Terms of Service

1. Provider and Customer

1.1 Provider. Vittnor is an online service for the management of security risks in the Customer's supply chain (the "Service"). The Service is provided by Shards Cybersecurity s.r.o., with its registered office at Kopčianska 3756/10, 851 01 Bratislava, Slovak Republic, IČO: 55151531, IČ DPH: SK2121900253, registered in the Commercial Register of the Municipal Court Bratislava III, Section: Sro, Insert No. 166725/B ("Shards Cybersecurity" or the "Provider").

1.2 Customer. These Terms of Service (the "Terms") constitute a legally binding agreement between the Provider and the organization in whose name the Service is used (the "Customer").

1.3 Incorporated Documents. The following documents are incorporated into and form an integral part of these Terms:

a. the GDPR Data Processing Agreement (DPA);

b. the Data Act Switching Schedule;

c. the DSA Hosting Policy;

d. the NIS2 Security Addendum, if and to the extent it applies to the Customer in accordance with Section 10.5; and

e. any Order.

1.4 Informational Documents. The Privacy Policy and the Browser Storage Notice are provided for information purposes in accordance with the GDPR and applicable laws on the storage of and access to information on terminal equipment. They do not form part of the contractual terms between the parties.

1.5 Order of Precedence. In the event of any conflict or inconsistency between these Terms and any document referred to in Section 1.3, the following order of precedence shall apply:

a. any Order, to the extent permitted by the mandatory provisions of applicable law;

b. the DPA, with respect to the processing of personal data;

c. the Data Act Switching Schedule, with respect to data export, switching and erasure;

d. the NIS2 Security Addendum, where applicable, with respect to the matters referred to in Section 10.6;

e. the DSA Hosting Policy, with respect to notices of illegal content, content moderation decisions and complaints; and

f. these Terms.

1.6 Publication. These Terms and the documents referred to in Sections 1.3(a) to (d) and 1.4 are published at vittnor.com/legal. An Order is provided only to the parties thereto.

2. Definitions

In these Terms, the following capitalized terms have the meanings set out below:

• "Browser Storage Notice" means the Provider's notice describing the cookies and similar technologies used to store or access information on Users' devices, published at vittnor.com/legal.
• "Commercial Code" means Act No. 513/1991 Coll., the Commercial Code of the Slovak Republic, as amended.
• "Counterparty" means any Organization other than the Customer with which the Customer exchanges requests, answers, evidence or messages through the Service, typically in a buyer–supplier relationship.
• "Customer Data" means all data and content submitted to the Service by or on behalf of the Customer or its Users, including supplier records, scoping decisions, risk assessments, questionnaires, answers, messages, evidence files and review decisions.
• "Data Act Switching Schedule" means the schedule setting out the Customer's rights to data export, switching and erasure, together with the related procedures and periods, pursuant to Chapter VI of Regulation (EU) 2023/2854 (the "Data Act"), published at vittnor.com/legal/data-export.
• "Directory" means the register of verified Organizations maintained by the Provider to enable customers of the Service to identify and connect with one another.
• "Directory Information" means an Organization's legal name, country, domain and identifiers (such as its company registration number), together with its verification and claim status.
• "DPA" or "GDPR Data Processing Agreement" means the data processing agreement entered into between the Provider and the Customer pursuant to Article 28 of Regulation (EU) 2016/679 (the "GDPR"), governing the processing of personal data by the Provider on behalf of the Customer, published at vittnor.com/legal/dpa.
• "DSA Hosting Policy" means the Provider's policy setting out its points of contact, notice-and-action mechanism, statements of reasons and internal complaint-handling procedure as a provider of hosting services under Regulation (EU) 2022/2065 (the "Digital Services Act"), published at vittnor.com/legal.
• "Microsoft Marketplace" means the commercial marketplace operated by Microsoft Corporation or its affiliates through which the Service may be offered to and purchased by customers.
• "NIS2 Security Addendum" means the addendum setting out the additional cybersecurity obligations of the Provider referred to in Section 10.6, which applies only to Customers referred to in Section 10.5(a), being entities subject to Directive (EU) 2022/2555 ("NIS2") or the national laws transposing it, and only in accordance with Section 10.5.
• "Order" means (i) an order form, pilot agreement, master services agreement or other document in written form, signed by authorized representatives of both parties, which expressly refers to these Terms; or (ii) a subscription to the Service purchased through Microsoft Marketplace, including a private offer accepted by the Customer; in each case specifying a paid Plan, the applicable fees, the subscription term and billing terms, and/or any other terms individually agreed between the parties with respect to the Service.
• "Organization" means a company or other legal entity registered in the Service, including the Customer.
• "Organization Administrator" means a User authorized to manage the Customer's Users, their access rights and the settings of the Customer's organization.
• "Plan" means the free plan or a paid subscription, including the features and limits described at vittnor.com/pricing or in the applicable Order.
• "Privacy Policy" means the Provider's privacy policy published at vittnor.com/legal/privacy.
• "User" means an individual authorized to access the Customer's organization in the Service.

