1. Who you contract with

Which company you contract with depends on where your business is established.

If your business is established in Türkiye, you contract with ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş., a joint-stock company established in Türkiye, whose address is Teknopark İzmir, İYTE Kampüsü, 35430 Urla/İzmir, Türkiye.
If your business is established anywhere else, you contract with ZincirX Inc., a Delaware corporation with Delaware file number 10758618, whose registered office is at c/o Legalinc Corporate Services Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, United States and whose principal office is at Teknopark İzmir, İYTE Kampüsü, 35430 Urla/İzmir, Türkiye.

That company is the other party to your contract and is responsible to you for ZincirX. It receives the price and issues invoices as tax law requires, except for purchases that Apple or Google sells. The Legal Notice (https://zincirx.com/legal-notice) gives the full details of both companies.

ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş. operates ZincirX for both companies. If you contract with ZincirX Inc., ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş. runs the service on its behalf, and ZincirX Inc. remains responsible to you for it.

If you buy in the mobile app through the App Store or Google Play, that store takes the payment under its own terms. The passports, and the service they are part of, are still provided by us under these Terms.

2. For businesses only

ZincirX is offered only to businesses. A business gives its tax number when it is set up on ZincirX, and everything done on ZincirX is done for a business.

When an account holder accepts these Terms or uses ZincirX, they confirm that they act for the business, for the purposes of its trade or profession, and that they are authorised to do so.

Because your business uses ZincirX for its trade or profession, consumer protection rules do not apply to your contract with us. If a law nevertheless treats a particular contract as a consumer contract, the rights that law gives cannot be excluded, and these Terms do not limit them.

3. Accounts and sign-in

Every person who uses ZincirX for your business needs their own account. They sign in with an email address and password, or through another service such as Google, Facebook or Apple, and the mobile apps keep them signed in with a token issued to their device.

Your business decides whom it invites and which role each person has. Changing the regulated content of a passport, such as its attributes and certifications, is limited to your business's owners and administrators and, for a batch, to the person who created it.

One person can be an account holder of more than one business.

Account holders must keep their sign-in details to themselves and must not share an account. They can turn on two-factor authentication for extra protection.

If you think an account has been used without permission, tell us at once at info@zincirx.com. We may suspend that account to protect you and others (section 16).

Your business is responsible for what its account holders do on ZincirX for it. It is also responsible for use of an account holder's account by someone else where your business or the account holder made that use possible, for example by sharing sign-in details or not keeping them safe.

Your business is not responsible for use of an account by someone else that neither it nor the account holder could reasonably have prevented. That includes use that results from a failure of our security, and use that takes place after you told us an account may have been compromised and we had a reasonable opportunity to act.

When a person stops working for your business, remove them from it. That ends their access to your business but does not close their own account.

An account holder closes their own account by applying from the profile on the website, which asks for the account's password, or from the profile in the mobile app. An account holder with no password to confirm, for example because they sign in only with Google or Facebook, can apply in the mobile app if they can sign in there. Anyone who cannot apply either way, for example because they can no longer sign in, can apply by email to info@zincirx.com from the address registered to the account. Step-by-step instructions are at https://zincirx.com/account/delete-instructions.

We answer every application within 30 days, and the account holder can withdraw it until it is completed. Our review of an application only confirms that it came from the account holder and, if they are the only owner of a business, checks whether anyone else can still manage that business. It is not a discretionary decision, and we decline an application only if we cannot confirm that it came from the account holder.

Completion anonymises the account. The account holder's name, email address, phone number, profile photo, password, two-factor settings, sign-in tokens and sessions, sign-in links with other services and memberships are removed, any application they made to introduce ZincirX to businesses is deleted, and sign-in is blocked for good. We confirm by email, to the address the application came from, when it is done. Where your business's records name them by email address, as the creator of a template or batch, the person responsible for a step or the person who uploaded a file, that address is replaced with one that identifies nobody. Passport revisions keep the email address of whoever made each change.

Completion does not close your business or take its passports offline, and the records that the Account Closure and Cancellation page (https://zincirx.com/cancellation-policy) lists are kept.

Keep your business's details, such as its name, address and tax number, accurate and up to date. They appear on your invoices.

4. What ZincirX is, and what it is not

ZincirX is an online service that we host and operate. With it, your business can do the following.

