These Terms of Service replace all previous terms governing yellow3.io and the services described below.
This summary is provided for convenience only. If it conflicts with the operative provisions below, the operative provisions apply.
yellow3 ApS publishes independent research, operates a free public register of Digital Product Passport providers and supplies a paid buyer platform that supports organisations planning, procuring, implementing and evidencing Digital Product Passport programmes.
Providers do not pay yellow3 to appear in the register and cannot pay to change, suppress or improve an independent finding.
yellow3 does not operate Digital Product Passports, certify providers or guarantee legal or regulatory compliance.
A finding that public evidence was not established is a dated statement about the available evidence. It is not a statement that the provider lacks the relevant capability.
These Terms of Service are entered into between:
yellow3 ApS
CVR no. 44954087
Hovedgaden 43
2970 Hørsholm
Denmark
Email: hello@yellow3.io
referred to as “yellow3”, “we”, “us” or “our”,
and each person or organisation that accesses the Website, submits information to the Register, purchases a Service or uses the Platform, referred to as “you” or “Customer”, as applicable.
These Terms govern:
By accessing the Website, creating an account, submitting information, accepting an Order or using a Service, you agree to the provisions that apply to that activity.
Part C, together with sections 1 to 8, Part E and Schedule 1, constitutes the Buyer Platform Terms. A reference in an Order, invoice or other agreement to the “Buyer Platform Terms” incorporates those provisions.
In these Terms:
“Applicable Data Protection Law” means the General Data Protection Regulation, the Danish Data Protection Act and any other data-protection law applicable to the relevant processing.
“Board Decision Snapshot” or “Snapshot” means a locked, point-in-time record generated by the Platform showing the requirements, evidence, findings, assumptions and decision state recorded at the time of generation.
“Customer Data” means information, documents, instructions, requirements, correspondence and other material submitted to the Platform by or on behalf of a Customer. It does not include Independent Research or aggregated information that no longer identifies the Customer or any individual.
“Customer Personal Data” means personal data contained in Customer Data that yellow3 processes on behalf of a Customer.
“DPP” means Digital Product Passport.
“Independent Research” means research, findings, source records, methods and datasets developed or maintained independently by yellow3, including public facts researched following a Customer request, provided that the Customer’s identity, requirements, private context and confidential communications are not disclosed.
“Order” means an accepted order form, invoice, online checkout, proposal, statement of work or other document identifying a paid Service.
“Output” means a report, comparison, shortlist, questionnaire, procurement package, implementation plan, Snapshot or other deliverable generated for a Customer through a paid Service.
“Platform” means the DPP Buyer Platform.
“Provider” means an organisation that supplies or claims to supply DPP-related products, technology or services.
“Register” means the public DPP Supplier Register operated by yellow3.
“Service” means any free or paid service provided by yellow3 under these Terms.
“User” means a natural person authorised to use a Customer’s Platform account.
Paid Services are offered exclusively to businesses, public authorities, institutions and persons acting for purposes connected with their trade, business or profession.
By purchasing a paid Service, you represent that:
yellow3 may provide:
Features, availability and descriptions may evolve over time. Paid Services remain subject to the applicable Order and section 45.
If documents conflict, the following order applies:
An Order changes these Terms only where it expressly identifies the provision being changed.
Inclusion in the Register is free.
Providers do not pay yellow3:
yellow3 does not accept advertising, sponsorship, referral fees, commissions or placement fees from Providers in exchange for any treatment in the Register.
A finding changes when the relevant evidence changes, an error is identified or the research methodology requires correction.
yellow3 has a commercial interest in the DPP market because it sells services to buyers selecting and implementing DPP solutions. That interest does not permit Providers to influence the Register or yellow3’s independent findings.
Unless expressly agreed in a separate written agreement, yellow3 does not:
yellow3 may structure requirements, support procurement, produce implementation plans, review evidence and help a Customer maintain an auditable decision record.
The Customer and its selected Provider remain responsible for operating the relevant passport system and fulfilling their respective contractual and regulatory obligations.
