Catalog.ID Organization Identity Agreement

Operator: Roberto Bourgonjen, a private individual in the Netherlands, operating catalog.id under operator code fndr ("Operator")
Address: Lange Leidsedwarsstraat 96, 1017 NM Amsterdam, the Netherlands
Last updated: 2026-10-15

This Catalog.ID Organization Identity Agreement ("Agreement") governs the registration and operation of an Organization Identity on catalog.id (the "Network") as operated by the Operator. It is concluded between the Operator and the legal entity registering the Organization Identity (the "Organization", "you").

Roberto Bourgonjen created the Catalog software and the catalog.id namespaces (in that capacity the "Founder"; referred to as "the Developer" in the Catalog.ID Whitepaper). He operates catalog.id himself, as a private individual, and also runs the Bitcash payment system used for Catalog services. The Network's services are provided under operator code fndr and can be reached at fndr.catalog.id. Where this Agreement refers to the Operator, it refers to him in his role as operator of the Network; where it refers to the Founder, it refers to him as the owner of the intellectual property in the Network. If the role of Operator passes to a company or other organisation, this Agreement transfers to it as described in Section 29.

How the three documents fit together. Natural persons join the Network as Members under the Catalog.ID Membership Agreement. Organizations register an Organization Identity under this Agreement and operate it through Delegate Identities. Each person operating a Delegate Identity accepts the Catalog.ID Delegate Terms at activation. Delegates do not conclude a membership agreement with the Operator: the Organization is the contracting party and bears legal responsibility for its Delegates' use of the Network.

1) Acceptance and authority

Your acceptance. This Agreement is accepted on behalf of the Organization by the natural person completing registration (the "Founding Person"), by confirming acceptance during registration, paying a registration fee where one applies, or operating the Organization Identity.
Authority. The Founding Person represents and warrants that they are authorized to bind the Organization to this Agreement. If the Founding Person lacks such authority, the Founding Person is personally liable for all obligations under this Agreement until the Organization ratifies it.
Operator's acceptance. The Operator accepts by activating the Organization Identity. No physical signature by the Operator is required.
Business capacity. The Organization enters into this Agreement in the course of a business, profession, or organizational purpose. Consumer protection rules for natural persons acting in a private capacity do not apply to this Agreement.

2) Purpose and relationship to other documents

What an Organization Identity is. An Organization Identity is a full Catalog.ID identity registered to an Organization: it has its own username, keys, claims, and public profile, and it can receive shared claims, hold an XRPL wallet, and be publicly resolvable. It is described in the Catalog.ID Whitepaper §3a.
Not a Member. An Organization Identity is not a Member of the Network. Membership is reserved for natural persons under the Catalog.ID Membership Agreement. Where this Agreement grants the Organization capabilities equivalent to those of Members (sharing, disputes, public claims), it does so contractually, not by conferring membership.
Delegate Terms. The Catalog.ID Delegate Terms ("Delegate Terms") are the usage rules each Delegate accepts personally at activation of their Delegate Identity. The Delegate Terms are directly enforceable against the Delegate for the Network's core protections (confidentiality, no doxxing, IP respect, key security). They do not make the Delegate a party to this Agreement and do not reduce the Organization's responsibility under Section 9.
Order of precedence. If documents conflict, the order of precedence is: (1) this Agreement, (2) the Delegate Terms, (3) the Catalog EULA and Cloud Services Terms where the Organization uses those services, (4) documentation and whitepapers (which are descriptive, not contractual).

