Terms and Conditions

1. Who we are and how to reach us

These Terms apply to Polarpass, provided by Tech by Build, the trade name of Menno de Vries, a sole proprietorship (eenmanszaak) established in the Netherlands. A sole proprietorship is not a separate legal entity, so your contract is with Menno de Vries, trading as Tech by Build. The app may be listed under either name in the App Store and Google Play. KVK number 96687762. VAT number NL005225215B96. Website and app: https://polarpass.eu and the Polarpass app.

Postal address, registered with the KVK as our correspondence address: Hallenweg 16, 5683 CT Best, the Netherlands. We do not receive visitors at this address. Our business address is a private home address and is shielded in the Dutch Business Register.

Contact us at support@techbybuild.com, through the contact form at https://polarpass.eu/contact, by phone on +31 6 21195761 or by post at the address above. We aim to reply within three business days (Monday to Friday, excluding Dutch public holidays). This is a target, not a guarantee, and it does not change any legal deadline.

2. Business customers only

Accounts and subscriptions are only for businesses and professionals, including self-employed people. You accept these Terms when the sign-up or order process asks you to. By accepting, you confirm that you use Polarpass for your trade, business or profession, that you are at least 18, and that you are authorised to accept on behalf of the customer you name. Anyone can read public passports without an account or subscription.

Web checkout asks for a business VAT number, so we do not expect to contract with consumers. If mandatory consumer law nevertheless applies to your contract, nothing in these Terms limits the rights it gives you. In particular, you may then withdraw within 14 days of concluding the contract, or longer where the law extends that period, without giving a reason, by sending a clear statement to support@techbybuild.com or our correspondence address. We then refund everything you paid within 14 days.

These Terms, the order confirmation and the DPA in the appendix form the agreement. The order confirmation shows the plan, price, taxes, billing period, allowance and seller, and you can keep a copy. The DPA takes priority for processing personal data. A separately signed agreement takes priority for what it covers. The Privacy Policy explains how we handle personal data; it is not a request for consent.

The agreement is concluded in English. You can review and correct your details before you accept or pay, and we store the accepted text (see section 20).

3. The service

Polarpass lets you create, organise, review and publish digital product passports, including model, batch and item passports, product data and evidence uploads, public, internal and hidden visibility, previews and published versions, QR codes and GS1 Digital Link identifiers, translations, CSV import and export, team roles, lifecycle and recall information, view and scan statistics, and your own passport domain where available. Public QR pages open in a browser without the app.

You supply the product facts, identifiers, translations, declarations and evidence and remain responsible for their accuracy, your right to use them, and compliance with the rules for your products. Readiness scores, category guidance and publication checks are help, not legal advice, certification or independent verification. We do not issue GTINs, verify who owns them or claim GS1 certification.

We provide software and hosting. We do not sell or manufacture the products described in passports, and a product seller's own warranty and safety obligations stay with that seller.

We serve business customers in EU Member States and other European markets where passport requirements apply. Which requirements apply depends on the product category and the applicable rules and their start dates. A template in Polarpass does not by itself show that a product complies.

The app supports iOS and iPadOS 15.1 or later and Android 7.0 or later. The website supports Chrome, Edge and Firefox 111 or later and Safari 16.4 or later. Older versions may work but are not supported. Features can vary by release, region and payment channel. Features marked beta are not part of the agreed service.

4. Accounts, team members and security

Keep your account and business details accurate. Protect your email account, sign-in provider and devices, never share sign-in codes or session tokens, and tell us promptly about suspected misuse.

The workspace owner accepts these Terms for the customer. People the customer invites use the service under the customer's agreement and do not accept separately. The customer is responsible for everyone it gives access to its workspace as for its own actions.

Workspace owners and administrators decide who has access and with which role, and must remove access that is no longer needed. Deleting the owner's account deletes the workspace; ownership does not pass to another member automatically, so arrange continuity first. Anyone holding a valid preview link can open it until it expires.