Nothing published or provided by yellow3 constitutes:
The Platform may help a Customer identify, structure and evidence requirements. It cannot determine future requirements that have not yet been legally defined.
Each Customer remains responsible for obtaining legal, technical, cybersecurity, regulatory, accounting and other specialist advice appropriate to its programme.
Register findings are developed through review of publicly available material, which may include:
yellow3 records, as applicable:
Findings are point-in-time research records. They are not permanent statements about a Provider.
The public Register may use the following finding states.
Demonstrated means yellow3 opened a public artifact that showed the relevant capability or fact and recorded the material supporting the finding.
Demonstrated does not mean that yellow3 has audited the Provider’s internal systems, tested the capability in production or certified the Provider.
Provider states means the Provider publicly asserts the relevant capability or fact, but yellow3 has not independently established it through a qualifying public artifact.
Not established means that, on the stated date, yellow3 searched for qualifying public evidence and did not establish it.
Not established:
Not applicable means the relevant check does not apply to the Provider or product, with the reason recorded.
Not assessed means yellow3 has not completed the relevant assessment or did not have sufficient information to apply the check.
A conclusion that a Provider does not meet a requirement may be recorded only within a specific buyer engagement where the Provider has confirmed in writing that it cannot satisfy that buyer’s identified requirement.
Such a conclusion:
The public Register does not produce:
The Platform may produce Customer-specific comparisons or recommendations based on that Customer’s recorded requirements. Such an Output is not a general public ranking or endorsement.
A Provider may request review of information concerning it.
Where qualifying evidence establishes that a finding is inaccurate or outdated, yellow3 may:
Corrections are free and do not require a commercial relationship.
A Provider does not have a right to remove an accurate finding solely because it is unfavourable or because the Provider would prefer the information not to be published.
Where yellow3 and a Provider disagree, yellow3 may publish a concise Provider response alongside the finding, provided that the response:
yellow3 may decline repetitive, abusive, misleading or unsupported correction requests.
A Provider may be permitted to claim its profile after yellow3 verifies control of an appropriate organisational domain or completes another verification process.
Profile verification confirms control of the verified account or domain. It does not certify the Provider, its capability or its legal status.
A person submitting information represents and warrants that:
The submitting organisation grants yellow3 a worldwide, non-exclusive, royalty-free licence to host, reproduce, format, display and publish the submitted material for the operation, promotion and historical documentation of the Register.
Company-supplied material is identified as such and remains visually and structurally separate from Independent Research.
yellow3 may edit formatting, reject a submission, request evidence, remove unlawful material or retain a historical record of corrections and previous statements.
Do not submit trade secrets, confidential information, special-category personal data or information concerning criminal offences through a public profile.
yellow3 takes reasonable care to apply its stated research method accurately.
yellow3 does not warrant that:
Absence of an organisation from the Register carries no meaning.
Users should review the source record and checked date before relying on a finding.
Subject to section 16, individual findings may be quoted or reproduced for:
Any quotation must:
Nothing in these Terms restricts rights that cannot lawfully be restricted, including lawful quotation, reporting, whistleblowing, regulatory disclosure and use in legal proceedings.
The Register and yellow3 research datasets may be protected by copyright and by the database rights available under applicable Danish and European law.
yellow3 has made substantial investment in obtaining, verifying, organising, maintaining and presenting the contents of the Register and its research datasets.
Except where permitted by law or expressly authorised in writing, you may not:
To the extent permitted by law, yellow3 expressly reserves its rights in relation to text and data mining, including extraction, reproduction and analysis for:
This reservation is made for the purposes of section 11 b of the Danish Copyright Act and Article 4(3) of Directive (EU) 2019/790.
yellow3 may also express this reservation through machine-readable means, including metadata, HTTP headers, robots instructions or other appropriate technical measures. The contractual reservation in these Terms supplements such machine-readable reservation.
Nothing in this section restricts text and data mining that yellow3 cannot lawfully reserve, including qualifying scientific-research uses under mandatory law.