3) Key definitions

Organization: the legal entity (company, partnership, association, foundation, government body, or other entity that is not a natural person) that is party to this Agreement.
Organization Identity: the Catalog.ID identity registered to the Organization under this Agreement, identified by a username in the 123abcd456 format (three digits, four lowercase letters, three digits). See Catalog.ID Whitepaper §3a.2.
Delegate Identity: a Catalog.ID identity created by the Organization for a natural person acting in the Organization's capacity, identified by a username in the ab12cd34fg format and permanently linked to the Organization Identity. See Catalog.ID Whitepaper §3b.
Delegate: the natural person operating a Delegate Identity. Delegates are not Members and do not conclude a membership agreement with the Operator; they accept the Delegate Terms at activation and operate under the Organization's legal responsibility.
Roles: the permission sets assignable to Delegate Identities: owner, admin, treasurer, and viewer, as described in the Catalog.ID Whitepaper §3a.4. A Delegate Identity may hold multiple roles.
Owner: a Delegate Identity holding the owner role. Owners have full control over the Organization Identity and are the Organization's accountable operators of it.
Member: a natural person registered on catalog.id under the Catalog.ID Membership Agreement.
Domain Claim: the validated claim containing the Organization's domain name, mandatory for every Organization Identity. See Catalog.ID Whitepaper §3a.6.
Member Shared Data: any data a Member, another Organization Identity, or a Delegate Identity shares with the Organization Identity or its Delegate Identities via the Network or Catalog clients/APIs, including (without limitation) encrypted attributes, messages, files, links, provenance records, decryption keys, identity assertions, and private metadata, as well as copies, extracts, screenshots, transcriptions, and summaries that reveal the substance of the original data.
Onward Sharing: disclosing, publishing, forwarding, selling, sublicensing, or otherwise making available Member Shared Data to any third party beyond the intended audience.
Agent Identity: a Catalog.ID identity registered to an autonomous or semi-autonomous entity acting on behalf of a personal or delegate identity (its "Principal"). Agent Identities created by Delegate Identities are governed by this Agreement (Section 10). See Catalog.ID Whitepaper §3c.
Membership Agreement: the Catalog.ID Membership Agreement governing Members.

4) Eligibility and registration

Eligible entities. Any legal entity may apply for an Organization Identity. Natural persons acting in a private capacity must register as Members under the Membership Agreement instead.
Accurate information. The Organization must provide accurate registration information, including its legal name, entity details, and domain name, and keep this information up to date.
Domain control required. Registration requires validation of the Organization's control over its domain name through the domain ownership flow described in the Catalog.ID Whitepaper §7.5 and §10a.
Registration flow. Registration creates two identities in a single transaction: the Organization Identity and its first Delegate Identity with the owner role, following the flow in the Catalog.ID Whitepaper §10a. The Founding Person accepts this Agreement on behalf of the Organization and personally accepts the Delegate Terms for the founding Delegate Identity. The Founding Person must hold an existing Catalog.ID identity (a Personal Account under the Membership Agreement or a Delegate Identity) at the time of registration (see Catalog.ID Whitepaper §10a).
At least one Owner. The Organization must maintain at least one active Delegate Identity with the owner role at all times. See Section 21 for continuity requirements.
No guarantee of acceptance. The Operator may refuse registration for legal, security, risk-management, or policy reasons. Where permitted and practicable, the Operator may provide a brief explanation, but may be unable to do so in some cases (for example due to security, privacy, or legal constraints).
Refusal of re-registration. The Operator may refuse registration or re-registration of an Organization whose Organization Identity was previously terminated for breach, or that is controlled by persons whose accounts were terminated for breach.
Sanctions compliance. The Organization represents and warrants that neither it, nor any person owning or controlling it, nor the Delegates it enrolls are subject to or listed on any EU, UN, or other applicable sanctions list that would prohibit the Operator from providing services, and that its use of the Network complies with applicable export control and sanctions laws. The Operator may refuse registration or terminate under Section 22.2 where this representation is or becomes untrue.
Registration by invitation. The Operator may limit registration to Organizations it has invited. An invitation is addressed to the Organization, may not be passed on to anyone else, and does not oblige the Operator to accept the registration.

5) Fees

No fees for invited Organizations. Registration of an Organization Identity on an invitation from the Operator is free of charge, and so is every Delegate Identity it creates. No registration or Delegate Identity fee is charged for it, at registration or at any later time.
Fees for other registrations. Where the Operator opens registration to Organizations it has not invited, it may charge a one-time registration processing fee for the processing and verification of the application, and a one-time fee for each Delegate Identity created, charged to the Organization. The amounts are stated in the registration flow before the application is submitted. These fees never apply to an Organization that registered without them.
VAT. All fees under this Agreement are stated exclusive of VAT and other applicable taxes, which are charged additionally where required. Where the reverse-charge mechanism applies, the Organization is responsible for accounting for VAT in its own jurisdiction.
Non-refundable. Fees are non-refundable once processing has started. An invitation or payment does not guarantee acceptance (Section 4.6); the Operator may retain fees to cover processing and verification performed before refusal.
No recurring fees. No periodic membership or subscription fee applies under this Agreement at the date stated above. The Operator may introduce fees for future optional services; such fees apply only if the Organization orders those services.
Payment terms. Invoiced amounts are payable within 30 days of the invoice date. The Operator may suspend creation of new Delegate Identities, and after notice suspend the Organization Identity, for overdue payments.

6) Organization credentials and key custody

Credential model. The Organization Identity has its own password, supersecret, and key bag, generated client-side during registration as described in the Catalog.ID Whitepaper §3a.3 and §10a. The "supersecret" is the backup credential that encrypts the Organization's key bag; the "key bag" is the set of the Organization's encrypted private keys stored on the Operator's servers.
Zero-knowledge custody. The Organization's plaintext private keys and supersecret are never transmitted to the Operator: private keys are stored only as encrypted key bag entries the Operator cannot decrypt, and the Operator cannot recover the Organization's private keys or supersecret. The password serves to authenticate the Organization's sessions and is verified against a stored hash; it cannot be recovered by the Operator. The Organization is solely responsible for the safekeeping of all its credentials. The system does not prescribe how the Organization manages them internally (corporate vault, split custody, or otherwise).
Credential loss. If the Organization's supersecret is lost and no Delegate Identity holds a wrapped copy of the current key chain, the Organization's encrypted keys and any claims encrypted to them are permanently unrecoverable. This is an intentional property of the system's zero-knowledge architecture.
Compromise. The Organization must promptly notify the Operator of suspected compromise of the Organization's credentials or keys. Lockdown and key rotation follow the mechanisms described in the Catalog.ID Whitepaper §3.3 and §3a.5, applied to the Organization Identity.
Administrative use only. The Organization account (direct login with the Organization's credentials) is intended for administrative operations: key rotation, key chain management, and Delegate onboarding. Daily operations must be performed through Delegate Identities.

7) Domain claim and revalidation

Mandatory Domain Claim. Every Organization Identity must maintain a validated Domain Claim. Publication of the Domain Claim as a public claim is mandatory, so that the Organization's web presence is discoverable from its username.
Annual revalidation. The domain validation certificate expires after 1 year. The Organization must revalidate domain ownership before expiry.
Freeze and grace period. If revalidation does not occur before expiry, the Organization Identity is frozen: no new claims can be shared with it, no transactions signed, no public claims published or updated. Existing shared claims remain accessible to current Delegate Identities. The Organization then has a 90-day grace period to revalidate. If revalidation does not occur within the grace period, the Operator may terminate the Organization Identity (Section 22).
Domain changes. The Organization may change its domain at any time by updating the Domain Claim and completing a new domain validation. The username, keys, claims, and history remain unchanged.

8) Delegate Identities

Creation. Delegate Identities are created by the Organization's owner or admin Delegate Identities through the invitation flow described in the Catalog.ID Whitepaper §3b.3 and §10b.
Natural persons only. Each Delegate Identity must be operated by a single identified natural person entitled to act for the Organization (employee, officer, or engaged contractor). Shared Delegate Identities are not permitted. Each Delegate must be of legal age and have full legal capacity to accept the Delegate Terms; the Organization must not create a Delegate Identity for a person lacking such capacity.
Delegate Terms acceptance. Activation of a Delegate Identity requires the Delegate's personal acceptance of the Delegate Terms. The Organization must not permit any person to operate a Delegate Identity without that acceptance, and must ensure each Delegate has a reasonable opportunity to read the Delegate Terms before activation.
Delegate key custody. The Delegate generates and holds their own credentials and keys; the Organization never receives them and cannot decrypt the Delegate's own claims. Access to Organization keys is role-based, through wrapped key copies, as described in the Catalog.ID Whitepaper §3a.3–3a.4 and §3b.4.
Role management. The Organization assigns and updates each Delegate Identity's roles. The Organization must grant no broader roles than the Delegate's function requires.
Lifecycle control and duty to offboard. The Organization controls the lifecycle of its Delegate Identities (freeze, role changes, termination). The Organization must promptly terminate a Delegate Identity when the underlying relationship ends or the Delegate is no longer entitled to act for the Organization, and must promptly freeze a Delegate Identity that is suspected of compromise or misuse.
Key rotation on departure. Termination or removal of a Delegate Identity triggers rotation of the Organization's encryption keys as described in the Catalog.ID Whitepaper §3a.5. The Organization is responsible for completing rotation promptly. The Organization must also decide on the departing Delegate Identity's published CPR signing keys (revocation or unpublication) per Catalog.ID Whitepaper §3a.8.1.
Audit. The Organization's owner and admin Delegate Identities can audit CPR signing activity across the Organization as described in the Catalog.ID Whitepaper §3a.8.2. The Organization is responsible for informing its Delegates of this capability (see also Section 18).

9) Responsibility for Delegates

Full responsibility. The Organization is responsible and liable toward the Operator, Members, and other Organizations for all acts and omissions performed through its Organization Identity, its Delegate Identities, and Agent Identities created by its Delegate Identities, as if the Organization had performed them itself.
Obligations flow down. The Organization must ensure that its Delegates comply with this Agreement and the Delegate Terms, including confidentiality (Section 13), IP respect (Section 14), and prohibited conduct (Section 16).
Delegate Terms do not shift responsibility. The Delegates' personal acceptance of the Delegate Terms gives the Operator and affected Members direct recourse against a Delegate for the core protections stated there, but does not reduce, limit, or excuse the Organization's responsibility and liability under this Section. Liquidated damages under Section 15 are owed by the Organization.
Internal handling of shared data. Data shared with the Organization Identity is accessible to all Delegate Identities holding the organization's attr_encrypt key (see Catalog.ID Whitepaper §3a.3.1). The Organization is responsible for its internal handling of such data, including need-to-know discipline and confidentiality undertakings of its personnel beyond the Delegate Terms.

10) Agent Identities

Delegate-created agents. Delegate Identities may create Agent Identities as described in the Catalog.ID Whitepaper §3c. Such Agent Identities operate under this Agreement; the Organization is responsible for their actions per Section 9.1.
Scoping. The Organization must ensure that Agent Identities are configured with session scopes and restrictions no broader than necessary for their purpose.
Persistent-mode runtimes and Organization keys. Persistent-mode agent runtimes that hold Organization key material (for example for automated key rotation or chain flattening) represent an elevated trust configuration (see Catalog.ID Whitepaper §3c.5.4). The Organization must maintain an internal policy governing whether and on which machines persistent-mode agents may hold Organization keys, must ensure the security of those machines, and must revoke agent refresh tokens and device records promptly on suspicion of compromise.
Malfunction. The Organization must ensure that an Agent Identity that is malfunctioning, compromised, or acting outside its intended scope is promptly terminated or revoked.

11) Public claims and license to publish

Eligible claim types. The Organization Identity may publish public claims of the types listed for organization identities in the Catalog.ID Whitepaper §4.5.4 (display name, description, domain, website, location, email, phone, postal address). Publication of the Domain Claim is mandatory (Section 7.1). Bank account details are not eligible for publication.
Required publication. Where the legal framework applicable to the Organization requires publication of certain information (for example a business address or contact email for commercial entities), the Operator may require publication of the corresponding claims as a condition of maintaining an active Organization Identity.
Validation and editorial discretion. No public claim is published without validation by the Operator. The Operator reviews the shared claim data, applies the validation procedure appropriate for the claim type, and decides whether to approve publication. Approved claims are signed by the Operator.
License to publish. By requesting publication, the Organization grants the Operator a worldwide, non-exclusive, royalty-free, perpetual license to publish the resulting public claim in cleartext, sign it with the Operator's key, and serve it through public APIs and profile interfaces. This license survives termination of the Organization Identity, so that public attribution remains resolvable for archival and historical purposes.
Deletion and updates. The Organization may delete or update its public claims at any time while the Organization Identity is active; deletion takes effect immediately and ends the license in Section 11.4 for the deleted claim. Updates follow the same validation process as initial publication. Claims not deleted before termination persist under the license.
Personal data in organization claims. Organization public claims are organizational data. Where an organization public claim contains personal data of a natural person (for example a contact person's name in the display name), the Organization warrants that it has a lawful basis for that publication and indemnifies the Operator against claims by the individual concerned.

12) Usernames and intellectual property

Ownership. The organization username namespace (123abcd456 format), the delegate username namespace (ab12cd34fg format), and the agent username namespace (ten lowercase letters) are part of a namespace system designed and created by the Founder. The namespaces, their formats, and the algorithms that generate them are the Founder's intellectual property, protected by copyright, EU sui generis database right, and this Agreement.
License chain. While the Founder is also the Operator, he licenses directly to the Organization its username, and the delegate usernames for assignment to its Delegates, for the duration of this Agreement, and the agent usernames assigned to Agent Identities created by its Delegate Identities, for the duration of each Agent Identity. If the role of Operator passes to another party (Section 29), the Founder licenses the namespaces to that party, which sublicenses these usernames to the Organization on the same terms.
No ownership; no transfer. The Organization does not own any username and may not claim ownership of, register as a trademark, or assert any proprietary right in any username or any part of the catalog.id namespaces. Usernames may not be sold, assigned, leased, or transferred.
Retirement. Upon termination of the Organization Identity, a Delegate Identity, or an Agent Identity created by a Delegate Identity, the corresponding username is permanently retired and never reassigned. Provenance records and other references to a retired username remain valid historical records referencing an identifier that no longer resolves to any identity.
Domain independence. The Organization's domain name remains the Organization's own; only the catalog.id username and namespace are licensed under this Section. Because the domain is a claim rather than the username, rebranding or domain changes do not affect the Organization Identity (Section 7.4).

13) Confidentiality and "no onward sharing" rule (core obligation)

Consent required. The Organization and its Delegates must not Onward Share Member Shared Data without the sharing party's explicit permission.
Minimum disclosure. If sharing is authorized, only what is necessary may be shared, and only with the authorized audience.
No public disclosure. Unless explicitly permitted, Member Shared Data must not be published publicly (including on websites, social media, forums, or repositories).
No re-identification / no doxxing. The Organization and its Delegates must not attempt to identify, deanonymize, correlate, or dox any natural person behind a Catalog.ID identity — including Members, Delegates of other Organizations, and holders of anonymous CPR signing keys — based on identifiers, metadata, or combined information.
Internal disclosure is not a breach. Access to Member Shared Data by the Organization's own Delegate Identities through organization-wide sharing (Section 9.4) is not Onward Sharing. Disclosure to any person who is not operating a Delegate Identity of the Organization is Onward Sharing, including disclosure to the Organization's own personnel outside the Network.
Non-circumvention. The Organization and its Delegates must not request, distribute, or accept decryption keys outside the platform's key-sharing mechanisms in order to evade revocation, audit, or access controls.
Survival. These confidentiality obligations continue after termination of this Agreement.

Breach of this section is a serious violation and may result in immediate suspension or termination.

14) Respect for IP, provenance, and attribution

Respect rights. The Organization must respect the copyright, neighboring rights, database rights, moral rights, and other IP rights of Members, other Organizations, and third parties, and must ensure its Delegates do the same.
No misrepresentation. The Organization must not misrepresent authorship, provenance, or permissions, including through the attribution effects of published delegate CPR signing keys.
License only with consent. The Organization may not redistribute another party's protected content without permission and a lawful basis.

IP notice-and-cure procedure (7 days)

IP Notice. A party alleging infringement by the Organization (or the Organization alleging infringement by a Member or another Organization) must send a written notice containing: a link or content identifier for the allegedly infringing material; a description of the alleged infringement; the requested cure; and any supporting evidence reasonably available.
Response. Within 7 days of receiving an IP Notice, the recipient must: (a) comply with the requested cure; (b) submit a counterclaim with reasons and evidence; or (c) request clarification (which does not extend the cure period unless both parties agree).
Failure to cure. Failure to respond or cure within the 7-day period triggers the liquidated damages under Section 15.2.
Interim measures. Where there is credible risk of ongoing harm, the Operator may temporarily delist or restrict public access to the disputed content during the cure window.

15) Financial liability and liquidated damages

15.1 Doxxing and unlawful disclosure

Publishing or disclosing the personal data of a Member, a Delegate, or any other natural person behind a Catalog.ID identity, or Member Shared Data, without consent, whether by public posting or sharing to third parties, gives rise to liquidated damages of €10,000 minimum per incident, plus any higher actual damages and costs (uncapped), including reasonable mitigation and enforcement costs. These amounts are a pre-estimate of harm and enforcement costs. The Operator's right to apply sanctions (Section 17) and to seek injunctive relief is fully preserved.

15.2 Copyright and IP infringement (notice + cure)

If the Organization is notified of alleged infringement and fails to cure within 7 days, liquidated damages of €2,500 per infringed work or content item apply, plus any higher actual damages and costs (uncapped), including reasonable mitigation and enforcement costs.

15.3 Attribution of breaches

Breaches committed by or through the Organization Identity, a Delegate Identity, or an Agent Identity created by a Delegate Identity are attributed to the Organization. Liquidated damages under this Section are owed by the Organization. This does not limit the Operator's or an affected party's right to pursue a Delegate directly under the Delegate Terms for injunctive relief and actual damages.

15.4 Determination of liability

Liability under this Section is determined through the dispute resolution process in Section 19 (disputes with Members or other Organizations) or Section 20 (disputes with the Operator). For safety cases (doxxing or unlawful disclosure), the Operator may open and pursue the dispute process on behalf of the Network. This does not limit the Operator's right to impose immediate sanctions under Section 17.

15.5 Mandatory law

Where mandatory law applies, a court may adjust a contractual penalty if fairness clearly requires it.

16) Prohibited conduct

The Organization must not use catalog.id, and must ensure its Delegates and Agent Identities do not use catalog.id, to:

harass, threaten, stalk, or intimidate others;
facilitate illegal activity;
distribute malware, attempt unauthorized access, or abuse the Network;
scrape or bulk-collect Member or Delegate data;
trade or sell access to decryption keys or Member Shared Data without consent;
impersonate others or mislead anyone about identity or authority, including presenting the Organization Identity as belonging to a different organization.

17) Enforcement and remedies (within the Network)

Measures. To protect the Network and enforce this Agreement, the Operator may: issue warnings or require corrective actions; restrict features (including sharing, publication, messaging, or API access) of the Organization Identity or individual Delegate Identities; freeze individual Delegate Identities; suspend or terminate the Organization Identity; and cooperate with lawful requests from competent authorities.
Emergency measures. Where there is credible risk of ongoing harm (for example doxxing, unlawful disclosure, harassment, or active misuse of keys), the Operator may impose temporary measures immediately, following the standards and time limits of Section 17.3 of the Membership Agreement applied mutatis mutandis to the Organization Identity and its Delegate Identities.
Duty to mitigate and cooperate. The Organization must promptly take reasonable steps to mitigate harm arising from a breach, preserve relevant evidence, and cooperate confidentially with arbitration panels and the Review Board. This duty does not require unlawful disclosures.
Proportionality. Where a breach is attributable to a single Delegate and the Organization cooperates fully (including freezing or terminating the Delegate Identity concerned and completing key rotation), the Operator will take that cooperation into account in choosing measures against the Organization Identity.

18) Data protection

Delegate data is personal data. Delegate Identity data (claims, keys, role set, the organization link, and audit records) is personal data of the Delegates. The Operator processes it in accordance with the GDPR and applicable Dutch data protection law, as described in the Privacy Policy.
Organization's own duties. In enrolling Delegates, the Organization acts under its own data protection responsibilities as employer or principal. The Organization must: have a lawful basis for requiring personnel to operate Delegate Identities; inform Delegates about the processing involved, including the CPR signing audit capability (Section 8.8); and respect Delegates' rights on termination of the underlying relationship (see Catalog.ID Whitepaper §3b.3 and §9a.6).
Independent controllers. The Operator and the Organization are independent controllers for their respective processing. Nothing in this Agreement creates a joint controllership or a processor relationship between them.
Organizational data. The Organization Identity's own username and organizational public claims are organizational data, not personal data, except where they contain information about natural persons (Section 11.6).

19) Disputes with Members and other Organizations (Network-first)

Scope. This Section applies to disputes between the Organization and a Member or another Organization arising from use of the Network, including confidentiality breaches, Onward Sharing, IP disputes, and misuse of keys.
Process. Such disputes follow the phased, Network-first process of Sections 17.1–17.8 of the Membership Agreement, applied mutatis mutandis, with the Organization as a party.
Representation. The Organization participates through an owner Delegate Identity or another Delegate Identity authorized in writing. Panel communications with that Delegate Identity bind the Organization.
Mandatory personal conversation. Where the process requires a face-to-face conversation, the Organization appoints one natural person (normally an Owner) to conduct it on its behalf.
Fees and deposits. The filing fees and deposits of Sections 17.4–17.5 of the Membership Agreement apply equally to the Organization as claimant or respondent.
Remedies. Panel remedies may be ordered against the Organization Identity and its Delegate Identities (cessation of sharing, delisting, required notices or corrections, trust-status impacts, and temporary or permanent access restrictions). Panel and Review Board decisions bind the Organization only as to remedies within the Network, as a condition of maintaining the Organization Identity; they constitute an internal complaint and enforcement scheme, not an arbitration agreement or arbitral award under the Dutch Arbitration Act, and do not bar either party's access to the competent court under Section 32. Refusal to comply may result in suspension or termination.

20) Disputes with the Operator

Informal resolution (mandatory). Before initiating formal proceedings, the Organization must contact the Operator at [email protected] describing the dispute. The Operator will attempt to resolve the matter within 30 days. Both parties agree to engage in good faith.
Mediation (mandatory). If informal resolution fails, either party may refer the matter to mediation administered by a qualified mediator in the Netherlands, agreed by the parties or, failing agreement, appointed by the competent court. Each party bears its own costs; the mediator's fees are shared equally. Mediation shall conclude within 60 days of referral unless the parties agree to extend.
Court (last resort). If the dispute is not resolved through Sections 20.1–20.2, either party may bring the dispute before the competent court under Section 32.
Urgent relief. Nothing in this Section prevents either party from seeking interim or injunctive relief from a competent court where necessary to prevent irreparable harm.

21) Owner continuity and succession

Continuity duty. The Organization must ensure that at least one active Owner exists at all times, and is strongly advised to maintain at least two, or to keep the Organization's supersecret securely available to management.
Loss of the last Owner. If the last Owner Delegate Identity is terminated, frozen, or its Delegate becomes unavailable, the Organization may re-establish control by using the Organization's own credentials (password and supersecret) to onboard a new Owner Delegate Identity.
Operator assistance. If the Organization's credentials are also unavailable, the Operator may, after verifying the requestor's authority to represent the Organization through appropriate corporate documentation, perform account-level interventions: freezing the Organization Identity, terminating Delegate Identities, or authorizing the creation of a new Owner Delegate Identity. The Operator cannot recover keys or encrypted data (Section 6.3): claims encrypted to keys whose chain is lost remain unrecoverable.
Disputes over control. Where control of the Organization is disputed (for example between shareholders or successors), the Operator may freeze the Organization Identity until presented with a binding resolution (agreement of the parties, corporate resolution, or court order).

22) Termination

By the Organization. The Organization may terminate this Agreement at any time through an Owner Delegate Identity or written notice from an authorized representative.
By the Operator. The Operator may suspend or terminate the Organization Identity for material breach of this Agreement, failed domain revalidation (Section 7.3), non-payment (Section 5.6), safety, security, or legal compliance reasons, or if the Organization ceases to exist or enters insolvent liquidation.
Cascade. Termination of the Organization Identity terminates all its Delegate Identities (Catalog.ID Whitepaper §3b.7). Delegates are notified. Linked personal identities of Delegates are unaffected.
Effects. Encrypted claims and keys are destroyed, usernames are permanently retired (Section 12.4), and public claims not deleted before termination persist: the Organization's claims under the license in Section 11.4, and Delegates' claims under the license granted by each Delegate in the Delegate Terms. CPR provenance records remain in the immutable record.
Survival. Sections intended to survive termination survive it, including Sections 11.4 (publication license), 12 (username IP), 13 (confidentiality), 15 (accrued liability), 19–20 (for disputes arising from facts occurring before termination), 23 (liability and indemnification), 31, and 32.

23) Liability and indemnification

Disclaimers. catalog.id is provided as is and as available to the maximum extent permitted by law. The Operator does not guarantee that Members, Delegates, or other Organizations will comply with their obligations, but provides tools and enforcement mechanisms and will act where appropriate.
Liability cap. The Operator's aggregate liability to the Organization under or in connection with this Agreement is limited to the total fees paid by the Organization to the Operator in the 12 months preceding the event giving rise to liability, or €2,500, whichever is higher. The Operator is not liable for indirect or consequential damages, loss of profit, loss of data caused by loss of credentials or keys within the Organization's custody, or damages resulting from acts of Members, Delegates, other Organizations, or Relying Parties.
Carve-outs. Nothing in this Agreement limits liability for intent or deliberate recklessness (opzet of bewuste roekeloosheid) of the Operator, or any other liability that cannot be limited under mandatory law.
Indemnification. The Organization indemnifies the Operator against third-party claims (including claims by Members and by the Organization's own Delegates and personnel) arising from the Organization's or its Delegates' breach of this Agreement, the Delegate Terms, or applicable law, including reasonable legal costs.