3. Acceptance and Orders

3.1 Business Use Only. The Service is intended solely for business use and is not offered to consumers.

3.2 Authority. By accepting these Terms, the individual accepting them agrees to these Terms on behalf of the Customer for the Customer's business purposes, and confirms that he or she is authorized to bind the Customer.

3.3 Acceptance by Order. Where the parties enter into an Order referred to in point (i) of the definition of Order, the Customer accepts these Terms upon signature of that Order by its authorized representative. Where the Customer purchases a subscription to the Service through Microsoft Marketplace, the Customer accepts these Terms upon completion of the purchase. In either case, no separate acceptance in the Service shall be required.

3.4 Fees and Payment. The fees for paid Plans, together with the invoicing schedule, payment terms and currency, shall be as set out in the applicable Order. Unless otherwise specified in the Order, all fees are exclusive of VAT and any other applicable taxes, and late payments shall bear interest at the statutory rate under the Commercial Code.

3.5 Microsoft Marketplace Purchases. Where the Customer purchases a subscription to the Service through Microsoft Marketplace:

a. the contract for the Service is concluded directly between the Customer and the Provider on these Terms. Microsoft Corporation and its affiliates are not parties to these Terms and shall have no liability or obligation to the Customer in respect of the Service;

b. ordering, invoicing, payment, the collection of applicable taxes and the billing of fees are governed by the terms applicable to Microsoft Marketplace, and Section 3.4 shall apply only to the extent consistent therewith;

c. the subscription term, renewal and cancellation of the subscription are as selected by the Customer in Microsoft Marketplace, and the renewal provisions of Section 16.1 shall not apply;

d. any refund to which the Customer is entitled under these Terms shall be requested and processed through Microsoft Marketplace in accordance with its applicable refund policies; and

e. the Provider may suspend or terminate the Customer's access to the paid features of the Service if the Marketplace subscription is suspended or cancelled, including for non-payment.

4. Accounts and Sign-in

4.1 Authentication. Users sign in using a Microsoft work or school account or a personal Microsoft account. Microsoft processes sign-in data as described in the Privacy Policy.

4.2 Individual Accounts. Each account is personal to a single individual. Users shall not share their access with any other person.

4.3 User Management. Organization Administrators determine which individuals may access the Customer's organization and with which rights, and are responsible for inviting and removing Users. The Customer is responsible for all acts and omissions of its Users in the Service and shall remove without undue delay any User who is no longer authorized to have access.

4.4 Unauthorized Access. The Customer shall notify the Provider without undue delay at security@shardscybersecurity.io if it suspects any unauthorized access to its organization.

4.5 Multiple Organizations. A User may belong to more than one Organization. Access to each Organization is separate and is controlled solely by that Organization.

4.6 Browser Storage. The Service stores and accesses information on Users' devices, such as cookies and local storage, as described in the Browser Storage Notice.

5. Verification and Directory

5.1 Unverified Organizations. A newly registered organization is unverified. An unverified organization may use the Service with respect to its own data and is visible only to its own Users. Until it is verified, an organization:

a. does not appear in the Directory;

b. cannot be linked to by other customers of the Service; and

c. cannot send questionnaires or requests to other Organizations.