5. Acceptable use

Use Polarpass lawfully. Do not try to gain unauthorised access, get around visibility or billing limits, upload malicious files, disrupt the service, use identifiers you are not entitled to, infringe intellectual property or privacy rights, or publish false or misleading product, safety or compliance claims. Do not create extra workspaces to avoid paying for passports.

Do not put unnecessary personal data or any sensitive personal data (such as health data or identity documents) in passports. Check every public field and file before you publish.

6. Your content and rights

You keep all rights in your product data, photos, documents and other content. You give us a non-exclusive licence to host, copy (including in backups), resize, format and display your content according to your visibility and publication settings, including after you cancel a plan. The licence covers only rights you hold or may grant, and ends when the content is deleted, except for backup copies until they expire. We will not use your content in our own marketing without your separate permission.

We keep content you have not published confidential. We use it only to provide the service and disclose it only to the providers listed in the DPA, to people you give access, or when the law requires it.

Only upload content you own, have permission to use, or may otherwise lawfully use, and make sure the permission covers commercial use and public display. A photo found online is not free to reuse just because you credit the creator. You must confirm your rights when you upload a file, and before publishing a file for which no confirmation is recorded. We record that confirmation and may ask for evidence. It does not prove that a rights holder actually gave permission. For each image you also record where it comes from (your own photograph, the manufacturer, a supplier or a licensed photographer) and a credit, which is shown with the image on the public passport; an image of unknown origin cannot be uploaded.

We and our licensors own the software, design and branding. You may use them only to use the service while you have access. Open-source components remain under their own licences.

If a third party brings a substantiated claim against us because of your unlawful content, your instructions or your breach of these Terms (for example about file rights, product, safety or compliance claims, identifiers such as GTINs, or personal data you publish), you reimburse the reasonable, documented costs and compensation we must pay, in proportion to the extent they were caused by your content, instructions or breach. We will tell you promptly, let you provide evidence and contribute to the defence, and not agree a settlement at your expense without your consent, which you will not unreasonably withhold. This does not apply to the extent the claim results from our own breach, negligence or misconduct, and an allegation alone does not create a debt. Each party bears its own fines and penalties imposed by authorities; this section does not make you pay ours.

7. Reporting illegal content and how we moderate

Anyone can report content they consider illegal, including copyright infringement, through the Report content link on a public passport, the report form at https://polarpass.eu/contact?report= or support@techbybuild.com. Include the exact passport or file address, why the content is illegal, your name and email, and a statement that you believe the report is accurate and complete. For copyright, identify the protected work and, if you act for the rights holder, your authority. The report form confirms receipt with a case reference, and we confirm receipt of reports sent by email.

A person reviews each report diligently and objectively; we do not use automated moderation. If we find content illegal or in breach of these Terms, we act quickly. We may restrict the affected file, its earlier published versions and identical copies in the same workspace, or the whole passport where necessary, and we may suspend accounts that repeatedly publish illegal content. A support reply target never delays this.

We tell the reporter what we decided. If we remove or restrict a customer's content, or suspend or end its account, we send the customer a statement of reasons with the restriction, the facts and grounds, and how to challenge it, unless the law prevents this. Either party can ask us to review the decision by replying to our message or emailing support@techbybuild.com, and can also go to court. If we learn of information suggesting a criminal offence that threatens someone's life or safety, we inform the authorities.

Under the Digital Services Act, Polarpass is a hosting service and, because customers ask us to make passports available to the public, an online platform for public passports. Our single point of contact for authorities, the European Commission, the European Board for Digital Services and users is support@techbybuild.com, in English or Dutch. Tech by Build is a micro or small enterprise, so the additional obligations for online platforms from which such enterprises are exempt, such as transparency reports and an internal complaint-handling system, do not apply to us. When the Digital Services Coordinator or the European Commission asks, we still give them our number of active users (Article 24(3)).

8. Free passport and drafts

Every workspace can publish its first passport free of charge, with no expiry, no payment details and no automatic subscription. Updates to that passport stay free, including after a paid plan ends. Archiving or unpublishing it does not give you another free passport. Model, batch and item passports each count as one passport.

