.2)

This text is published in English only.

1. Parties, scope and acceptance

1.1 These Terms of Service (the "Terms") are an agreement between Qubites ApS, Ulsøparken 49, 2. tv., 2660 Brøndby Strand, Denmark, CVR 37061026, trading as DPP Host ("DPP Host", "we"), and the business that uses the Service through an Organisation (the "Customer").

1.2 Businesses only. The Service is offered only to businesses acting in their trade, business, craft or profession, sole traders included. By accepting these Terms, the person accepting confirms that the Customer is such a business. The Service is not offered to consumers. Consumers view Published Passports, which needs no account, and, where the Customer offers Owner Services, use the Owner Area under the Customer's own terms and privacy notice. These Terms do not govern that use.

1.3 Acceptance. A User accepts these Terms for the Customer when they create an Account: the sign-in screen links these Terms and says that continuing accepts them. The User accepts them again each time they buy a Plan or a Credit Pack, or top up the Prepaid Balance, through Stripe Checkout, by ticking the box for these Terms there, which the payment provider, Stripe, records with the date. The User confirms that they may bind the Customer. Acceptance of these Terms is also acceptance of the Data Processing Agreement (the DPA), which applies from the same moment to all processing in DPA Annex I (GDPR Art. 28(9)). These Terms are published with their version and date at dpphost.eu/legal/terms/, as a page the Customer can store and print.

1.4 Acting for the Organisation. The Customer acts in the Service through its Organisation Owners and Admins. The Customer is bound by what its Organisation Owners and Admins do in the Service, and by what its other Members, API Keys, MCP Grants and Connections do within the permissions the Customer gave them, and by what Partner Staff do in its Organisation within the role the Customer gave the Partner.

1.5 Documents and order of precedence. The agreement consists of:

• (a) any signed order or contract with DPP Host (an "Order"; Enterprise, the plan sold by Order, is no longer offered since 16 Oct 2026);
• (b) the Data Processing Agreement (the "DPA"), on the processing of personal data;
• (c) the Owner Services Annex, on Owner Services;
• (d) these Terms and their Schedules;
• (e) the Price List.

If they conflict, the document listed first prevails, except that the DPA always prevails on the processing of personal data, and the Price List prevails over Schedule 2 on a price or a limit. For a Partner, the Partner Terms are also part of the agreement and prevail over these Terms on the partner programme.

1.6 Language. These Terms are written in English. If DPP Host provides a translation, the English text prevails.

2. Definitions

In these Terms:

• Account: the sign-in of one User.
• Admin: a Member with the admin role.
• AI Credits: units that plans grant and Credit Packs add (clause 5.14).
• API: the REST API at api.dpphost.eu/v1.
• API Key: a credential for the API that an Admin or Organisation Owner creates.
• Approval: the confirmation by a Member, on the approval page of the Dashboard, of the values a Passport Version will publish (clause 6.2).
• Brand: in the DPA and the Owner Services Annex, the Customer.
• Business Verification: the check that the Customer is a real business (clause 4.5).
• Client: the Customer whose Organisation is a Client Organisation of the Partner.
• Client Organisation: an Organisation whose Organisation Owner linked a Partner to it (clause 4.10).
• Connection: the link between a Shop and the Customer's Organisation (clause 12.2).
• Continuity Period: the period in clause 15.1.
• Continuity Promise: the commitment in clause 15.1.
• Credit Pack: a one-time purchase of AI Credits.
• Customer Content: everything the Customer, its Members, API Keys, MCP Grants, Connections and suppliers put into the Service: product data, passport values, evidence, images, documents, page blocks, themes and settings.
• Dashboard: the web application at app.dpphost.eu.
• Delegation: the permission a GTIN licensee gives another Organisation to publish Passports for part of its approved GTIN Claim (clause 7.4).
• Draft: a Passport, or a value, that is not published.
• Economic Operator: the person responsible for a product under Regulation (EU) 2024/1781 (the "ESPR") and the rules made under it.
• Editor, Viewer: Members with the editor or viewer role.
• Free Plan, Premium: the Plans in clause 5.1. The Dashboard and DPP Host's website show the Free Plan as "Basic". Basic in these Terms is the paid plan of clause 5.1(b), which is no longer offered.
• Executor: the person in clause 15.6.
• First Year: for a Passport, the 12 months from its first publication, counted in calendar days in UTC (a Passport first published on day D is in its First Year up to and including the day before D plus 12 months); for an item that a lot's published list of serial numbers names without a Passport of its own, the 12 months from the list that first named it. Such an item that later gets a Passport of its own is counted once, from its first listing. A Passport or item that was withdrawn still counts in its First Year.
• GTIN: a Global Trade Item Number issued under the GS1 system.
• GTIN Claim: the Customer's claim, approved by DPP Host, to publish Passports for a GS1 company prefix or for single GTINs (clause 7).
• Main Terms: in the DPA, these Terms.
• MCP: the Model Context Protocol server at mcp.dpphost.eu/mcp.
• MCP Grant: the permission a Member gives an AI client to use the MCP for one Organisation.
• Member: a User who belongs to an Organisation.
• Organisation: the workspace in the Service that holds the Customer's Customer Content, Members, Plan and settings.
• Organisation Export: the download in clause 15.9.
• Organisation Owner: a Member with the owner role. (The Owner Services Annex uses "Owner" for a consumer who uses the Owner Area. These Terms call that person a "Product Owner".)
• Owner Area, Owner Services: as defined in the Owner Services Annex.
• Partner: a Customer in the partner programme, under the Partner Terms.
• Partner Link: the link between one Partner Organisation and one Client Organisation, with the role the Client Organisation's Organisation Owner chose (clause 4.10).
• Partner Organisation: the Organisation of a Partner.
• Partner Staff: Members of a Partner Organisation who are Members of a Client Organisation through a Partner Link.
• Passport: a digital product passport for a product model, batch or item, held in the Service.
• Passport Version: one published state of a Passport. A Passport Version is never changed after publication.
• Payment Mode: how Premium charges for Passports, chosen at Checkout: paid once or spread over the First Year (clause 5.3).
• Plan: the Free Plan or Premium.
• Premium Layer: the brand layer of Premium (clause 3.2(f)).
• Prepaid Balance: the balance an Organisation tops up in advance and pays its Passports from when it pays them once (clause 5.18).
• Price List: the prices and limits shown in the Dashboard and, for a purchase, in Stripe Checkout before payment.
• Published Passport: a Passport with at least one Passport Version.
• Qubites: in the DPA, DPP Host.
• Resolver: the service at id.dpphost.eu that answers the address of each Published Passport.
• Service: the services of DPP Host described in clause 3 and Schedule 1.
• Shop: an online shop the Customer runs on a third-party platform, such as WooCommerce.
• Statement of Reasons: the statement in clause 9.6.
• Supplier Form: the form in clause 12.1.
• User: a person who has an Account.
• Verified Organisation: an Organisation that has passed Business Verification.

3. The Service

3.1 What DPP Host does. DPP Host lets businesses create, publish and host digital product passports for their products, and keeps Published Passports available at stable addresses that printed QR codes point to. Schedule 1 lists each module and its status on the date of these Terms.

