Legal

1.1 Cifro

Cifro is a cloud-based software platform for managing, collecting, processing, transforming, enriching, monitoring, matching, analyzing and transferring product and related business data.

The public website is available at cifro.com ("Website"), and the software platform is available through cifro.app and related service domains ("Service Area").

The Website, Service Area and functionality provided through them are collectively referred to as the "Service" or "Cifro."

1.2 Contracting Provider

Cifro is operated under the Cifro brand.

The legal person, entity or sole proprietor acting as the contracting service provider for a particular Customer ("Provider") is identified in the applicable Legal Notice, order confirmation, invoice, payment documentation or other commercial documentation made available to the Customer at or before contracting.

References in these Terms to "Cifro," "we," "us" or "our" mean the applicable Provider acting under the Cifro brand.

1.3 Business-to-Business Service

Cifro is a business-to-business service intended exclusively for businesses, entrepreneurs, organizations and persons acting for purposes related to their trade, business or professional activity.

The Service is not intended for consumers acting primarily for personal, family or household purposes.

By registering an Account, activating a Free Trial, purchasing a Subscription Plan or otherwise using the Service, you represent that:

• you use the Service in a business or professional capacity;
• if you act on behalf of an organization, you have authority to bind that organization; and
• you are not using the Service as a consumer.

1.4 Acceptance

A Customer accepts these Terms when its authorized representative accepts them through the registration, Free Trial, subscription or other applicable electronic acceptance process.

Cifro may record the version of the Terms accepted, the date and time of acceptance and other information reasonably necessary to document such acceptance.

If you do not agree to these Terms, you must not use the Service.

3.1 Account Registration

Access to certain parts of the Website may be available without registration.

Access to the Service Area requires an Account.

The Customer must provide accurate information when creating or maintaining an Account.

3.2 Account Security

The Customer is responsible for:

• maintaining the confidentiality and security of Account credentials;
• controlling access granted to Authorized Users;
• configuring appropriate permissions;
• promptly removing access for persons who are no longer authorized; and
• notifying Cifro without undue delay if unauthorized access is suspected.

3.3 Authorized Users

The Customer may permit Authorized Users to use the Service on its behalf.

The Customer is responsible for activities performed through its Account and for ensuring that Authorized Users comply with these Terms.

4.1 Subscription Plans

Cifro provides the Service through Subscription Plans that may differ in functionality, Resource Limits, usage allowances and pricing.

Current plan characteristics may be described on the Website, in the Service Area, in an offer, quotation, invoice or other commercial documentation.

4.2 Monthly Postpaid Billing

Cifro operates on a monthly postpaid billing model, unless otherwise expressly agreed with the Customer.

At the end of each Billing Period, Cifro calculates the total amount payable for that period.

The amount may include:

• the base Subscription Plan fee;
• charges for exceeding Resource Limits;
• charges for Automated Operations or other metered usage;
• AI-related usage charges where applicable;
• additional functionality or services ordered by the Customer; and
• applicable taxes or other agreed charges.

4.3 Payment

The Customer must pay the amount due by the due date stated in the applicable invoice, payment request, Account or other commercial documentation.

Available payment methods may include:

• online card or acquiring payment; and
• manual payment against an invoice.

Cifro does not automatically charge the Customer's payment card on a recurring basis unless the Customer and Cifro expressly agree otherwise in the future.

Each payment is initiated separately by the Customer.

4.4 Usage-Based Charges

Certain functionality may generate charges based on actual usage.

The Customer is responsible for monitoring its use of the Service, Resource Limits, Automated Operations and any other chargeable usage.

Where available, Cifro may provide usage information or limits in the Service Area, but the Customer remains responsible for configuring and monitoring its workflows and usage.

4.5 Taxes

Unless expressly stated otherwise, fees exclude applicable taxes, duties or similar governmental charges.

The Customer is responsible for taxes applicable to its purchase or use of the Service, except taxes imposed on Cifro's income.

4.6 Refunds

Except where otherwise required by applicable law or expressly agreed by Cifro, payments are final and non-refundable.

Refunds may be considered in cases of:

• a billing error;
• a duplicate payment;
• a refund required by applicable law; or
• another case expressly approved by Cifro.

5.1 Trial Period

Eligible Customers may receive a 30-day Free Trial.

No payment card is required to activate the Free Trial.

Unless otherwise stated, a Free Trial may be used only once by the same Customer or organization.

5.2 No Automatic Conversion

The Free Trial does not automatically convert into a paid subscription.

At the end of the 30-day trial period, access to the Service may be blocked until the Customer makes its first payment for a paid Subscription Plan.

After payment, access may be restored and the Customer may continue using the Service under the applicable paid plan.

5.3 Trial Availability

The Free Trial is a promotional offering.

Cifro may modify eligibility requirements or discontinue offering Free Trials to new Customers.

6.1 Upgrade or Downgrade

The Customer may request an upgrade or downgrade of its Subscription Plan.

Unless otherwise agreed, the new Subscription Plan takes effect from the beginning of the next Billing Period.

The plan applicable during the current Billing Period remains in effect until that period ends.

6.2 Cancellation

The Customer may discontinue its subscription.

Cancellation does not eliminate amounts already accrued or payable for the current or previous Billing Periods.