A free workspace can keep up to five unpublished drafts at a time; drafts do not use the free passport. Publishing or updating further passports requires a paid plan.

9. Plans, prices and VAT

Paid plans are billed monthly. Prices on the website are in euros and exclude VAT. The checkout and order confirmation show the price, allowance, billing period, VAT and any other charges before you pay.

Tech by Build does not use the Dutch small businesses scheme (KOR). Customers in the Netherlands pay Dutch VAT, currently 21%. Customers in another EU country that give a valid VAT number pay no Dutch VAT: the invoice states that reverse charge applies and you account for VAT in your own country. We may check VAT numbers in the EU VIES database and charge the VAT that applies if a number is missing or invalid. Customers outside the EU are generally not charged Dutch VAT and account for any local tax themselves, unless the law requires us to charge it.

For website subscriptions, Tech by Build is the seller and Stripe issues the invoice on our behalf. For App Store and Google Play purchases, Apple or Google is the seller, charges any VAT and provides the receipt, using the price shown in the store.

A plan's allowance counts every passport in the workspace that is not archived, including drafts, in the order the passports were created.

On website subscriptions you can choose to allow passports beyond the allowance. This option is off until you turn it on. Each passport above the allowance then costs EUR 0.50 excl. VAT for each billing period in which it is above the allowance, including a passport created or restored during that period; this charge is not prorated and is added to the invoice at the end of the period. Archiving a passport stops its charge from the next period but does not refund the current one. You can turn the option off once your passports are back within the allowance. App Store and Google Play plans stop at their allowance and never charge for additional passports.

10. Billing, plan changes and price changes

Your subscription renews every month until you cancel. Stripe processes website payments; Apple and Google bill purchases made in their stores. You authorise only the recurring charge and any options you explicitly turn on. Using the free passport never starts a paid subscription.

You can upgrade a website subscription at any time in the billing settings. The upgrade takes effect immediately, and the difference for the rest of the current period is invoiced straight away. A website subscription cannot be moved to a smaller plan during a period: to switch to a smaller plan, cancel and start the smaller plan after the current period ends, or ask support for help. Store plan changes follow Apple's or Google's rules. Promotion codes apply only under the conditions shown with them.

We tell you by email at least 30 days before a price increase applies to your subscription, and you can cancel before then. A longer notice period applies where the law requires one. Price changes never affect a period you have already paid for.

11. Cancellation and refunds

Cancel a website subscription in the billing settings, which open Stripe's customer portal. Cancel iOS subscriptions in your Apple account settings at least 24 hours before the period ends, and Android subscriptions in Google Play. Contact support if you cannot reach the cancellation route.

Cancellation takes effect at the end of the paid month, and you keep access until then. Your workspace and published passports remain. Uninstalling the app, signing out or unpublishing does not cancel billing, and deleting your account does not cancel an Apple subscription, so cancel it first.

Paid months are not refunded when you cancel or stop using the service, unless the order offered a refund or the law requires one. We do refund billing errors, duplicate or unauthorised charges, charges after cancellation took effect, and service that was not provided as agreed, fully or partly as appropriate.

For website payments, email support@techbybuild.com with your account email, the invoice or transaction reference, the payment date and a short explanation. We tell you the outcome and refund through Stripe to the original payment method. When the money arrives depends on your bank. For App Store or Google Play purchases, request a refund from Apple or Google; we can help.

12. How long passports stay online

Published passports, their versions and QR links stay online at no extra charge for as long as we operate Polarpass, including after you archive a product or cancel a plan. Unpublishing removes them. Deleting the workspace removes its passports and its domain and identifier registrations.

Product rules such as the Ecodesign for Sustainable Products Regulation (EU) 2024/1781 can require a passport to stay available for a set period and a backup copy to be kept by a separate passport service provider. Unless we agree otherwise in writing, Tech by Build is not that backup provider, and you remain responsible for the backup copy and any required availability period. Keep your own export.