Automated access to the Website or Register is prohibited unless:
Prohibited activity includes scraping, crawling, bulk downloading, automated account creation and attempts to bypass rate limits or technical restrictions.
yellow3 may block automated access and suspend accounts used for prohibited extraction.
The Platform is a business subscription service supporting the planning, procurement, implementation and evidencing of DPP programmes.
Its product principle is:
Plan it. Buy it. Implement it. Prove it.
The Platform may help a Customer:
Sections 7 and 8 apply fully. The Platform does not operate product passports and does not certify compliance.
Access is granted only to named Users authorised by the Customer.
The Customer must appoint at least one account administrator responsible for:
Credentials are personal and must not be shared.
The Customer is responsible for activity conducted through its accounts, except to the extent the activity results from yellow3’s breach of its security obligations.
The Customer must notify yellow3 promptly if it suspects unauthorised access or compromise.
yellow3 may require password resets, multi-factor authentication or other reasonable security measures.
The applicable fees, currency, payment schedule, subscription period and included usage are stated in the Order.
Unless the Order states otherwise:
Overdue amounts may accrue interest and recovery costs in accordance with the Danish Interest Act.
yellow3 may suspend a paid Service for undisputed overdue amounts after giving reasonable written notice and an opportunity to cure.
Payment card services may be provided by an independent payment processor. yellow3 does not receive or store complete card details where they are processed directly by that provider.
The initial subscription term is stated in the Order.
A subscription renews only where the Order expressly states that automatic renewal applies.
Where automatic renewal applies:
Where the Order does not address renewal, the subscription ends at the conclusion of the stated term.
Customer Data is buyer-private.
Subject to these Terms and the Customer’s instructions, yellow3 will not disclose Customer Data to:
Customer Data is logically isolated by organisation within the Platform.
yellow3 does not sell Customer Data.
yellow3 does not disclose which buyers are evaluating a Provider, or that a Provider is being evaluated, unless:
The Customer retains ownership of Customer Data.
The Customer grants yellow3 a limited, non-exclusive licence to host, copy, transmit, format and otherwise process Customer Data solely as necessary to:
The Customer is responsible for:
The Platform is not intended for special-category personal data, criminal-offence data, medical records, employee disciplinary records or other highly sensitive personal data.
The Customer must not submit such data unless yellow3 has expressly agreed in writing and appropriate safeguards have been established.
The Platform may allow a Customer to send evidence requests or questionnaires to Providers.
The Customer controls whether an evidence request is sent and is responsible for:
A Provider response is recorded as the Provider’s statement for the relevant Customer engagement.
A Provider response:
A commitment made during a specific negotiation does not establish a general public capability.
yellow3 does not become party to an agreement or non-disclosure agreement between a Customer and Provider unless yellow3 expressly accepts that agreement in writing.
Public facts established through independent research may be used to maintain the Register or support other Customers.
yellow3 will not reuse as Independent Research:
Where a Customer request leads yellow3 to research a public fact, yellow3 may retain and reuse the resulting public source and general finding without identifying the Customer.
The Platform may use automated systems and artificial intelligence to assist with:
Automated Outputs may contain errors, omissions or inappropriate inferences.
Where material conclusions are presented, the Platform is designed to associate those conclusions with relevant records, evidence, assumptions or uncertainty states.
The Customer must review Outputs appropriate to the importance and risk of the decision.
yellow3 will not use Customer Data to train or fine-tune a general-purpose, shared or publicly available artificial-intelligence model unless the Customer has expressly agreed in writing.
Where an artificial-intelligence subprocessor handles Customer Data, yellow3 will use available contractual and technical configurations intended to prevent the subprocessor from using that data for its own model training.
A Board Decision Snapshot is locked after generation and cannot be silently overwritten through ordinary Platform use.
Where a correction, deletion or legal requirement affects a Snapshot:
The Customer may export available programme data and Outputs during the subscription in a commonly used format supported by the Platform.
Unless the Order states otherwise:
At termination, the Customer will normally have 30 days to request or complete an export, unless access has been suspended for unlawful conduct or a serious security risk.
yellow3 will implement appropriate technical and organisational measures designed to protect Customer Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access.