Define process and product templates, including a product's GTIN and the steps it goes through.
Record production batches step by step, with times, the GPS positions captured at the start and end of each step, photos and documents.
Issue passports whose public pages show your record of a batch, reached through a QR code and, where you enter a GTIN and a lot number, through a GS1 Digital Link address built from them.
Publish passports in machine-readable form, as JSON-LD and as GS1 EPCIS 2.0 events, and export your data.
See how often the QR codes of your passports are scanned.
Give people you choose, such as an authority or another business in your supply chain, access to passport attributes that are not public.
Ask an AI assistant for help with using ZincirX.

Every photo and document uploaded to a template, a batch or a step receives a SHA-256 fingerprint, which can show that the file has not changed since it was uploaded. A fingerprint shows only that; it says nothing about whether the content of the file is true.

Changes to a passport's attributes, certifications and product group are recorded as revisions, and earlier revisions are kept, a design choice that keeps a record of what those parts of a passport said, and when.

Keeping earlier revisions is not an inability to delete. Personal data in an earlier revision can be removed on your instruction, as the Data Processing Terms (https://zincirx.com/data-processing) describe, and specific content can be disabled as section 9 describes.

Other parts of a batch's record, such as its step details, photos and documents, can be changed or removed by those entitled to manage the batch, and those changes are not kept as revisions.

A passport page shows your business's own record of a product. We do not check that the record is true, and we do not verify that a physical product is genuine.

A QR code can be copied onto other goods, so a passport page cannot show that the item in someone's hand is one of those it describes.

We are not a certification body, and we do not endorse any product, claim or certificate shown on a passport page.

We do not claim that ZincirX, or any passport, meets the EU Ecodesign for Sustainable Products Regulation (Regulation (EU) 2024/1781), a harmonised standard or any other law that applies to your products, and we are not a certified digital product passport service provider. Section 6 explains what remains your responsibility.

Each ZincirX passport covers one production batch. ZincirX passports are not battery passports under the EU Batteries Regulation (Regulation (EU) 2023/1542).

Nothing in ZincirX, including the AI assistant, is legal, regulatory or other professional advice.

5. Passports and their identifiers

Passports are allocated to your business when you buy them. Each has a unique identifier and its own QR code, is bound to your business and appears in its list of passports.

You can download and print a passport's QR code as soon as it is allocated, before you issue it. That is why an allocated passport cannot be returned, exchanged, moved to another business or sold to anyone else.

Passports you have not issued do not expire. They stay available to your business for as long as your contract with us continues, and can be withdrawn before then only if the purchase they came from is refunded or reversed, as the Sales, Delivery and Refund Policy (https://zincirx.com/refund-policy) explains.

You issue a passport by assigning it to a production batch. Its identifier always comes from the passports allocated to your business: it cannot be chosen, and one business cannot use another's. The passport's public page then shows your record of that batch, and anyone can see the public part of it free of charge, without signing in.

Everything in the public part of a passport can be seen by anyone who has its QR code or its address. A GS1 Digital Link address, unlike a passport's identifier, is made of a GTIN and a lot number and can be guessed.

Once a passport has been issued under a template's GTIN, that GTIN can no longer be changed or removed, because the GS1 Digital Link addresses printed with it lead to your passports through it. A GTIN can still be added to a template that does not have one yet.

Passport attributes meant only for restricted or authority access are not shown on the public page or in the public machine-readable versions of the passport.

An issued passport's identifier stays with the batch it was issued for. We never move it to another batch or product and never reuse it, even if you ask us to.

The reason is that its QR code may already be on products in circulation. Moving it would make every item carrying the code show another batch's record, which would mislead the people who scan it, could hide a recall, and would break the persistent link between a product and its passport that EU product passport rules require.

If a passport is wrong, someone entitled to change it corrects it in ZincirX, and its identifier stays the same. A correction to its attributes, certifications or product group is added as a revision, and earlier revisions are kept, so both the correction and what it corrected stay part of the record.

If products were labelled with the wrong code, correct the record so that it says which items the passport covers, or relabel the items with new passports. The original passport stays online either way.

You can mark a batch as recalled, and its public page then shows that it has been recalled. Handling the recall itself, including informing an authority where the law requires it, is your responsibility.

A template under which passports have been issued cannot be deleted.

Each issued passport stays online for its availability term. The term is 10 years, counted from the day the passport is issued, unless the order it came from states a different term; if that order recorded a later end date, the later date applies.

The availability term does not depend on your account. An issued passport stays online if your business stops using ZincirX, if an account holder's account is closed, if a fixed-term plan ends, if your business becomes insolvent or stops trading, and after your contract with us ends.