5.2 Verification Procedure. To obtain verification, the Customer shall submit a verification request in the Service together with its legal identifier. The Provider will review the request against public business registers and other information available to it.

5.3 Scope of Verification. Verification confirms only that the Provider is reasonably satisfied that the Organization exists as a genuine legal entity and that the requesting person is authorized to act on its behalf. Verification does not constitute an assessment of the Organization's security, reliability or suitability as a supplier.

5.4 Refusal and Withdrawal. The Provider may refuse a verification request, request additional information, or withdraw verification if any information provided proves to be inaccurate or misleading, or if the organization is misused. The Provider shall inform the Customer of the reasons for its decision. A refused or unverified organization retains access to its own data.

5.5 Directory Visibility. Upon verification, the Customer's Directory Information becomes visible to all customers of the Service, who may search for the Customer and add it as a supplier. The Customer shall keep its Directory Information accurate and up to date. Following verification, the Customer's Directory Information may be changed only through the Provider.

5.6 Entries for Non-Customers. The Provider may create and maintain Directory entries for companies that are not customers of the Service, based on public registers or information provided by customers, to enable customers to add such companies as suppliers. A company claims its entry when one of its representatives joins it as a User. A company may request the correction or removal of its entry at privacy@shardscybersecurity.io.

5.7 Prohibited Registrations. The Customer shall not register, or seek verification for, an Organization that it does not represent, impersonate any other Organization, or create duplicate organizations in order to circumvent any limits of the Service.

6. Working with Other Organizations

6.1 Roles. The Service connects buyers with their suppliers. Within the Service:

a. a buyer maintains supplier records, assesses risk, and sends questionnaires and requests for evidence; and

b. a supplier responds to requests, uploads evidence and communicates with the buyer.

An Organization may act in both roles.

6.2 Segregation of Data. A buyer's supplier records, scoping decisions, risk assessments, review decisions and self-recorded answers are not visible to the supplier. A supplier has access only to the requests addressed to it and to the message thread it shares with the buyer.

6.3 Conditions for Requests. A request may be sent only by a verified Organization and only to a verified Organization that has at least one User.

6.4 Content Shared with Counterparties. By submitting answers, evidence or messages to a Counterparty, the Customer makes such content available to that Counterparty. The Counterparty may use such content for its own supplier-risk management purposes and may retain it in its records as part of its review history, including after the relationship between the Customer and the Counterparty has ended.

6.5 Role of the Provider. The Provider transmits such content on the Customer's instructions. The Provider is not a party to the relationship between the Customer and any Counterparty and is not responsible for (a) the use of any content by a Counterparty, or (b) the accuracy of any content received from a Counterparty.

6.6 Customer's Responsibility. The Customer is responsible for ensuring that it holds all rights necessary to share any content it submits, including in compliance with applicable confidentiality obligations and data protection laws. The Customer shall not submit more personal data than is necessary for the relevant request.

6.7 No Verification of Content. Answers and evidence constitute statements of the Organization submitting them. The Provider does not review or verify them.

6.8 No Obligations Between Organizations. These Terms do not create any obligations between the Customer and any Counterparty. Any obligation to respond to security questionnaires or similar requests arises solely from the Customer's separate agreement with that Counterparty.

7. Acceptable Use

7.1 Prohibited Conduct. The Customer shall not, and shall ensure that its Users do not:

a. use the Service in breach of any applicable law, or of any sanctions or export-control regulations;

b. upload malware, or any content that is unlawful or infringes the rights of third parties;

c. impersonate any person or Organization, or provide false information for the purposes of registration or verification;

d. access or attempt to access the data of another Organization, or circumvent any access controls, verification procedures, rate limits or Plan limits;

e. probe, scan or test the security of the Service without the Provider's prior written consent, except as permitted under Section 7.2 or the NIS2 Security Addendum;

f. scrape or bulk-download the Directory, or use Directory Information for marketing purposes;

g. use invitations or requests to send spam or other unsolicited communications;

h. overload the Service or otherwise interfere with its operation;

i. make the Service available to any third party other than Counterparties and advisers permitted under Section 7.3; or

j. copy or reverse-engineer the Service or any of its content, including question templates or the scoring method, for the purpose of developing a competing product, except to the extent permitted by applicable law.

