Terms of service

Parties and scope

These terms govern the provision of the Trama platform by Edoardo Rinaldi (the "provider") to the company that subscribes to it (the "customer"). Trama is not yet incorporated; until the company is registered, contracts are with the founder in a personal capacity, and the registered entity will succeed to them on incorporation.

They apply from the moment an account is created or the service is used, whichever is earlier. Where an order form, a data processing agreement or a signed contract addresses the same subject, that document prevails over these terms.

The service

Trama collects documents from the customer’s suppliers, extracts data from them, and assembles that data into a Digital Product Passport that the customer publishes. The published passport is an immutable file, served at a stable web address reachable from a data carrier on the product.

The service is provided as it stands at any given time. Features are added and changed; nothing in these terms is a commitment to a feature that does not exist on the day they are read.

Accounts and administration

A workspace belongs to the customer. The first account created for it is an administrator, and administrators decide who else may join and with what permissions. The customer is responsible for the actions taken under its accounts and for removing access when a person leaves.

Accounts are personal. Credentials are not to be shared, and an account is not to be used by more than one person.

The customer’s data and content

Documents, product records and supply-chain data uploaded or generated in the workspace remain the customer’s. The provider processes them to operate the service, to produce the passports the customer publishes, and to keep the records the law requires.

The provider does not sell customer data, does not use it to train models for third parties, and does not disclose it to other customers.

Personal data

The customer is the controller of the personal data it puts into the platform — its staff, its suppliers’ contacts — and the provider is the processor. A separate data processing agreement governs that processing and forms part of this agreement; it is entered into before personal data is processed on the customer’s behalf.

Data is stored and processed in the European Union. Published passports contain no personal data by design.

Published passports and their permanence

Publication is an act with consequences that outlast this agreement. Regulation (EU) 2024/1781 requires a passport to remain available for at least the expected lifetime of the product, including after the operator responsible for it ceases activity.

The provider therefore continues to serve every passport the customer published, at the address it was published on, after this agreement ends and whatever the reason it ended. That commitment is included in the price paid at publication and is not charged again.

The obligation under the Regulation remains the customer’s. The provider operates the service that keeps the passport available; it does not assume the customer’s duties towards the European Union or towards any authority.

Removal of a published passport

A published passport is removed only where the publication was erroneous — what was published was never a valid passport — or where a competent authority or a court orders it. There is no other ground, and a request from the customer is not one: a product that is no longer sold is marked as withdrawn, and its passport stays reachable.

Where a passport is removed, its files are moved to a private archive and deleted 365 days later. They are kept for that period because they are not reproducible and because the likeliest reason for a removal is an erroneous publication, where answering "what exactly was served, and for how long" is the only way to establish what happened.

Resolver domains

Passports resolve on an address operated by the provider, or on a subdomain the customer owns. A customer that chooses its own address is responsible for keeping that domain registered and delegated to the service.

If that domain stops resolving, every code already printed on a product stops working, and neither party can restore it: the address is inside the printed symbol and cannot be changed, and a scan that fails at the domain never reaches the provider. Passports remain reachable at the provider’s own address; the printed codes do not.

Accuracy and verification

The provider is not a certification body and does not verify the truth of what a supplier states in a document. The platform extracts data and shows the evidence behind it; a person at the customer confirms every datum before it can enter a passport.

The customer is responsible for the content of the passports it publishes and for their compliance with the requirements applicable to its products.

Fees

Fees, included volumes and the price of publications beyond them are set out in the customer’s order form. Invoices are payable within 30 days.

A change to the price list applies to the customer from the following subscription period, and is notified at least 30 days before it takes effect.

Term, suspension and termination

The subscription runs for the period stated in the order form and renews for equal periods unless either party gives notice at least 30 days before the end of the current one.

The provider may suspend access where an invoice is more than 30 days overdue, or where use of the service threatens its security or its availability to others. Suspension is notified and is lifted as soon as the cause is resolved.

On termination the customer loses access to the platform: to the workspace, to its documents and to the ability to publish. It does not lose the passports it has already published, which continue to be served as described above. The customer may export its data at any time before access ends.

Availability and support

The provider operates the service with the care of a professional and works to keep it available, and does not currently offer a contractual availability level. Where one is agreed it is stated in the order form.

Support is provided by email at the address below during Italian business hours.

Liability

Neither party excludes liability for death or personal injury caused by its negligence, for fraud, or for anything else that cannot be excluded under the applicable law.

Subject to that, the provider’s total liability under this agreement is limited to the fees paid by the customer in the twelve months preceding the event giving rise to the claim. Neither party is liable for loss of profit, loss of business or indirect loss.

Confidentiality

Each party keeps confidential the information it receives from the other that is marked as confidential or that a reasonable person would understand to be confidential, and uses it only to perform this agreement. Supply-chain relationships are confidential by their nature.

The obligation survives the agreement by five years, and does not apply to information that is public through no breach of it, or that a law or an authority requires to be disclosed.

Changes to these terms

These terms may be updated. A change that materially affects the customer is notified by email at least 30 days before it takes effect, and the customer may terminate before that date if it does not accept it.

The date of the last change is shown at the top of this page.

Governing law

Italian law governs this agreement, and the Italian courts have jurisdiction over disputes arising from it.