The minimum security commitments are described in Schedule 1.
The Customer acknowledges that no online service can guarantee absolute security or uninterrupted operation.
Unless an Order includes a specific service-level commitment:
yellow3 will use commercially reasonable efforts to avoid unnecessary disruption and to restore material functionality following an incident.
For Customer Personal Data:
For personal data yellow3 processes for its own purposes, including account administration, billing, security, Website operation and public research, yellow3 acts as controller.
yellow3’s Privacy Notice explains its controller processing.
If the Customer is a processor acting for another controller, yellow3 acts as the Customer’s subprocessor and the Customer warrants that it is authorised to appoint yellow3.
Subject to payment of all applicable fees, yellow3 grants the Customer a perpetual, non-exclusive, worldwide, royalty-free licence to use, copy and adapt Customer-specific Outputs for:
The Customer may not:
The licence does not transfer ownership of yellow3’s underlying methods, templates, taxonomies, research systems, software, Independent Research or pre-existing intellectual property.
The Customer and Users must not:
yellow3 may suspend all or part of the Platform where reasonably necessary to:
Where practicable, yellow3 will provide prior notice and an opportunity to cure.
Where immediate action is required, yellow3 may suspend first and notify the Customer promptly afterwards.
yellow3 will limit a suspension to the scope and duration reasonably necessary.
Either party may terminate an Order:
yellow3 may terminate immediately for deliberate misuse of the Register, unlawful extraction, serious security abuse, fraud or repeated infringement of third-party rights.
Termination for convenience is available only where stated in the Order.
On termination or expiry:
Advisory sessions, workshops, briefings and masterclasses may be purchased through the Website or an Order.
Prices and included services are stated at the time of purchase.
By completing a purchase, the Customer confirms that:
Additional work, travel, research or deliverables are included only if stated in the Order.
Unless an Order states otherwise:
If yellow3 cancels, the Customer may choose between:
Each party must keep confidential non-public business information disclosed during an advisory engagement, subject to section 39.
Materials supplied by yellow3 may be used internally by the Customer but may not be sold, publicly redistributed or used to create a competing commercial product.
No session may be recorded, transcribed by an external service or broadcast without the prior consent of all participants.
Customer-specific deliverables are subject to the licence in section 30 unless the Order states otherwise.
Except for Customer Data and third-party material, all rights in the Website, Platform, Register, research instruments, datasets, software, methods, templates, taxonomies, designs, graphics, logos and content belong to yellow3 or its licensors.
No right is granted except as expressly stated in these Terms.
The yellow3 name, logo and other brand elements may not be used in a way that suggests sponsorship, certification, endorsement or partnership without prior written permission.
“Confidential Information” means non-public information disclosed by one party to the other that is identified as confidential or that should reasonably be understood to be confidential given its nature and the circumstances of disclosure.
Confidential Information does not include information that the receiving party can demonstrate:
The receiving party must:
A party may disclose Confidential Information where required by law, court or regulator, provided it gives prior notice where legally permitted and reasonably assists efforts to limit the disclosure.
These obligations continue for five years after disclosure. Trade secrets remain protected for as long as they remain trade secrets under applicable law.
Where a User voluntarily provides suggestions or feedback concerning a Service, yellow3 may use that feedback without restriction or payment, provided that yellow3 does not identify the Customer or disclose its Confidential Information.
The Website and Platform may use or link to third-party services.
Third-party services may be governed by separate terms and privacy notices.
yellow3 is not responsible for:
Where a third party processes Customer Personal Data on yellow3’s behalf, Schedule 1 applies.
yellow3 warrants that paid Services will be performed with reasonable skill and care and will materially conform to the applicable Order.
If yellow3 materially breaches this warranty and the Customer notifies yellow3 promptly, yellow3 may, at its option:
This is the Customer’s primary contractual remedy for breach of the service warranty.