The only exceptions are specific content that we disable because it is illegal or breaches these Terms, or because a court or authority orders us to (section 9), and passports erased when you leave, because erasure was chosen for their order at checkout or because you ask for it (section 14).

The availability term is what we provide for the price. It is not a statement of how long the law requires a passport for your product to stay available; the rules for your product group decide that, and if they require a longer period, arranging it is your responsibility. Nor is it a minimum period for your business: you can end your contract at any time (section 14).

6. Our role as your passport service provider

When you issue passports on ZincirX, your business authorises us to act as its digital product passport service provider for them, storing them and making them available to those entitled to see them.

Under EU law, that authorisation comes from the business that places the product on the market, or puts it into service, in the European Union. If that is another business, such as your importer, you are responsible for making sure that it authorises us for those passports, which it can do by writing to us at info@zincirx.com. An authorised representative does not place products on the market, so it cannot give that authorisation, and EU law does not let it take over the duty to keep passports available and backed up.

You remain the economic operator responsible for your products. Where the law requires them, that includes the following.

Making sure the content of each passport is accurate, complete and up to date.
Checking that the rules for your product accept a passport for each production batch, which is what ZincirX issues, and using the kind of identifier and data carrier those rules require. If they require a GS1 key, enter your GTIN and lot numbers, and the GS1 Digital Link addresses built from them lead to your passports (section 5).
Registering passports in the EU digital product passport registry, and giving a registration identifier to customs where required. We do not register passports on your behalf.
Arranging a back-up copy of your passports with a digital product passport service provider.
Giving dealers a copy of a passport's QR code or address when they ask for one. You can download both from ZincirX, including after your contract ends.
Dealing with authorities, taking corrective action and meeting every other duty the law places on you.

To support a back-up, or any other use of your passports outside ZincirX, you can download a complete copy of your issued passports at any time and free of charge, in the open zincirx.dpp format, and the public part of each one as JSON-LD and as GS1 EPCIS 2.0 events (section 13).

We process passport data only to provide ZincirX and to meet our legal obligations. We do not sell it, reuse it or process it beyond what that requires unless you specifically agree, and by accepting these Terms you agree to two such uses and to no others.

First, we publish totals across all businesses, namely the number of templates, the number of batches and how many batches are in each status, which identify no business, product or person. Second, when an account holder chooses to type passport data into the AI assistant, we send it to Google, which processes it for us to produce the answer (section 11).

We will adapt ZincirX to the requirements the EU adopts for digital product passport service providers and for identifiers, and may change the service to meet them (section 21).

7. Your content

Your content is everything your business and its account holders put into ZincirX or record with it, such as templates, batches, steps and the GPS positions recorded with them, photos, documents, passport attributes, certifications and revisions, and the passports built from them.

Your content remains yours. We host it; we are not its author, and publishing it on a passport page does not mean that we adopt or vouch for it.

Your business gives us a non-exclusive, worldwide, royalty-free licence to store, copy, process, display and publish its content, including on passport pages, through QR codes and GS1 Digital Link addresses and through our programming interfaces, as far as that is needed to provide ZincirX and to meet our legal obligations.

The licence lasts as long as your contract and, for issued passports, until the end of their availability term or until they are erased, whichever is sooner.

You confirm that your business holds the rights needed to grant this licence, including in photos and documents made by others, and that it is entitled to use every GTIN, GLN, EORI number, certificate, logo and mark it enters. We do not check who a GTIN belongs to.

You are responsible for your content being accurate, complete, up to date and lawful. We do not review content before it is published, and we have no general obligation to monitor it.

We do not edit your content. Without your instruction we only disable access to specific content, as section 9 describes, or act on the order of a court or authority.

8. What may not be published

These rules apply to everything your business puts into ZincirX, and above all to what appears on public passport pages, which anyone can see. Your content must not do any of the following.

Be illegal, or concern an illegal product or activity.
Infringe anyone's intellectual property or other rights, such as the copyright in a photo or a trade mark.
Give false or misleading information about a product, such as its origin, composition, method or date of manufacture, or its environmental or social characteristics.
Claim a certificate, approval, label or mark that the product or your business does not hold, or suggest that ZincirX or anyone else endorses the product when they do not.
Present another business's products as your own.
Contain other people's personal data without a legal basis, or personal data of the people who buy or use your products without their explicit consent.
Contain malware, or links meant to deceive the people who scan a QR code.

Keep personal data out of the public part of a passport unless you have a legal basis to publish it. Names, faces and the GPS positions recorded with steps can identify the people who work for you.

We apply these rules diligently, objectively and proportionately, with due regard to the rights and legitimate interests of everyone involved, including freedom of expression and your freedom to conduct a business.

Section 9 explains how breaches are reported and what we may do about them.

9. Reporting illegal content, and how we moderate

Anyone can report content on a public passport page, or on any other page we host, that they believe is illegal, with the form at https://zincirx.com/report-content. Every public passport page links to the form, and following the link fills in the address of the page.

A report can also be sent by email to info@zincirx.com, together with the address of the page.

The form asks for the address of the page, an explanation of why the content is illegal, and a statement that the report is made in good faith and is accurate and complete. A name and an email address are optional; when an email address is given, we confirm receipt there.

A person reviews every report and makes every decision about content, and we do not use automated means to moderate content. We may also review content on our own initiative, for example when we learn of it another way.

We decide in a timely, diligent, non-arbitrary and objective way. If we find that content is illegal or breaches section 8, we may take one or more of these measures, choosing the least severe one that is enough.

Disabling access to a specific item, such as a photo, a document, an attribute or an earlier revision, while the rest of the passport stays online.
Disabling access to the public page of a passport.
Suspending, or as a last resort closing, an account holder's account or your business's account (section 16).

Disabling access to specific content as this section describes takes precedence over the availability term and over keeping earlier revisions, and is not a breach of these Terms.

When we take a measure because content is illegal or breaches these Terms, we send a statement of reasons to the email address of the account concerned, at the latest when the measure takes effect. It states the measure, where it applies and for how long; the facts we relied on, including whether we acted on a report or on our own initiative; whether any automated means were used; the legal or contractual ground, with an explanation; and how the decision can be contested.

When a report gave an email address, we tell the person who made it, without undue delay, what we decided and how they can seek redress.

If a court or another competent authority orders us to act against content or to provide information, we comply as the law requires. We tell you about the order before we act on it, and afterwards what we did, unless the order or the law requires us to wait or not to tell you. The Data Formats and Infrastructure page (https://zincirx.com/data-formats) describes the further measures we take when a government or public authority seeks access to data we hold for you.

If content gives rise to a suspicion of a criminal offence that threatens someone's life or safety, we inform the competent authorities, as the law requires.

You, an account holder or the person who made a report can contest any of our decisions by writing to info@zincirx.com, saying which decision and why. A person reviews it again without undue delay and replies with the outcome and the reasons.

Our decisions are not final. Asking us for a review is optional and does not limit any other remedy, including going to court or, for decisions about content in the European Union, complaining to a Digital Services Coordinator.

10. Acceptable use

When using ZincirX, your business and its account holders must not do any of the following.

Use ZincirX for anything illegal, or to deceive the people who scan your products' QR codes.
Try to get into accounts, businesses or data that are not theirs, or probe, test or get around our security.
Disrupt or overload ZincirX or the systems it runs on, including by sending automated requests beyond the limits of our interfaces.
Copy, decompile or reverse engineer the software of ZincirX, except as far as the law allows.
Resell access to ZincirX, or let anyone use it who is not an account holder of your business or someone you have authorised under these Terms.
Use ZincirX to send unsolicited messages, or to collect other people's personal data without a legal basis.
Set up an account or a business with false details.

A serious or repeated breach of this section can lead to the measures described in section 16.

11. The AI assistant

ZincirX includes an AI assistant that answers questions about using the service, both in ZincirX and on our website.

The assistant is an AI system, not a person. It is our own feature, provided in ZincirX by us and on our public website by ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş., and the company that provides it is the controller of what is typed into it. Its answers are produced by a model supplied by Google (Gemini). It is not part of the processing we do on your behalf under the Data Processing Terms (https://zincirx.com/data-processing).

What you type is sent to Google, which processes it for us to produce the answer, and we do not store the conversation. Do not type personal data, or confidential information you do not want sent to Google; the Privacy Policy (https://zincirx.com/privacy) explains how this data is handled.

Answers are generated automatically and can be wrong, incomplete or out of date, however confident they sound. They are not legal, regulatory, tax or other professional advice.

Check an answer before you rely on it, and never put it into a passport without checking it.

The assistant cannot receive notices, reports or requests. To reach a person, use the contact details in section 23.

Your business is responsible for how its account holders use the assistant and its answers.

12. Prices and payment

What you buy, how you pay, how passports are delivered and when we refund are set out in the Sales, Delivery and Refund Policy (https://zincirx.com/refund-policy). In short, the following applies.

