Terms of Service

Rules for using getBrand.io.

§ 1. GENERAL PROVISIONS AND DEFINITIONS

  1. These Terms (hereinafter: the “Terms”) set out the rules, scope and conditions of use of the technology platform and of the services provided by electronic means by the company operating under the business name Innodia sp. z o.o. with its registered office in Bydgoszcz (85-009), Poland, ul. Dworcowa 29/6, entered into the register of entrepreneurs of the National Court Register maintained by Sąd Rejenowy w Bydgoszczy, XIII Wydział Gospodarczy Krajowego Rejestru Sądowego under KRS number: 0001237194, with share capital of 5000 PLN, holding NIP: 9671497788 and REGON: 544572940 (hereinafter as: the “Provider”).

  2. The Terms constitute terms and conditions for the provision of services by electronic means within the meaning of Article 8(1)(1) of the Polish Act of 18 July 2002 on the Provision of Services by Electronic Means.

  3. Definitions of the terms used in the Terms:

    1. Platform – the internet platform available at https://getbrand.io together with all its subpages, subdomains, applications and application programming interfaces (API), through which the Provider provides the Services.

    2. User – a natural person who has reached 18 years of age and has full capacity to perform legal acts, conducting business or professional activity and using the Platform solely for a purpose directly related to that activity (B2B relationship), a legal person or an organizational unit without legal personality to which the law grants legal capacity, using the Platform; registration and use of the Platform by a consumer within the meaning of Article 221 of the Polish Civil Code, or by a natural person referred to in Article 3855 of the Polish Civil Code (entrepreneur with consumer rights), as well as by a minor, are strictly prohibited.

    3. Reseller (Paddle) – a third party, i.e. respectively: Paddle.com Market Ltd., Paddle Payments Ltd. or Paddle.com Inc., acting as an authorized reseller and merchant of record (the entity bearing sole legal and financial responsibility for the execution of the transaction - Merchant of Record), being the direct party to the contract of sale of paid subscription plans to the User, responsible for collecting fees, invoicing, taxes and financial settlements.

    4. Account – the individual profile of the User on the Platform, constituting a set of resources in the Provider’s ICT system, secured by a unique identifier (e-mail address), through which the User obtains access to the Services.

    5. Login Form – the interface on the Platform enabling registration (creation of an Account) or authentication and obtaining access to the Account.

    6. Identifier – data entered by the User through the Platform application or the API interface for the purpose of submitting a Query, comprising in particular an internet domain name, a URL address within a given domain, an e-mail address associated with a domain or other input parameters specified in the technical documentation of the Platform (https://getbrand.io/docs), enabling the algorithmic acquisition of information about the brand associated with such data.

    7. Query – an order to retrieve and analyze the identification and visual data of a given brand, submitted by the User through the Account (including through the API interface) by entering the selected Identifier.

    8. API (Application Programming Interface) – the programming interface made available by the Provider enabling the integration of the User’s external systems with the infrastructure of the Platform for the purpose of automating the sending of Queries.

    9. Service / Services – services provided by the Provider by electronic means in the SaaS (Software as a Service) model, consisting in making available analytical tools for the automatic acquisition and processing of publicly available identification and visual data of brands.

    10. Agreement – the agreement for the provision of services by electronic means concluded between the Provider and the User on the terms set out in the Terms.

    11. Pricing – the current list of subscription plans, Query limits and fees, available at https://getbrand.io/pricing.

    12. Billing Period – a period of one (1) month for which access to the Services is granted under the selected subscription plan, counted from the day of activation of the subscription, constituting a recurring billing cycle of the User.

    13. Free Plan – a subscription plan made available free of charge, insofar as it is currently offered, with the scope of functionality, the Query limit, the number of API keys and the Query frequency limits (rate limit) specified in the Pricing.

    14. Trial – a free trial period covering the functionalities of a paid plan, while maintaining the Query limit and the Query frequency limit applicable to the Free Plan. The Trial lasts for the period indicated in the Pricing; upon its expiry the Account switches to the Free Plan, unless the User activates a paid plan.

  4. All financial transactions, the purchase of subscriptions, invoicing and the handling of complaints of a financial nature are carried out directly by the Reseller (Paddle) as the exclusive seller of subscriptions acting as the Merchant of Record. The User acknowledges and accepts that the purchase of a paid subscription plan requires the conclusion of a separate contract of sale directly with the Reseller (Paddle), on the terms set out in the terms and conditions provided by Paddle (https://www.paddle.com/legal/buyer-terms). The Provider is not a party to that contract of sale.

§ 2. RULES FOR USING THE PLATFORM

  1. The User shall use the Platform in a manner consistent with its intended purpose, with the provisions of these Terms, with the applicable provisions of law, with social norms and with the principles of community life.

  2. Authentication on the Platform takes place without the use of a traditional password (passwordless method) by means of one-time login links sent to the User’s e-mail address or through integration with external identity service providers (so-called social login, e.g. Google, GitHub), whereas access through the API interface requires authentication on each occasion using a unique API key generated beforehand by the User in the Platform application.