3.2 The modules. On the date of these Terms, the Service consists of:

• (a) Dashboard: products, variants, Passports, Drafts, suggestions, Approvals, Members and roles, Organisation settings, labels and the marketplace export.
• (b) Passports and the Resolver: Published Passports at id.dpphost.eu under GS1 Digital Link paths (/01/{gtin}, with /10/{batch} and /21/{serial}) or, for a DPP Host ID, under /DH/{ID} (clause 7.1), as a web page, JSON-LD, a linkset, a data file and an integrity proof, in the content languages the Customer provides. The Resolver reads published files from storage, not from the database. Earlier Passport Versions stay available.
• (c) Integrity timestamps: a daily timestamp of the published Passport Versions through OpenTimestamps. This is not a qualified electronic time stamp under Regulation (EU) No 910/2014.
• (d) Imports: imports of CSV, tab-separated text and Excel (.xlsx) files in the Dashboard, and of CSV and JSON through the API. Imported values are suggestions until a Member confirms them.
• (e) Labels: hang tags, care labels, box labels and paper bands as PDF files for Published Passports.
• (f) Premium Layer (Premium): a brand theme, a brand page and product pages built from fixed block types around the passport content, labels in the brand colour with saved designs, and API and MCP tools for pages. The passport content itself is the same in every design, and brand settings cannot change or hide it. A mobile tabbed layout is not available yet and is not part of the Service.
• (g) API, MCP and webhooks (clause 11).
• (h) Shop Connectors (clause 12.2).
• (i) Owner Services (Premium), under the Owner Services Annex.
• (j) Organisation Export (clause 15.9).

3.3 DPP Host's role under the ESPR. The Customer authorises DPP Host, as an independent third party, to host and make available its Passports and to keep a separate copy of them. DPP Host does not claim to be a verified DPP service provider. DPP Host does not register Passports in the EU registry on the Customer's behalf.

3.4 No secondary use. DPP Host uses Customer Content only to provide the Service, to keep Published Passports available under clause 15, to keep copies and backups, to handle notices and complaints, and to meet its legal duties. DPP Host does not sell Customer Content, does not use it to train AI models, and does not show customers statistics about scans.

3.5 Draft rules. Required passport fields come from rule sets. The textile rule set is a draft, because the textile delegated act is not adopted, and its requirements can change. DPP Host's checks of required fields, formats and sizes are technical checks. They are not legal advice and do not show that a Passport meets the law.

3.6 Premium release checks. Before a Premium page is released, DPP Host checks it for some generic environmental claims and offsetting claims (Directive (EU) 2024/825), for numbers that contradict or are not supported by confirmed passport values, and for missing alternative text. The checks block a release when they find a problem. They are not legal advice and do not find every misleading claim. The Customer remains responsible for its claims.

3.7 Independent service. DPP Host is an independent commercial service. It is not affiliated with, endorsed by or operated by the European Union or any of its institutions, or by GS1.

3.8 Features not yet available. A feature that Schedule 1 or the Dashboard marks as planned, coming or not available is not part of the Service until DPP Host makes it available. DPP Host does not promise that it will.

3.9 Changes to the Service. DPP Host may change the Service. Within /v1, DPP Host makes only additive changes to the API (clause 11.6). If DPP Host removes a feature that is part of the Customer's paid Plan, it gives 30 days' notice, and the Customer may cancel the Plan with a refund of the prepaid fees for the unused period. Limits of the Free Plan change only as clause 5.2 says. For Owner Services, Owner Services Annex clauses 10.1 and 12 apply; for the DPA, DPA clause 16.2 applies.

4. Accounts, roles and verification

4.1 Accounts. A User signs in with an email address and a password, with a one-time email code or link, or through a Google, Apple or Microsoft account whose email address that provider has verified. A User keeps their sign-in details confidential and tells DPP Host at hello@dpphost.eu without delay if they think someone else has used them. Sessions end after 30 days without use and at the latest after 90 days. A User may add a second step to their sign-in with an authenticator app; DPP Host does not require it on the date of these Terms, and a User who loses the app asks DPP Host to remove the second step under the procedure the Dashboard describes (proof of identity required).

4.2 Organisations. A User can create Organisations. A User can create at most 5 Organisations in 24 hours. Each Organisation has at least one Organisation Owner at all times.

4.3 Roles. Each Member has one role:

• Viewer: can see products and Passports, and cannot change anything.
• Editor: can edit products, suppliers, Passports and Premium pages, confirm values, publish Passports through an Approval (clause 6.2), and release Premium pages.
• Admin: can also invite people, change roles, edit Organisation settings, buy and change Plans and Credit Packs, run Business Verification, file GTIN Claims, prove domains, manage API Keys (including the passports:publish scope, clause 6.3) and webhooks, link Shops, and request the Organisation Export.
• Organisation Owner: full control, including over other Organisation Owners. Only an Organisation Owner can make another Member an Organisation Owner or remove that role. Nobody can raise their own role.

4.4 Invitations and Members. The Customer decides whom it invites and which role each Member has, and is responsible for its Members. An invitation expires after 7 days. A Member can leave an Organisation. The last Organisation Owner cannot leave or be removed. A Plan's user limit counts Members and open invitations. Partner Staff do not count against a Plan's user limit. A smaller Plan never removes Members; it only stops new invitations and acceptances until the Organisation is under the limit.

4.5 Business Verification. An Organisation must pass Business Verification before its first publish. Before that, it can hold at most 25 Draft Passports. The Customer chooses a route:

• (a) an EU VAT number, checked against the EU VIES service;
• (b) a company register: the Danish CVR is checked automatically; other registers are checked by hand;
• (c) the sole-trader route, checked by hand;
• (d) the manual route, for businesses outside the EU whose number cannot be checked online.

A valid answer from VIES or the CVR verifies the Organisation at once. DPP Host decides other routes by hand, usually within one working day; this is a target, not a commitment. If VIES or the CVR does not answer, the request waits.

4.6 One Verified Organisation per legal entity. A legal entity, identified by its country and its VAT or register number, can have only one Verified Organisation.

4.7 True information. The Customer gives true and complete information for Business Verification and keeps it up to date. DPP Host may revoke a verification that was based on false information or that is no longer valid. After a revocation the Organisation cannot publish. Its Published Passports stay online, subject to clause 9. Where the ground is content that is illegal or incompatible with these Terms, DPP Host gives a Statement of Reasons under clause 9.6, and the Customer can ask for a review under clause 9.7.

4.8 Domains. An Admin can prove control of a web domain with a DNS TXT record. A domain proof lets Passports and pages link to that domain. It does not verify the business.

4.9 Closing an Organisation or an Account. A User can delete their own Account in the Dashboard, after signing in again, unless they are the only Organisation Owner of an Organisation with other members, the only member of an Organisation that is not closed, or hold an owner account (they delete it in the owner area first). Deleting the Account removes the User's memberships, the sign-in and its sign-in history; the audit log keeps the User's identifier. There is no self-service closure of an Organisation. The Customer asks for it by email to hello@dpphost.eu (for personal data, privacy@dpphost.eu). DPP Host archives a closed Organisation and does not delete it, because its Published Passports and the audit log stay (clauses 15 and 16.5).

4.10 Partners.

• (a) An Organisation Owner may link a Partner to the Organisation and choose its role, Viewer or Editor. An Organisation Owner or Admin may change that role or end the Partner Link at any time; access ends at once.
• (b) The Customer stays the Customer for its Organisation and responsible under clause 6, also for what Partner Staff do (clause 1.4).
• (c) Partner Staff never hold the Admin or Organisation Owner role in a Client Organisation.
• (d) DPP Host is not a party to the Customer's agreement with its Partner and is not responsible for the Partner's services.
• (e) DPP Host may end a Partner's access under the Partner Terms, and then tells the Customer.