Any Customer Data that the Customer wishes to retain should be exported before Account deletion or before the applicable retention period expires.

7.1 Cifro as a Software Tool

Cifro provides software tools that allow Customers to collect, process, transform, analyze, manage, automate and transfer data.

The Service may perform operations based on configurations, instructions, formulas, rules, prompts, scenarios, schedules and other settings selected or approved by the Customer.

7.2 Customer Responsibility

The Customer is responsible for:

• determining how the Service is configured and used;
• determining whether a configuration or workflow is appropriate for its business;
• reviewing data and outputs where appropriate;
• decisions and actions taken using the Service or based on Service outputs;
• compliance of its use of the Service with applicable laws and contractual obligations; and
• ensuring that it has the necessary rights to Customer Data and other data processed through the Service.

Cifro does not control the Customer's business decisions or purposes for using the Service.

To the maximum extent permitted by applicable law, Cifro is not responsible for consequences resulting from the Customer's configurations, instructions, automated processes or use of resulting data.

8.1 Ownership

As between Cifro and the Customer, the Customer retains all rights, title and interest in Customer Data.

Nothing in these Terms transfers ownership of Customer Data to Cifro.

8.2 Limited Right to Process Customer Data

The Customer grants Cifro the limited rights necessary to host, store, access, transmit, process, transform, copy and otherwise use Customer Data solely as reasonably necessary to:

• provide the Service;
• perform operations requested or configured by the Customer;
• maintain and secure the Service;
• provide support;
• prevent abuse or security incidents; and
• comply with applicable legal obligations.

8.3 No Sale of Customer Data

Cifro does not sell Customer Data.

8.4 AI Training

Cifro will not use Customer Data to train Cifro's own artificial intelligence models or third-party artificial intelligence models without the Customer's separate consent.

8.5 Aggregated and Anonymized Information

Cifro may use aggregated, anonymized or de-identified technical and usage information that does not identify the Customer or an individual for purposes including:

• Service analytics;
• security;
• performance monitoring;
• capacity planning;
• product development; and
• improvement of the Service.

9.1 AI Processing

Cifro may provide AI-powered functionality for processing, transforming, extracting, classifying, matching, translating, generating, normalizing or enriching Customer Data.

To perform an AI operation, Cifro may transmit Customer Data, prompts, instructions or other information necessary for the requested processing to a third-party AI provider.

Cifro may receive the resulting output and write that output to designated fields or use it in subsequent operations configured by the Customer.

9.2 Third-Party AI Providers

AI functionality may rely on third-party AI providers and models.

Cifro does not guarantee the continued availability, functionality, pricing or characteristics of a particular AI model or provider.

Available models and providers may change over time.

Use of a third-party AI service may also be subject to that provider's own terms and policies.

9.3 Customer AI Provider Accounts and Charges

Where the Customer connects or uses its own third-party AI provider account, credentials, API key or billing relationship:

• all charges imposed by that provider are the Customer's responsibility;
• Cifro does not control the provider's pricing, token consumption, billing methodology or account limits; and
• Cifro is not responsible for charges incurred on the Customer's third-party AI account as a result of the Customer's use or configuration of AI Features.

The Customer is responsible for configuring any spending limits, usage limits, quotas or other safeguards available through the relevant AI provider.

This includes charges resulting from:

• repeated processing;
• scheduled operations;
• automated scenarios;
• large data volumes;
• incorrectly configured workflows;
• repeated failures or retries; and
• unexpectedly high use.

Where AI usage is provided through Cifro rather than through the Customer's own provider account, applicable AI or processing charges may form part of Cifro usage charges under the applicable Subscription Plan.

9.4 AI Output

AI-generated or AI-assisted results may be inaccurate, incomplete, inconsistent or unsuitable for a particular purpose.

The Customer is responsible for determining whether AI output is suitable for its intended use.

9.5 Automatic Application of AI Results

Cifro may allow the Customer to configure AI results to be applied automatically without prior manual review or confirmation.

Automatic application may include:

• writing values into Customer Data fields;
• modifying product information;
• assigning categories or attributes;
• using AI-generated values in subsequent processing;
• triggering additional scenarios or Automated Operations; or
• exporting resulting data.

By enabling automatic application, the Customer acknowledges that AI-generated results may contain errors or unexpected output and may be applied before review by a person.

The Customer is responsible for deciding whether automatic application is appropriate, configuring relevant safeguards and monitoring the resulting operations.

10.1 Extraction Tools

Cifro may provide technical tools that allow the Customer to obtain or process data from:

• third-party websites;
• price lists;
• files;
• feeds;
• external databases;
• APIs;
• supplier or competitor sources; and
• other external data sources.

10.2 Customer Responsibility

The Customer is responsible for ensuring that it has the rights, permissions and lawful basis necessary to access, extract, process and use data from sources selected or configured by the Customer.

This includes compliance with applicable:

• laws;
• contractual obligations;
• intellectual property rights;
• database rights;
• privacy and data protection requirements; and
• third-party rights.

Cifro provides technical tooling and does not independently verify the Customer's legal right to use each source or dataset.

