Terms of service

1. Parties and definitions

The contract is between:

• the Provider: Blockchain Italia S.r.l., with registered office in Via Brembo 27, 20139 Milano (MI), Italia, VAT number 10441490967, Registro delle imprese di Milano Monza Brianza Lodi n. 10441490967, REA MI-2532140, share capital €10,000, fully paid up, sole shareholder (“we”);
• the Customer: the business or professional that the Provider invites to use the Service (“organization”).

In these Terms:

• Service: the Proofora platform, that is the web application, the public passport pages, the QR codes and the registration on the blockchain;
• User: the natural person who uses the Service on behalf of the Customer, with a personal account. The Owner User is the User with the owner role of the organization;
• Passport: the digital passport of a product created by the Customer. An issued version is a published version, which no longer changes;
• Customer Content: data, texts, documents and photos that the Customer and its Users enter in the Service;
• Sector model: the configuration that defines the fields of a passport for a sector and which of them are public (public fields);
• Public page: the web page of a passport, opened by the QR code and visible to anyone;
• Registration on the blockchain: writing the cryptographic fingerprints (hashes) and the technical data of an issued version on a public blockchain.

The contract is concluded when the Owner User accepts these Terms at the first access, from the invitation link. Whoever accepts them declares that they have the power to do so for the Customer and that the Customer acts for its business or profession. The other Users accept them at their first access and comply with them as conditions of use.

The contract consists of these Terms and of any special conditions agreed in writing, which prevail. The privacy notice explains how we process personal data.

Before accepting, the Owner User can read, save and print these Terms from this page and correct the data of the sign-up form. The contract is concluded in Italian or in English. We record the accepted version and the date: the version in force stays on this page, and we send previous versions on request. The parties, neither of which is a consumer, exclude the order acknowledgment of Article 13 of Italian Legislative Decree 70/2003 and, beyond what this clause says, the information of Article 12.

2. The Service

The Service lets the Customer:

• create the digital passports of its products, guided by the sector models;
• issue versions digitally signed by the platform;
• publish a public page for each passport, reached through a QR code to print on the product;
• register the cryptographic fingerprints of each version on a public blockchain, so that anyone can check that the published data has not been altered.

During the pilot, registration takes place on a public test network, currently Ethereum Sepolia. A test network has no economic value and its operators can reset or shut it down: in that case the blockchain verification of the registered versions may no longer be available. We may register the versions again on a production network, letting the Customer know.

The Service provides tools. It does not certify the compliance of products or the accuracy of data, and it does not replace technical or legal advice.

3. Pilot, availability and costs

• The Service is in a pilot phase (early access). Features, sector models and interfaces may change, even without notice, and some features may be incomplete or contain errors.
• We do not guarantee a service level (SLA). We make diligent efforts to keep the Service available, but there may be interruptions, including for maintenance. When possible we give notice.
• During the pilot the Service is free of charge, unless otherwise agreed in writing.
• We announce the end of the pilot and the following economic conditions at least 30 days in advance, by email to the Owner User. After the pilot: the Service continues only at the economic conditions agreed in writing with the Customer. No cost is due without an express acceptance of the new conditions. If the Customer does not accept them, the contract ends at the end of the pilot and the Customer can export its data (clause 10).

4. Access by invitation, accounts and roles

• Access is by invitation only. Our team invites the Owner User; the Owner User and the administrators of the Customer can invite other Users. The invitation link is personal and expires after 7 days.
• Each User has a personal account and does not share the credentials. The password must have at least 10 characters. Users keep their credentials safe and tell us immediately about any unauthorized access, writing to info@proofora.it.
• The Customer assigns the roles: owner, administrator, editor, read-only. Editors create and issue passports; administrators also manage Users and settings; the owner can do everything.
• The Customer is responsible for the actions of its Users as if they were its own. It removes immediately the Users who must no longer have access, for example people who leave the company.