5. Plans, fees, payment and VAT

5.1 Plans. DPP Host offers two Plans, the Free Plan and Premium:

• (a) the Free Plan (shown in the Dashboard as "Basic"): no fee, for at most 100 Passports in their First Year (clause 5.2);
• (b) Basic, a paid plan that paid for each Passport beyond the 100 the Free Plan covers in their First Year, has not been offered since 27 Oct 2026. No Organisation was on it when it was withdrawn. Above the Free Plan's 100 Passports, an Organisation chooses Premium;
• (c) Premium: a subscription with monthly invoices, bought in the Dashboard, with the Premium Layer, that pays for each Passport in the Payment Mode the Customer chooses (clause 5.3). It has no monthly fee.

Schedule 2 lists the prices and limits of each Plan on the date of these Terms. The Price List in force prevails over Schedule 2.

5.2 The Free Plan. The Free Plan is for Verified Organisations. It has no fee and no time limit. It covers at most 100 Passports in their First Year, within the other limits in Schedule 2. A first publication of a Passport, or a lot's list of serial numbers that adds new items, that would take the Organisation above that number is refused until the Organisation buys Premium, or until enough of its Passports have left their First Year; the Dashboard and the API say why. Nothing already published goes offline, and a new Passport Version of a Published Passport is never refused for this reason. A Passport is charged for at most once, or in its First Year, and then stays online at no charge (clauses 5.3 and 15.1). DPP Host may change the limits of the Free Plan with 90 days' notice. A change applies only to new usage: it never takes a Published Passport offline and never charges for one.

5.3 Premium prices. Premium is priced per Passport, at the prices in the Price List when the Customer buys, in one of two Payment Modes the Customer chooses at Checkout (paid once, unless the Customer chooses to spread the cost). There is no monthly fee. On the date of these Terms the Price List says, excluding VAT:

• (a) Paid once: EUR 1 for each Passport. A Passport is paid once, when it is first published, from the Prepaid Balance (clause 5.18); a Passport the Prepaid Balance does not cover waits until it is topped up. The subscription's monthly invoices are EUR 0. A Passport first published on the Free Plan before the purchase is not charged (the Free Plan covered it).
• (b) Spread over the First Year: EUR 0.10 per month for each Passport in its First Year (EUR 1.20 in total for a Passport over its 12 months). Each monthly invoice is charged in advance for the number of Passports in their First Year that DPP Host counted last before the invoice; DPP Host counts once a day and gives the number to Stripe. A change of that number during a month is not charged or credited for that month. A month without a Passport in its First Year is invoiced EUR 0.

Stripe Checkout shows the final price before the Customer pays. Premium renews automatically each month until cancelled. A running subscription keeps its Payment Mode; to change the Payment Mode, the Customer cancels (clause 5.11) and buys again once the subscription has ended. The Dashboard shows the number of Passports and the amount of the next invoice. A Passport is charged for at most once in the first mode, and only in its First Year in the second.

5.4 Price changes. A change of the Price List applies to new purchases. A running subscription keeps its price until DPP Host gives notice of a change. DPP Host gives at least 60 days' notice before a new price applies to a running subscription, and the Customer may cancel before then. The number of Passports that each invoice charges follows the Customer's use (clause 5.3); that is not a change of price.

5.5 Starting on the Free Plan. Every new Organisation starts on the Free Plan. There is no trial of Premium.

5.6 Buying. Only an Admin or Organisation Owner can buy, change or cancel a Plan, buy a Credit Pack or top up the Prepaid Balance (clause 5.18). Payment runs through Stripe Checkout, by card or SEPA Direct Debit in euro, except a top-up charged to a card or account saved for automatic top-up (clause 5.18(b) and (c)). An Organisation can have one subscription at a time. If two subscriptions start at the same time, DPP Host cancels the second at once and refunds its invoice. Premium starts as soon as it is bought. Spread over the First Year (clause 5.3(b)), nothing is charged on the day of the purchase: the first monthly invoice is made the next morning (05:00 UTC), after DPP Host's daily count. DPP Host does not check at Checkout that the Organisation is verified.

5.7 Promotion codes. DPP Host may accept promotion codes at Checkout. The terms of a code (discount, duration, eligibility) are those stated with it. A code has no cash value.

5.8 Invoices. Stripe issues invoices and receipts in euro. The Customer finds them in the Stripe customer portal, which an Admin opens from the Dashboard. The Customer keeps its billing email, address and VAT number up to date there.

5.9 VAT. Prices exclude VAT.

• (a) Customers in Denmark pay Danish VAT at the rate in force (25% on the date of these Terms).
• (b) Business customers in other EU countries with a VAT number that VIES confirms as valid are invoiced under the reverse-charge procedure and account for the VAT themselves.

The Customer is responsible for the VAT number and address it gives. If a tax authority decides that VAT was due because that information was wrong, the Customer pays the VAT and any related charge. Stripe Tax calculates the tax on each invoice.

5.10 Changing Plans. The Customer moves from the Free Plan to Premium by buying Premium (clause 5.6), and from Premium to the Free Plan by cancelling (clause 5.11). Because Basic is no longer offered (clause 5.1(b)), no other change of Plan is offered. The billing period is always one month. A smaller Plan never removes Published Passports or Members.

5.11 Cancellation. An Admin or Organisation Owner cancels Premium in the Stripe customer portal. Cancellation takes effect at the end of the paid period. The Organisation then moves to the Free Plan. Nothing is deleted; after Premium, the Premium Layer shows the Basic page design (clause 5.15).

5.12 Late payment. If a subscription payment fails, the Organisation keeps full use of its Plan, and DPP Host sends a reminder at once, after 3 days and after 7 days. If the amount is still unpaid after 14 days, counted in calendar days in UTC from the failure, the paid Plan ends and the Organisation moves to the Free Plan. A later payment of the open invoice restores the paid Plan. DPP Host never takes a Published Passport offline, makes an Organisation read-only or deletes data because of a late payment.

5.13 Refunds. Fees are not refunded, except:

• (a) the automatic refund of a second subscription (clause 5.6);
• (b) the pro-rata refund in a wind-down (clause 15.5);
• (c) where the law requires a refund;
• (d) where DPP Host decides to refund in a single case;
• (e) the refunds in clauses 3.9 and 18.4;
• (f) a pro-rata refund of prepaid fees for a service the Customer ends after an objection under DPA clause 7.4 or 7.5;
• (g) the unused Prepaid Balance when the Customer closes its account (clause 5.18(g)).

If the Customer disputes a payment with its bank (chargeback), or DPP Host refunds a subscription invoice in full, the process in clause 5.12 starts as for a failed payment, unless DPP Host wins the dispute or the amount is paid again. A refund or chargeback also removes the unused AI Credits that the payment granted.

5.14 AI Credits.

• (a) Plans grant AI Credits for each month: 20 on the Free Plan, 200 on Premium. Premium gives a month's AI Credits when the subscription starts (spread over the First Year, with its first invoice the next morning) and again with each monthly renewal. Plan credits expire at the end of the month they are granted for.
• (b) Credit Packs add 1,000 or 5,000 AI Credits for a one-time payment. Pack credits do not expire. Credit Packs cannot be bought while an Organisation is read-only or archived.
• (c) AI Credits have no cash value and cannot be transferred to another Organisation.
• (d) API and MCP calls do not use AI Credits.
• (e) What uses AI Credits. A Member's reading of files or of a web page that suggests passport values (in the Dashboard's New passport, or a file added in the Guide; also a Representative's mandate) and each answer of the Guide use 1 AI Credit; a reading or an answer that fails uses none. Reading the columns of a spreadsheet for an import, a GS1 document for a GTIN claim, a Supplier's file on a Supplier Form and a maker's files sent through its EU representative's link use none.
• (f) Beyond the month's AI Credits. When the Organisation has no AI Credits left, each further AI Credit costs EUR 0.05, excluding VAT, taken from the Prepaid Balance (clause 5.18) when the reading or the answer is made. If the Prepaid Balance is below that price, the reading or the answer is refused and nothing is taken; the Dashboard says so and offers a top-up.