7.2 Vulnerability Disclosure. The Provider welcomes reports of security vulnerabilities at security@shardscybersecurity.io. Good-faith security research conducted in accordance with the Provider's published disclosure policy shall not constitute a breach of Section 7.1.

7.3 Advisers. The Customer may permit its advisers, such as consultants or auditors, to use the Service as Users. The Customer remains fully responsible for the acts and omissions of such advisers.

7.4 Illegal Content. Any person, whether or not a User, may notify the Provider of content in the Service that such person considers to be illegal. The submission and handling of such notices, and the Provider's points of contact for authorities and Users, are governed by the DSA Hosting Policy. The Provider does not assume any general obligation to monitor content in the Service.

8. Suspension

8.1 Grounds for Suspension. The Provider may suspend the Service, in whole or in part, for the Customer or any User if:

a. suspension is necessary to prevent a security threat or harm to the Service or to third parties;

b. Section 7.1 is breached seriously or repeatedly;

c. any fees due under an Order remain unpaid fourteen (14) days after a payment reminder; or

d. suspension is required by law or by a competent authority.

8.2 Scope and Restoration. Any suspension shall be limited to the extent necessary. The Provider shall give prior notice of the suspension where practicable and otherwise without undue delay thereafter, and shall restore access once the cause of the suspension has been resolved. Suspension shall not result in the deletion of any Customer Data.

8.3 Statement of Reasons and Redress. Where the Provider removes or disables access to content, or suspends or terminates the Service for the Customer or any User, on the ground that content is illegal or incompatible with these Terms, the Provider shall provide the affected Customer or User with a statement of reasons. The affected Customer or User may contest such decision through the internal complaint-handling procedure, in each case as set out in the DSA Hosting Policy.

9. Availability, Support and Updates

9.1 Availability. The Provider shall use reasonable efforts to keep the Service available at all times but does not guarantee that the Service will be uninterrupted. Where possible, the Provider schedules maintenance outside business hours (Central European Time) and announces significant maintenance in advance.

9.2 Support and Service Levels. The free plan is provided without any service levels. Support is provided through documentation and by email at support@shardscybersecurity.io on a best-effort basis. Support and any service levels for paid Plans are as set out in the applicable Order.

9.3 Changes to Features. The Provider develops the Service continuously and may add, modify or remove features. The Provider shall not materially reduce the core functionality of a paid Plan during a paid subscription term. Should it do so, the Customer may terminate the affected Plan and shall be entitled to a pro-rata refund of any prepaid fees.

9.4 Beta Features. Features designated as beta or preview are provided in accordance with Section 14.2 and may be withdrawn by the Provider at any time.

10. Security and Data Protection

10.1 Security Measures. The Provider protects the Service and Customer Data by technical and organizational measures appropriate to the risk, as described in Annex II of the DPA. The Provider may update these measures, provided that the overall level of protection is not reduced.

10.2 Customer's Obligations. The Customer is responsible for managing its Users and their access rights, and for securing its devices and its Users' Microsoft accounts. The Provider recommends the use of multi-factor authentication for all accounts.

10.3 Exchanged Files. Files exchanged through the Service originate from other Organizations. The Customer shall handle downloaded files with the same degree of care as email attachments. The Service does not currently scan uploaded files for malware.

10.4 Security Incidents. Security incidents affecting personal data are handled in accordance with the DPA. The Provider shall notify the Customer without undue delay of any other security incident that materially affects the Customer's organization and, where the NIS2 Security Addendum applies, within the time limits set out therein.

10.5 NIS2 Security Addendum. The NIS2 Security Addendum shall apply in addition to these Terms only if (a) the Customer is an essential or important entity within the meaning of NIS2, or is subject to equivalent obligations under the national laws transposing NIS2, including an operator of essential services (prevádzkovateľ základnej služby) under Slovak Act No. 69/2018 Coll. on Cybersecurity, as amended, and (b) the applicable Order expressly provides that the NIS2 Security Addendum applies. A Customer that is such an entity may request the conclusion of such an Order at legal@shardscybersecurity.io. The NIS2 Security Addendum shall not apply to any other Customer.

10.6 Scope of the NIS2 Security Addendum. In accordance with Article 21(2)(d) of NIS2 and point 5.1.4 of the Annex to Commission Implementing Regulation (EU) 2024/2690, the NIS2 Security Addendum shall set out, as appropriate, the obligations of the Provider as a direct supplier of the Customer with respect to:

a. cybersecurity requirements applicable to the Service, including the technical and organizational security measures implemented by the Provider, which shall be no less protective than those described in Annex II of the DPA;

b. awareness, skills and training of the Provider's personnel having access to Customer Data or to the systems used to provide the Service and, where appropriate, the certifications required of such personnel;

c. background checks of such personnel, to the extent permitted by applicable law;

d. notification of incidents that present a risk to the security of the Customer's network and information systems, without undue delay and in any event within twenty-four (24) hours after the Provider becomes aware of such incident;

e. the Customer's right to audit the Provider or to receive audit reports, certifications or other evidence of compliance, subject to reasonable conditions as to notice, frequency, scope and confidentiality;

f. the identification, assessment and remediation of vulnerabilities in the Service that present a risk to the security of the Customer's network and information systems, including notification of such vulnerabilities to the Customer where appropriate;

g. subcontracting, including the Provider's obligation to impose on its subcontractors involved in the provision of the Service cybersecurity requirements equivalent to those referred to in point (a); and

h. the Provider's obligations upon termination, including the retrieval and secure disposal of information obtained by the Provider in the course of providing the Service, without prejudice to the DPA and the Data Act Switching Schedule.

10.7 Data Protection. To the extent Customer Data contains personal data, the Provider processes such personal data as a processor on behalf of the Customer in accordance with the DPA. The Provider processes personal data relating to accounts, sign-in, registration, verification, the Directory and the security of the Service as a controller, as described in the Privacy Policy.

11. Intellectual Property

11.1 Provider's Rights. The Provider and its licensors own all rights in the Service, including its software, design, documentation, question templates and catalogue, risk-scoring method, and the Directory as a database. Except for the rights expressly granted in Section 11.2, these Terms do not transfer any such rights to the Customer.

11.2 Licence to the Customer. Subject to these Terms, the Provider grants the Customer a non-exclusive, non-transferable and non-sublicensable right, for the duration of these Terms and within the limits of its Plan, to use the Service, and to permit its Users to use the Service, for the Customer's internal business purposes. The Customer may use any output it generates using the Service, such as assessments and reports, in its own business, including by sharing such output with its auditors and supervisory authorities.

11.3 Feedback. The Provider may use any suggestions or feedback provided by the Customer freely and without any obligation or compensation to the Customer.

11.4 Publicity. The Provider shall not publicly identify the Customer as its customer without the Customer's prior consent.

12. Confidentiality

12.1 Confidentiality Obligation. Each party shall keep confidential all non-public information of the other party and shall use such information solely for the purposes of these Terms. A party may disclose such information only to its employees, advisers and subcontractors who need to know it and who are bound by confidentiality obligations.

12.2 Exceptions. This Section 12 does not apply to information that:

a. is or becomes publicly available;

b. was already known to the receiving party;

c. was independently developed by the receiving party; or

d. was lawfully received from a third party.

12.3 Compelled Disclosure. A party may disclose confidential information where required by law. In such case, the disclosing party shall inform the other party of the disclosure obligation in advance or, at the latest, without undue delay after becoming aware of the court or other official order, unless it is legally obliged to keep such information confidential.

12.4 Customer Data. Customer Data constitutes confidential information of the Customer. The Provider's personnel may access Customer Data only subject to written confidentiality obligations and only to the extent necessary to provide support, verify Organizations, maintain the security of the Service or comply with applicable law.