10.3 Right to Restrict Processing

Cifro may refuse, limit, suspend or discontinue processing of a particular source if Cifro reasonably believes that processing may:

• violate applicable law;
• violate third-party rights;
• create a material security risk;
• breach applicable contractual restrictions; or
• create material legal or technical risk for Cifro or the Service.

11.1 Integrations

Cifro may provide connectors, import tools, export tools, APIs or other interfaces for exchanging data with third-party systems.

The availability, functionality and technical requirements of such interfaces may change over time.

Certain integrations may require separate configuration, credentials or third-party accounts.

11.2 Third-Party Services

Cifro may use or integrate with third-party:

• hosting and infrastructure providers;
• communication services;
• payment providers;
• AI providers;
• monitoring services;
• data sources;
• software services; and
• other subprocessors or technical providers.

Cifro does not control third-party services and does not guarantee their continued availability, functionality, pricing or performance.

11.3 Subprocessors

Where required by applicable data protection law, additional information regarding subprocessors and data processing arrangements may be provided through Cifro's Privacy Policy, Data Processing Agreement, Subprocessor List or other applicable documentation.

12.1 Confidential Information

Each party may receive non-public information belonging to the other party.

Confidential Information may include:

• Customer Data;
• product information;
• supplier and customer information;
• prices and inventory;
• business rules and configurations;
• credentials;
• commercial information;
• technical information;
• product roadmaps;
• non-public pricing;
• documentation; and
• other information that reasonably should be understood to be confidential.

12.2 Obligations

Each party will:

• protect the other party's Confidential Information using reasonable safeguards;
• use such information only as necessary for performance or use of the Service; and
• disclose it only to personnel, contractors, professional advisers or service providers who need access and are subject to appropriate confidentiality obligations.

12.3 Exclusions

Confidentiality obligations do not apply to information that the receiving party can demonstrate:

• became publicly available without breach of these Terms;
• was lawfully known before disclosure;
• was independently developed without use of the other party's Confidential Information; or
• was lawfully obtained from a third party without confidentiality restrictions.

12.4 Required Disclosure

A party may disclose Confidential Information where required by law or a binding order of a competent authority.

Where legally permitted, the receiving party should provide reasonable notice before such disclosure.

15.1 Standard Technical Support

Cifro may provide technical support for standard Service functionality, including:

• account and configuration questions;
• guidance regarding built-in functionality;
• troubleshooting technical errors;
• investigation of Service-related performance issues; and
• questions regarding Subscription Plans, Resource Limits and billing.

Support availability and response priority may depend on the applicable Subscription Plan.

15.2 Exclusions

Unless separately agreed, standard Technical Support does not include:

• custom development;
• development of customer-specific integrations;
• manual data cleaning or normalization;
• manual management of Customer Data;
• recovery of data already permanently deleted;
• individual consulting;
• custom migration work; or
• business strategy or operational consulting.

Such work may be offered as Professional Services.

16.1 Availability

Cifro will use commercially reasonable efforts to maintain the availability and operation of the Service.

Cifro does not guarantee uninterrupted or error-free availability.

16.2 Maintenance

The Service may be temporarily unavailable because of:

• planned maintenance;
• emergency maintenance;
• software updates;
• infrastructure changes; or
• security measures.

Cifro will provide advance notice of material planned maintenance where reasonably practicable.

16.3 External Events

Cifro is not responsible for Service interruptions caused by circumstances outside its reasonable control, including:

• third-party provider failures;
• internet or telecommunications failures;
• external cyberattacks;
• Customer systems or configurations;
• actions of the Customer or Authorized Users;
• governmental actions; or
• Force Majeure Events.

16.4 Security

Cifro will use commercially reasonable technical and organizational measures intended to protect the Service and Customer Data.

No internet-based service can guarantee absolute security.

The Customer remains responsible for Account security, credentials, Authorized Users and the security of systems connected to Cifro.

17.1 Product Development

Cifro is continuously developed and may be updated automatically.

Cifro may add, modify, improve, replace or discontinue features.

17.2 Ordinary Product Changes

Ordinary updates, improvements and changes may be implemented without separate Customer approval, provided that they do not materially reduce the core functionality of the Service already paid for during the applicable Billing Period.

17.3 Material Changes

Where Cifro makes a material change to:

• these Terms;
• Subscription pricing; or
• material billing rules,

Cifro will provide reasonable advance notice.

Changes to pricing will normally take effect from the next applicable Billing Period unless otherwise stated or agreed.

If the Customer does not agree to a material change, it may discontinue use of the Service before the change becomes effective.

20.1 Payment Due Date

If the Customer does not pay the amount due by the payment due date, the following process applies.

20.2 After 11 Calendar Days

After 11 calendar days of non-payment, Automated Operations may be suspended.

Manual Account access may remain available.

20.3 After 31 Calendar Days

After 31 calendar days of non-payment, access to the Account and Service may be fully blocked for the Account Owner and Authorized Users.

20.4 After 61 Calendar Days

If payment is not received during the additional 30-day period following full blocking — a total of 61 calendar days from the missed payment due date — Cifro may permanently delete the Account and associated Customer Data.

Once permanently deleted, such data may no longer be recoverable.

20.5 Reactivation

If outstanding amounts are paid before full blocking, Service functionality and Automated Operations may be restored.

If payment is made after full blocking but before permanent deletion, Cifro may restore access where technically possible.