5.15 When a paid Plan ends. When Premium ends (after cancellation, or clause 5.12), the Organisation moves to the Free Plan. Published Passports stay online. Editing and publishing continue within the Free Plan limits: while the Organisation has 100 or more Passports in their First Year, a new Passport waits as clause 5.2 says. After Premium, the Premium Layer is switched off and pages show the Basic page design, and Owner Services pause (Owner Services Annex, clause 4.3). Nothing is deleted, and the Premium content returns when Premium starts again.

5.16 Orders. The prices, limits and any service levels of an Order are those in the Order. There is no service level agreement unless an Order contains one. Enterprise, the plan sold by Order, is no longer offered (16 Oct 2026).

5.17 Purchases through a Shop platform. Premium cannot be bought through a Shop platform on the date of these Terms.

5.18 Prepaid Balance.

• (a) Who pays from it. An Organisation pays its Passports from a prepaid balance in its billing currency (the "Prepaid Balance") unless a subscription in the Payment Mode spread over the First Year (clause 5.3(b)) pays them: when it pays them once (clause 5.3(a)), and on a Plan set up without a subscription. Every Organisation, on every Plan (the Free Plan included) and whatever pays its Passports, pays from it each AI Credit it uses when it has no AI Credits left (clause 5.14(f)), and may top it up under (b). The Prepaid Balance is the sum of its top-ups, less what was taken from it under (d) and (e). The Dashboard shows it and every entry.
• (b) Top-ups. An Admin or Organisation Owner tops up the Prepaid Balance in the Dashboard by one of the amounts the Dashboard offers (on the date of these Terms EUR 50, EUR 100 or EUR 500, excluding VAT), through Stripe Checkout, by card or SEPA Direct Debit in euro. Where a reading of files waits because the Organisation has no AI Credits left and the Prepaid Balance is short (clause 5.14(f)), and a card is saved for automatic top-up under (c), the Admin or Organisation Owner may instead have that card charged at once in the Dashboard, for one of the same amounts plus VAT; if the bank declines the card, or asks for a confirmation that the Dashboard cannot show, nothing is charged and the Dashboard offers Stripe Checkout instead. A top-up counts once its payment has succeeded; a SEPA Direct Debit can take several business days. A top-up charged to a saved card in the Dashboard, and an automatic top-up under (c), do not go through Stripe Checkout and show no box for these Terms: the Customer accepted these Terms at the Checkout that saved the card or account (clause 1.3).
• (c) Automatic top-up. Automatic top-up is selected by default when an Organisation tops up and has not chosen yet; the Admin or Organisation Owner who tops up may deselect it before paying, and that choice is kept. Next to the choice in the Dashboard, and on Stripe Checkout above its payment button, DPP Host states the top-up amount and the amount below which it charges. With automatic top-up selected, the payment method of that top-up is saved, and whenever the Prepaid Balance is below the amount chosen (by default EUR 10), DPP Host charges it for the top-up amount chosen (by default the smallest offered, EUR 50), plus VAT, at most once a day, without asking again, and emails the Admins and Organisation Owners after each charge. If a charge fails, automatic top-up pauses and the Admins and Organisation Owners are told by email; it resumes when a top-up succeeds or a new payment method is saved with one. It can be turned off in the Dashboard at any time.
• (d) Use. The first publication of a Passport, or a lot's list of serial numbers that adds new items, takes its price under clause 5.3(a) from the Prepaid Balance at that moment. If the Prepaid Balance does not cover it, the publication is refused and nothing is taken; the Dashboard and the API say how much is missing. A new Passport Version, a Passport the Plan covers at no charge and a Passport already paid for take nothing. An AI Credit beyond the month's takes its price under clause 5.14(f) when it is used.
• (e) Refunds, chargebacks and corrections. A refund or chargeback of a top-up takes the amount it added, or its share of a partial refund, back from the Prepaid Balance; a chargeback DPP Host wins gives it back. DPP Host may correct the Prepaid Balance with an entry that states the reason (a goodwill credit, the correction of an error). The Prepaid Balance may become negative; new Passports then wait until it is topped up. Published Passports stay online in every case.
• (f) No expiry. The Prepaid Balance does not expire while the account is open. It has no cash value, earns no interest and cannot be transferred to another Organisation.
• (g) Closing the account. When the Customer closes its account or ends these Terms, DPP Host refunds the unused Prepaid Balance on the Customer's written request to hello@dpphost.eu, to the payment method or bank account the Customer names. In a wind-down, clause 15.5 applies.
• (h) VAT. A top-up is invoiced with VAT under clause 5.9 when it is paid; Stripe issues the invoice for a top-up through Checkout and a receipt for an automatic top-up.

6. The Customer's duties

6.1 Responsibility for Passport content. The Customer is the Economic Operator, or acts for the Economic Operator, for the products its Passports describe. The Customer is responsible for the accuracy, completeness and legality of Customer Content and of every Passport Version it publishes, and for meeting the ESPR, the delegated acts under it, and other product, consumer and environmental law. DPP Host does not check the truth of passport values. Every Published Passport says that the Customer is responsible for the accuracy of its data.

6.2 Confirmation by a person. Values that come from imports, Supplier Forms, Shops, AI clients through the MCP, or API Keys without the publish scope are suggestions. They are published only after a Member confirms each value on the approval page of the Dashboard. The Member must have signed in within the last 5 minutes. An Approval is valid for 24 hours and can be used once. There is no "confirm all". When a Member confirms a value or approves a publish, they do so for the Customer, and the Customer is bound by it. DPP Host records each confirmation and publish in the audit log.

6.3 Unattended publishing. An API Key that an Admin granted the passports:publish scope publishes without an Approval. The Customer is responsible for each such publish as if an Admin had approved it.

6.4 Published Passport Versions. A Passport Version cannot be changed or deleted after it is published. The Customer corrects a Passport by publishing a new Passport Version. When the product is off the market, the Customer can mark the Passport withdrawn; the Passport then stays online with a withdrawal notice.

6.5 GTINs. The Customer warrants that each GTIN it publishes under is licensed to it by a GS1 member organisation, or is covered by a Delegation from the licensee (clause 7).

6.6 No personal data about consumers. The Customer does not put personal data about consumers, or any other personal data that the product information does not need, into Passports, pages or public files. DPP Host does not check passport fields for personal data.

6.7 The Customer's own duties. The Customer is responsible for:

• (a) registering its products and Passports where the law requires it; DPP Host cannot register them on the Customer's behalf;
• (b) showing the passport link in its online offers and on its products, and printing QR codes and labels that meet the rules;
• (c) the care symbols it prints: they are trademarks of GINETEX, and the Customer follows GINETEX's rules;
• (d) keeping its own copy of its data, using the Organisation Export;
• (e) cooperating with DPP Host on notices, orders and complaints under clause 9.

7. GTIN claims and the GTIN dispute procedure

7.1 Why a claim is needed. A Passport under a Rule Set that requires a GTIN is published only if each of its GTINs is covered by an approved GTIN Claim of the Organisation or by an active Delegation. Other Passports may instead use a DPP Host ID that DPP Host issued to the Organisation. A DPP Host ID is 12 letters and digits, shown as K7M4-QXR2-WPDL, and the Passport's address is https://id.dpphost.eu/DH/{ID}, with /LOT/{batch} or /SER/{serial} for a batch or an item. DPP Host issues it once per size, never gives it to another Organisation and never moves the address. A DPP Host ID is not a GTIN, not a GS1 identifier and not the unique product identifier of an EU passport rule, and a Passport that uses one is voluntary.