QR codes and links on our domain stop working if a passport is unpublished or deleted, or the service closes. For products that need long-term access, use your own passport domain or a GS1 Digital Link on a domain you control, so you can redirect it to another provider.

If we decide to stop offering Polarpass, we tell you by email at least 90 days in advance. Published passports stay online during that period and you can export everything, as described in section 13. If Polarpass has to stop because its owner has died or is permanently unable to run it, the notice may be shorter; we, or whoever then handles the business's affairs, will give as much notice as reasonably possible and keep published passports online and your data available for export for as long as reasonably possible.

13. Exporting your data and switching provider

You can export your data at any time: product data as CSV, and your account archive (Settings → Account → Download my data) as a ZIP file with your data in JSON and your uploaded files in their original format.

Under the EU Data Act you can ask us at any time, by writing to support@techbybuild.com, to switch your data to another provider or your own systems, or to delete it; if you are switching, tell us which provider. The notice period is at most two months. A transition period of up to 30 days then follows. If 30 days is technically impossible, we tell you why within 14 working days of your request and propose a longer period of at most seven months. You may extend the transition period once, for as long as you consider appropriate for your purposes.

During the transition period the service and these Terms continue. We help you, and providers you authorise, with the transfer; keep the service running with due care; tell you about any known risks to its continuity; keep your data secure, including while it is transferred and during the retrieval period; and give you the information you need for your exit plan.

Exportable data is everything in the exports listed in the table below: product and passport content, translations, visibility settings, published versions, uploaded images and documents, QR codes, GS1 Digital Link paths, your passport domain, passport view and scan statistics, workspace and team settings, tasks and activity, file-rights records, and your account, contract and billing records, in CSV, JSON and the original file formats. Only the following are not included: our software, design, category templates and guidance; our server, security and rate-limit logs; password, sign-in code and token hashes and similar security credentials, such as domain verification, push and store purchase tokens; individual view and scan entries, which the export contains as daily totals; our internal records of payment-provider notifications; and our case files on reports of illegal content, whose decisions and reasons we send you by email. After the transition period you have at least 30 days to retrieve your data, after which we delete it, subject to legal retention duties, and confirm the deletion.

Switching and exporting are free of charge. Your contract ends when the switch is complete, or at the end of the notice period if you only ask for deletion, and we confirm the end by email.

Where your data is held: the server and its backups are in Hostinger data centres in the EU (the server is in Frankfurt, Germany) and are subject to EU and German law. Traffic passes through Cloudflare's global network. Section 7 of the Privacy Policy lists every provider and its location, and Annex C of the DPA lists those that process customer data on your behalf. To protect non-personal data held in the EU against government access that would conflict with EU or Member State law, we use only providers bound by data processing terms and transfer safeguards, limit access to Tech by Build's owner with two-step login, and encrypt data in transit. If an authority outside the EU asks for your data, we disclose it only where an international agreement or EU law allows it, check that the request is lawful, challenge it where it is not, disclose the minimum necessary and tell you first unless the law forbids it.

The table below is our register of the exportable data structures and formats. We keep it up to date when an export changes. Text is UTF-8; CSV files are comma-separated with every value in double quotes; dates are ISO 8601 in UTC.

14. Availability and changes to the service

We provide the service with reasonable care and skill and apply security updates and other updates needed to keep it working and lawful. Report problems so we can investigate.

We do not promise that the service will be uninterrupted or error-free, and unless we have agreed a separate service level agreement in writing, we do not guarantee any uptime percentage. Scheduled maintenance, emergency maintenance, upgrades and reasonable technical downtime are part of the service and are not a breach of these Terms.

The service depends on infrastructure from other providers, such as Hostinger (hosting), Cloudflare (network and DNS), Stripe, Apple and Google (payments and sign-in) and email and push services. We are not responsible for outages or failures of that infrastructure that are outside our reasonable control. Problems we cause ourselves, for example by misconfiguring a provider, not paying it or ignoring its notices, remain our responsibility under section 16.