  3. The User shall keep confidential and protect against access by third parties its access data and authentication parameters, in particular access to the e-mail inbox, associated accounts on social networking services used for authorization on the Platform, as well as generated API keys. The Provider shall not be liable for the consequences of the disclosure, loss or unauthorized sharing by the User of such data and keys with third parties.

  4. The registration of multiple Accounts by the same User is permitted (e.g. for the purposes of handling different projects or employers), subject to the prohibition on creating multiple Accounts solely for the purpose of artificially multiplying free Query limits (credits) or avoiding subscription fees. Breach of this prohibition entitles the Provider to block or delete such Accounts with immediate effect.

  5. It is prohibited to aggregate and simultaneously use multiple API keys originating from different Accounts (including those registered by different employees or associates of the same entity) within one IT system, application or for the purposes of the activity of a single enterprise, in order to circumvent the limits assigned to a given subscription plan. Such action, undertaken without the prior consent of the Provider, constitutes a material breach of the Terms and entitles the Provider to immediately block the associated API keys and suspend access to those Accounts.

  6. It is prohibited to resell data obtained from the Platform in any form, in particular in the form of raw databases, to create on their basis products competing with the Platform, as well as to retrieve them in an automated manner (scraping). Only the operational use of the data for the User’s own purposes is permitted.

  7. The Provider grants the User a limited, non-exclusive, non-transferable license, without the right to grant sublicenses, to use the Platform and the Query results generated therein. For the avoidance of doubt, this license does not cover the original logotypes, trademarks, graphics or other brand assets displayed in the Query results, which remain the exclusive property of third parties. The User acknowledges and accepts that the Provider is not the owner, licensor or entity holding the intellectual property rights of third parties (including their logotypes and trademarks), nor does it promote those entities, recommend their activity or have any economic connection with them. The Provider excludes any liability for data retrieved from websites or other sources associated with the Identifiers, in particular for their lawfulness, correctness, completeness, quality, usefulness or security, accuracy, integrity, as well as for any intellectual property rights associated with them.

  8. By initiating a Query on the Platform, the User declares that it holds legal title or a legitimate legal basis to request the retrieval, processing and display of the visual data of the selected brand. The User bears the sole obligation to make its own legal assessment of whether the manner of presentation and use of those assets planned by it qualifies as statutorily permitted informational use, or whether it requires obtaining direct consent or a license from the entitled trademark owner.

  9. The introduction into the Platform of any content of an unlawful nature, infringing the personal rights of third parties or intellectual property rights, is strictly prohibited. This prohibition also covers a complete ban on undertaking any actions of a hacking, sabotage nature or aimed at breaching the security of the infrastructure of the Provider or the Users, including in particular: gaining unauthorized access to systems and networks (hacking), breaking or attempting to circumvent technical safeguards, conducting unagreed security testing (including penetration testing and vulnerability scanning), disrupting the availability of the Platform (including by means of DoS/DDoS attacks), exploiting system vulnerabilities, as well as introducing malicious software or any other unauthorized interference with the source code or databases of the Platform.

  10. In the course of using the Platform, including when generating Queries through the user interface and the API interface, it is prohibited to enter Identifiers associated with websites which present, contain or propagate content of an unlawful nature, contrary to good morals, infringing the personal rights of third parties or offending public order, including in particular materials of a pornographic, drastic nature, inciting hatred, propagating violence or infringing the dignity or rights of minors. In the event that attempts to generate Queries concerning the aforementioned internet addresses are revealed, the Provider is entitled to immediately block such a Query, suspend access to the Account or delete the Account with immediate effect, without the User being entitled to any claims for damages or refund of fees, and also – in the cases provided for by the provisions of law – to notify the competent state authorities.

  11. It is prohibited to use the Platform and the API interface for the purpose of acquiring, processing, storing or disseminating any data inconsistent with the applicable provisions of law.

  12. It is prohibited to enter as an Identifier the personal data of natural persons in respect of which the User does not have a valid legal basis for processing within the meaning of Article 6 of Regulation (EU) 2016/679 (GDPR). Breach of this prohibition constitutes a material breach of the Terms and entitles the Provider to immediately block the Account and the API keys.

  13. The technical requirements necessary to use the Platform include possession of a device with access to the Internet, equipped with a current version of the Windows, MacOS or Linux operating system and a current version of the Chrome, Edge, Firefox or Safari web browser (with JavaScript and cookies enabled) and an active e-mail address, whereas in the case of using the API interface – possession of software capable of establishing encrypted connections (HTTPS protocol) and of handling and processing data in JSON format.

  14. By providing the Provider with any comments, suggestions, proposals for improvements or reports concerning the Platform or the Services, the User grants the Provider a free of charge, non-exclusive right, unlimited in time and territory, to use them for any purpose, including for the development and commercialization of the Services, without any obligation of remuneration, attribution of authorship or accounting for benefits.

