Exit and Migration Concept

Biber DPP – software-as-a-service platform for digital product passports

Published by: BCCM Inkubator GmbH (Biberware brand), Bahnhofstraße 32, 09648 Mittweida, Germany
Responsible: Lucas Johns
Contact: info@biberware.com

1 Purpose and scope

This concept describes how customers of Biber DPP can extract their data and their published digital product passports (DPP) from the Platform completely, securely and without depending on Biberware. They can then continue to run the data and passports with another provider or on their own infrastructure.

It applies to all Biber DPP service packages. Services designated as beta, preview or test environment are excluded under Section 4(3) of the Terms.

This concept gives effect to the provisions on data export, provider switching and deletion in Section 10 of the general terms and conditions (the "Terms") and supplements the data processing agreement (the "DPA") for Biber DPP. Where mandatory requirements of Regulation (EU) 2023/2854 (Data Act) provide for more extensive rights, those prevail.

2 Reference framework

3 Guiding principles

• The customer owns the data. All product and passport data belongs to the customer. Biberware acquires no rights in it (Section 11(2) of the Terms).
• Export at any time. Throughout the term of the contract the customer may request a full export at any time and access its data directly via the API at any time.
• Open, documented formats. Exports are provided in structured, commonly used and machine-readable formats with published schemas: JSON, W3C Verifiable Credentials and original files.
• Customer-controlled identifiers. Data carriers on products point to a domain the customer controls. Switching provider therefore requires no change to products already placed on the market.
• Traceability. Every export contains a manifest with checksums. Every deletion is confirmed in text form on request.

4 Exit scenarios

The backup copy with an independent service provider required by law is also covered in chapter 8.

5 Exportable data and formats

5.1 Scope

Further data, such as drafts and user and supplier lists, is provided by Biberware on request in a commonly used format (JSON or CSV).

The export does not include the Platform software and its source code (Section 2(2) of the Terms), internal operational and security logs, authentication data such as passwords, or operational backups. Private signing keys are released only under chapter 6.3.

5.2 Export routes

The export package is available for download no later than seven calendar days after the request. Only administrative users of the customer can download it, and only over authenticated, TLS-encrypted connections.

6 Identifiers, resolvers and credentials

The critical point in any DPP provider switch is the data carrier (QR code, data matrix, RFID) on the product. It is applied once and points to the same address permanently. Biber DPP is therefore designed so that this address is under the customer's control.

6.1 Addressing published passports

In both production variants the redirect is under the customer's control. The customer can switch the target to another provider or to its own infrastructure at any time and without any involvement of Biberware.

6.2 Cutover when switching

• The target provider or the customer serves the transferred passports under the same paths. The manifest contains the mapping of public address to passport and version for that purpose.
• The customer changes the DNS record of its subdomain or the target in the GS1 resolver.
• Biber DPP continues to serve the passports unchanged during the transition period and the retrieval period. The customer decides when to switch the redirect; public retrieval is not interrupted in the process.

6.3 Verifiable Credentials and keys

• Each workspace has its own key pair. The issuer identity is maintained as a DID on the customer domain (did:web). After a switch, the customer or the target provider can therefore serve the DID document.
• Credentials already issued remain verifiable as long as the DID document with the previous verification key can be retrieved. For new credentials, the target provider adds a key of its own. The private key does not have to be transferred for this.
• On express request in text form, Biberware releases the workspace's private key in encrypted form to a body named by the customer. Once the exit is complete, the key is deleted at Biberware.

7 Procedure on termination and provider switching

Every termination follows the same procedure, regardless of whether the customer or Biberware gives notice and whether the customer switches to another provider, takes the data over itself or no longer needs it.

If switching within 30 calendar days is technically not feasible, Biberware notifies the customer within 14 working days of the notice and gives reasons. Biberware states an alternative transition period of no more than seven months. The service continues to run during that time. The contract ends on expiry of the transition period; where there is no transition period it ends on the termination date and the retrieval period begins immediately.

On request, Biberware coordinates the technical procedure directly with the target provider, for example for a transfer via the API.

8 Discontinuation of the service, insolvency and backup copy

Biber DPP addresses the risk of Biberware not continuing operations primarily by technical means. Contractual commitments are only enforceable to a limited extent in an insolvency.

• The redirect stays with the customer. Production passports run via the customer domain or the GS1 resolver (chapter 6.1). The customer can point retrieval at another source without any involvement of Biberware.
• Verifiability stays with the customer. The DID document is part of every export and is hosted on the customer domain. Credentials remain verifiable as soon as the customer serves it itself.
• A full data set can be held by the customer. Via export and API (chapter 5.2) the customer can obtain a complete data set at any time and hold it itself. Another provider, or the customer on its own infrastructure, can continue to operate from that data set.
• Planned discontinuation. Biberware announces a planned discontinuation of Biber DPP in text form with at least three months' notice (Section 9(2) of the Terms). The procedure under chapter 7 applies in that case too, including the transition and retrieval periods.
• Insolvency of the customer. The obligation to keep product passports available for the period laid down by law also continues where the economic operator itself no longer exists. The backup copy with an independent service provider is intended for that purpose.

For the backup copy with an independent service provider required by law, Biberware is preparing a shared solution for all customers so that each customer does not have to commission a service provider of its own. Its design will follow the legal acts still pending and the European standard EN 18221:2026. Independently of that, the customer's own domain, the complete export and the DID document already secure the continuation of the passports today.

9 Costs

Free of charge

• Self-service and API export throughout the term and during the transition and retrieval periods
• Complete export package including documents, credentials and the DID document
• Export documentation and published schemas
• Information about the switching process and coordination with the target provider
• Deletion and confirmation of deletion

Charged on a time and materials basis

• Transformation of the data into a target provider's proprietary formats
• Support with import and mapping in the target system
• Individual interfaces or special exports
• Continued operation of published passports beyond the retrieval period (Section 10(7) of the Terms)

Services charged on a time and materials basis are quoted in advance and billed at the daily rates agreed. Biberware does not charge switching charges for the switching steps required by the Data Act.

10 Deletion on completion

• After the retrieval period expires, Biberware deletes all data of the workspace from the database and object storage, including the private signing key.
• Backup copies are deleted on their regular expiry, and no later than 90 days after the contract ends (clause 10(2) DPA).
• Excluded is data subject to statutory retention obligations or required for the establishment, exercise or defence of legal claims, such as contract and billing records. Processing of such data is restricted.
• Biberware confirms the deletion in text form on request.

Biberware cannot retrieve credentials already published or issued to third parties from those third parties (clause 2(8) DPA).

11 Roles and responsibilities

Contact for all exit enquiries: info@biberware.com

12 Review

The export function is part of the Platform's automated tests. At least annually, a test workspace is used to check whether a full export is complete. This includes importing the data and verifying the credentials outside Biber DPP.

This concept is reviewed at least annually and whenever the Platform or the legal requirements change materially, and is adjusted where necessary.

Annex A: Mapping to ISO/IEC 27001:2022