Yes. the private key is generated and kept only in the chip which is isolated offline, even the manufacturers & owners can’t get it out.
The setup process actually only happen when the customers who bought the gift products with ChipBase first time
tapped it with a phone installed ChipBase mobile app. The customers can topup crypto into the newly created address, but cannot change or control the ultimate private key… it never leaves the ChipBase. The customers send the products(already topup with crypto) to whom, who will get the capability to process the crypto assets by using ChipBase mobile app too.