  15. The User undertakes to keep confidential the information obtained in connection with the use of the Services which has not been made publicly available by the Provider, in particular API keys, non-public technical documentation and information about the security measures of the Platform. This obligation binds for the term of the Agreement and for three (3) years after its termination.

§ 3. CONCLUSION OF THE AGREEMENT AND CONDITIONS FOR THE PROVISION OF SERVICES

  1. The Agreement for the provision of services by electronic means shall be deemed concluded upon the first successful authentication of the User on the Platform. Registration or logging in by clicking a dedicated button, accompanied by information about acceptance of the Terms, is tantamount to a declaration by the User that it has read these Terms and fully accepts all of their provisions. On the basis of the Agreement so concluded, the Provider provides the User with the Services under the Free Plan (insofar as such a plan is currently offered in the Pricing). The activation and provision of the Services under paid subscription plans requires the prior conclusion of a subscription sale contract with the Reseller (Paddle) and takes place after automatic confirmation of payment of the fee by the Reseller.

  2. By registering, authenticating on the Platform, generating an API key or submitting any Query, the User unequivocally declares, assures and warrants that it uses the Platform and the Services solely for a purpose directly related to the business or professional activity conducted by it, resulting in particular from the subject matter of the business activity performed by it (B2B relationship), and that the Agreement being concluded is of a fully professional character for it. The User declares that it does not conclude the Agreement and does not use the Services as a consumer within the meaning of Article 221 of the Polish Civil Code, nor as a natural person referred to in Article 3855 of the Polish Civil Code (entrepreneur with consumer rights), and that all legal and financial consequences arising from the submission of an untrue declaration in this respect shall be borne solely by the User.

  3. The choice of subscription plan, the Query limits and the amount of fees for the use of paid Services are specified in the Pricing (https://getbrand.io/pricing). The Pricing may be subject to changes, which does not require an amendment of these Terms; new rates and limits do not apply to Billing Periods already paid for and ongoing. A change of fees or limits for subscriptions already active requires notification of the User by electronic means with 7 days’ notice and applies from the nearest Billing Period commencing after the expiry of that period. Failure to cancel the subscription means acceptance of the new conditions.

  4. Paid Services are provided in a renewable subscription model. Subscription fees are collected in advance for each successive Billing Period on the calendar day corresponding to the day of activation of the subscription. Where in a given calendar month there is no day corresponding to the day of activation of the subscription (e.g. the 29th, 30th or 31st day of the month), the subscription fee for that period shall be collected on the last business or calendar day of that month, in accordance with the billing rules of the Reseller (Paddle). The subscription is automatically extended for a further period, unless the User cancels it before the commencement of a new Billing Period.

  5. The contract of sale of paid subscription plans is concluded directly between the User and the Reseller (Paddle) as the seller. The legal relationship concerning the purchase transaction, invoicing and tax settlements is governed by the commercial terms and conditions of the Reseller (https://www.paddle.com/legal/buyer-terms), accepted by the User during the purchase process. The User acknowledges that the Provider is not a party to the subscription sale contract, is not the issuer of invoices and bears no liability for the financial transactions and payment processes carried out by the Reseller.

  6. The Provider has the right to terminate the Agreement with the User without stating a reason with a 14-day notice period with effect at the end of the current Billing Period, by sending the relevant declaration to the e-mail address assigned to the Account. This does not limit the Provider’s rights to terminate the Agreement with immediate effect or to block the Account in the cases indicated in the Terms.

  7. The User may at any time resign from the Services by deactivating the subscription in the payment management panel (operated by Paddle) or by deleting the Account. Resignation with effect at the end of the current Billing Period does not entitle the User to demand a refund of the fee for the unused period.

  8. In the event of a breach by the User of any provisions of these Terms or of the provisions of law, the Provider has the right to immediately block access to the Account and to all Accounts associated with it, and subsequently to delete them permanently, of which it shall notify the User by electronic means. This action results in termination of the Agreement with immediate effect and does not entitle the User to demand a refund of any subscription fees paid.

  9. The Provider reserves the right to temporarily suspend the provision of the Services or the operation of the Platform (in whole or in part) in order to carry out repair works, planned maintenance, inspection, software or hardware updates, as well as for reasons beyond the Provider’s control (including failures of hosting service providers). The Provider shall bear no liability whatsoever for any resulting inconvenience, interruptions in the availability of the platform or lost profits of the User.

  10. The Provider reserves the right to develop and modify the Services, including to change the functionality, appearance, technical parameters and to withdraw individual functions, modules or options of the Platform, subject to the following rules:

    1. with respect to the Free Plan or the Trial – changes, including the discontinuation of the provision of the Services in whole or in part, may be introduced at any time, without prior notice and without any liability of the Provider for damages;

    2. with respect to paid plans – the Provider is entitled to introduce changes which do not materially limit the key functionality of the Service covered by the paid Billing Period, i.e. the ability to submit Queries and obtain their results within the applicable credit limit; such changes may be introduced without prior notice;

    3. changes materially limiting the key functionality of the Service under paid plans, as well as the discontinuation of the provision of the Service in whole, require prior notification of the Users by electronic means with at least 30 days’ notice. In such a case, the User is entitled to terminate the Agreement by notice with effect as at the date on which the change enters into force, and the subscription is not further renewed. Exercise of this right exhausts the User’s claims on account of the change introduced.