24) Changes to this Agreement

The Operator may update this Agreement. For material changes, the Operator gives at least 30 days' advance notice by in-Network notification and on catalog.id (Section 28.2).
If the Organization does not accept a material change, it may terminate this Agreement before the change takes effect. Continued use of the Organization Identity after the effective date constitutes acceptance.

25) Force majeure

Neither party shall be liable for delays or failures in performance resulting from events beyond its reasonable control, including natural disasters, war, terrorism, cyberattacks, pandemic, government action, or internet/infrastructure failures. This does not excuse the Organization's obligations under Section 13 (Confidentiality) or its payment obligations for services already rendered.

26) Severability

If any provision of this Agreement is held invalid, illegal, or unenforceable, the remaining provisions continue in full force. The invalid provision shall be modified to the minimum extent necessary to make it enforceable while preserving its intent.

27) Waiver

Failure or delay by either party in enforcing a provision of this Agreement does not constitute a waiver of that provision or of the right to enforce it later.

28) Notices

Legal notices to the Operator must be sent to [email protected] or by post to Lange Leidsedwarsstraat 96, 1017 NM Amsterdam, the Netherlands, and are effective on receipt.
Contact details the Organization holds as end-to-end encrypted claims are not available to the Operator. The Operator therefore gives notices to the Organization by in-Network notification: a notice placed in the Organization Identity and in its Owner Delegate Identities, shown in the notification area of the Catalog Dashboard (the Catalog desktop application) and when they sign in to catalog.id. Notices that concern all Organizations are also published on catalog.id. A notice is deemed received 48 hours after it was placed. The Operator may also send legal notices to a contact email address or business address the Organization has published as a public claim or shared with the Operator.
Operational communications (including enforcement and emergency measure notifications) may be given through the Network.
IP Notices under Section 14 and dispute filings under Section 19 must be submitted through the Network's designated dispute interface or, if unavailable, by email; the cure period of Section 14.5 runs from receipt through that channel.

29) Transfer of this Agreement

By the Organization. The Organization may not assign this Agreement or the Organization Identity without the Operator's prior written consent, except to a legal successor of the entire organization by merger, demerger, or conversion under applicable corporate law, provided the successor notifies the Operator and assumes all obligations.
To a successor Operator. The Operator may transfer this Agreement, with all rights and obligations under it, to a company or other organisation that takes over the role of Operator of catalog.id and assumes the Operator's obligations under this Agreement. The Organization consents in advance to such a transfer (contract takeover under Article 6:159 of the Dutch Civil Code).
Notice and effect. The Operator announces a transfer at least 30 days before it takes effect, by in-Network notification and on catalog.id (Section 28.2), naming the successor Operator. If the Organization objects, it may terminate this Agreement at any time (Section 22.1). From the moment the transfer takes effect, the successor Operator is the Organization's counterparty in place of Roberto Bourgonjen; the Organization Identity, its Delegate Identities, usernames, keys, encrypted claims, and public claims continue unchanged. The Founder's intellectual property in the catalog.id namespaces does not transfer with this Agreement; the Founder licenses it to the successor Operator (Section 12.2).

30) Entire agreement

This Agreement, together with the documents referenced in Section 2.4, constitutes the entire agreement between the Operator and the Organization regarding the Organization Identity, and supersedes prior discussions and arrangements on that subject.

31) Governing law

This Agreement is governed by the laws of the Netherlands, excluding conflict-of-law rules and the United Nations Convention on Contracts for the International Sale of Goods.

32) Venue / court

Disputes that proceed to court under Section 19 or 20 shall be brought before the competent court in the Netherlands for the district in which the Operator is domiciled or established.

33) Contact

Roberto Bourgonjen, operator of catalog.id
Address: Lange Leidsedwarsstraat 96, 1017 NM Amsterdam, the Netherlands
Website: catalog.id
Email: [email protected]