Subject to this express warranty and mandatory law:
Nothing in these Terms excludes or limits liability to the extent it cannot lawfully be excluded or limited, including liability for:
Subject to the preceding paragraph, neither party is liable for:
yellow3 is not liable merely because:
For paid Services, yellow3’s aggregate liability arising from or connected with an Order will not exceed the fees paid or payable by the Customer for the affected Service during the 12 months immediately preceding the event giving rise to the claim.
For a Service supplied for less than 12 months, the cap is the total fees paid or payable for that Service.
The liability cap does not apply to:
For free Services, yellow3 has no liability except to the extent required by mandatory law.
The Customer will indemnify yellow3 against third-party claims, damages, liabilities and reasonable external legal costs arising directly from:
The indemnity does not apply to the extent the claim results from yellow3’s breach, negligence or unauthorised modification of Customer Data.
yellow3 must:
yellow3 may change free Services, research methods and public Website features at any time.
For a paid Service during an active term, yellow3 will not materially reduce its core contracted functionality without:
yellow3 may make immediate changes required for:
yellow3 may update these Terms.
Material changes affecting an active paid term will normally take effect:
Where a material change takes effect during an active term and materially disadvantages the Customer, the Customer may terminate the affected Service before the change takes effect and receive a pro-rata refund of prepaid unused fees.
Continued use after the effective date of a validly notified change constitutes acceptance.
Neither party is liable for delay or failure caused by circumstances beyond its reasonable control, including natural disasters, war, terrorism, civil disorder, government action, widespread telecommunications failure, widespread cloud-infrastructure failure, labour dispute or interruption of essential utilities.
The affected party must:
Force majeure does not excuse payment obligations already due or a failure that reasonable security or continuity measures should have prevented.
Operational notices may be provided through:
Notices concerning breach, termination or legal claims must be sent by email and by another method reasonably capable of proving delivery.
A Customer must keep its account and billing contact details current.
The Customer may not assign an Order without yellow3’s prior written consent, which will not be unreasonably withheld.
yellow3 may assign these Terms or an Order:
provided that the assignment does not materially reduce the Customer’s rights.
yellow3 may use subcontractors to provide the Services. yellow3 remains responsible for their performance to the extent required by these Terms and Applicable Data Protection Law.
If a provision is invalid or unenforceable, it will be modified to the minimum extent necessary to make it enforceable. If modification is not possible, it will be removed without affecting the remaining provisions.
A failure or delay in exercising a right is not a waiver of that right.
A waiver is effective only if made in writing and applies only to the specific circumstances identified.
These Terms, the applicable Order and any incorporated schedules constitute the entire agreement concerning the relevant Service and replace prior discussions, representations and agreements concerning that subject.
Nothing creates:
Except as expressly stated, no third party has a right to enforce these Terms.
Electronic acceptance, electronic signatures and electronic records have the same contractual effect as paper acceptance and signatures.
These Terms and any non-contractual obligations connected with them are governed by Danish law, without regard to conflict-of-law principles.
The courts of Denmark have exclusive jurisdiction.
The competent court for the place of yellow3’s registered office will be the agreed court of first instance, unless mandatory law requires another venue.
The governing version of these Terms is the English-language version. A translation is provided for convenience only.
Questions concerning these Terms may be sent to:
yellow3 ApS
Hovedgaden 43
2970 Hørsholm
Denmark
CVR no. 44954087
Email: hello@yellow3.io
Register correction requests should be submitted through the correction route displayed in the Register or by email.
Data-protection requests should be submitted through the contact route stated in the Privacy Notice.
This Schedule forms part of the Buyer Platform Terms and applies where yellow3 processes Customer Personal Data on behalf of the Customer.
The Customer is the controller and yellow3 is the processor.
Where the Customer acts as processor for another controller, yellow3 is a subprocessor.
yellow3 will process Customer Personal Data only:
The Customer instructs yellow3 to process Customer Personal Data for the purposes described in Appendix A.
The Customer may issue additional reasonable written instructions that are consistent with the Service and Applicable Data Protection Law. Additional work or material cost resulting from such instructions may require an agreed fee.
If yellow3 believes an instruction infringes Applicable Data Protection Law, yellow3 will notify the Customer unless legally prohibited and may suspend the affected processing while the parties resolve the issue.