Passports are sold as one-time prepaid packages in any quantity. There is no subscription, nothing renews and there is no trial of any kind.
There are no free passports and no trial period: your business buys the passports it issues.
Fixed-term plans for one month or one year are no longer sold. A plan bought earlier was paid once, does not renew and simply ends on its expiry date.
When you buy from us, the price is the total shown at checkout, calculated by our server from the quantity you order.
Before every purchase on our website, and every purchase through the checkout the mobile app opens in the browser, you confirm that the purchase is final, and we record that confirmation.
Purchases are final, except in the four cases the Sales, Delivery and Refund Policy lists: a charge made in error; passports paid for but not credited, where we do not put that right promptly; a failure of the service that we cannot remedy; and a right the law gives you that no contract can exclude.
Refunds of purchases made through the App Store or Google Play are decided by that store under its own terms, and a charge made in error in its checkout is for it to put right. In the other three cases, if the store does not refund you, we do.
Purchases made before September 18, 2026 stay under the terms that applied when they were made, including any refund right those terms gave (section 21).

There is no charge for exporting your data, for switching to another provider or to your own systems, or for erasure when you leave (sections 13 and 14).

13. Exporting your data

Your data is yours. You can take a copy of it at any time, free of charge, during your contract and, after it ends, during the retrieval period in section 14.

Owners and administrators can download, at any time, all of your business's issued passports in one file in the open zincirx.dpp format. It contains every attribute at every access level, the certifications, the full revision history, the availability term, the identifiers and linked data, with a manifest of SHA-256 digests.

You can also export batch lists as CSV or PDF, a batch's details as PDF or CSV, and your custom reports; download each uploaded file in its original form, with its SHA-256 fingerprint; and download each passport's QR code as an image or as a printable label. Anyone can read the public part of each passport as JSON-LD and as GS1 EPCIS 2.0 events. Each account holder can download their own data as JSON from the profile on the website or in the mobile app.

Anything you cannot export yourself, such as all your original files in a single download, or an export you cannot reach in the web app at the time, for example while an account is suspended, we send you on request to info@zincirx.com, without undue delay, in a structured, commonly used and machine-readable format such as JSON or CSV, with files in the format in which they were uploaded.

The Data Formats and Infrastructure page (https://zincirx.com/data-formats), which we keep up to date, describes the data structures and formats of these exports and the standards they follow. It also states where the servers that hold your data are, which jurisdiction that infrastructure is subject to, and what we do to prevent government access to your data that would conflict with EU law or the law of an EU Member State.

The data and digital assets you can export, and that move with you when you switch, are those listed below. The list is complete.

Your business profile, including its name, address, tax number, GLN and EORI number, and its members and their roles.
Your templates and their step definitions, including GTINs, tags, certifications, specifications and translations, and the files attached to them.
Your batches, with their passport identifiers, lot numbers and statuses, and their steps, with the times and GPS positions recorded for them.
Every file uploaded to your steps and batches, such as photos and documents, with its SHA-256 fingerprint.
The attributes of each passport at every access level, and every revision of each passport.
Your passports in machine-readable form, as JSON-LD, as GS1 EPCIS 2.0 events and in the zincirx.dpp format.
Every passport identifier allocated to your business, issued or not yet issued, with its QR code.
The scan statistics we hold for your passports.
The access grants your business has issued for restricted or authority access to its passports, and the record of reads made with them.
The custom reports you have set up.
Your orders and invoices with us, and the records of which versions of our terms were accepted for your business and of each purchase's confirmation that it was final.
Any other content that your business or its account holders entered or uploaded for your business.

We do not store conversations with the AI assistant, so there are none to export.

The only data excluded from export is data about how ZincirX itself works whose export would put our trade secrets or the security of the service at risk. It consists of the security and audit logs we keep to protect the service; passwords, which we hold only in hashed form, two-factor secrets, sign-in tokens and the secret tokens of access grants; the keys we use to pseudonymise network addresses and to sign passports; and our internal settings, including the instructions we give the AI model.

That list of exclusions is complete, and the exclusions never delay or prevent a switch.

Exports, and the public machine-readable versions of your passports, are free of charge. On your instruction we deliver an export directly to anyone you authorise to act for you, such as a new provider.

14. Switching provider, leaving and erasure

You can end your contract with us at any time, to move your data to another provider or to your own systems, to have it erased, or a combination of these. The terms in this section apply to every customer, and include those the EU Data Act (Regulation (EU) 2023/2854) requires.

To start, an owner or administrator of your business, or someone you have authorised to act for you, such as your new provider, gives us notice by email to info@zincirx.com. We check only that the notice comes from someone entitled to act for your business; that check is not a discretionary decision and does not extend any period below.