7.2 Filing a claim. An Admin files a GTIN Claim for a GS1 company prefix (4 to 12 digits) or for single GTINs, with evidence:

• (a) a match with the GS1 licensee register;
• (b) a letter from the licensee, with a reference;
• (c) a proven domain of the Organisation;
• (d) a GS1 Digital Link at an https address;
• (e) the Organisation's GS1 licence certificate or GS1 membership invoice, one PDF or photo, which DPP Host has read automatically by its AI service provider and of which it keeps only the company details it shows, not the file.

DPP Host checks the evidence by hand, including a lookup in the GS1 register, and approves or rejects the claim, usually within one working day; this is a target, not a commitment. With evidence (e), DPP Host approves the claim automatically when the document is a GS1 licence certificate or membership invoice from a GS1 member organisation that lists the claimed company prefix, is in date, and names as licensee the Organisation's verified legal name and country, and no other Organisation claims or holds an overlapping number; otherwise DPP Host checks the claim by hand as above. DPP Host never rejects a claim automatically, and never approves one on a domain proof alone. An automatically approved claim can be revoked like any other.

7.3 Overlapping claims and numbers that cannot be claimed. DPP Host does not accept a claim that overlaps a claim already approved for another Organisation, or one under dispute; an overlap is handled as a dispute under clause 7.5. DPP Host also does not accept a claim to a number GS1 never licenses to a company for its products (GS1's numbers for examples, restricted circulation, coupons and refund receipts, and the ISSN, ISBN and ISMN ranges). A claim of an Organisation that is not verified as a business waits until it is.

7.4 Delegations. An Admin of the licensee can let another Organisation (a brand or a reseller) publish under part of an approved claim, and can revoke that Delegation.

7.5 The GTIN dispute procedure.

• (a) A GS1 licensee that shows that another Organisation holds a GTIN Claim for its GTINs sends DPP Host evidence of its licence, and DPP Host files the licensee's own GTIN Claim for the dispute.
• (a1) A licensee that does not use DPP Host can send a notice under clause 9.3 with evidence of its licence. DPP Host handles it under clause 9, and can open a dispute under this clause.
• (b) DPP Host opens a dispute between the two claims and tells both Organisations.
• (c) DPP Host checks the evidence, with GS1 or the documents, and decides whether the dispute is upheld or dismissed.
• (d) If the dispute is upheld: the licensee's claim is approved; the other claim is rejected with its Delegations; and each Published Passport of the other Organisation that no other claim or Delegation covers is taken down. The address of such a Passport answers with a notice that it was taken down (HTTP 410). Its Passport Versions are kept as a record. The other Organisation gets a Statement of Reasons naming this clause as the ground.
• (e) If the dispute is dismissed, both claims return to their state before the dispute.
• (f) Either Organisation can ask for a review of the decision under clause 9.7.

7.6 Nature of the decision. A decision under this clause 7 concerns only the use of the Service. It is not a decision on who owns or holds rights in a GTIN or a trademark.

8. Acceptable use and content rules

8.1 Prohibited use. The Customer does not use the Service, and makes sure its Members, API Keys, MCP Grants and Connections do not use it:

• (a) to publish illegal content, including content that infringes intellectual property, is unsafe product information, or is child sexual abuse material;
• (b) to impersonate another business or person, or to publish Passports for products it does not place on the market or represent;
• (c) to publish under GTINs that are not licensed to it or delegated to it;
• (d) to publish false or misleading product information, including misleading environmental claims;
• (e) to publish personal data in breach of clause 6.6;
• (f) to send Supplier Form requests that are not genuine, or to use its verified name to deceive suppliers (phishing);
• (g) to upload malware or files meant to harm DPP Host, Users or the public;
• (h) to get around limits, rate limits, verification, Approval or GTIN checks, for example by creating Organisations to multiply the Free Plan;
• (i) to test the security of the Service, scan it or load it, without DPP Host's written permission;
• (j) to access data of another Organisation;
• (k) to choose a resolver name or organisation name that imitates another business's name or trademark;
• (l) in breach of the law or of these Terms.

8.2 Technical content rules. The Service enforces these rules:

• (a) a Passport Version is at most 64 KB;
• (b) images are JPEG, PNG, WebP or AVIF (no SVG), at most 300 KB each and 2 GB per Organisation; location and other metadata are stripped, or the file is refused;
• (c) pages are built from fixed block types, never from HTML the Customer writes;
• (d) links in Passports and pages go only to domains the Organisation has proven;
• (e) numbers on Premium pages are taken from passport fields, never typed in.

8.3 Owner Services. The Owner Services Annex, clause 6, adds rules for Owner Services.

9. Notices, moderation and the Digital Services Act

9.1 DSA status. DPP Host provides a hosting service under Regulation (EU) 2022/2065 (the "DSA").

9.2 Points of contact. The single point of contact for authorities, the Commission and the Board (Art. 11) and for recipients of the Service (Art. 12) is hello@dpphost.eu. DPP Host answers in English or Danish, and also reads German, French, Spanish, Italian, Dutch and Polish. A person reads every message.

9.3 Notices of illegal content. Anyone can report content they consider illegal, or incompatible with these Terms, with the form on the DSA page or by email to hello@dpphost.eu (Art. 16). A notice names the content's address and explains why. The form asks the notifier for a statement that they believe in good faith that the notice is accurate and complete. Under DSA Art. 16(2)(c), a notice gives the notifier's name and email, except a notice about child sexual abuse material. The form does not require them for any notice. DPP Host still reviews a notice without them, but cannot confirm it or tell the decision. DPP Host confirms receipt when an email is given, usually within 1 working day, and tells the notifier the decision and the redress.

9.4 How DPP Host decides. A person at DPP Host decides every notice under clause 9.3. The Service blocks some content automatically, without a person: the release checks in clause 3.6 and the upload rules in clause 8.2. The Customer can ask for a review of an automatic block under clause 9.7. DPP Host aims to triage a notice within 2 working days and to decide within 7 days. It acts at once on child sexual abuse material and on content that suggests a threat to life or safety, and reports such cases to the police (Art. 18).

9.5 Measures. DPP Host chooses the narrowest measure that deals with the problem, in this order:

• (a) withhold named fields of a Passport Version;
• (b) withhold a whole Passport Version;
• (c) take a Passport down: its address answers that it was taken down (HTTP 410), or that it is unavailable for legal reasons (HTTP 451);
• (d) make the Organisation read-only: Members can no longer edit or publish; Published Passports stay online.

Above (a), DPP Host records why a narrower measure was not enough. Published Passport Versions are kept as a record under every measure. The ground of a measure is either that the content is illegal under a named law, or that it is incompatible with a named clause of these Terms.

9.6 Statements of Reasons. For every measure, DPP Host gives the Customer a statement of reasons under Art. 17: what was decided, its scope and duration, the facts, whether automated means were used, the ground, and the redress. The Customer finds it in the Dashboard under Organisation settings, Moderation decisions. Statements are in English. A Statement of Reasons never names the notifier.