12.5 Duration. The obligations under this Section 12 shall survive for three (3) years following the termination of these Terms and, with respect to trade secrets, for as long as such information remains a trade secret.

13. Service Scope

13.1 Purpose of the Service. The Service assists the Customer in organizing and documenting the management of security risks relating to its direct suppliers and service providers. Use of the Service does not ensure the Customer's compliance with Directive (EU) 2022/2555 (NIS2) or its national transposition laws, Regulation (EU) 2022/2554 (DORA), Regulation (EU) 2016/679 (GDPR) or any other law or standard.

13.2 No Substitute for Professional Judgment. The Service does not replace the Customer's own judgment, audits or legal advice. All decisions regarding the Customer's suppliers remain the sole responsibility of the Customer.

13.3 Risk Scores. Risk tiers and scores are calculated using a defined methodology based on the answers provided. They are intended to support the Customer's decision-making and do not constitute a certification, rating or guarantee with respect to any supplier.

13.4 General Guidance. Question templates and in-product guidance are general in nature and do not constitute legal or professional cybersecurity advice tailored to the Customer's circumstances.

13.5 No Verification. The Provider does not verify answers or evidence (Section 6.7), and the verification of an Organization does not constitute a security assessment of that Organization (Section 5.3).

14. Liability for Defects

14.1 Paid Plans. For paid Plans, the Provider shall be liable for defects of the Service, being any material non-conformity of the Service with its documentation for the applicable Plan. The Customer shall notify the Provider of any defect without undue delay after discovering it. The Provider shall remedy any duly notified defect within a reasonable period. If the Provider fails to do so, the Customer may terminate the affected Plan and shall be entitled to a refund of prepaid fees for the unused portion of the subscription term.

14.2 Free Plan and Beta Features. The free plan and beta features are provided free of charge, in the condition in which they are made available from time to time. To the extent permitted by applicable law, the Provider shall not be liable for defects of the free plan or of beta features.

14.3 Scope. Except as expressly set out in this Section 14, and to the extent permitted by applicable law, the Provider makes no commitment as to the properties of the Service, including its fitness for any particular purpose of the Customer. Nothing in this Section 14 shall limit or exclude any right to compensation for damage, which is governed exclusively by Section 15.

14.4 Customer's Confirmation. The Customer confirms that all information it provides during registration and verification is true, complete and accurate.

15. Liability

15.1 Unlimited Liability. Nothing in these Terms shall limit or exclude either party's liability for (a) damage caused intentionally or through gross negligence, (b) damage resulting from death or personal injury, or (c) any other liability that cannot be limited or excluded under applicable law. Nothing in this Section 15 shall be construed as a waiver of any claim for damages before the breach of obligation from which damage may arise within the meaning of Section 386(1) of the Commercial Code.

15.2 Foreseeability of Damage. Pursuant to Section 379 of the Commercial Code, damage exceeding the damage which the breaching party foresaw, or could have foreseen, at the time of conclusion of these Terms as a possible consequence of its breach of obligation shall not be compensated. In determining the damage so foreseeable, the parties have taken into account, in particular, the following facts known to both parties at the time of conclusion of these Terms:

a. that the Service is a tool supporting, but not replacing, the Customer's own supplier-risk decisions, which remain the sole responsibility of the Customer (Section 13);

b. the amount of the fees payable for the Service and the fact that the free plan is provided free of charge;

c. that the Provider does not review or verify answers, evidence or other content submitted by Counterparties (Section 6.7); and

d. the Customer's ability to protect itself against loss by maintaining its own records, controls and insurance.

15.3 Damage Not Foreseeable. Having regard to the facts set out in Section 15.2, the parties agree and declare that, at the time of conclusion of these Terms, the Provider neither foresaw nor could have foreseen, as a possible consequence of a breach of its obligations, damage arising from:

a. decisions made by the Customer regarding its suppliers, including the selection, retention or termination of any supplier; or

b. the inaccuracy, incompleteness or unlawfulness of any answers, evidence or other content provided by a Counterparty.

For the avoidance of doubt, this Section 15.3 does not exclude compensation for loss of profit (ušlý zisk), which shall be compensated in accordance with the Commercial Code, subject to Section 15.4.