The Customer warrants that:
The Customer is responsible for responding to data subjects and determining whether their requests are valid.
yellow3 will ensure that persons authorised to process Customer Personal Data:
Confidentiality obligations continue after a person’s access ends.
yellow3 will implement and maintain technical and organisational measures appropriate to the risk, including the measures described in Appendix B.
yellow3 may update those measures provided the overall level of protection is not materially reduced.
The Customer is responsible for assessing whether the measures are appropriate for its processing and for configuring Customer-controlled security features appropriately.
yellow3 will notify the Customer without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data.
The notification will provide available information concerning:
Information may be provided in stages as it becomes available.
yellow3’s notification does not constitute an admission of fault or liability.
The Customer is responsible for notifications to data subjects and supervisory authorities unless the parties agree otherwise.
Taking into account the nature of the processing and information available to yellow3, yellow3 will reasonably assist the Customer with:
Where assistance requires substantial work beyond normal Service operation, yellow3 may charge reasonable fees agreed in advance, except where the assistance is required because of yellow3’s breach.
The Customer gives yellow3 general authorisation to appoint subprocessors.
yellow3 will:
The Customer may object to a new subprocessor on reasonable and documented data-protection grounds.
The parties will attempt to resolve the objection in good faith.
If no reasonable solution is available, the Customer may terminate the materially affected part of the Service before the subprocessor begins processing and receive a pro-rata refund of prepaid unused fees for that affected part.
Where an artificial-intelligence service acts as subprocessor, yellow3 will use available enterprise or API terms and settings intended to prevent use of Customer Personal Data for the provider’s own model training, unless the Customer expressly agrees otherwise.
yellow3 will not transfer Customer Personal Data outside the European Economic Area unless:
Appropriate safeguards may include the European Commission’s standard contractual clauses then in force, together with supplementary measures where required.
The Customer authorises yellow3 to enter into applicable standard contractual clauses on the Customer’s behalf where necessary to appoint an authorised subprocessor.
If yellow3 receives a request directly from a data subject concerning Customer Personal Data, yellow3 will:
yellow3 will make available information reasonably necessary to demonstrate compliance with this Schedule.
Where available, yellow3 may first satisfy an audit request through:
If that information is insufficient, the Customer may conduct one audit in any 12-month period, unless a breach, regulator or material risk reasonably requires an additional audit.
An audit must:
No audit may require disclosure of information that would compromise another customer, security controls or yellow3’s legal obligations.
During the Service, the Customer may export Customer Personal Data using available functionality.
Following termination, expiry or a valid deletion instruction, yellow3 will delete or return Customer Personal Data in accordance with section 27, unless:
Data retained in backups will remain protected and will be deleted or overwritten through the normal backup lifecycle.
Where yellow3 retains data because law requires it, yellow3 will process it only for that legal purpose.
If yellow3 is legally required to disclose Customer Personal Data, yellow3 will notify the Customer before disclosure unless prohibited by law.
yellow3 will disclose only the data legally required and will reasonably challenge disproportionate or unlawful demands where appropriate.
yellow3 will maintain records of processing activities required of it as a processor.
yellow3 will cooperate with competent supervisory authorities in accordance with Applicable Data Protection Law.
Liability arising under this Schedule is subject to section 43 of the Terms, except to the extent Applicable Data Protection Law prohibits that limitation.
If this Schedule conflicts with another provision concerning processing of Customer Personal Data, this Schedule prevails.
Operation, hosting, security, support and administration of the DPP Buyer Platform and Customer programmes.
For the subscription term and the applicable export, retention and deletion periods described in the Terms or Order.
Processing may include:
The Service is not intended for special-category personal data, criminal-offence data or similarly sensitive information unless expressly agreed in writing.
Processing locations are determined by yellow3’s authorised infrastructure and subprocessors and are subject to sections 7 and 8 of this Schedule.
yellow3 will maintain measures appropriate to the risk, including:
Where artificial-intelligence services process Customer Personal Data: