B2B SaaS Terms
Version 5 September 2026
Terms for Passvanta monthly self-service subscriptions and individual Enterprise contracts.
1 Provider and scope
The provider is Ömer Salmaz, Passvanta, Philippsburger Straße 83a, 68753 Waghäusel, Germany, legal@passvanta.com. These Terms apply to the cloud-based Passvanta service, including subscribed modules, interfaces and support. The service is available only to entrepreneurs within section 14 BGB, public-law legal entities and special public-law funds. Consumer contracts are excluded. Customer terms apply only if Passvanta expressly accepts them in text form.
2 Definitions
Customer means the organisation named in the checkout or Order Form. Users are individuals granted access by the Customer. Customer Content is data, documents and other content entered by the Customer or invited Suppliers. Suppliers are external businesses or representatives invited to provide limited information. Exportable Data and Digital Assets have the meanings in the EU Data Act.
3 Service
Passvanta provides a B2B SaaS platform to collect, structure, review and publish product, supplier, evidence and digital-product-passport data. The selected plan or Enterprise Order Form defines the features. Passvanta provides the agreed software functions but does not promise a particular commercial, regulatory or administrative outcome. It does not provide legal advice, certification, notified-body conformity assessment or public-authority approval and does not assume the legal role of an economic operator.
4 Contract conclusion
Plan pages invite the Customer to make an offer. Completing checkout submits a binding offer. The contract starts when Passvanta expressly accepts, activates the paid account or begins performance. Enterprise contracts start on acceptance of an individual Order Form. The Customer confirms that the acting person has authority to contract and administer the account. Passvanta records the accepted Terms version and provides storable contract documents.
5 Accounts, organisations and roles
Credentials are personal and must not be shared. The Customer keeps organisation, billing and contact data current, grants least-privilege permissions and removes departed users promptly. Critical permissions such as publication, registry submission, API keys, owner transfer and billing must be limited to authorised roles. The Customer is responsible for its Users' acts to the extent legally attributable to it and must report suspected compromise to support@passvanta.com without undue delay. A Customer may authorise Supplier and Service Provider organisations for clearly limited tasks. It defines the organisations, products, requests, fields and roles shared and remains responsible for the engagement and lawfulness of disclosure. Passvanta grants no cross-organisation access without documented authorisation and logs critical permission changes.
6 Plans, fees and invoices
Self-service subscriptions are billed monthly in advance at the price displayed on contract conclusion. Enterprise fees follow the Order Form. Usage limits and overages follow the plan or Order Form. Passvanta issues its own invoices through Resend and collects payments through Stripe. Fees are due on invoice. If the section 19 UStG small-
business exemption applies, no VAT is charged and the invoice states the exemption. If the tax status changes, legally due VAT is added prospectively. After a failed payment, Passvanta may restrict paid functions following notice and a reasonable cure period. Set-off is permitted with undisputed or finally adjudicated claims; retention rights must arise from the same contract.
7 Term and termination
A monthly subscription runs for one month and renews for successive one-month periods unless cancelled by the end of the current billing period. Cancellation is available in the account or by text-form notice to billing@passvanta.com. Enterprise terms follow the Order Form. Either party may terminate for cause. Cause includes a material breach not cured after warning, repeated unlawful content or unpaid fees after a reasonable cure period. No warning is required where unreasonable or clearly futile.
8 Availability, maintenance and changes
Passvanta supplies the service with reasonable professional care. No specific availability applies unless an Enterprise SLA states one. Planned maintenance is announced where practicable; emergency maintenance may occur without notice to protect security or stability. Passvanta may develop features if the agreed core purpose remains available and the Customer is not unreasonably disadvantaged. Material adverse changes receive at least 30 days' notice. If a change removes an agreed core function, the Customer may terminate when the change takes effect.
9 Customer obligations
The Customer ensures that Customer Content is lawful, accurate and authorised and obtains required notices, consents, instructions and rights. It must not upload malware, unlawful material, unauthorised secrets, special-category data, criminal-conviction data, private identity documents or complete payment credentials unless expressly approved. The Customer must review extracted and suggested data, validate evidence and require qualified approval before publication or registry submission. It remains responsible for product compliance, market placement, mandatory statements, supplier diligence and authority communications. Before public DPP publication or recipient sharing, the Customer reviews personal data, trade secrets, access rights and legal publication duties. Public content may be accessed worldwide and further processed by third parties. Technical publication or registry transmission is not authority approval. Mass automation, limit circumvention, unauthorised security testing, reverse engineering beyond mandatory rights and use to train a directly competing model or service are prohibited.
10 Customer Content and licence
The Customer keeps all rights in Customer Content. For the contract term, it grants Passvanta a non-exclusive, purpose-limited licence to host, copy, technically transform and transmit Customer Content to authorised processors where necessary for the service, security, support or documented instructions. Passvanta does not use Customer Content to train general AI models without separate explicit agreement. Aggregated statistics may be used only where no Customer, User, Supplier or product can be identified.