  11. Apart from the right referred to in paragraph 10(3), the introduction of changes to the Service does not constitute grounds for any claims for damages by the User or for a demand for a refund of subscription fees paid.

  12. The Provider is entitled to delete an Account maintained under the Free Plan if, for a period of ninety (90) days, the User has not logged in to the Platform or submitted a Query using an API key. Deletion takes place without prior notice and results in termination of the Agreement and loss of the data associated with the Account.

§ 4. FUNCTIONALITY OF THE PLATFORM AND THE API INTERFACE

  1. The User, through the interface of the Platform application or the API interface, may submit a Query by entering the appropriate Identifier. The detailed technical specification for submitting Queries and the current list of supported types of Identifiers are set out in the technical documentation (https://getbrand.io/docs) made available on the Platform. The results presented by the Platform constitute an automated, algorithmic interpretation of publicly available visual identity assets and information about the brand associated with a given Identifier, or are based on data and graphic materials posted directly by a verified User under the Domain Takeover procedure referred to in paragraphs 2 and 3 below.

  2. A User who successfully verifies its rights to a given internet domain (in particular by registering an Account using an e-mail address in that domain or by completing another procedure specified on the Platform) has the possibility to block the presentation of automatically generated results and to independently manage the presentation of visual and identification data associated with that domain (hereinafter: “Domain Takeover”).

  3. Under the Domain Takeover option, a verified User may directly post and update graphic materials (including logotypes) and identification data of its brand. In such a case, the results of subsequent Queries concerning that Identifier, submitted by any other users of the Platform, will contain the data posted directly by the verified User, taking priority over the automated algorithmic results referred to in paragraph 1. The User posting its own data bears full and sole responsibility for their lawfulness, including for holding the appropriate copyrights and trademark protection rights.

    The User posting such data declares, warrants and assures that:

    1. it holds all necessary copyrights, licenses and trademark protection rights;

    2. the posted materials and data do not infringe the rights of third parties, their personal rights, the principles of fair competition, good morals or the provisions on the protection of personal data (GDPR); the data entered and the files uploaded (in particular graphic files in vector or raster formats) are safe, free from technical defects, malicious software, viruses, hidden scripts (including XSS vulnerabilities) or other code capable of disrupting the operation of the Platform or breaching the security of the systems of the Provider or of other Users;

    3. the posted materials and data do not contain the personal data of natural persons; if, notwithstanding the foregoing, such data are posted, the User declares and warrants that it has a valid legal basis for making them available to the Provider and that it has fulfilled towards the data subjects the information obligation referred to in Article 14 GDPR, including that it has informed them of the sharing of the data on the Platform and of their public presentation to other users of the Platform.

  4. Upon uploading graphic materials (including logotypes) or entering data, the User grants the Provider a free of charge, non-exclusive, territorially unlimited license (authorization) for the term of the Agreement, to use those materials and data for the purpose of providing the Services, which includes in particular their storage in the memory of the Provider’s systems, digital reproduction and their public presentation and making available to other users of the Platform in the Query results.

  5. Queries may be submitted directly through the user interface in the Platform application or automatically by means of the API, following the prior generation of API authentication keys in the Account panel.

  6. The results of the analysis are presented in the form of structured textual data (e.g. JSON format) or in graphic form in the application.

  7. The Query results are generated on the basis of data retrieved and analyzed directly in real time from an external source associated with the Identifier, data stored in the cache of the Platform, or data posted directly by a verified User under the Domain Takeover. The Provider does not guarantee immediate synchronization of the presented results with the actual, current state of the assets associated with the analyzed Identifier. The User accepts that the presented results may not take into account changes introduced by the brand owner after the date of its last analysis or update on the Platform.

  8. The User shall update the data retrieved from the Platform (including data stored in its local systems or applications) by generating a new Query for the given Identifier at least once every thirty (30) days. All risks and liability (including towards third parties) associated with the use of the data retrieved from the Platform – regardless of the moment of their retrieval – rest solely with the User, and the failure to update the data in a timely manner burdens solely the User.

  9. The URL addresses to graphic files made available in the Query results serve solely for their direct download and saving in the User’s own local systems. It is prohibited to use those links for purposes other than downloading the files, including for their direct embedding (hotlinking) in external applications or on websites. The links made available automatically expire and cease to be active upon the lapse of fifteen (15) minutes from the moment of their generation.

  10. The use of the Services is settled by means of credits assigned to the User’s Account under the selected subscription plan. Credits are renewed at the beginning of each successive Billing Period. Credits not used in a given Billing Period expire irretrievably – they do not accumulate and do not carry over to the next subscription period.

  11. Each submitted Query (including a repeated Query or one concerning an Identifier previously analyzed, for which the results are retrieved from the cache of the Platform) reduces the balance of available credits by one (1) credit. A credit is not charged solely in the event that the Platform returns information about a system error preventing the analysis of the domain from being carried out.

  12. The Platform, the application, the API interface and all Services provided through them are supplied “as-is” and “as-available”. The Provider grants no guarantees or warranties (express or implied) as to the error-free operation of the Services, their uninterrupted availability, compatibility with the User’s systems, non-infringement of third-party rights, merchantability, or their fitness for the User’s particular business purpose.

  13. The Provider may make available additional, free or paid auxiliary tools, including software development kits (SDK), plugins, integrations and automations with external services (distributed under proprietary or open-source licenses). These elements are of a purely auxiliary nature and are supplied “as-is” and “as-available”. Their use, download and implementation in one’s own systems takes place at the User’s sole risk. The Provider excludes any liability (both contractual and tortious) for their operation, currency, error-free operation and any damage arising in the User’s systems in connection with their use.

§ 5. PAYMENTS AND THE ROLE OF THE RESELLER (PADDLE)

  1. The entity solely responsible for the sale of paid subscription plans, the collection of amounts due, the issuance of invoices and tax settlements (including VAT/Sales Tax) is the Reseller (Paddle) acting as an authorized merchant of record (Merchant of Record).

  2. The prices presented in the public Pricing on the website and in the application (before the identity and tax location of the User are determined) are net prices and do not include value added tax (VAT) or other turnover taxes (in particular Sales Tax). The final gross price payable (including taxes calculated in accordance with the User’s tax jurisdiction) is calculated by the Reseller and presented to the User in the payment process (in the Paddle transaction window), as well as in the application when changing subscription plans (upgrade/downgrade) and in messages encouraging a change of plan.

  3. In order to receive an invoice documenting the purchase for the purposes of its business activity, the User shall provide its valid tax identification number (NIP / VAT ID / TAX ID) and complete company registration data directly in the payment form of the Reseller (Paddle) at the moment of purchase. Since the exclusive seller and the entity issuing invoices is the Reseller, the Provider does not participate in the invoicing process and does not carry out tax settlements of the Transaction. All questions and matters concerning issued invoices or tax charged should be directed directly to the Reseller (https://www.paddle.net).

  4. The subscription is payable in advance for each Billing Period. The detailed payment rules are set out in the payment terms and conditions of the Reseller (https://www.paddle.com/legal/buyer-terms).

  5. In the event of failure to pay the subscription fee for a further Billing Period, unsuccessful charging of the payment instrument, withdrawal or challenge of a payment (including the initiation of a chargeback procedure), a refund of the fee made by the Reseller to the User, as well as in the event of cancellation, expiry or suspension of the subscription, the Provider is entitled to immediately suspend access to the Account and the API keys, downgrade the plan to the Free Plan or delete the Account, without prior notice.

  6. A refund of a fee made by the Reseller does not constitute an acknowledgement of the User’s claim against the Provider.

  7. The rules, deadlines and conditions for making any refunds of funds are governed solely by the commercial terms and conditions of the Reseller (Paddle Buyer Terms, available at: https://www.paddle.com/legal/buyer-terms), which the User accepts in the purchase process. All claims and requests for refunds must be submitted to and are handled directly by the Reseller on the basis of those terms.

  8. In the event that the User initiates a payment chargeback procedure directly with the issuer of the payment card or with a financial institution, without first exhausting the complaint procedure with the Reseller (Paddle) or the Provider, and that procedure proves to be unjustified, the User undertakes to cover all documented costs and fees charged to the Provider or the Reseller (including operational fees for handling the chargeback dispute) imposed by financial institutions or the Reseller.

§ 6. LIABILITY AND ITS LIMITATION

  1. The data provided under the Service originate from public sources, are entered directly by users or constitute the result of their automatic processing by the Platform. The Provider does not guarantee their error-free character, currency, completeness, or conformity with the actual and legal state of affairs.

  2. The data obtained through the Platform require, on each occasion, validation, cleansing, securing and verification by the User before their operational use. Such data should be treated as untrusted input. Given that these materials (including graphic files) originate directly from external, public websites or are supplied by third parties, the Provider does not guarantee their full technical security, and the User shall apply its own current antivirus tools and security procedures before downloading them or integrating them into its own systems.

  3. To the fullest extent permitted by law, subject to mandatory provisions of law, including in particular liability for damage caused by willful misconduct, the Provider excludes its liability towards Users on any account, including in particular for:

    1. interruptions in the functioning of the Platform, maintenance works, technical failures and force majeure;

    2. the operation of free SDK libraries, automations and external integrations;

    3. the infringement of intellectual property rights, trademark protection rights or personal rights of third parties (brand owners) in connection with any use by the User of logotypes or other data retrieved from the Platform;

    4. the processing of personal data entered by the User as an Identifier without a valid legal basis or in breach of the provisions on the protection of personal data, as well as for the further use by the User of the Query results in a manner infringing those provisions.