9.7 Internal complaints. The Customer, and a notifier, can ask DPP Host to review a decision within 6 months, by writing to hello@dpphost.eu with the decision reference. DPP Host offers this review to every Customer and notifier. Where possible, a person other than the one who decided reviews it. If the decision was wrong, DPP Host reverses it. DPP Host aims to decide within 14 days, tells the complainant the decision and the reasons, and names the redress in clause 9.8. A measure stays in force during the review unless DPP Host decides otherwise.

9.8 Other redress. The Customer can also turn to a certified out-of-court dispute settlement body (Art. 21), where the DSA gives that right, and to the courts. The Danish Digital Services Coordinator is the Agency for Digital Government (Digitaliseringsstyrelsen).

9.9 Orders. DPP Host acts on orders from courts and authorities (Arts 9 and 10) and tells the Customer unless the order forbids it.

9.10 Misuse. DPP Host may make an Organisation read-only if it often provides manifestly illegal content, after a warning. DPP Host may stop handling notices from a person who often sends manifestly unfounded notices, after a warning.

9.11 Suspension of the Service for security. Clause 16.3 applies.

9.12 Transparency. DPP Host publishes the transparency reports that the DSA requires of it.

10. Intellectual property and licences

10.1 The Customer's content. The Customer keeps all rights in Customer Content.

10.2 Licence to DPP Host. The Customer grants DPP Host a non-exclusive, worldwide, royalty-free licence to host, store, copy, convert (to web pages, JSON-LD, linksets, data files, labels and exports), translate the interface around, display, make available to the public and back up Customer Content, as far as needed to provide the Service. For Published Passport Versions and the images and documents they show, the licence:

• (a) lasts for the Continuity Period and survives the end of these Terms and the end of DPP Host;
• (b) cannot be revoked;
• (c) covers copies in backups, in the final static copy and in the packages in clause 15;
• (d) may be sublicensed to DPP Host's sub-processors, to the Executor and to a DPP service provider that takes over the Passports, only to keep the Published Passports available.

10.3 The Customer's warranty. The Customer warrants that it has the rights to grant clause 10.2, including for third-party images and documents, fonts it uploads and trademarks it shows. For third-party images, the Customer records the licence and source in the media library.

10.4 DPP Host's rights. DPP Host keeps all rights in the Service, its software, templates, passport page design and documentation. During these Terms, the Customer may use the Service for its own business. The Customer may print, use and keep the labels and QR codes it makes with the Service, also after these Terms end. The WooCommerce plugin is licensed under the GNU General Public License v2 or later, and fonts under their own licences (SIL Open Font License).

10.5 Feedback. DPP Host may use suggestions the Customer makes about the Service without any duty to the Customer.

10.6 Third-party names. DPP Host uses the names GS1, GS1 Digital Link, WooCommerce, Shopify and the names of marketplaces only to describe compatibility. This does not mean any partnership or endorsement.

10.7 Confidentiality. DPP Host keeps Customer Content that is not published confidential, uses it only under clause 3.4, and protects it with the measures in DPA Annex II. It may disclose it to its sub-processors, to the Executor under clause 15, and where the law or an order requires. The Customer keeps the terms of an Order confidential. This clause survives the end of these Terms for 5 years.

11. API, MCP and webhooks

11.1 API Keys. Only an Admin or Organisation Owner creates, rotates and revokes API Keys, in the Dashboard. A key is shown once. It has scopes and an expiry of 1 to 24 months. An Organisation can have at most 25 active keys. A key never has more rights than its creator's current role, and stops working when its creator leaves the Organisation. The Customer keeps keys secret and uses them only on servers, never in a browser or in a URL. DPP Host refuses a key sent in a URL and marks it exposed.

11.2 MCP. A Member gives an AI client access to one Organisation through an MCP Grant, with a sign-in and consent screen. A grant lasts 90 days by default (30, 90, 180 or 365 days can be chosen), ends after 30 days without use, and can be revoked at any time. Through the MCP, an AI client can read and write Drafts and suggestions within its scopes. It can never publish, confirm values, release or withdraw anything, or manage webhooks, keys, Members, billing, verification or ownership. Values an AI client writes are stored as suggestions and need confirmation under clause 6.2.

11.3 The Customer's responsibility. The Customer is responsible for everything done with its API Keys, MCP Grants and Connections, and for the AI clients, agents, integrators and systems it connects, including their output and any instructions they follow. DPP Host is not responsible for AI clients and other third-party software.

11.4 Limits. The API and MCP have the rate limits and daily quotas of the Plan (Schedule 2), counted per Organisation across all its keys and grants, and abuse limits per client address and per key. Over a limit, DPP Host answers HTTP 429 with a Retry-After header. The per-minute count is approximate. DPP Host may change these limits with 90 days' notice for new usage, and may lower them at once to stop abuse or protect the Service.

11.5 Webhooks. An Admin, with a sign-in from the last 5 minutes, or an API Key with the webhooks:manage scope, manages webhooks; the MCP never does. An Organisation can have at most 10 webhooks. DPP Host:

• (a) delivers each event at least once, not necessarily in order, and signs it with HMAC-SHA256;
• (b) counts a 2xx answer within 10 seconds as delivered, and retries up to 10 times over about 24 hours;
• (c) turns a webhook off after 15 failed attempts in a row over at least 72 hours, and tells the Admins;
• (d) sends only identifiers in event bodies, never a Product Owner's email address or message;
• (e) keeps the delivery log for 30 days.

The Customer checks the signature and the timestamp of each event.

11.6 Changes and deprecation. Within /v1, DPP Host makes only additive changes. A deprecated endpoint or field keeps working for at least 12 months after DPP Host announces the deprecation. DPP Host announces a deprecation by email to the Organisation Owners and Admins.

11.7 No service level. Clause 14 applies to the API and the MCP.

12. Supplier Forms and Shop Connectors

12.1 Supplier Forms. An Editor, Admin or Organisation Owner can ask a supplier for passport values with a Supplier Form, which the supplier opens through a link at forms.dpphost.eu. These rules apply:

• (a) Only a Verified Organisation can have DPP Host email a request to a supplier. The email names the Organisation by the legal name a register disclosed or DPP Host staff confirmed.
• (b) A supplier needs no account. A link is valid for 7 to 90 days (30 by default). The Customer sets the due date (14 days by default). DPP Host sends at most 2 reminders.
• (c) A supplier sees only what the Customer asks. Answers are suggestions that a Member confirms under clause 6.2.
• (d) Evidence files are PDF, JPEG or PNG, at most 10 MB each, 20 per request and 1 GB per Organisation. DPP Host deletes evidence of a closed request 90 days after closing, unless a confirmed value cites it.
• (e) The Customer is responsible for having a lawful basis to contact each supplier and for the content of its requests.
• (f) A supplier can report a request. Reporting withdraws the request and blocks the address for that Organisation. DPP Host may make an Organisation read-only for misuse (clause 8.1(f)).

12.2 Shop Connectors. On the date of these Terms, the WooCommerce plugin "DPP Host for WooCommerce" is available to pilot shops. It is free. A Shopify app is not available yet.