5. Customer Content and responsibilities

• The Customer is solely responsible for the Customer Content: for its accuracy, completeness, updating and lawfulness. It makes sure it holds the necessary rights, for example on photos, trademarks and third-party documents.
• Before issuing a version the Customer checks the data: an issued version does not change, it is corrected by issuing a new one (clause 6).
• The Customer does not enter personal data in public fields, except the data that product legislation requires to be published, such as the details of the manufacturer. It does not upload photos in which people can be recognized without a legal basis. For the personal data it enters in the other fields it has a legal basis and informs the people concerned.
• The obligations under Regulation (EU) 2024/1781 (ESPR), its delegated acts and other product and sector legislation remain with the Customer: for example the Batteries Regulation (EU) 2023/1542 or the Deforestation Regulation (EU) 2023/1115. The sector models reflect our reading of the legislation and standards at the date of their version and may not cover all the obligations of the Customer: the Customer checks them.
• We treat non-public Content as confidential: we use it only to provide the Service and look at it only when needed for support, security or legal obligations.
• The Customer holds the Provider harmless from third-party claims arising from unlawful or inaccurate Customer Content, or from a breach of these Terms by its Users.

6. Public pages and registration on the blockchain

• By issuing a version the Customer asks us to publish it. The public fields, the product name, the photo and the technical data of the version become visible to anyone: on the public page, in the downloadable technical document and in the token metadata.
• Anyone can read, copy and keep the published data, for example search engines, blockchain explorers and marketplaces. We cannot control or delete these copies.
• For each issued version we register cryptographic fingerprints and technical data on the public blockchain. The registration is permanent: it cannot be changed or deleted, by us or by anyone else.
• An issued version stays in our systems as it is, in the verification archive, so that it can be verified. The archive and the public pages remain after the end of the contract too, for the period and on the conditions of clause 10. To correct data the Customer issues a new version; previous versions remain verifiable.
• Non-public fields enter the version document only as salted cryptographic commitments, which do not reveal the value.

7. Acceptable use

The Customer and its Users use the Service only for the passports of the Customer’s products, in compliance with the law and with these Terms. In particular they must not:

• publish false or misleading data, including environmental claims that cannot be proven;
• enter unlawful or offensive content, or content that infringes the rights of others;
• upload malicious software or try to access the data of other organizations;
• bypass security measures or usage limits, or overload the Service;
• reverse engineer the software, except where the law allows it;
• use invitations to send unsolicited communications;
• resell the Service or make it available to third parties without a written agreement.

8. Intellectual property

• The Service, the software, the sector models, the trademarks and our content remain ours or our licensors’. For the duration of the contract the Customer has a non-exclusive and non-transferable right to use them for its business.
• The Customer Content remains the Customer’s. The Customer grants us a free and non-exclusive licence to store, process, reproduce and publish it for the sole purpose of providing the Service. The licence ends with the contract, except for what remains registered on the blockchain, for the public pages as long as they stay online and, for verification and proof only, for the verification archive of the issued versions and what we keep by law (clause 10).
• We may freely use suggestions and feedback on the Service, with no obligation towards whoever sends them.
• Some components of the Service are open source software, under their own licences.

9. Personal data protection

• For the data of Users and of access requests we are the controller: we process it as described in the privacy notice.
• For the personal data the Customer enters in passports, the Customer is the controller and we are the processor (GDPR art. 28). The parties govern it with the data processing agreement: a separate contract, concluded with each customer organization before it enters personal data in passports. For this data the agreement prevails over the Terms.
• The providers listed in the privacy notice are our sub-processors. We tell the Customer before adding or replacing one, so that it can object. If the Customer objects and we find no solution, it can withdraw at no cost.