  4. Subject to mandatory provisions of law, including in particular liability for damage caused by the Provider’s willful misconduct:

    1. The Provider’s liability for lost profits (lucrum cessans), including also indirect and consequential damages, pure financial losses, as well as for technical damage, including damage caused by malicious software (malware), the loss, corruption or destruction of data and disruptions in the operation of the User’s ICT infrastructure, is entirely excluded.

    2. The Parties expressly exclude the Provider’s liability under the statutory warranty for defects (rękojmia) for physical and legal defects of the Platform and the Services.

    3. The aggregate and maximum liability of the Provider for damages towards the User on any account (including on account of non-performance or improper performance of the Agreement, contract or tort) for actual damage incurred (damnum emergens) is limited in amount to the equivalent of the subscription fees actually paid by that User to the Reseller (Paddle) for access to the Services in the period of three (3) months immediately preceding the event giving rise to the damage.

  5. Subject to mandatory provisions of law (including liability for damage caused by willful misconduct), the Provider’s liability for damages (both contractual and tortious) for any actual damage, lost profits and indirect damages is entirely excluded in relation to:

    1. Users using the Free Plan or the Trial;

    2. the use by any Users of the free auxiliary tools made available by the Provider, including software development kits (SDK), source codes, integrations, plugins and automations. These tools are made available “as-is” and “as-available”, and their implementation and use takes place at the User’s sole risk.

  6. The User declares and warrants that it holds legal title, a license, consent or another legitimate legal basis to request the retrieval, processing and further use of the visual data (including logotypes and trademarks) covered by its Query.

  7. The User undertakes to release the Provider from all liability and to cover all damage, costs of court disputes, administrative penalties and legal service costs incurred by the Provider in connection with claims of third parties (including brand owners) arising from the unauthorized retrieval, processing or further use of data by the User, as well as on account of breach of the declaration referred to in paragraph 6.

  8. In the event of any claims being raised by third parties (including brand owners) or penalties being imposed by state administration authorities in connection with:

    1. materials, files or data posted by the User under the Domain Takeover procedure referred to in § 4(2) and (3),

    2. the posting by the User of personal data in breach of the prohibition referred to in § 10(4);

    3. the entry by the User as an Identifier of the personal data of a natural person without a valid legal basis for processing or without fulfilling the information obligation referred to in Article 14 GDPR, including in breach of the prohibition referred to in § 2(12)

    the User undertakes to release the Provider from any liability on this account, to join any proceedings on the side of the Provider at its own cost, and to fully cover all damage incurred by the Provider, including to pay adjudicated amounts, compensation for non-pecuniary damage, administrative penalties and to cover the full costs of legal services and legal representation.

  9. The Query results referred to in § 4(1) (algorithmic results) constitute an automated interpretation of publicly available assets. The Provider does not carry out prior verification or moderation of assets acquired automatically from external sources. The Provider’s liability in this respect is subject to the limitations set out in this paragraph, and entitled brand owners are entitled to the rights set out in § 7(7)–(11) (objection, rectification, erasure).

  10. With respect to materials, files and data posted by Users under the Domain Takeover procedure (§ 4(2)–(4)), the Provider acts solely as a hosting service provider. The Provider does not initiate the transmission of such content, does not select its recipient, does not modify its content and does not carry out prior or ongoing control, verification or moderation thereof, and bears no liability for its content, correctness, completeness, currency or lawfulness. The Provider takes action with respect to such content immediately upon obtaining credible information about its unlawful character, in the manner set out in § 7(1)–(6).

  11. The Provider bears no liability for the non-performance or improper performance of the Services, including for the temporary or permanent inability to retrieve visual and identification data of brands, if this is a consequence of technical, legal or organizational changes introduced by the operators of external websites (constituting the source of the data), including the implementation by those entities of systems protecting against the automatic reading of data (bot/scraping blocks). Such changes do not constitute grounds for any claims for damages or for a demand for a refund of subscription fees by the User.

  12. The Provider bears no liability for the non-performance or improper performance of the Services caused by force majeure, understood as an external event, impossible to foresee and which could not be prevented, in particular: natural disasters, war, acts of terror, epidemics, decisions of public authorities, strikes, failures of the Internet network, failures or cessation of activity of hosting, cloud or telecommunications service providers, as well as ICT attacks, including DoS/DDoS attacks.

§ 7. PROCEDURE FOR REPORTING INFRINGEMENTS AND CONTENT MODERATION

  1. Any person or entity (including a brand owner or its authorized representative) may report to the Provider at the e-mail address: support@getbrand.io the presence on the Platform of information or materials (in particular logotypes posted under the Domain Takeover procedure) which it considers to be illegal, infringing intellectual property rights (including trademark protection rights) or infringing the provisions of these Terms.

  2. The report should be sufficiently precise and substantiated. In order to expedite the procedure, it is recommended that the report contain at least:

    1. an unambiguous indication of the Identifier to which the report relates;

    2. a justification of why the reporting party considers the content to be illegal or infringing rights (in the case of trademarks – an indication of the protection right number or a link to the register);

    3. the contact details of the reporting party (first name, surname or entity name, e-mail address);

    4. a declaration of the reporting party that it acts in good faith and is convinced that the information contained in the report is correct and complete.

  3. Upon receipt of a report meeting the requirements set out in paragraph 2, the Provider shall promptly confirm its receipt by electronic means. The Provider examines the report without undue delay, in a non-arbitrary, objective manner and with due diligence.

  4. Where the report is found to be justified, the Provider takes appropriate moderation action, consisting in particular in blocking access to the disputed materials, deleting them or restoring the default algorithmic results. The Provider shall promptly notify of the decision taken both the reporting party and the User whose content has been blocked or deleted (if its contact details are known), stating the reasons for the decision.

  5. A User whose content has been deleted or blocked on the basis of a report referred to in this paragraph has the right to lodge an appeal against the Provider’s decision within 14 days from the date of receipt of the reasons for the decision. The appeal should be lodged at the e-mail address indicated in paragraph 6.

  6. The Provider designates the e-mail address: support@getbrand.io, as a single point of contact for direct communication with the authorities of the Member States, the European Commission, the European Board for Digital Services and with Users and third parties in matters related to the functioning of the Platform, including for the purpose of reporting illegal content or content inconsistent with the Terms. Communication may be conducted in Polish and in English.

  7. An entitled owner of a brand, trademark or rights to a domain (or its authorized representative) may at any time, without stating a reason, submit to the Provider:

    1. a demand to cease processing (opt-out) – i.e. permanently to cease the retrieval, storage, processing and presentation on the Platform of data associated with the indicated Identifier;

    2. a demand for rectification or updating of the presented data;

    3. a demand for the deletion of specified materials (in particular logotypes).

  8. The report should be directed to the e-mail address: support@getbrand.io. The report should contain: (i) an indication of the Identifier, (ii) an indication of the basis of the entitlement (e.g. protection right number, registration data, control over the domain), (iii) contact details, (iv) a declaration of acting in good faith.

  9. Following positive verification of the reporting party’s entitlement, the Provider:

    1. promptly, and no later than within 7 days, blocks the presentation of the indicated data on the Platform and removes them from the cache, and

    2. adds the indicated Identifier to an exclusion list (no-crawl / no-serve list), preventing the renewed automatic acquisition and presentation of data associated with that Identifier, unless the reporting party withdraws the demand.

  10. The Provider confirms the fulfilment of the demand by electronic means.

  11. Exercise of the rights referred to in paragraph 7 does not require demonstrating the unlawfulness of the presented data and does not constitute an acknowledgement by the Provider of any claims.

  12. The rights referred to in paragraphs 7–11 may also be exercised by a natural person whose personal data are presented on the Platform in association with a given Identifier. This right is available independently of the rights arising from the provisions on the protection of personal data, the rules for the exercise of which are set out in the Privacy Policy.

§ 8. COMPLAINTS

  1. The User has the right to lodge a complaint concerning the functioning of the Platform and the Services provided (excluding financial and settlement matters subject to the jurisdiction of the Reseller).

  2. Complaints should be lodged by electronic means at the e-mail address: support@getbrand.io.

  3. The complaint should contain: the User’s identifier (e-mail), a detailed description of the technical problem that has occurred and a specification of the demand.

  4. The Provider examines the complaint within 14 days from the date of its receipt. The response is sent to the e-mail address from which the complaint was submitted. The absence of a response within the above period does not mean that the complaint has been upheld.

  5. Complaints and questions concerning payments, transactions, tax settlements, subscriptions or refunds of funds must be directed directly to the Reseller (Paddle) through the dedicated portal for buyers: https://www.paddle.net or in accordance with the procedure indicated at https://www.paddle.com/legal/refund-policy. Since the party to financial transactions is the Reseller, all refunds, modifications or cancellations of payments are carried out and settled by the Reseller.

§ 9. COPYRIGHT AND THIRD-PARTY BRANDS

  1. All elements of the Platform, including in particular the software, source code, architecture, graphic interface, databases, texts, graphics and logotypes constituting the property of the Provider, are subject to legal protection under the Polish Act of 4 February 1994 on Copyright and Related Rights. Their copying, modification or dissemination without the prior written consent of the Provider is prohibited.

  2. The Platform processes and presents data, logotypes, names and other elements of the visual identity of third-party brands which are publicly available on the Internet. The display of these elements is of a purely informational and analytical nature, facilitating the visual identification of entities at the User’s request.