• (a) Linking. An Admin or Organisation Owner links a Shop in the Dashboard, with a sign-in from the last 5 minutes. The Admin confirms that they manage the Shop and started the link from its admin. DPP Host does not check control of the Shop's host. A Shop can be linked to one Organisation at a time. Linking it to another Organisation revokes the old link and tells the old Organisation's Admins.
• (b) What a Connection may do. Add products and variations as Drafts with suggestions (product and variation identifiers, names, SKUs, GTINs and product addresses); read the status of its own items; and show a link to the Published Passport on the product page.
• (c) What a Connection never may do. Confirm or publish a value; read any other data of the Organisation; delete anything in DPP Host; or send DPP Host data about the Shop's customers or orders. The Service enforces these limits on its servers.
• (d) Changes in the Shop. After the first import, changes in the Shop never overwrite data in DPP Host. They show as changed in the Shop, and a Member decides. Nothing in DPP Host is deleted because the Shop deleted something.
• (e) Limits. Each Connection can add up to 20,000 rows and make up to 5,000 requests a day. The Free Plan and Premium include 3 Connections.
• (f) Credentials. A Connection's credential lasts 12 months and is rotated before it expires. A WooCommerce Connection needs an Admin's approval again every 24 months. A Connection belongs to the Organisation, not to the person who linked it.
• (g) The Customer is responsible for meeting the terms of its Shop platform and for the privacy information it gives its shop's visitors.

12.3 Marketplace export. The Dashboard can make a file with the SKU, GTIN, name and passport link of each product, for upload to online marketplaces. DPP Host has no relationship with those marketplaces. The Customer uploads the file and is responsible for its offers there.

13. Data protection

13.1 DPP Host as controller. DPP Host is the controller of the personal data it processes to run the Service for the Customer: the Accounts of Users, Members and roles, billing contacts, Business Verification data, audit logs, emails it sends, notices under clause 9, and the sign-in identity used in the Owner Area. DPP Host's privacy notice describes this processing.

13.2 DPP Host as processor. DPP Host processes personal data on the Customer's behalf for Owner Services, and in the other cases listed in Annex I of the DPA. The DPA applies to that processing and prevails over these Terms.

13.3 The Customer's duties. The Customer has a lawful basis for the personal data it puts into the Service, informs its Members, suppliers and Product Owners as the law requires, and follows clause 6.6.

13.4 Sub-processors and location. The sub-processors are named in the list of sub-processors. The database is in Frankfurt (Supabase), and passport files, images, evidence and backups are stored at Cloudflare in the EU jurisdiction. Cloudflare's network serves the Service worldwide.

13.5 Security incidents. DPP Host handles personal data breaches under its internal breach procedure and, for processing under the DPA, under DPA clause 11.

14. Availability and support

14.1 No service level. DPP Host provides the Service as it is and as available. DPP Host does not commit to any uptime, response time or recovery time, unless an Order says so. The Resolver serves Published Passports from storage, not from the database, so Published Passports keep answering when the Dashboard, the API or the database is down. That is a description of the design, not a commitment.

14.2 Maintenance. DPP Host may interrupt parts of the Service for maintenance or security. It tries to keep interruptions of the Resolver short.

14.3 Support. Support is by email to hello@dpphost.eu. A person reads every email. There is no guaranteed response time. The API returns a request identifier to quote in support requests. The targets in clauses 4.5, 7.2 and 9 are targets, not commitments.

14.4 Copies. DPP Host keeps copies of Published Passports for continuity (clause 15). Its internal recovery targets are not commitments. The Customer keeps its own copy of its data with the Organisation Export.

15. Continuity and end of service

15.1 The Continuity Promise. Published Passports stay online at the Resolver for the period the applicable EU rules require, up to 15 years, and never less than 10 years from publication (the "Continuity Period"). This applies even if the Customer stops using DPP Host, moves to the Free Plan, stops paying, or its Organisation is closed. DPP Host never takes a Published Passport offline for billing reasons. A Passport is charged for only on a paid Plan, at most once or only in its First Year (clause 5.3); after that it stays online at no charge for the rest of the Continuity Period.

15.2 Exceptions. The Continuity Promise does not prevent DPP Host from:

• (a) taking a measure under clause 9, or taking Passports down under the GTIN dispute procedure (clause 7.5);
• (b) acting on a law, a court order or an order of an authority;
• (c) withholding personal data or illegal content from a Passport;
• (d) interruptions under clause 14.2, and events outside DPP Host's reasonable control.

15.3 Longer periods. If a delegated act under the ESPR requires Passports to stay available for more than 15 years, DPP Host gives the Customer at least 12 months' notice before its Passports would reach 15 years, and gives the Customer an export of them so that the Customer or another provider can keep them available.

15.4 What stays online. Each Published Passport stays with its Passport Versions, images, JSON-LD and integrity proofs. The Premium Layer stays only while the Organisation has Premium (clause 5.15). If the Passports are ever served from the final static copy (clause 15.6(c)), requests for another format, an earlier version or another language open the Passport page in its default form.

15.5 If DPP Host stops. If DPP Host decides to stop the Service:

• (a) DPP Host gives every Organisation at least 6 months' notice, by email, in the Dashboard and on its site;
• (b) from the notice, DPP Host takes no new Accounts, Organisations or purchases, and paid Plans do not renew; a Plan that would run beyond the end of publishing ends then, and DPP Host refunds the unused part pro rata;
• (c) the Customer can publish and edit until 30 days before the closing date;
• (d) the API and the MCP stop on the closing date;
• (e) Admins can download the Organisation Export until 30 days after the closing date;
• (f) 30 days after the closing date, DPP Host deletes Drafts, unpublished values, Members, Accounts, API Keys, webhooks and supplier evidence; the Owner Area ends as DPA clause 12.2 and Owner Services Annex clause 9.3 say; the Organisation Export does not contain Owner Area data. Until 30 days after the closing date, a Brand may ask for the export of its Owner Data under Owner Services Annex clause 9.2;
• (g) DPP Host keeps bookkeeping records for the period Danish law requires, then deletes them;
• (h) Published Passports are never deleted in a wind-down and stay online under clause 15.6.

15.6 Arrangements for continuity.

• (a) Domain. The domain dpphost.eu, in every printed QR code, is registered and paid until 2036. DPP Host transfers it to the Executor before Qubites ApS is dissolved.
• (b) Executor. If the Executor is in place when DPP Host stops, the Executor keeps the Resolver running for the rest of the Continuity Period, pays the hosting, and handles takedown orders and notices. The Executor never changes, adds to or sells passport content, and runs no analytics.
• (c) Final static copy. If the Executor's arrangement fails, a final static copy of the Published Passports on a separate host keeps every printed QR code answering.
• (d) Nightly copy. DPP Host makes a nightly copy of Published Passports and their images in a separate storage bucket at Cloudflare in the EU. DPP Host keeps no copy of them outside Cloudflare.

15.7 The Customer's back-up copy. Where the ESPR requires a back-up copy through a DPP service provider (Art. 10(4)), the Customer chooses that provider. In a wind-down, the Customer chooses a provider for products it still places on the market and updates the provider named in its Passports.

15.8 Leaving DPP Host. When the Customer leaves, its Published Passports stay at the Resolver under clause 15.1. DPP Host does not redirect them to another host. The Customer can host copies elsewhere using the Organisation Export, and print new labels for new products.

15.9 Organisation Export. An Admin or Organisation Owner can ask for the Organisation Export in the Dashboard, in any status of the Organisation, at most once every 24 hours. DPP Host builds it in the background and emails when it is ready. The files are kept for 7 days. The export holds the Published Passports as a static website, the published files, CSV files of Passports, values and Drafts, images and documents, a list of evidence, the released Premium page versions and checksums. It never holds Owner Area data, Members' email addresses, API Key digests, webhook secrets, the audit log, notices under clause 9 or billing data.

16. Suspension and termination

16.1 By the Customer. The Customer can stop using the Service at any time. It cancels a paid Plan under clause 5.11 and asks for closure of the Organisation under clause 4.9.

16.2 Billing never suspends. DPP Host does not suspend the Service, make an Organisation read-only or archive it for billing reasons. Non-payment only moves the Organisation to the Free Plan (clause 5.12).