15.4 Foreseeable Amount of Damage. Having regard to the facts set out in Section 15.2, the parties further agree and declare that the total damage which each party foresaw or could have foreseen at the time of conclusion of these Terms as a possible consequence of all its breaches of obligations under these Terms, including the documents incorporated pursuant to Section 1.3, occurring in any Contract Year, taken together, does not exceed the greater of:

a. the total fees paid or payable by the Customer for the Service in respect of that Contract Year, whether directly or through Microsoft Marketplace; and

b. EUR 500 (five hundred euros).

For the purposes of this Section 15, "Contract Year" means each period of twelve (12) consecutive months commencing on the date of conclusion of these Terms or on any anniversary thereof. Accordingly, pursuant to Section 379 of the Commercial Code and subject to Sections 15.1 and 15.5, damage exceeding the amount determined under this Section 15.4 shall not be compensated.

15.5 Exceptions. Sections 15.3 and 15.4 shall not apply to (a) the Customer's obligation to pay fees and any interest on late payment, or (b) the Customer's obligations under Section 15.7. Any amounts paid under Section 15.7 shall not count towards the amount determined under Section 15.4.

15.6 Contribution of the Injured Party. In accordance with Section 384 of the Commercial Code, a party's obligation to compensate damage shall be reduced proportionately to the extent that the damage was also caused by a breach of obligations of the injured party or by circumstances on its side, including, in the case of the Customer, a breach of Sections 4.3, 4.4, 6.6 or 10.2 by the Customer or its Users.

15.7 Third-Party Claims. The Customer shall compensate the Provider for any damage, including reasonable costs of legal representation, incurred by the Provider as a result of claims asserted against the Provider by third parties arising from (a) Customer Data submitted unlawfully by the Customer or its Users, or (b) a breach of Section 7.1 by the Customer or its Users. The Provider shall notify the Customer of any such claim without undue delay, shall allow the Customer to participate in the defence of such claim at the Customer's expense, and shall not acknowledge or settle any such claim without the Customer's prior written consent, which shall not be unreasonably withheld or delayed.

15.8 Limitation Periods. Nothing in these Terms shall shorten or otherwise modify the limitation periods under Sections 387 to 408 of the Commercial Code.

16. Term and Termination

16.1 Term. These Terms apply from the date of acceptance until the Customer's organization is closed. A paid subscription remains in effect for the subscription term specified in the applicable Order. Unless otherwise specified in the Order, and subject to Section 3.5(c) for subscriptions purchased through Microsoft Marketplace, a paid subscription shall automatically renew for successive periods of twelve (12) months, unless either party gives written notice of non-renewal at least thirty (30) days before the end of the then-current subscription term.

16.2 Termination by the Customer. A Customer on the free plan may close its organization at any time by a written request of an Organization Administrator sent to support@shardscybersecurity.io. A paid subscription terminates at the end of its subscription term in accordance with Section 16.1, or earlier where permitted under these Terms, and in each case subject to the Customer's rights under the Data Act Switching Schedule.

16.3 Termination for Cause. Either party may terminate these Terms with immediate effect by written notice to the other party if the other party:

a. commits a material breach of these Terms and fails to remedy such breach within thirty (30) days of receiving notice thereof; or

b. becomes subject to insolvency, bankruptcy, restructuring or liquidation proceedings, to the extent such termination is permitted by applicable law.

16.4 Termination of the Free Plan. The Provider may terminate a free plan upon sixty (60) days' prior notice.

16.5 Data Export, Switching and Erasure. The Customer may request an export of Customer Data at any time during the term of these Terms. The Customer's rights to switch to another provider of data processing services, to port Customer Data to its own systems and to have Customer Data erased, including the applicable notice, transitional and retrieval periods, are governed by the Data Act Switching Schedule. Upon any termination of these Terms, the Data Act Switching Schedule shall apply.

16.6 Survival. Termination of these Terms shall not affect any rights or obligations accrued prior to termination. Sections 11.1, 11.3, 12, 13, 15 and 19, the Data Act Switching Schedule and, where applicable, the obligations under the NIS2 Security Addendum referred to in Section 10.6(h) shall survive the termination of these Terms.