We may change the service for valid reasons, such as security, legal requirements or compatibility. If a change significantly reduces a feature you pay for, we tell you at least 30 days in advance, and you can cancel and receive a pro-rata refund for the unused part of your current month.

15. Suspension and termination

You can cancel, stop using the service or delete your account at any time in the app or at https://polarpass.eu/account-deletion. Export first and arrange continuity for passports you are required to keep available.

We may restrict content or access, proportionately, for a security threat, illegal content, unpaid invoices or a serious breach of these Terms. Where possible we explain why and give you a reasonable chance to fix it first; we act immediately when we must protect people or data or comply with the law. You can ask us to review the decision.

Ending the agreement does not cancel amounts already due, refund rights or obligations that by their nature continue. Cancelling does not by itself delete data; the Privacy Policy explains what happens to it.

16. Liability

To the fullest extent the law allows, we are not liable for indirect or consequential loss, including loss of profit, revenue, savings or business opportunities, reputational damage or loss of goodwill, business interruption, loss or corruption of data you could have restored from your own export, and claims by your own customers.

Our total liability in any 12-month period is limited to the higher of (a) the fees paid for the service in the 12 months before the event that caused the damage, including fees paid through Apple or Google, and (b) the price of one month of the Starter plan (EUR 19.00 excl. VAT). If you only use the free passport and have never paid for the service, our total liability is therefore at most that amount.

To the fullest extent permitted by applicable law, the limits in this section apply to all claims against us arising out of or relating to data protection or security, including claims for contribution or recourse under Article 82(5) GDPR. They limit only our liability, not yours.

We are not liable for fines, penalties, product withdrawals or recalls, customs or market-surveillance measures, or claims by your own customers that result from the content, identifiers or compliance decisions you supply or publish, or from not keeping an export or a required backup copy.

These limits do not apply to damage caused by our fraud, intent, deliberate recklessness or gross negligence, or to death or personal injury. Nothing in these Terms limits the rights of individuals under Article 82 GDPR or any liability that cannot lawfully be limited. If mandatory consumer law applies, liability follows that law.

Report a claim to us in writing within 12 months after you became aware, or could reasonably have become aware, of the facts behind it. Later claims lapse, unless the law does not allow this.

17. Force majeure

Neither party is liable for a failure or delay caused by circumstances beyond its reasonable control, such as outages at hosting, network, payment or app-store providers we depend on, power or internet failures, cyberattacks that could not reasonably be prevented, government measures and natural disasters. Payment for service already provided remains due. If the situation lasts more than 60 days, either party may end the affected subscription with immediate effect, and we refund prepaid amounts for the period after it ends.

18. Changes to these Terms

We may change these Terms for a valid reason, such as new features, legal requirements or a change in providers. We announce changes by email and in the service at least 30 days before they take effect, unless the law or a security risk requires a change sooner. The service then asks the workspace owner to accept the new version. If you do not agree, you can cancel before the change takes effect, and we refund any prepaid period after that date. We never treat silence as agreement to a change that materially affects you. If the owner has neither accepted nor cancelled when the change takes effect, published passports stay online and you can still export your data, cancel and delete your account, but the workspace is paused until the new version is accepted.

19. Law and disputes

Dutch law applies; the UN Convention on Contracts for the International Sale of Goods (CISG) does not. Disputes with business customers go exclusively to the District Court of Noord-Nederland (Rechtbank Noord-Nederland), unless mandatory law gives jurisdiction to another court, such as the sub-district court (kantonrechter) for claims of up to EUR 25,000. We may also bring a claim before the courts where the customer is established. If mandatory consumer law applies, you keep the protection of the law of your country of residence and can go to your own courts.

Please contact support first so we can try to resolve your complaint. Tech by Build is not a member of a dispute resolution body (such as a Geschillencommissie) and, as a service for businesses only, does not take part in alternative dispute resolution. A consumer can still use a competent dispute resolution body or their European Consumer Centre. The EU Online Dispute Resolution platform closed on 20 July 2025.

