Data Formats and Infrastructure

1. About this register

This register covers the data that the Terms of Service list as exportable, in their section on exporting your data. For each format it gives the structure of the data, the standard the format follows, who can use it and where.

Every export described here is free of charge, whether you make it yourself or ask us for it. Exports are available throughout your contract and, after it ends, during the retrieval period that the Terms of Service set out.

The formats follow these standards and open specifications.

• JSON, for the zincirx.dpp format (section 2) and for an account holder's own data (section 7).
• JSON-LD, with a vocabulary we publish, delivered inside a W3C Verifiable Credential, for each passport in machine-readable form (section 3).
• GS1 EPCIS 2.0, for the recorded steps of the batch behind each passport (section 3).
• GS1 Digital Link, for passport addresses built from a product's GTIN and a batch's lot number (section 4).
• QR codes, as PNG, JPEG or SVG images (section 4).
• CSV and PDF, for batch lists, batch details and reports (section 5).
• SHA-256, for the fingerprints of uploaded files (section 6) and the digests of exported passports (section 2).
• ZIP, for sending many files together (section 8).

Anything else you ask for is sent in a structured, commonly used and machine-readable format (section 8). Section 9 lists the restrictions and technical limitations we know of.

We keep this register up to date, and we announce every change to it on this page (section 13).

2. All your passports in the zincirx.dpp format

The zincirx.dpp format is our own open format for a complete copy of your passports. One JSON file holds every passport your business has issued, at every access level and with its full revision history, together with a manifest of SHA-256 digests.

Owners and administrators of your business can download it at any time, free of charge, from the Digital Product Passport page in the web app, with “Download all passports”. The file covers the business they are working in when they download it.

The file has two parts. The first is a manifest. It names the format and its version, gives the time of the export, identifies your business by its name, tax number, GLN, EORI number and country, gives the number of passports, lists each passport's identifier with the SHA-256 digest of that passport, and states the latest date until which any of the passports is to stay online. While we sign passports (section 3), it also gives our issuer identifier and a SHA-256 digest of that list of digests.

The second part holds the passports. Each one contains the following.

• Its availability: the day it was issued and the day its availability term ends.
• Its identifiers: the passport's identifier, the address of its public page and, where they are set, its lot number, its GTIN and its GS1 Digital Link address.
• The product and the batch: the product's name, description, category and product group, and the batch's name, production date, status and creation time and, for a recalled batch, the reason for the recall.
• Its attributes, each with its key, value, label and unit and the block and access level it belongs to: public, restricted or authority.
• Its certifications.
• Its revisions: for each change, what changed, the old and the new value, who made the change and when.
• Its traceability events: the batch's recorded steps as a GS1 EPCIS 2.0 document (section 3).
• Its evidence: each photo and document attached to the batch and its steps, listed by file name, type, size and SHA-256 fingerprint.
• Its linked data: the passport as a JSON-LD document at every access level (section 3).

Each digest in the manifest is the SHA-256 hash of that passport written as compact JSON, with its object keys sorted and with slashes and non-ASCII characters left unescaped, so the same content always gives the same digest. Recomputing it shows whether a passport in the file is the one that was exported.

The photos and documents themselves are not inside the file. Each can be downloaded as section 6 describes, and we send them all together on request (section 8). Their fingerprints let you check that a file you hold is the one recorded.

You can use the file for your own records, as a back-up copy of your passports, or to move them to another provider or to your own systems.

3. Each passport in machine-readable form: JSON-LD and GS1 EPCIS 2.0

Every issued passport is also available in two machine-readable forms through our public programming interface, at addresses formed from the passport's identifier. Anyone can use them, free of charge and without signing in.

The first is the passport as a JSON-LD document. It contains the product, the batch, the passport's attributes and certifications, a section saying what the document covers, such as the product group and that it describes a batch, and a link to its traceability events. The batch's details include its GS1 Digital Link address where it has one.

The JSON-LD document uses a vocabulary that we publish on our website and that each document names in its context, so that every term it uses can be looked up.

