What ZincirX guarantees, and what it does not

What we guarantee

• Every evidence file is fingerprinted with SHA-256 when it is uploaded. Anyone holding a copy can compute its fingerprint and compare it with the one the passport shows.
• Passport changes are added, never written over. A correction is a new revision beside the old one, so a passport's history can always be read back. This is how the software is built; it is a design choice, not a claim that stored data could never be altered.
• A passport identifier is never given to another product, even at a customer's request. A mistake is corrected by a revision, and a recall is recorded as a recall.
• Each passport stays available for 10 years from the day it is issued — the term fixed when it was sold.
• Information is shown in three tiers: public, legitimate interest and authority. A field whose tier is not defined is treated as the most restricted one.
• Passports are published in open formats — GS1 Digital Link, JSON-LD and GS1 EPCIS 2.0 events, signed as W3C Verifiable Credentials where signing is switched on — and a customer can export its data at any time.
• A request to delete personal data is completed within 30 days. Personal data is removed or anonymised; the passports a customer issued stay online, because the products carrying them are still in circulation.

Data Formats & Infrastructure

What we do not do

• We do not check what a manufacturer records. A passport shows the manufacturer's own record: the steps, files and statements it entered. What ZincirX adds is when each entry was made and by which account, and the fingerprints that show whether a file has changed since.
• We do not certify products or companies, and we do not call ZincirX compliant or approved: no certification scheme for passport service providers exists yet, and no product group's passport rules apply before its own delegated act. ZincirX is designed with the EU Digital Product Passport rules (ESPR) in mind.
• A ZincirX passport covers a batch (a lot), not an individual item.
• A passport cannot show that the item in your hand is the one it describes. A QR code can be copied; what it opens is the manufacturer's record for that batch.
• We have not registered any passport in the EU Digital Product Passport Registry. Its machine interface is not available yet; our integration waits for it and claims nothing until a registration actually succeeds.
• Food is outside the scope of ESPR. A food passport on ZincirX is a voluntary record that a buyer may ask for, not an ESPR requirement.

Dates that matter

Years marked "indicative" are the European Commission's plan, not law.

1. 18 July 2024 — the Ecodesign for Sustainable Products Regulation, (EU) 2024/1781, enters into force.
2. 16 April 2025 — the Commission adopts its first ESPR working plan. Indicative years for the product rules: iron and steel 2026, textiles and apparel 2027, furniture 2028.
3. 20 July 2026 — the EU Digital Product Passport Registry goes live.
4. 6 August 2026 — Implementing Regulation (EU) 2026/1778 on access to the registry and registration enters into force.
5. 18 February 2027 — the battery passport becomes mandatory under the Batteries Regulation, (EU) 2023/1542, Article 77.