16.3 Suspension by DPP Host. DPP Host may make an Organisation read-only, or archive it, where:

• (a) a decision under clause 9 requires it;
• (b) the Customer seriously or repeatedly breaches these Terms, in particular clauses 6 and 8;
• (c) a legal hold, an order or the law requires it;
• (d) it is needed to stop a security risk or harm to others;
• (e) the Customer asked to close the Organisation.

A read-only or archived Organisation cannot edit, publish, use AI features or invite people. Its Published Passports stay online. DPP Host tells the Customer the reasons, with a Statement of Reasons where clause 9 applies, before the suspension where possible and otherwise at the latest when it applies, and lifts it when the reason ends.

16.4 Termination by DPP Host. DPP Host may end these Terms:

• (a) for a paid Plan, at the end of the paid period, with at least 90 days' notice;
• (b) for the Free Plan, with at least 90 days' notice;
• (c) at once, by written notice, if the Customer materially breaches these Terms and does not cure the breach within 14 days of a notice, or where the breach cannot be cured. Where the ground is content that is illegal or incompatible with these Terms, DPP Host gives a Statement of Reasons under clause 9.6, and the Customer can ask for a review under clause 9.7;
• (d) under clause 15.5.

16.5 Effect. When these Terms end, Users lose access to the Organisation, except that Admins and Organisation Owners can request and download the Organisation Export for 30 days after the end. API Keys, MCP Grants, Connections and webhooks stop. Published Passports stay online under clause 15. DPP Host keeps the audit log and records it must keep by law. 90 days after these Terms end, DPP Host deletes Drafts, unpublished values, supplier contacts and evidence that no Published Passport Version cites, unless the law requires otherwise. Published Passport Versions stay online under clause 15. DPP Host deletes other data as its privacy notice and the DPA say.

16.6 Survival. Clauses 5 (for fees due), 6.1, 6.4 to 6.6, 7.6, 9, 10.2 to 10.4, 10.7, 15, 16.5, 17, 19, 20 and 21 survive the end of these Terms. Clauses 6.1, 6.4 to 6.6, 9 and 10.2 to 10.4 apply for as long as Published Passports stay online under clause 15.

17. Liability

17.1 No limit. Nothing in these Terms limits liability for intent or gross negligence, or where Danish law does not allow a limit.

17.2 Excluded losses. Neither party is liable for indirect or consequential loss, including loss of profit, revenue, goodwill or data, business interruption, product recalls, or fines and orders against the Customer about the content of its Passports.

17.3 Cap. Each party's total liability in any 12 months under or in connection with these Terms is limited to:

• (a) for a Customer on a paid Plan: the fees the Customer paid in the 12 months before the event that gave rise to the claim;
• (b) for a Customer on the Free Plan: EUR 0;
• (c) the cap does not apply to fees due, to the indemnities in clause 17.5 and in Owner Services Annex clause 11.1, or to clause 17.1.

17.4 Matters outside DPP Host's responsibility. DPP Host is not liable for:

• (a) the accuracy, completeness or legality of Customer Content, or for a Passport's compliance with the law;
• (b) values a Member confirmed or an API Key published;
• (c) the acts of AI clients, integrators, Shops, Shop platforms, payment providers and other third parties the Customer uses;
• (d) a decision under clause 7 or 9 taken in good faith.

17.5 Customer indemnity. The Customer holds DPP Host harmless from claims by third parties and fines from authorities that result from Customer Content, from a breach of clauses 6, 8 or 10.3, or from use of its API Keys, MCP Grants and Connections, except to the extent DPP Host caused them by breaching these Terms.

17.6 Force majeure. Neither party is liable for a delay or failure caused by events outside its reasonable control.

17.7 Time limit for claims. The limitation periods of Danish law apply.

18. Changes to these Terms

18.1 DPP Host may change these Terms. It tells the Customer by email to the Organisation Owners and Admins and in the Dashboard at least 30 days before a change applies. For Owner Services, Owner Services Annex clauses 10.1 and 12 apply; for the DPA, DPA clause 16.2 applies.

18.2 A change needed by law, by an order or for security may apply sooner.

18.3 Changes to Free Plan limits follow clause 5.2 (90 days, new usage only). Price changes for running subscriptions follow clause 5.4.

18.4 If a change is materially to the Customer's disadvantage, the Customer may cancel a paid Plan before the change applies and get a refund of the prepaid fees for the unused period. Continued use after the change applies means acceptance.

19. Notices

19.1 To DPP Host: by email to hello@dpphost.eu; about personal data, to privacy@dpphost.eu; notices of illegal content under clause 9.3; formal legal notices also by post to Qubites ApS, Ulsøparken 49, 2. tv., 2660 Brøndby Strand, Denmark.

19.2 To the Customer: by email to its Organisation Owners and Admins or its billing email, or in the Dashboard. An email is received when sent to the address in the Service, unless DPP Host learns it was not delivered.

20. General

20.1 Assignment. The Customer may not transfer these Terms without DPP Host's written consent. DPP Host may transfer these Terms, or the hosting of Published Passports, to a successor, to the Executor or to another DPP service provider, and tells the Customer.

20.2 Entire agreement. The documents in clause 1.5 are the whole agreement on the Service. Statements on DPP Host's website describe the Service; they are not part of the agreement unless these Terms say so.

20.3 Severability. If a clause is invalid, the rest stays in force, and the parties replace the invalid clause with a valid one as close to its purpose as possible.

20.4 No waiver. A party does not waive a right by not using it.

20.5 Subcontractors. DPP Host may use subcontractors. It remains responsible for them under these Terms.

21. Governing law and venue

21.1 These Terms are governed by Danish law, without its rules on the choice of law.

21.2 Disputes go to the Copenhagen City Court (Københavns Byret) as the court of first instance.

Schedule 1: Modules and status on the date of these Terms

Schedule 2: Plan prices and limits on the date of these Terms

The Price List in force prevails. Unlimited means no limit in the Service. Prices exclude VAT. Basic, the paid plan, is no longer offered (27 Oct 2026, clause 5.1(b)). Enterprise is no longer offered (16 Oct 2026); an Order sets its own prices and limits (clause 5.16).

Item	Free Plan (shown as "Basic")	Premium
Price, paid once (the default; from the Prepaid Balance, clause 5.18)	EUR 0	EUR 1 for each Passport, once
Top-ups of the Prepaid Balance (excluding VAT)	EUR 50, EUR 100 or EUR 500; automatic top-up below EUR 10 by default	same
Price, spread over the First Year	-	EUR 0.10 a month for each Passport in its First Year (EUR 1.20 in total)
Monthly fee	-	None
Passports in their First Year	At most 100	Unlimited
Passports once paid for, or after their First Year	Online at no charge	same
Billing period	-	One month (invoices)
Users (Members and open invitations; Partner Staff not counted)	3	10
Shop Connections	3	3
AI Credits a month	20	200
Each AI Credit used when none are left (from the Prepaid Balance, clause 5.14(f))	EUR 0.05	same
Premium Layer and Owner Services	No	Yes
API and MCP requests a minute	60	600
API and MCP requests a day (UTC)	10,000	No daily cap
Publishes a day (UTC)	1,000	10,000
Size of one Passport Version	64 KB	64 KB
Passport Versions per Passport a day	20	20
Rows per import job	5,000	5,000
Draft Passports before Business Verification	25	25
Images	300 KB each, 2 GB per Organisation	same
Per Shop Connection	20,000 rows and 5,000 requests a day	same
Credit Packs	1,000 AI Credits for EUR 10; 5,000 for EUR 40 (excluding VAT)	same