The notice period is 30 calendar days from the day we receive your notice. By the end of it at the latest, you tell us which of these you want, alone or together, namely a move to another provider, which you name, a move to your own systems, or erasure of your data.

We move your data without undue delay, and at the latest within a transitional period of 30 calendar days that starts when the notice period ends. You can extend the transitional period once, for as long as you consider appropriate for your purposes.

Throughout the notice and transitional periods the contract stays in force and ZincirX keeps running with due care, including your passport pages and our programming interfaces.

During that time we give you, and any provider you authorise, reasonable help with the move and all the information relevant to your exit. We tell you of any risk we know of to the continuity of the service, cooperate in good faith with your new provider, and keep a high level of security throughout, including during the retrieval period. The Account Closure and Cancellation page (https://zincirx.com/cancellation-policy) summarises these steps, and the Data Formats and Infrastructure page (https://zincirx.com/data-formats) describes the formats in which your data is exported.

If a move within the transitional period is technically not feasible, we tell you within 14 working days of your notice, explain why, and propose an alternative transitional period of no more than seven months, during which the service keeps running.

The contract ends, and we tell you so, when the move has been completed successfully. If you chose erasure without a move, the contract ends at the end of the notice period.

You then have 30 calendar days to retrieve your data, starting when the transitional period ends or, if you chose erasure without a move, when the contract ends.

When the retrieval period ends, we erase all the data and digital assets that your business generated or that relate directly to it, with these exceptions.

Passports already issued from orders for which keeping them online was chosen at checkout, or for which no choice was recorded, such as purchases through the App Store or Google Play, with the product and batch records, files and revisions that make them up. They are erased when their availability term ends instead, so that the QR codes on products in circulation keep working (section 15).
Records the law requires us to keep, such as payment and invoice records, which we keep for the periods tax and commercial law require and then delete.
Records of which versions of our terms were accepted, and of each purchase's confirmation that it was final, which we keep for the limitation periods that apply to claims under the contract.

Passports from orders for which erasure was chosen at checkout are erased with the rest of your data when the retrieval period ends, and the QR codes printed on those products stop leading to your record. You can change that choice for any order, either way, in your notice or by the end of the notice period.

Before you ask for that, make sure that no law requires those passports to stay available for your products. Their identifiers are never reused, even after they are erased.

Switching, exporting and erasure are free of charge. None of them depends on a payment, on a disputed charge or on whether you have used your passports, and we put no other obstacle in the way of ending your contract, contracting with another provider or moving your data.

Ending the contract costs nothing, and we charge no fee for ending it early. What you have already paid is not refunded, except as the Sales, Delivery and Refund Policy (https://zincirx.com/refund-policy) provides: the price of passports you have not issued, of the unused part of a fixed-term plan and of the rest of the availability term of issued passports erased when you leave stays paid. That policy states this before you buy, together with our standard fees and the fact that there are no switching charges.

Ending your business's contract does not close its account holders' own accounts. Each account holder can close their account as the Account Closure and Cancellation page (https://zincirx.com/cancellation-policy) explains.

15. Printed QR codes after you leave

The QR codes already printed on your products keep working after you leave. If you move to another provider, or your contract ends for any other reason, the address in each of those codes goes on showing the passport it was issued for until that passport's availability term ends.

Moving to another provider does not change where those codes lead. Each code contains a ZincirX address, so it keeps leading to the passport we host, not to your new provider.

The same applies to GS1 Digital Link addresses built from your GTINs and lot numbers, because a GTIN cannot be changed once passports have been issued under it (section 5).

The address in a passport's QR code never starts showing another product's record, and a passport's identifier is never reused, during its availability term or after it.

If your contract with us has ended, each passport is erased when its availability term ends, unless it was erased sooner because erasure was chosen for its order or you asked for it (section 14).

Until then, specific content can still be disabled if it is illegal or breaches these Terms, or if a court or authority orders it (section 9).

16. Suspension and termination

We may suspend or close your business's account, or an account holder's account, only on these grounds.

A serious or repeated breach of these Terms, including publishing illegal content, or content that section 8 prohibits, on public passport pages.
Fraud or abuse of payments, including abuse of refunds or chargebacks.
A threat to the security of an account, of the service or of other customers, such as an account that appears to have been taken over.
A legal obligation, or an order from a court or another competent authority.

Any measure we take is proportionate to its reason. Where disabling specific content is enough, we do that instead of suspending an account, and we suspend rather than close where suspension is enough.

We close your business's account for a breach of these Terms only if the breach is serious and you have not put it right within a reasonable time after we asked you to, or if it cannot be put right.

Where we can, we give notice and our reasons before a measure takes effect. We act first and explain at the same time only where waiting would cause harm, as with ongoing fraud, a security threat or illegal content, or where the law or an authority requires it.

When the measure is taken because content is illegal or breaches these Terms, you receive the statement of reasons described in section 9. When we act for another reason, we also tell you what we did and why, unless the law or an authority prevents us.

Nobody can sign in to a suspended account, but suspension deletes nothing, and when it ends the account is exactly as it was. Suspension never stops you getting a copy of your data; if you cannot sign in, ask us for an export at info@zincirx.com.

Neither suspension nor closure takes issued passports offline. They stay online for their availability term, apart from specific content disabled under section 9.

If we close your business's account, the contract ends and section 14 applies as if you had chosen erasure. You have 30 calendar days from the closure to retrieve your data, after which it is erased with the same exceptions, and any refund follows the Sales, Delivery and Refund Policy (https://zincirx.com/refund-policy).

You can contest any of these decisions as section 9 describes.

You can end the contract at any time, as section 14 describes. If we seriously breach these Terms and do not put it right within a reasonable time after you ask us to, you can also end it for that reason, keeping your rights under section 14, and the Sales, Delivery and Refund Policy sets out the refund that then applies.

If we decide to stop providing ZincirX altogether, we tell you as far in advance as we reasonably can and help you move your data as section 14 describes. If we can then no longer keep your issued passports online for the rest of their availability term, we refund as the Sales, Delivery and Refund Policy sets out.

When the contract ends, the parts of these Terms that by their nature continue, such as those on issued passports, liability, confidentiality and governing law, continue to apply.

17. Our commitments and our liability

We provide ZincirX with the care and skill of a diligent provider of such a service. In particular, we keep issued passports online for their availability term except as sections 9 and 14 provide, never reassign or reuse their identifiers, do not edit your content and let you export your data.

We aim to keep ZincirX available at all times, but we do not promise that it will run without interruption or error. Maintenance, faults and events outside our control can make it unavailable for a time.

Beyond the commitments in these Terms, we do not promise that ZincirX, or a passport, meets a law that applies to your products or suits a particular purpose of yours.

We are not responsible for the accuracy or lawfulness of the content your business supplies, or for what third parties do with copies of your QR codes.

Nothing in these Terms excludes or limits any of the following.

Our liability for intent or gross negligence, including that of the people we rely on to provide ZincirX.
Our liability for injury to life, body or health.
Your right to be repaid what you paid for something we did not provide, as the Sales, Delivery and Refund Policy sets out.
Your right to require us to do what these Terms oblige us to do, including on exporting your data, switching and erasure, and your right to end the contract if we do not.
Any other liability that the law applicable to your contract does not allow to be excluded or limited.

Apart from those cases, if we breach through slight negligence an obligation that is essential to the contract, meaning one that must be met for the contract to be carried out at all and on which you may rely, such as keeping issued passports online, never reassigning their identifiers and letting you export your data, we are liable only for damage that was typical and foreseeable when the contract was made.

For damage caused by slight negligence in any other case, we are likewise liable only for damage that was typical and foreseeable when the contract was made, and our total liability to your business for all such damage is limited to what your business paid us for ZincirX in the 12 months before the event that gave rise to the claim, and in any case to no less than TRY 10,000 (if you contract with ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş.) or $250 (if you contract with ZincirX Inc.).

Your business compensates us for the losses and reasonable costs we incur from claims by third parties or authorities that result from its content or from its breach of these Terms, to the extent that your business is responsible for them.

18. Intellectual property

ZincirX, including its software, design and documentation and the ZincirX name and logo, belongs to us or to those who license it to us. These Terms transfer none of those rights to you.

During your contract, we give your business a non-exclusive, non-transferable right to use ZincirX for its own business, as these Terms allow.

Your business may print the QR codes and addresses of its passports on its products, packaging and documents, and may keep using those already printed after the contract ends.

Your content, and your exports of it, remain yours (section 7).

If you send us suggestions about ZincirX, we may use them freely and owe you nothing for them.

19. Confidentiality

We keep confidential everything in your account that is not published on a public passport page. Our staff, and the service providers who help us run ZincirX, see it only as far as they need to and are bound to keep it confidential.

We disclose it to anyone else only as these Terms or the Data Processing Terms allow, with your agreement, or where the law, a court or an authority requires it.