10. Term, suspension, withdrawal and termination

• The contract is for an indefinite term.
• The Customer can withdraw at any time, writing to info@proofora.it.
• We can withdraw with 30 days’ notice, by email to the Owner User, for example at the end of the pilot.
• We can suspend the access of a User or of the Customer, even without notice, in case of a serious breach of these Terms, a security risk, unlawful use or an order of an authority. We restore access when the cause is resolved.
• We can terminate the contract by written notice (art. 1456 of the Italian Civil Code) if the Customer or one of its Users breaches one of these obligations: not to publish false data or unlawful content (clause 7); not to try to access the data of other organizations and not to bypass security measures (clause 7); not to resell the Service or make it available to third parties (clause 7); to use the Service and the software only within the licence (clause 8).
• Until the end of the contract and for 30 days afterwards, the Customer can ask us to export its data in a structured format (JSON), together with the photos.
• After that period we delete the Customer Content and the User accounts within 90 days of the end of the contract, and from backups within the following 30 days. Only this remains:
  • the fingerprints registered on the blockchain, which cannot be deleted;
  • the verification archive of the issued versions (clause 6): public fields, photo, cryptographic commitments of the non-public fields, signature, fingerprints and a technical identifier of the author, without name or email. We keep it for 10 years, so that issued passports can be verified and we can prove what was published and when. We delete the values of the non-public fields with the rest of the Content;
  • the public pages of the issued versions (clause 6), with their photos, the downloadable technical documents and the token metadata. They stay online, read-only, for 10 years from the end of the contract, so that the QR codes already printed on the products keep working. From the end of the contract no passports can be created and no versions issued;
  • the data we must keep by law or to defend ourselves in court, including the audit log, for 10 years from each event, and the proof of acceptance of the Terms, for 10 years from the end of the contract.
• The Customer can ask us in writing to take the public pages, with their photos and the token metadata, offline earlier: we do so within 90 days of the request or, if later, of the end of the contract. Once 10 years have passed since the end of the contract, we delete the public pages, their photos, the token metadata, the version documents and the verification archive.
• The Customer remains in any case responsible for keeping its passports available for the period required by product legislation.

11. Limitation of liability

• During the pilot the Service is provided as is and as available. Except for mandatory rules, we do not guarantee that it is fit for a particular purpose or free of errors or interruptions.
• We are only liable for direct damage that was foreseeable when the contract was concluded (art. 1225 of the Italian Civil Code), up to a maximum of the amount the Customer paid for the Service in the 12 months before the event that caused the damage.
• In particular we are not liable for: the Customer Content and its compliance with the law; the consequences of the publication and of the registration on the blockchain requested by the Customer; resets, delays or outages of the test network and of third-party services we do not control, such as blockchain networks and explorers; loss of profit and indirect damage.
• These limitations do not apply in case of wilful misconduct or gross negligence, nor to the breach of obligations arising from rules of public policy (art. 1229 of the Italian Civil Code), nor in the other cases where the law does not allow them.

12. Changes to the Terms and versions

• Each version of the Terms has a code (year, month and day) and an effective date, shown at the top. This is version 2026-10-28. For each User we record the accepted version and the date.
• We may change the Terms, for example for new features, for the end of the pilot or for changes in the law. We announce significant changes to Owner Users and administrators at least 30 days in advance, by email or in the application.
• If the Customer does not accept the changes, it can withdraw at no cost before they take effect. Changes required by law or by security reasons can apply immediately.
• A new version may ask for a new acceptance at the first access.

13. Governing law and jurisdiction

The contract is governed by Italian law. The Court of Milan has exclusive jurisdiction over any dispute about the contract.

14. Final provisions

• If a clause is invalid, the others remain valid.
• If we do not enforce a right, we do not waive it.
• Communications take place by email, to the addresses of the accounts, and by certified email (PEC) when a formal notice is needed.
• The Terms are published in Italian and in English. In case of differences the Italian text prevails.

15. Contacts

Provider

Blockchain Italia S.r.l.

Registered office

Via Brembo 27, 20139 Milano (MI), Italia

VAT number

10441490967

Registration

Registro delle imprese di Milano Monza Brianza Lodi n. 10441490967, REA MI-2532140

Share capital

€10,000, fully paid up, sole shareholder

Email

info@proofora.it

Certified email (PEC)

blockchainitaliasrl@legalmail.it

Privacy

segreteria@blockchainitalia.io

16. Specific approval of clauses

Under Articles 1341 and 1342 of the Italian Civil Code, the Customer specifically approves these clauses:

• clause 3: changes to the Service without notice and no availability guarantee;
• clause 5: responsibility of the Customer for its Content and indemnity;
• clause 6: publication and permanent registration on the blockchain;
• clause 10: suspension, withdrawal by the Provider, termination and the 30-day period to request the export of data;
• clause 11: limitation of liability;
• clause 12: changes to the Terms;
• clause 13: exclusive jurisdiction.