11 AI functions
Passvanta may use Mistral AI, OpenAI and Google Gemini through business or API services. AI outputs are probabilistic suggestions and may misstate facts, classifications, translations or regulatory assessments. They are not legal advice, conformity evidence or authority-confirmed information. Passvanta records provenance and enables human review to the extent included in the service. The Customer retains final approval of critical fields, Readiness decisions, DPP publication and registry submission. Each party complies with its duties under the EU AI Act, including appropriate AI literacy for persons operating the functions.
12 DPP and compliance qualification
Regulatory Packs, validations, deadlines, Readiness values and blockers reflect the working state documented in Passvanta. They do not replace review of all laws applicable to the specific product, supply chain, territory and date. Delegated acts, implementing acts, standards and authority practice may change. A 100 percent score or absence of displayed blockers is not a declaration of conformity and does not guarantee completeness, marketability or authority acceptance.
13 Data protection and processing
Each party performs its own privacy duties. The Passvanta DPA applies to processing on the Customer's behalf. The Customer gives only lawful instructions and informs individuals. Passvanta may use the subprocessors identified in the DPA.
14 Confidentiality
Both parties keep non-public business, technical and organisational information confidential, use it only for the contract and disclose it only to appropriately bound persons who need it. Exclusions apply to information demonstrably already known, independently developed, lawfully received from a third party or public. Legally compelled disclosure remains permitted, with prior notice where lawful.
15 Intellectual property
Passvanta and its licensors retain all rights in the software, interface, documentation, marks, templates, regulatory rules and technical models. The Customer receives a non-exclusive, non-transferable right for authorised Users to use the service for its business during the contract. Mandatory statutory rights remain unaffected.
16 Third parties and integrations
Providers such as Stripe, Vercel, Cloudflare, Neon, Resend and AI vendors supply their own services. Passvanta selects and manages its processors under the GDPR. Customer-enabled external integrations may have separate provider terms. Passvanta is not responsible for Customer-selected services outside Passvanta's control.
17 Data export and switching
During the contract, the Customer can obtain Exportable Data and Digital Assets through available export functions or by asking support@passvanta.com, in a commonly used, structured and machine-readable format. Categories include product master data, DPP fields, supplier assignments, evidence metadata, Customer documents, audit data and approvals where attributable and exportable. Internal operations data, security rules, abuse signals, proprietary source code, general models, internal telemetry and data protected by third-party rights or Passvanta trade secrets are excluded where the exclusion does not impede switching. Passvanta provides reasonable assistance, maintains security and, where possible, continuity. The ordinary transition period is no more than 30 calendar days unless technically unfeasible or extended once at the Customer's request. Passvanta explains technical infeasibility within 14 working days; an alternative period will not exceed seven months. Exportable data remains retrievable for at least 30 calendar days after transition and is then deleted subject to law, backup cycles or contrary instruction. Until 11 January 2027, Passvanta may charge only transparent, directly incurred switching costs. From 12 January 2027, Passvanta charges no switching fee; additional assistance beyond legal duties may be separately agreed.
18 Defects and warranty
The Customer reports reproducible defects with necessary diagnostic information. Passvanta remedies material defects within a reasonable period. Statutory remedies apply if cure fails or is unreasonable. Strict liability for defects
existing at contract conclusion under section 536a(1) BGB is excluded where lawful. Issues caused by unsupported systems, Customer changes, inaccurate data, disregard of documentation or Customer-selected third parties are not defects in Passvanta.
19 Liability
Passvanta has unlimited liability for intent, gross negligence, death or personal injury, product liability, fraudulent concealment and express guarantees. For ordinary negligence, Passvanta is liable only for breach of a cardinal obligation necessary to perform the contract and on which the Customer may ordinarily rely. Liability is then limited to foreseeable, typical loss and in aggregate per contract year to the net fees paid in the twelve months preceding the event. The cap does not apply where it would defeat the contract's purpose or conflict with mandatory law. For data loss caused by ordinary negligence, liability is limited to the typical restoration cost that would have arisen with reasonable exports and backups. These limits also protect employees and agents.
20 Indemnity
The Customer indemnifies Passvanta against justified third-party claims arising from unlawful Customer Content, missing rights, unlawful instructions or Customer-responsible use. Passvanta must notify the Customer promptly and allow defence where legally possible. A settlement imposing duties on Passvanta requires its consent. No indemnity applies to the extent Passvanta caused the claim.
21 Price and Terms changes
Price changes for a future renewal period receive at least six weeks' text-form notice and apply prospectively. The Customer may cancel before they take effect. These Terms may change for objective reasons such as law, security or service changes. Material adverse amendments receive at least six weeks' notice. Silence is not acceptance unless mandatory law permits an effective alternative agreement.
22 Force majeure
Neither party is liable for delay caused by events outside reasonable control where it took reasonable precautions and promptly notified the other party. Fees for services already supplied remain due. If the event lasts more than 30 days and materially defeats the contract's purpose, either party may terminate the affected part.
23 Governing law and language
German law applies, excluding the UN Convention on Contracts for the International Sale of Goods. If the Customer is a merchant, public-law legal entity or special public-law fund, the courts at Passvanta's place of business have jurisdiction. Mandatory exclusive jurisdiction remains unaffected. Notices may be given in text form. Invalid terms are replaced by statute and do not affect the remaining contract. If the German and English versions differ, the German version prevails.