Your business keeps confidential any information about ZincirX that we give it and that is not public, such as information about our security.

These duties do not cover information that is or becomes public other than through a breach of this section, and they continue after the contract ends.

Public passport pages, and the public machine-readable versions of passports, are public by design, and showing them is not a breach of confidentiality.

20. Personal data

The company you contract with is the controller of the personal data of your account holders, as the Privacy Policy (https://zincirx.com/privacy) explains. If you contract with ZincirX Inc., ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş. processes that data on its behalf.

For personal data in your content, such as names entered in steps, people shown in photos and GPS positions recorded with steps, your business is the controller, and the company you contract with processes the data on your behalf as your processor. Where that company is ZincirX Inc., ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş. processes the data as its sub-processor.

The Data Processing Terms (https://zincirx.com/data-processing) govern that processing and form part of these Terms.

We do not use your content for our own purposes, such as training AI models or marketing, beyond the uses listed in section 6.

Your business is responsible for having a legal basis for the personal data it puts into ZincirX, for informing the people concerned, and for what it chooses to publish on passport pages, which anyone can see (section 8).

21. Accepting these Terms, and changes to them

This version of the Terms takes effect on September 18, 2026.

Before using the ZincirX web app, each account holder accepts, on behalf of the business, these Terms, the Sales, Delivery and Refund Policy and the Data Processing Terms, and confirms having read the Privacy Policy. By accepting, the account holder confirms that they are authorised to do so for the business.

We record who accepted which version, and when; each version is identified by the date it takes effect. We keep these records for the life of the account and afterwards for the limitation periods that apply to claims under the contract, including after the account is closed.

These Terms also apply when your business uses ZincirX through the mobile apps or our programming interfaces. You can save or print them from this page at any time.

We may change these Terms for a valid reason, such as a change in the law, the adoption of rules for digital product passports, or a change in the service.

A change is significant if it reduces your rights or adds to your obligations. We tell you of a significant change before it takes effect, and each account holder is asked to accept the new version on your behalf before continuing to use the web app. The change applies to your business only once it has been accepted for it.

Other changes, such as corrections, clearer wording or new contact details, take effect when we publish them. Changes to the Data Processing Terms are the exception: we tell you of every one by email and in the service, and each applies only once it has been accepted for your business.

If you do not accept a significant change, it does not bind your business, and the version you last accepted continues to govern your contract.

An account holder who has not accepted the change cannot use the web app, apart from the profile page. Your business can still end the contract free of charge as section 14 describes, its issued passports stay online, and you can get a copy of your data by writing to info@zincirx.com.

A new version never changes a purchase already made. Each purchase stays under the terms that applied when it was made, including purchases made before September 18, 2026.

We may also change ZincirX itself, for example to improve it or to comply with the law, as long as the change is reasonable for your business, taking its interests into account. A change to the service never takes issued passports offline before their availability term ends and never stops you from exporting your data.

22. Governing law and courts

These Terms, and every contract made under them, are governed by the law of the Republic of Türkiye, whichever of the two companies you contract with.

The courts and enforcement offices of İzmir, Türkiye, have exclusive jurisdiction over any dispute arising from or in connection with these Terms.

This choice does not take away any protection that a law gives your business whatever law the parties choose, including rules of European Union law that apply to your contract regardless of the law that governs it. Nor does it prevent you from complaining to a competent authority.

Where the Data Processing Terms, or standard contractual clauses included in them, name another law or court for the matters they cover, that law or court applies to those matters.

If a provision of these Terms is invalid, the rest remain in force, and the invalid provision is replaced by what the law provides.

If a problem arises, please tell us first at info@zincirx.com so that we can try to resolve it. That is not a condition of going to court.

23. Notices and contact

We send notices about your contract to the email addresses of your business's owners and administrators and, where a notice concerns one person, to that account holder's email address. We may also show notices in the web app.

Keep those email addresses up to date so that our notices reach you.

You can reach us by email at info@zincirx.com or by phone on +90 536 587 41 81; our contact page (https://zincirx.com/contact) lists both. Messages are read and answered by people; the AI assistant is not a way to contact us.

You can write to us in English, Turkish, German or Spanish.

The address info@zincirx.com is also our single point of contact under the EU Digital Services Act, for users of ZincirX and for the authorities.

Our company details are in the Legal Notice (https://zincirx.com/legal-notice). Our representatives in the European Union are listed there, with their contact details, in the company details, and info@zincirx.com is always open, including for anything meant for a representative.

Terms of Service