Cifro does not guarantee that all previously stored or processed data can be restored in such circumstances.

20.6 Responsibility for Payment-Related Interruption

The Customer is responsible for ensuring timely payment.

To the maximum extent permitted by applicable law, Cifro is not responsible for business interruption, missed Automated Operations or other consequences resulting from Service restrictions applied in accordance with this Section because of non-payment.

21.1 Termination

The Customer may stop using Cifro and may request Account deletion through the applicable support or Account process.

21.2 Data Export Before Deletion

The Customer is responsible for exporting Customer Data it wishes to retain before permanent Account deletion.

21.3 Permanent Deletion

Following permanent Account deletion, Customer Data in active production systems will be deleted, except information that Cifro is required to retain by applicable law.

Residual copies may remain temporarily in routine technical backup systems until overwritten or deleted through Cifro's ordinary backup lifecycle.

Such backup copies are not considered active Customer accounts and may not be available for individual restoration.

21.4 Suspended Accounts

Where an Account is suspended rather than permanently deleted, Cifro may retain Customer Data while the suspension or underlying issue is being resolved.

22.1 Standard Export

The Customer may use the standard data export functionality made available by Cifro to export Customer Data in the formats supported by the Service.

22.2 Switching and Portability

Where applicable law requires data portability, switching assistance or data retrieval rights, Cifro will provide the functionality and assistance required by such law.

Cifro will not impose switching charges where such charges are prohibited by applicable law.

22.3 Optional Paid Migration Services

At the Customer's request, Cifro may provide additional services beyond standard export and legally required switching assistance, including:

• custom data formats;
• data transformation;
• field mapping;
• data cleaning;
• custom export development;
• custom connectors;
• migration to another platform;
• migration validation; or
• consulting and technical assistance.

These services may be charged separately as Professional Services where the Customer agrees to the applicable scope and price.

23.1 Cifro Technology

Cifro and its licensors retain all rights, title and interest in and to:

• the Service;
• software;
• source code;
• user interface;
• architecture;
• algorithms;
• documentation;
• trademarks;
• designs; and
• other technology or intellectual property belonging to Cifro.

Except for the rights expressly granted under these Terms, no intellectual property rights are transferred to the Customer.

23.2 Customer License to Use the Service

Subject to these Terms and payment of applicable fees, Cifro grants the Customer a limited, non-exclusive, non-transferable right to access and use the Service for the Customer's internal business purposes during the applicable subscription period.

23.3 Feedback

If the Customer voluntarily provides suggestions or feedback regarding Cifro, Cifro may use such feedback to improve the Service without restriction or compensation, provided that doing so does not grant Cifro ownership of Customer Data or Customer Confidential Information.

25.1 Excluded Losses

To the maximum extent permitted by applicable law, Cifro will not be liable for indirect, incidental, special, punitive, exemplary or consequential damages, or for loss of:

• profits;
• revenue;
• business opportunities;
• anticipated savings;
• goodwill; or
• business interruption,

arising from or related to the Service or these Terms.

25.2 Liability Cap

To the maximum extent permitted by applicable law, Cifro's total aggregate liability arising out of or relating to the Service or these Terms will not exceed the fees paid or payable by the Customer for one Billing Period immediately preceding the event giving rise to the claim.

For claims arising solely during a Free Trial for which no fees were paid, liability will be limited to the maximum extent permitted by applicable law.

25.3 Non-Excludable Liability

Nothing in these Terms excludes or limits liability where such exclusion or limitation is prohibited by applicable law, including where applicable in cases of fraud, intentional misconduct or other liability that cannot legally be excluded or limited.

30.1 Entire Agreement

These Terms, together with applicable Subscription Plan information, Privacy Policy, DPA, commercial documentation and any applicable Professional Services agreement, constitute the agreement governing use of the Service.

30.2 Order of Precedence

If documents conflict:

1. a specifically negotiated written agreement or Statement of Work prevails for the subject matter it expressly covers;
2. applicable order, quotation or commercial documentation applies next;
3. these Terms apply thereafter.

30.3 Assignment

The Customer may not assign its rights or obligations under these Terms without Cifro's prior written consent, except as required by applicable law.

Cifro may assign the agreement in connection with a corporate restructuring, financing, merger, acquisition, sale of business or transfer of the Cifro Service to another legal entity, subject to applicable law.

30.4 Severability

If any provision of these Terms is found unenforceable, the remaining provisions remain in effect.

The invalid provision will be interpreted or replaced to the minimum extent necessary to make it enforceable while preserving its intended commercial purpose where possible.

30.5 No Waiver

Failure to enforce a provision does not constitute a waiver of that provision.

30.6 Survival

Provisions that by their nature should survive termination will survive, including provisions relating to:

• payment obligations;
• confidentiality;
• intellectual property;
• data deletion;
• liability;
• indemnification; and
• dispute resolution.

30.7 Language

These Terms may be translated into other languages for convenience.

The English version is the controlling version.

If a translation conflicts with the English version, the English version prevails to the extent permitted by applicable law.

3.1 Cifro as Data Controller

Cifro generally acts as controller for personal data necessary to operate and administer its own business and Service, including account administration, billing, sales, support, security, Website analytics, marketing communications and compliance activities.