17. Changes to Terms

17.1 Right to Amend. The Provider may modify the Service and amend these Terms, in whole or in part, only for the following reasons:

a. to reflect changes in applicable laws or standards;

b. to enhance the quality, security or accessibility of the Service; or

c. to prevent abuse or harm.

17.2 Notice of Changes. The Provider shall notify Organization Administrators of any substantial or material change at least thirty (30) days in advance, by email.

17.3 Right to Terminate. If a change may adversely affect the Customer, the Customer may terminate the Service and these Terms within thirty (30) days of receiving notice of the change. If the Customer does not terminate within this period, the change shall be deemed accepted and shall take effect on the date specified in the amended Terms.

17.4 Refund. If a Customer on a paid Plan terminates the Service in accordance with Section 17.3, the Customer shall be entitled to a pro-rata refund of any prepaid fees.

17.5 Incorporated Documents. This Section 17 shall apply mutatis mutandis to any amendment of the documents referred to in Sections 1.3(a) to (d), unless the relevant document provides otherwise, provided that no amendment of the NIS2 Security Addendum shall reduce the overall level of protection afforded to the Customer. An Order referred to in point (i) of the definition of Order may be amended only by a written agreement signed by authorized representatives of both parties. A subscription purchased through Microsoft Marketplace may be changed only through Microsoft Marketplace.

18. Notices

18.1 Notices to the Customer. The Provider shall deliver notices to the Customer by in-app notification to its Organization Administrators or by email to the address of an Organization Administrator.

19. Governing Law and Disputes

19.1 Governing Law. These Terms shall be governed by and construed in accordance with the laws of the Slovak Republic. The parties agree that the conflict-of-laws provisions of the governing law and the United Nations Convention on Contracts for the International Sale of Goods shall not apply.

19.2 Dispute Resolution. The parties shall first attempt to resolve any dispute arising out of or in connection with these Terms within thirty (30) calendar days. If the dispute is not resolved within that period, the courts of the Slovak Republic having jurisdiction over the Provider's registered office in Bratislava shall have exclusive jurisdiction, to which the Customer expressly submits. Nothing in this Section 19.2 shall prevent either party from applying at any time to a competent court for interim measures (neodkladné opatrenie).

20. General

20.1 Assignment. The Customer may not assign these Terms without the Provider's prior consent. The Provider may assign these Terms to a successor in connection with a merger or sale of its business upon prior written notice to the Customer.

20.2 Subcontractors. The Provider may engage subcontractors and shall remain responsible for their performance. The engagement of sub-processors of personal data is governed by the DPA.

20.3 Force Majeure. Neither party shall be liable for any failure to perform caused by events beyond its reasonable control, provided that it has taken reasonable steps to prevent and mitigate such failure.

20.4 Severability. If any provision of these Terms is held by a court of competent jurisdiction to be illegal, invalid or unenforceable, the remaining provisions shall remain in full force and effect.

20.5 No Waiver. No failure or delay in exercising any right under these Terms shall operate as a waiver of that right or of any other term or condition hereof.

20.6 Entire Agreement. These Terms, together with the documents incorporated pursuant to Section 1.3 (including any Order), constitute the entire agreement between the Customer and the Provider with respect to the Service and supersede all prior communications, understandings and agreements relating to the Service, unless otherwise agreed between the parties in writing.

20.7 Language. These Terms are drawn up in the English language. In the event of any discrepancy between language versions of these Terms, the English version shall prevail.

20.8 Electronic Commerce. As between businesses, the parties agree that Section 5(3) to (6) of Act No. 22/2004 Coll. on Electronic Commerce shall not apply.

21. Contact

Shards Cybersecurity s.r.o., Kopčianska 3756/10, 851 01 Bratislava, Slovak Republic

• Support: support@shardscybersecurity.io
• Legal: legal@shardscybersecurity.io
• Privacy: privacy@shardscybersecurity.io
• Security: security@shardscybersecurity.io