20. General

Notices. We send notices to the email address of the workspace owner or of the account that accepted these Terms, and may also show them in the service. Keep it current. Send notices to us at support@techbybuild.com, or for privacy matters privacy@techbybuild.com.

Your own terms. These Terms apply instead of any general terms, purchase conditions or similar terms of the customer, which we expressly reject.

Transfer. You may transfer the agreement only with our written consent. You agree in advance that we may transfer it to a company that continues Polarpass, such as a private limited company (BV) of the current owner or a buyer of the business. We tell you before the transfer, and you can cancel if you object.

Entire agreement. These Terms, including the DPA and your order details, are the complete agreement about the service and replace earlier proposals. Provisions that by their nature continue after the agreement ends, such as payment, liability, indemnity, governing law and data deletion, continue to apply.

Invalid clauses. If a provision is invalid, the rest remains in force and the parties replace the invalid provision with a valid one that comes as close as possible to its purpose. Not enforcing a right immediately does not waive it.

Versions. The exact text you accept is stored with your acceptance record, and you can download it from your acceptance receipt or account export. Previous versions are available on request.

21. Apps from the Apple App Store and Google Play

These Terms are concluded between you and Menno de Vries, trading as Tech by Build, and not with Apple or Google. Tech by Build, not Apple, is solely responsible for the app and its content. Apple has no obligation to provide maintenance or support for the app. Tech by Build is responsible for any product warranties, whether express or implied by law, to the extent they are not effectively disclaimed. If the app does not conform to an applicable warranty, you may notify Apple, and Apple will refund any purchase price paid for the app; to the maximum extent permitted by law, Apple has no other warranty obligation for the app, and any other claims, losses, liabilities, damages, costs or expenses caused by a failure to conform to a warranty are Tech by Build's responsibility, not Apple's.

Tech by Build, not Apple, is responsible for addressing any claims by you or a third party relating to the app or your possession and use of it, including product liability claims, claims that the app fails to meet an applicable legal or regulatory requirement, and claims under consumer protection, privacy or similar laws. If a third party claims that the app, or your possession and use of it, infringes its intellectual property rights, Tech by Build, not Apple, is solely responsible for investigating, defending, settling and discharging that claim.

The licence to use the iOS app is a non-transferable licence to use it on Apple-branded products that you own or control, as permitted by the Usage Rules in the Apple Media Services Terms and Conditions, except that other accounts associated with the purchaser may also access and use it through Family Sharing or volume purchasing. You confirm that you are not located in a country subject to a United States government embargo or designated by it as supporting terrorism, and that you are not on a United States government list of prohibited or restricted parties. You must also comply with applicable third-party terms when using the app, such as your network provider's terms.

Questions, complaints or claims about the app can be sent to Menno de Vries, trading as Tech by Build, Hallenweg 16, 5683 CT Best, the Netherlands, by phone on +31 6 21195761 or by email to support@techbybuild.com. Apple and its subsidiaries are third-party beneficiaries of these Terms and, once you accept them, may enforce them against you as regards the iOS app. Purchases through Google Play are also subject to Google Play's terms.

Appendix — Data Processing Agreement

This data processing agreement (verwerkersovereenkomst) is part of the Terms and is accepted with them. It applies when Tech by Build processes personal data on the customer's behalf. Product data that does not relate to an identifiable person is not covered, because it is not personal data.

DPA 1. Parties and scope

Customer: the business named as customer when the Terms were accepted. The person accepting confirms that they may bind that business.

Processor: Menno de Vries, trading as Tech by Build, a sole proprietorship (eenmanszaak) established in the Netherlands, KVK 96687762, VAT NL005225215B96, operating Polarpass at https://polarpass.eu. Because a sole proprietorship is not a separate legal entity, the processor is Menno de Vries personally; this agreement calls the processor Tech by Build. Postal address, registered with the KVK as its correspondence address: Hallenweg 16, 5683 CT Best, the Netherlands; its business address is a private home address and is shielded in the Dutch Business Register. Privacy contact: privacy@techbybuild.com or +31 6 21195761.

