What documents do I need for the contract with my software supplier?
When you engage a software supplier to compile and host the digital product passport for your tyres, there is more to discuss than just a quotation. In addition to the usual procurement documents, this involves a processor agreement for the data you provide, a service agreement with clear arrangements regarding hosting and availability, a specification of which data fields are processed, and an agreement on what happens when the cooperation ends.
That last point is precisely the detail that features most prominently on this subject: most companies think of "documents for the contract" in terms of the quotation and the processor agreement, and forget the continuity agreement. Since the passport is expected to remain accessible for ten years, the question of what happens if your supplier stops, is taken over or goes bankrupt is at least as important as the question of what the service costs.
The documents you gather for the discussion
Before you bring a supplier to the table, it is helpful if you have already put a few things in order yourself. This starts with the technical documentation of the tyres themselves: type designations, material data and the data that the manufacturer or importer has already provided. You also need an overview of who plays which role in your organisation, so that it is clear who acts as a market participant and who is the day-to-day contact person. What this precisely entails is set out in the knowledge bank with a brief answer per subject.
For the contract itself, there are three types of documents. First, the processor agreement: because personal data may appear in submission files or contact details, it must be established who bears which responsibility. Second, the service agreement or SLA, with arrangements on the availability of the QR data carrier, response times for faults and the duration of the hosting obligation. Third, an exit arrangement: how you get the data back if you switch supplier, and in what format.
Why this detail is often overlooked
The hosting period of ten years sounds like something the supplier will arrange, and that is usually the case. But a contract that only describes the ongoing service delivery says nothing about what happens after a merger, a takeover or the supplier ceasing business. For your company this is relevant because the obligation to keep the passport accessible remains with you as a market participant, even if the party that technically hosts it changes.
The regulation itself does not prescribe how you arrange this contractually; that is up to you and your supplier. It is, however, advisable to include in the contract how data is transferred, in what format, and within what timeframe, so that a change of supplier does not mean that the passport is temporarily inaccessible. Specific questions you can ask a supplier about this can be found in the overview on where the information in the passport comes from and how it is maintained.
Who draws up these documents and who reviews them
In practice, the supplier usually draws up the draft processor agreement and SLA, and you review these internally or with a lawyer. The latter is not an unnecessary step: a contract that reads well does not automatically cover what is specific to your company, for example because you work with multiple brands or import countries. For the question of how carefully data is handled, it is useful to also look at how data is secured and who has access to it.
If you still need to determine which documents are relevant for your situation, you don't have to figure that out all at once. A brief inventory helps you see which documents you already have and what is still missing.
If you notice that you're not sure exactly where your company stands in this process, the free quick-scan on tyrepas.eu provides a first indication in a few questions. For the underlying rules and concepts, you can always consult the knowledge base; for your own contract situation, a lawyer or the competent supervisory authority remains the appropriate point of contact.