The document is delivered inside a W3C Verifiable Credential that carries our digital signature, made with an Ed25519 key. Our public verification interface checks that signature, which shows that the document came from us and has not changed since we signed it; it does not show that its content is true. A request can also ask for the document without the credential.

The second is the batch's traceability events, as a GS1 EPCIS 2.0 document in JSON-LD. It contains one event for each step that has started, giving when it happened, the step's name and, where a position was recorded, where. Each event identifies the batch by its GTIN and lot number where both are set, and otherwise by the address of its public page.

The JSON-LD document shows only a passport's public attributes. The exception is a request made with an access grant your business has given for restricted or authority access: the document then also shows the attributes of that grant's level. A grant can cover one passport, the passports of one product template or all your business's passports, and its holder presents it as a token with each request.

The EPCIS document shows the batch's recorded steps, which its public page also shows.

A complete copy at every access level is the zincirx.dpp file (section 2), which only your business's owners and administrators can download.

4. Passport addresses, GS1 Digital Link and QR codes

Every passport has an address on our website, formed from its identifier, at which its public page can be seen once the passport is issued. That is the address its QR code contains, unless you choose the GS1 Digital Link address instead.

Where a product template has a GTIN and a batch has a lot number, the passport also has a GS1 Digital Link address, built from the GTIN and the lot number as the GS1 Digital Link standard provides. It leads to the passport's public page, and it is included in the zincirx.dpp file and in the passport's JSON-LD document.

QR codes can be downloaded as images in these places.

• On a batch's page in the web app, account holders who can see the batch can download its QR code as a PNG or JPEG image, or open a label page ready to print. On the label page, a passport that has a GS1 Digital Link address can have that address put in its QR code instead.
• In My UUIDs in the web app, the QR code of every passport allocated to your business, issued or not yet issued, can be downloaded as a PNG or SVG image.

Once passports have been issued under a GTIN, that GTIN cannot be changed or removed from its product template, so the GS1 Digital Link addresses printed with it keep leading to those passports.

5. Batch lists, batch details and reports: CSV and PDF

Account holders can export from the web app the data they can see about your business's batches.

• The list of batches, as CSV or PDF, from the batch list, with any filters they have applied. The CSV file has one row per batch, with its identifier, product template, status, production date, the email address of the account holder who created it, its creation time and its progress through its steps.
• The details of one batch, as PDF or CSV, from the batch's page. The CSV file gives the batch's details and then one row per step, with its name, status and location, the positions recorded at its start and end, the person responsible, its start and end times and its duration. The PDF also shows the batch's QR code.
• Custom reports, as CSV, from Reports, with the data each report has been set up to show.

Each CSV file begins with a title line and the time it was generated. A batch list then has a single table; the details of a batch and a custom report are laid out in blocks, each with its own heading. The headings in the details of a batch are in the language the account holder is using.

CSV files are meant for further processing, and PDF files for reading and printing.

6. Uploaded photos and documents

Each photo and document uploaded to ZincirX is stored exactly as it was uploaded. Account holders who can see the template, batch or step a file belongs to can open and download it there, in that form.

Photos and documents shown on a public passport page can also be opened there by anyone who views the page.

Each file receives a SHA-256 fingerprint when it is uploaded, which can show that the file has not changed since. The fingerprints of the files attached to your batches and their steps are listed in the zincirx.dpp file (section 2).

To receive all your business's photos and documents in one download, ask us (section 8).

7. An account holder's own data: JSON

Each account holder can download a copy of their own data as a JSON file, with “Download my data” on their profile page on the website or with “Export My Data” on the profile screen in the mobile app.

The file includes their account details, namely their name, email address, phone number and when the account was created; the businesses they belong to, with their role in each and when they joined, and the email address, phone number, city and country of the first of them; the templates they created, with their names, descriptions and creation times; the batches they created, with their identifiers, names, statuses and creation times; and the time of the export.