The customer decides why and how personal data in its workspace is used and is the controller. Tech by Build processes that data only to provide Polarpass and is the processor. Annex A describes the processing.

Tech by Build's own processing for accounts, team invitations and access administration, billing, support, security and passport statistics is not covered; Tech by Build is the controller for it, as its Privacy Policy explains.

If this agreement conflicts with the rest of the Terms, this agreement prevails for the processing of personal data. Mandatory law and any applicable Standard Contractual Clauses prevail over both.

DPA 2. Instructions

The customer's instructions are the Terms, this agreement and the actions authorised users take in the workspace, such as publishing or deleting. The customer can give further written instructions through privacy@techbybuild.com. The customer is responsible for having a lawful basis for the processing, informing the people concerned, the accuracy of the data and what it decides to publish. If the customer is itself a processor, it confirms that its controller has authorised this agreement and our subprocessors.

Tech by Build processes the data only on documented instructions, including for international transfers, unless EU or Dutch law requires otherwise; in that case it tells the customer first, unless that law forbids it. It tells the customer promptly if it believes an instruction breaks data protection law and may suspend that instruction until it is resolved. It never sells customer data or uses it for advertising or any other purpose of its own.

DPA 3. Confidentiality

Only people who need access to provide the service can access customer personal data, and they are bound by confidentiality. Today that is only Tech by Build's owner. Access is removed when it is no longer needed. Public passport content is visible to the public only because the customer chose to publish it.

DPA 4. Security

Tech by Build takes appropriate technical and organisational measures under Article 32 GDPR, taking into account the risks, the nature of the data, the state of the art and the costs. Annex B lists them. Tech by Build reviews them regularly and may update them as long as the overall level of protection does not decrease.

The customer manages its users and their roles, secures its own devices and sign-in accounts, and decides what to make public.

DPA 5. Subprocessors

The customer gives general authorisation for the subprocessors in Annex C. Tech by Build gives at least 30 days' notice by email before adding or replacing a subprocessor, with its function and location. The customer may object on reasonable data protection grounds within that period. If the parties cannot find a solution, the customer may end the affected service before the change takes effect and receive a refund of any prepaid period it has not used.

Tech by Build imposes the same data protection obligations on each subprocessor by written contract and remains responsible to the customer for its subprocessors.

DPA 6. Locations and international transfers

Annex C lists where data is processed. Tech by Build transfers personal data outside the EEA only under Chapter V GDPR: to a country or certified recipient with an adequacy decision, or under the European Commission's Standard Contractual Clauses, with a transfer assessment and supplementary measures where needed. On request it gives the customer information about the safeguards.

DPA 7. Requests from individuals

Tech by Build forwards requests about customer data to the customer without undue delay and does not answer them itself unless the customer asks or the law requires it. It helps the customer respond to requests for access, correction, deletion, restriction, objection and portability, and applies corrections, deletions and restrictions the customer instructs, in time for the customer to meet its legal deadlines.

DPA 8. Personal data breaches

Tech by Build notifies the customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting customer data. The notice describes what is known: the nature of the breach, the categories and approximate number of people and records, the likely consequences, the measures taken or proposed, and a contact person. Further information follows as it becomes available.

Notices go to the email address of the person who accepted the Terms, or to another breach contact the customer gives to privacy@techbybuild.com. The customer decides whether to notify the supervisory authority and the people concerned. Tech by Build contains the breach, preserves evidence and helps the customer meet its own obligations.

DPA 9. Assistance

Taking into account the processing and the information available to it, Tech by Build helps the customer with its obligations under Articles 32 to 36 GDPR: security, breach notifications, data protection impact assessments and prior consultation with a supervisory authority.

DPA 10. Return and deletion

When the service ends, the customer chooses whether to receive its data and then have it deleted, or to have it deleted straight away. Annex B describes the export. Tech by Build deletes the customer data as described in Annex B, unless EU or Dutch law requires it to be kept. Data kept for that reason is used for nothing else. Tech by Build confirms deletion on request.