3.2 Cifro as Data Processor

Customers may upload, import, collect, generate, synchronize or otherwise process personal data relating to third parties through Cifro.

Such data may include, for example, business contact information relating to employees, suppliers, sellers, contractors, representatives, partners or other persons.

Where the Customer determines why and how such personal data is processed and Cifro processes it solely on the Customer's behalf and according to the Customer's instructions, the Customer acts as the data controller and Cifro acts as the data processor.

Such processing is additionally governed by the applicable Data Processing Agreement ("DPA").

The Customer is responsible for determining the lawful basis for its processing, providing required privacy notices, obtaining any required permissions or consents and ensuring that its use of Cifro complies with applicable law.

Cifro is not responsible for independently verifying the lawful basis, provenance or legality of every dataset submitted to the Service by Customers.

4.1 Account and Contact Data

This may include your name, business email address, company or organization, position or role, account role and other business contact information.

A telephone number may also be provided, but it is generally optional.

We may process authentication and account-security information necessary to provide access to the Service.

4.2 Invited User Data

An Account Owner or Authorized User may invite colleagues or other persons to a Cifro account.

In such cases, we may receive your business email address and related information from your employer, organization, Account Owner or another Authorized User rather than directly from you.

4.3 Lead and Inquiry Data

When you submit a Free Trial request, Request Demo, Contact Sales or similar form, we may collect information such as your name, business email, company, optional telephone number and information contained in your request or message.

Such information may be processed through CRM and business communication systems used by Cifro.

4.4 Billing and Transaction Data

Cifro may process company billing details, invoice information, payment amount, payment status and related accounting information.

Payment card information is processed by third-party payment service providers.

Cifro does not receive or store full payment card details.

Cifro receives only limited payment information required for billing and subscription administration, such as the payment amount and payment status.

4.5 Support and Correspondence Data

If you contact Cifro through email, a helpdesk, messaging platform or another support channel, we may process your contact details, message contents, attachments, technical information and records of the communication.

Where third-party communication platforms are used, those providers may also process information in accordance with their own privacy terms.

4.6 Technical, Security and Audit Data

Cifro may automatically collect and maintain technical information such as IP address, browser or device information, login events, authentication events, timestamps, system events, error logs and security-related information.

The Service may also maintain audit records concerning actions performed by users, including imports, exports, scenarios, automated operations and other actions performed through the account.

4.7 Usage Data

We may process information about how users interact with the Website and Service, such as pages or features used, actions performed, session activity, feature usage and related technical metadata.

4.8 Customer Data and Customer-Controlled Personal Data

Customers may submit product catalogs, price lists, product information, supplier information, competitor information, files, datasets and other content to Cifro.

Such Customer Data may occasionally contain personal data.

Where Cifro processes that personal data on behalf of a Customer, Section 3.2 and the applicable DPA apply.

4.9 Integration Data

Where a Customer connects Cifro to an external application, system, API, data source or other integration, Cifro may process connection information, configuration information, identifiers, tokens, credentials or other information reasonably required to operate the integration.

4.10 AI Processing Data

Where AI functionality is used, Cifro may process and retain prompts, instructions, selected input data, contextual data, AI-generated outputs and technical metadata relating to AI execution.

More information is provided in Section 9.

4.11 Marketing Data

Where you subscribe to marketing communications, we may process your contact information, subscription status and information reasonably necessary to administer marketing preferences.

Marketing consent may be collected through an optional checkbox during registration or Free Trial activation or through separate subscription forms on the Website.

7.1 Service Communications

We may send emails or other communications necessary to operate the Service, including messages concerning account access, security, billing, subscription status, technical issues, changes affecting the Service, legal notices and other important operational matters.

These communications are not marketing communications and may be necessary while an account or business relationship remains active.

7.2 Marketing Communications

Where you have subscribed to marketing communications, Cifro may send product news, feature announcements, educational materials, offers and other marketing information.

Marketing subscription is optional and is not required to use Cifro.

You may unsubscribe at any time through the unsubscribe mechanism contained in marketing emails.

Cifro may retain limited suppression information after an unsubscribe request where necessary to ensure that the marketing preference continues to be respected.

1.1 Cifro

"Cifro" means the Cifro SaaS Platform operated by the Provider identified in the applicable Legal Notice and, where relevant, the Customer's order, invoice or other commercial documentation.

1.2 Customer

"Customer" means the business, organization or other legal person that has accepted the Customer Agreement or is identified as the Customer in the relevant Cifro account, order, invoice or other commercial documentation.

1.3 Incorporation

This DPA automatically forms part of the Customer Agreement whenever Cifro processes Personal Data on behalf of Customer. A separate signature is not required unless separately agreed. For enterprise, procurement, tender, compliance or similar purposes, the Parties may execute this DPA or a substantially equivalent version separately.

1.4 B2B Use

The Service is intended exclusively for business use. Customer represents that it enters into this DPA in connection with its business, trade or professional activities.

3.1 Customer as Controller

Where Customer determines the purposes and means of Processing Customer Personal Data, Customer acts as Controller and Cifro acts as Processor.

3.2 Other Relationships

Where Customer itself acts as Processor for another Controller, Cifro may act as Customer's Subprocessor. References in this DPA to Customer's obligations as Controller shall apply to Customer to the extent relevant to its own obligations toward the applicable Controller.