This is the account holder's own data. Your business's records are exported as sections 2 to 6 describe.

8. Anything else, on request

We send you on request anything that the Terms of Service list as exportable and that you cannot export yourself as sections 2 to 7 describe. We send it free of charge and without undue delay, in a structured, commonly used and machine-readable format such as JSON or CSV, with files as they were uploaded.

That includes, for example, the following.

• All the photos and documents of your business, in one ZIP archive, each file as it was uploaded.
• A list of every passport identifier allocated to your business, issued or not yet issued.
• Your business profile, and its members and their roles.
• Your templates and their step definitions.
• The scan statistics we hold for your passports.
• The access grants your business has issued, and the record of reads made with them.
• Your orders, and the invoices issued to you.
• The records of which versions of our terms were accepted for your business, and of each purchase's confirmation that it was final.

To ask, write to info@zincirx.com. We check only that the request comes from someone entitled to act for your business, such as an owner or administrator, or a provider you have authorised to act for you.

The only data excluded from export is listed in the Terms of Service, in their section on exporting your data. It is data about how ZincirX itself works whose export would put our trade secrets or the security of the service at risk.

9. Known limitations

These are the restrictions and technical limitations of exporting and moving your data that we know of.

• We do not offer a published programming interface for exporting a whole account. The complete copy of your passports is the zincirx.dpp file, and what sections 3 to 7 do not cover is sent on request (section 8).
• Our public programming interface gives only the public part of a passport, or the part an access grant covers, and it limits how many requests can be made in a given time.
• The signature on a passport credential is made by our own method. Our verification interface checks it, but other software for verifiable credentials may not accept it.
• The zincirx.dpp file lists each photo and document by name, type, size and fingerprint but does not contain the file itself.
• The zincirx.dpp file covers one business at a time. An owner or administrator of several businesses downloads a file for each of them.
• Revisions record changes to a passport's attributes, certifications and product group. Changes to a batch's steps, such as their notes and locations, are not kept as revisions, and neither are files that your business removes, so exports show steps and files as they stand when the export is made, without earlier versions.
• Photos added with the mobile app are compressed, and large ones reduced in size, on the phone before they are uploaded, so the file we keep, and its fingerprint, are those of that processed copy, not of the original photo on the phone.
• An SVG file downloaded from My UUIDs contains the QR code as an embedded pixel image, not as vector shapes.
• The exports in sections 2, 5 and 6 are made in the web app. An account holder whose account is suspended, who has not yet accepted a new version of our terms, or who acts for a business that has no passport package, such as one whose older fixed-term plan has ended, cannot reach them there. We then send them on request (section 8), free of charge.
• Moving to another provider does not change where the QR codes already printed on your products lead. They keep leading to the passports we host (section 12).

10. Where the service runs and which law applies

ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş. operates ZincirX from Türkiye, for both of our companies. Where you contract with ZincirX Inc., ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş. runs the service on its behalf, and ZincirX Inc. remains responsible to you for it.

The service runs on servers provided by a hosting provider. The table at the end of this page names the hosting provider and states the country in which the servers are located.

The infrastructure is therefore subject to the law of the country in which the servers are located, and to the law of Türkiye, where ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş., which operates it, is established. The company you contract with is also subject to the law of the country in which it is established: Türkiye for ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş., and the United States for ZincirX Inc. The table sums this up.

Some parts of the service rely on other providers. The emails the service sends are delivered through the hosting provider's mail service, which passes them to an email relay service. When an account holder uses the AI assistant, what they type is sent to Google, which processes it for us to produce the reply, and we do not store it.

The Data Processing Terms (https://zincirx.com/data-processing) describe the sub-processors that process personal data in your content, and we send you their current list, saying where each one processes it, on request. The Privacy Policy (https://zincirx.com/privacy) explains how messages to the AI assistant are handled.

We keep this information up to date. A new or replacement hosting provider is a change of sub-processor, which we tell you about in advance, as the Data Processing Terms describe.