Cancelling a paid plan does not end the service while the customer still uses free passport hosting. Deletion and correction instructions also apply to earlier published versions where relevant. If a backup is restored, Tech by Build first re-applies earlier deletion and restriction instructions.

DPA 11. Information and audits

Tech by Build gives the customer the information needed to show compliance with Article 28 GDPR and allows and contributes to audits, including inspections, by the customer or an independent auditor it appoints. Audits take place at most once a year, unless a personal data breach or a supervisory authority gives reason for another, and are arranged with reasonable notice, under confidentiality and without access to other customers' data. Existing reports and documentation may be used where they answer the audit's questions. Each party bears its own audit costs. Tech by Build cooperates with supervisory authorities.

DPA 12. Duration, liability and changes

This agreement lasts as long as Tech by Build processes customer personal data, including until backups expire. Dutch law applies. Tech by Build's liability under this agreement is limited as set out in section 16 of the Terms. To the fullest extent permitted by applicable law, that limitation applies to all claims against Tech by Build arising out of or relating to data protection, including claims for contribution or recourse under Article 82(5) GDPR. It does not limit the customer's liability. As a processor, Tech by Build is liable towards individuals only as Article 82(2) GDPR provides: where it has not complied with obligations directed at processors or has acted outside or contrary to the customer's lawful instructions. If Tech by Build pays compensation to an individual, or settles a claim, for damage that is wholly or partly the customer's responsibility, the customer reimburses Tech by Build for the customer's share, also where Tech by Build did not pay full compensation. This applies only if Tech by Build told the customer about the claim promptly, let it provide evidence and contribute to the defence, and did not agree a settlement at the customer's expense without its consent, which the customer will not unreasonably withhold. Nothing in this agreement limits the rights of individuals under Article 82 GDPR or any liability that cannot lawfully be limited. Changes need the customer's agreement as described in section 18 of the Terms. Processing under this agreement starts only after the customer has accepted it.

The acceptance record contains the customer's name, the accepting account and contact, the version, the exact text of the Terms and this agreement, its hash, the acceptance statement, the channel and the server time. The customer can download it at any time from its acceptance receipt or account export, and earlier records are kept when the Terms change.

DPA Annex A — Details of processing

DPA Annex B — Security measures and export

Application measures: session tokens are random and stored only as hashes, with expiry and revocation; workspace roles and access checks on every request; internal and hidden content removed from public responses on the server; rate limits; previews that expire after ten minutes; upload type, size and file-signature checks; secure token storage in the mobile app; web security headers; HTTPS on all public addresses.

Organisational measures: only Tech by Build's owner has access to customer data and to the hosting and administration accounts; there is no staff or contractor access. Administrative accounts use two-step login.

Operations: data is encrypted in transit with HTTPS; stored data is protected by access controls and Hostinger's data centre security, without separate encryption at rest. Server and dependency security updates are applied at least monthly, and urgent fixes sooner. The application has health checks that show whether it is running. Incidents are handled as described in DPA 8.

Backups: the database and uploaded files are copied daily and each copy is kept on the server for 7 days. Hostinger also makes a weekly backup of the whole server, stored separately from it in the same or a nearby Hostinger data centre region, and keeps the two most recent. Backups are restored with PostgreSQL's restore tools or Hostinger's restore function.

Export: product data as CSV at any time, and the account archive as a ZIP file containing the data in JSON and the uploaded files in their original format. On request, Tech by Build provides the data listed in section 13 of the Terms within 14 days.

Deletion: when the customer deletes its workspace, or the retrieval period after switching ends, active copies are deleted at once and remaining copies disappear when backups expire, within 30 days.

DPA Annex C — Subprocessors

Stripe, Apple and Google handle payments and sign-in as independent controllers and are not subprocessors for passport content.

Resend sends sign-in, invitation and account emails and delivers contact-form messages. That is Tech by Build's own processing as controller (DPA 1), so Resend is listed in the Privacy Policy rather than here.