3.3 Cifro as Independent Controller

This DPA does not apply to Personal Data that Cifro Processes as an independent Controller for its own legitimate purposes, including account administration, billing, security, fraud prevention, support administration and compliance activities. Such Processing is governed by Cifro's Privacy Policy.

5.1 Documented Instructions

Cifro shall Process Customer Personal Data only on Customer's documented instructions, except where otherwise required by Applicable Data Protection Law.

For purposes of this DPA, documented instructions include without limitation:

• the Customer Agreement;
• this DPA;
• configurations selected within the Service;
• account and user settings;
• imports and exports;
• integrations;
• workflows and scenarios;
• formulas and automation rules;
• AI configurations and prompts;
• APIs and connectors;
• Customer-selected data sources;
• retention or deletion settings;
• actions initiated by Account Owners or Authorized Users; and
• other instructions submitted or authorized through the Service.

Customer's use or configuration of a Service feature constitutes an instruction to Process the relevant Customer Personal Data as reasonably necessary to provide that feature.

5.2 Additional Instructions

Instructions outside the normal functionality or scope of the Service require Cifro's prior agreement. Cifro may treat implementation of additional or bespoke instructions as Professional Services subject to additional fees.

5.3 Unlawful or Risky Instructions

Cifro may refuse, suspend, limit or request modification of an instruction where Cifro reasonably believes that the instruction:

• violates Applicable Data Protection Law or another applicable law;
• creates a material security risk;
• infringes third-party rights;
• is technically unreasonable;
• conflicts with the Customer Agreement; or
• falls materially outside the intended scope of the Service.

Where required by Applicable Data Protection Law, Cifro will inform Customer if Cifro believes an instruction infringes applicable data protection requirements.

6.1 Lawful Basis

Customer has and will maintain a valid lawful basis for the collection and Processing of Customer Personal Data.

6.2 Notices and Consents

Customer has provided all notices and obtained all consents, permissions, authorizations or other rights required by applicable law.

6.3 Authority to Use Cifro

Customer has the right to disclose Customer Personal Data to Cifro and to authorize Cifro and its Subprocessors to Process it as contemplated by the Customer Agreement.

6.4 Data Accuracy

Customer is responsible for the accuracy, quality, relevance and legality of Customer Personal Data.

6.5 Customer Configuration

Customer determines what information is submitted to Cifro, which users receive access, which integrations and data sources are connected, which workflows and automated operations are enabled, which AI functionality is used and, where applicable, available retention and deletion configurations.

6.6 Authorized Users

Customer is responsible for actions and omissions of its Account Owners, Authorized Users and other persons using Customer credentials or Customer-controlled access.

6.7 External Data Sources

Customer is responsible for determining whether it has the legal right to collect and Process information obtained through scraping, extractors, imports, APIs, feeds, integrations, websites, third-party datasets and other external sources. Cifro is not required to independently investigate the lawful origin of every source or dataset selected by Customer.

6.8 Reliance on Customer

To the fullest extent permitted by law, Cifro may rely on Customer's instructions, representations and warranties regarding Customer Personal Data and is not required to independently perform a legal review of each dataset or Processing activity.

10.1 Security Measures

Cifro shall implement appropriate technical and organisational measures designed to provide a level of security appropriate to the relevant risks. The general categories of measures are described in Annex 2.

10.2 Changes to Security Measures

Cifro may modify, replace, improve or reorganize its security measures from time to time, provided that such changes do not materially reduce the overall level of protection applicable to Customer Personal Data.

10.3 No Absolute Security Guarantee

No electronic system, network, storage technology or data transmission method can be guaranteed to be completely secure. Accordingly, this DPA does not constitute a guarantee of absolute security, zero security incidents, uninterrupted availability, zero vulnerabilities or compliance with any specific certification or security standard unless expressly agreed separately in writing.

10.4 Security Information

Cifro may provide Customer with reasonable security documentation where appropriate. Cifro is not required to disclose information where disclosure would reasonably create a security risk, reveal exploitable vulnerabilities, compromise another Customer, expose confidential infrastructure information or disclose Cifro or third-party trade secrets.

11.1 General Authorization

Customer grants Cifro general authorization to engage Subprocessors in connection with the Service.

11.2 Subprocessor List

Current Subprocessors are maintained in Cifro's public Subprocessor List on cifro.com. The Subprocessor List is incorporated by reference into this DPA.

11.3 Changes

Cifro may add, remove or replace Subprocessors from time to time. Where Applicable Data Protection Law requires notification or an opportunity to object, Cifro will provide an appropriate mechanism consistent with applicable requirements. Cifro is not required under this DPA to provide a fixed advance notification period unless separately agreed or legally required.

11.4 Customer Objections

Any Customer objection to a new Subprocessor must be made on reasonable grounds, relate specifically to protection of Customer Personal Data and describe the material data protection risk relied upon. A general commercial objection or preference for another provider is not sufficient.

Cifro and Customer will use commercially reasonable efforts to address a valid objection. If no reasonable solution is available, Cifro may, as appropriate, replace the Subprocessor, change the relevant Processing arrangement, disable or limit the affected feature, permit Customer to discontinue the affected Processing or terminate the affected Service component. Nothing requires Cifro to materially redesign the Service or incur disproportionate cost to accommodate Customer's objection.