11. Requests from governments and authorities

A court or public authority, in any country, may seek access to data we hold or ask us to hand it over. These are the measures we take so that the data we hold for you is not accessed or transferred in a way that would conflict with the law of the European Union or of the Member State concerned.

We apply them to all the data we hold for you, whether or not it is personal data, and whichever country it is held in.

• We give a government or public authority access to data we hold for you, or transfer it to them, only where the law compels us to, such as under a legally binding order of a court or competent authority, or where the law requires us to report a suspected criminal offence that threatens someone's life or safety. We do not do so voluntarily.
• Before acting on an order, we check that it has a legal basis that binds us, that it comes from a court or authority entitled to make it, and exactly what it covers.
• Where the data is held in the European Union and the order comes from a court or authority of a country outside the Union, we act on it only in the circumstances that Article 32 of the EU Data Act sets out for such orders, for example under an international agreement between that country and the Union or a Member State.
• We disclose only the minimum that the order requires, on a reasonable reading of it.
• Before we comply, we tell you about the request. We hold back only where the law or the order forbids us to tell you or requires us to wait, for example to protect a criminal investigation, and only for as long as it does. Where the data is held in the European Union and the request comes from outside the Union, we hold back only where the request serves law enforcement, and only for as long as telling you would undermine that work.
• Within our companies, only the staff who need access to your data to run, support or secure the service have it, and they are bound to keep it confidential.
• Data travels between browsers or the mobile apps and our servers over encrypted connections (HTTPS).
• Passwords are stored only as hashes, account holders can turn on two-factor sign-in, and access to a business's data in the service depends on membership of that business and on the member's role.

These commitments form part of your contract with us, because this page forms part of the Terms of Service. Where you contract with ZincirX Inc., ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş., which operates the platform, is bound by a written agreement to the same data protection obligations as the Data Processing Terms (https://zincirx.com/data-processing) place on ZincirX Inc.

The Terms of Service say how we deal with an order to act against content, and the Data Processing Terms say how we deal with a legal requirement to process the personal data in your content.

12. Switching provider and leaving

How to move your data to another provider or to your own systems, or to have it erased, is set out in the Terms of Service (https://zincirx.com/terms), in their section on switching provider, leaving and erasure. That section gives the notice, transitional and retrieval periods, and says what is erased and when.

The data you can export, and the only data excluded from export, are listed in the Terms of Service, in their section on exporting your data. This page gives the formats in which that data is available.

The Data Processing Terms (https://zincirx.com/data-processing) say how the personal data in your content is returned and deleted when the service ends.

Exporting, switching and erasure are free of charge. During a switch, we help you and any provider you authorise to act for you, and on request we send you, or that provider, the exports described on this page. You can also give that provider an access grant, so that it can read your passports through our programming interface (section 3).

Throughout the notice and transitional periods, ZincirX keeps running as usual, including the web app, your passport pages, the GS1 Digital Link addresses and the programming interfaces described on this page, and you can take every export described here until the retrieval period ends.

The QR codes already printed on your products keep leading to the passports we host after you move, as the Terms of Service explain in their section on printed QR codes after you leave.

13. Changes to this page

We keep this page up to date. When we add, change or withdraw a format, a standard or an interface, or when the hosting provider or the country of the servers changes, we announce it on this page, and the date at the top shows the version in force.

Because this page forms part of the Terms of Service, a change that reduces your rights takes effect as the Terms of Service provide for significant changes.

No change stops you from exporting your data free of charge.

14. Contact

To ask for an export, or with a question about the formats, interfaces or infrastructure described here, write to info@zincirx.com or call +90 536 587 41 81. Our contact page at https://zincirx.com/contact lists both.

People read and answer these messages. The AI assistant cannot take a request or a notice.

You can write to us in English, Turkish, German or Spanish.

Our company details are in the Legal Notice (https://zincirx.com/legal-notice). Our representatives in the European Union are listed there, with their contact details, in the company details, and you can always write to info@zincirx.com instead.