11.5 Subprocessor Obligations

Where required under Applicable Data Protection Law, Cifro will impose on Subprocessors data protection obligations appropriate to the Processing and consistent with applicable processor requirements.

11.6 No Additional Warranty

Cifro's engagement of a Subprocessor does not constitute a guarantee that the Subprocessor will operate without interruption, never experience a security incident, never make an error or provide services beyond its contractual obligations. Nothing in this DPA expands Cifro's liability beyond liability imposed by Applicable Data Protection Law and the Customer Agreement.

11.7 Liability Framework

To the fullest extent permitted by applicable law, any liability of Cifro arising from acts or omissions of a Subprocessor is subject to the exclusions, limitations and aggregate liability cap contained in the Customer Agreement. Nothing in this provision excludes liability that cannot lawfully be excluded or limited.

11.8 No Direct Audit Right

Customer does not receive a direct contractual audit right against a Cifro Subprocessor solely by virtue of this DPA. Cifro may rely on third-party certifications, audit reports, compliance documentation or other evidence provided by Subprocessors where reasonably appropriate. Cifro is not required to disclose confidential contracts with Subprocessors.

14.1 Customer Responsibility

Customer is responsible for determining whether a Data Subject request is valid, determining the legally required response, meeting applicable response deadlines and communicating with the Data Subject.

14.2 Requests Received by Cifro

If Cifro receives a request concerning Customer Personal Data for which Cifro acts as Processor, Cifro may redirect the requester to Customer unless Cifro is legally required to respond directly.

14.3 Assistance

Taking into account the nature of Processing, Cifro shall provide reasonable assistance to Customer through appropriate technical and organisational measures where required by Applicable Data Protection Law.

14.4 Self-Service Functionality

Cifro is not required to manually perform an operation that Customer can reasonably perform through available Service functionality.

14.5 Additional Assistance

If Customer requests extensive manual searches, custom reports, custom exports, engineering work, bespoke data transformation, historical restoration or other assistance beyond standard Service functionality, Cifro may treat that assistance as Professional Services and charge reasonable fees, except to the extent applicable law requires such assistance to be provided without additional charge.

14.6 Identification

Customer must provide information reasonably sufficient for Cifro to identify the relevant account, Data Subject, dataset and Processing activity.

15.1 Notification

Where required by Applicable Data Protection Law, Cifro shall notify Customer of a confirmed Personal Data Breach affecting Customer Personal Data without undue delay after becoming aware of it.

15.2 Content of Notice

Cifro will provide information reasonably available to it and required by applicable law. Customer acknowledges that investigation may be ongoing when the initial notice is issued. Cifro may therefore provide information in stages as it becomes reasonably available.

15.3 No Admission

A notification or communication concerning an incident does not constitute an admission of fault, liability, negligence or breach of this DPA.

15.4 Non-Breach Events

Cifro is not required under this Section to notify Customer of an event that does not constitute a Personal Data Breach under Applicable Data Protection Law.

15.5 Customer Notifications

Customer remains responsible for determining whether it must notify Data Subjects, Supervisory Authorities, business partners or other parties.

15.6 Assistance

Cifro shall provide reasonable assistance as legally required. Significant bespoke assistance beyond Cifro's standard incident response may be subject to reasonable fees, except where applicable law requires otherwise.

15.7 Customer-Caused Incidents

To the fullest extent permitted by law, Cifro is not responsible for a Personal Data Breach caused by Customer, Customer personnel, Authorized Users, compromised Customer credentials, Customer misconfiguration, Customer Third-Party Services, unlawful Customer instructions or Customer's failure to implement appropriate security measures, except to the extent Cifro itself is legally responsible for the event.

16.1 Compliance Information

Cifro shall make information reasonably necessary to demonstrate compliance with applicable Processor obligations available to Customer.

16.2 Documentary Review First

Where reasonably sufficient, Cifro may satisfy Customer compliance requests through written responses, security documentation, compliance questionnaires, independent audit reports, certifications, summaries, Subprocessor documentation or other reasonably appropriate evidence.

16.3 Frequency

Customer shall not conduct repetitive or excessive audits. Unless required by law, a further audit may be refused or deferred where substantially equivalent information has recently been provided and there has been no material change or incident reasonably justifying another audit.

16.4 Notice and Scope

Customer shall provide reasonable prior notice of an audit request. Audits must have a reasonable scope, occur during reasonable business hours, minimize disruption to Cifro, comply with Cifro's security requirements and be subject to appropriate confidentiality obligations.

16.5 Restricted Information

Except where strictly required by law, Customer is not entitled to access source code, data relating to other Customers, systems unrelated to Customer, internal vulnerability details, penetration-testing techniques or exploitable findings, confidential Subprocessor agreements, trade secrets or information whose disclosure would reasonably increase security risk.

16.6 On-Site Audits

On-site audits are permitted only where reasonably justified and where documentary evidence is insufficient, or where required by applicable law or a competent Supervisory Authority.

16.7 Costs

Customer bears its own audit costs. Where an audit or compliance request requires significant bespoke, extraordinary or on-site assistance from Cifro, Customer shall reimburse Cifro's reasonable costs, except to the extent prohibited by applicable law.

16.8 Subprocessor Audits

Customer does not have an automatic right to audit a Subprocessor directly. Where appropriate, Cifro may provide available third-party reports, certifications or other information regarding the relevant Subprocessor.

18.1 Processing Locations

Customer Personal Data may be Processed in countries where Cifro, its service providers and Subprocessors operate. Cifro does not commit under this DPA to store or Process Customer Personal Data exclusively in a particular country or region unless separately agreed in writing.

18.2 Transfer Mechanisms

Where Applicable Data Protection Law requires a specific mechanism for an international transfer, Cifro shall use an appropriate legally recognized mechanism. Such mechanisms may include an adequacy decision, SCCs, another approved contractual mechanism or another lawful mechanism available under Applicable Data Protection Law.

18.3 SCCs

SCCs apply only to the extent legally required for the relevant transfer.

18.4 Changes to Transfer Mechanisms

Cifro may replace, supplement or modify a transfer mechanism where reasonably necessary because of changes in law, regulatory guidance, court decisions, infrastructure changes, changes of Subprocessor, Processing location changes or invalidation, replacement or modification of an existing mechanism. Such changes do not require execution of a new DPA unless applicable law requires otherwise.

18.5 Customer Cooperation

Customer shall reasonably provide information necessary for legally required transfer assessments.

18.6 Customer Third-Party Services

Where Customer independently connects or uses a Customer Third-Party Service, Customer is primarily responsible for evaluating and implementing any international transfer mechanism applicable to Customer's relationship with that third party.

19.1 Customer Export

Customer is responsible for exporting information it wishes to retain before termination, closure or expiration of the Service.

19.2 Following Termination

Following termination, Cifro may delete or return Customer Personal Data in accordance with the Customer Agreement, available Service functionality, Customer instructions, applicable legal requirements and Cifro's standard retention and deletion procedures.

19.3 No Indefinite Preservation

Cifro is not required to preserve Customer Personal Data indefinitely after termination.

19.4 Backups and Residual Copies

Deleted Customer Personal Data may remain temporarily in backups, disaster-recovery systems, redundant storage, security records, archives or other residual copies. Such copies may remain until deleted, overwritten or rendered inaccessible through Cifro's normal data lifecycle. They are not intended for routine business use and may be accessed where reasonably necessary for disaster recovery, security, legal compliance, fraud prevention, investigation, disputes or establishment, exercise or defence of legal claims.

19.5 Legally Required Retention

Cifro may retain information where required or permitted by law, including for legal, security, accounting, dispute-resolution, fraud-prevention or claims purposes.

19.6 Custom Restoration or Export

Cifro does not guarantee availability of bespoke recovery, historical restoration, custom migration or custom export after termination. If available, such work may be treated as paid Professional Services unless applicable law requires otherwise.

20.1 Customer Agreement Applies

This DPA does not create a separate or additional liability regime. To the fullest extent permitted by applicable law, all liability arising from or relating to this DPA is subject to the same exclusions, disclaimers, limitations, aggregate liability cap and claims procedures contained in the Customer Agreement.

20.2 No Increased Liability

Nothing in this DPA is intended to increase Cifro's contractual liability beyond the liability expressly assumed in the Customer Agreement.

20.3 Non-Excludable Liability

Nothing limits or excludes liability to the extent such liability cannot legally be limited or excluded.

22.1 Term

This DPA remains effective for the duration of the Customer Agreement and thereafter for as long as Cifro continues to Process Customer Personal Data subject to this DPA.

22.2 Survival

Provisions that by their nature should survive termination remain effective for as long as applicable, including provisions concerning confidentiality, retention and deletion, liability, indemnity, audits relating to prior Processing, international transfers and legal compliance. Termination of the Customer Agreement does not require immediate deletion of every copy of Customer Personal Data outside the deletion and retention framework described in this DPA.

25.1 No Third-Party Contract Rights

Except where Applicable Data Protection Law or applicable SCCs expressly provide otherwise, this DPA does not create contractual rights for persons who are not Parties to the Customer Agreement.

25.2 Severability

If any provision is invalid or unenforceable, the remaining provisions continue in effect. The invalid provision shall be interpreted or modified to the minimum extent necessary to make it enforceable where legally possible.

25.3 Governing Law

The governing law and dispute-resolution provisions of the Customer Agreement apply to this DPA, subject to mandatory provisions of Applicable Data Protection Law and any applicable SCCs.

25.4 Language

The English version of this DPA is the controlling version. Any translation is provided for convenience only.

1. General Authorization

Customer authorizes Cifro to use Subprocessors in accordance with Section 11 of this DPA.

2. Current List

The current list of relevant Subprocessors is maintained separately on the Cifro Subprocessor List page available through cifro.com. The Subprocessor List is incorporated into this DPA by reference.

3. Updates

Cifro may update the Subprocessor List from time to time. Applicable notification and objection rights are governed by Section 11, Applicable Data Protection Law and any applicable separately agreed terms.

4. Customer Third-Party Services

Customer Third-Party Services are not included in the Cifro Subprocessor List where the relevant third party is independently selected or contracted by Customer and does not act as a Subprocessor appointed by Cifro.

End of Data Processing Agreement