  3. The retrieval and operational use by the User of logotypes, trademarks and other materials protected by copyright or industrial property law belonging to third parties (verified brands) takes place at the User’s sole responsibility. The User is obliged to ensure that its manner of using such materials (e.g. for offering, presentation purposes or within permitted use) does not infringe the intellectual property rights and trademark protection rights of those third parties. The Provider grants no licenses or sublicenses to use the trademarks and graphic materials of third parties.

  4. The User acknowledges and accepts that the Provider is not the owner, licensor or entity holding the intellectual property rights of third parties (including their logotypes and trademarks). The presentation of these elements on the Platform is of a purely referential (informational) nature and does not mean that the Provider promotes those entities, recommends their activity, or that it has any economic connection with them. The Provider excludes any liability for data retrieved from internet domains indicated directly by the User. The data and Query results supplied through the Platform, as well as the free software development kits (SDK), source codes, integrations and automations, are for information and reference purposes only.

§ 10. PROTECTION OF PERSONAL DATA

  1. The Provider is an independent controller of the personal data of:

    1. Users – to the extent of Account data, data necessary for the provision of the Services, settlements and communication;
    2. natural persons whose data the Provider obtains from publicly available sources or which have been extracted from an Identifier entered by a User, stores in the database and cache of the Platform and presents to users of the Platform;
    3. natural persons whose data have been contained in materials posted by verified Users under the Domain Takeover – to the extent to which the Provider stores those materials and presents them to other users of the Platform.

    The basis for processing in the cases specified in items 2 and 3 is the legitimate interest of the Provider consisting in the provision of the Services (Article 6(1)(f) GDPR).

  2. The detailed rules for the processing of personal data, the information obligations and the rights of data subjects arising from the GDPR are set out in the Privacy Policy available at https://getbrand.io/privacy-policy.

  3. The personal data necessary for the execution of payments and invoicing are provided by the User directly to the Reseller (Paddle) or transferred to the Reseller by the Provider in order to link the payment with the Account (in particular the User’s e-mail address). The Reseller is an independent controller of personal data in this respect.

  4. The posting of the personal data of natural persons under the Domain Takeover is prohibited. The Provider is entitled to delete data posted in breach of this prohibition without notice and without liability towards the User.

  5. If, notwithstanding the prohibition referred to in paragraph 4, the User posts the personal data of natural persons under the Domain Takeover, the Provider is the controller of such data in accordance with paragraph 1(3). The User declares and warrants that it had a valid legal basis for making them available and that it fulfilled the information obligation referred to in Article 14 GDPR. The provisions of § 4(3)(3) and § 6(8) shall apply.

  6. The Platform enables the User to enter as an Identifier the personal data of third parties, in particular e-mail addresses, URL addresses or domain names. With respect to such data, the User acts as the controller, and the Provider as the processor. Upon acceptance of the Terms on registration of the Account, the Parties conclude a Personal Data Processing Agreement, the content of which constitutes Annex No. 1 to the Terms and forms an integral part thereof. The Processing Agreement is concluded by each User regardless of whether and when it enters personal data as an Identifier; in the absence of the entry of such data, the Processing Agreement remains without object. The Processing Agreement is binding for the term of the Agreement.

  7. The entrustment referred to in paragraph 6 covers solely the personal data entered by the User as an Identifier for the purpose of performing a Query. The entrustment does not cover, in particular: data acquired by the Provider from external sources, the domain name saved in the database of the Platform after the performance of a Query, data stored in the cache of the Platform, Query results, data posted under the Domain Takeover, User Account data or aggregated and anonymized data – in this respect the Provider acts as an independent controller in accordance with paragraph 1.

  8. An Identifier entered in the form of an e-mail address or a URL address is not recorded in the database of the Platform in its full content – in the course of processing the Query, the domain name is extracted from it and only in that form is it saved in the database and presented in the Query history in the Account. The full content of the Identifier may remain in system logs and security logs for a period not exceeding 30 days from the date of submission of the Query, upon the lapse of which it is subject to automatic, irreversible deletion.

§ 11. FINAL PROVISIONS

  1. In matters not regulated by these Terms, the relevant provisions of Polish law shall apply, in particular the Polish Civil Code and the Polish Act on the Provision of Services by Electronic Means.

  2. The Terms shall be governed by and construed in accordance with Polish law. Any disputes arising under this Agreement between the Provider and the User, the Parties undertake to resolve in the first instance amicably, by way of direct negotiation or mediation. Only in the event of failure to reach an understanding within 30 days from the commencement of talks shall the dispute be submitted for resolution by a common court in Poland having local jurisdiction over the registered office of the Provider.

  3. The Provider reserves the right to introduce changes to the Terms for important reasons (e.g. changes in the provisions of law, technological changes in the functioning of the Platform, a change of business model). Users shall be notified of a planned change by electronic means with at least 7 days’ notice. Changes enter into force upon the lapse of the indicated period, unless the User terminates the Agreement by notice before it enters into force.

  4. If any of the provisions of the Terms proves to be invalid or ineffective in whole or in part, the remaining provisions shall remain in force. In place of the invalid or ineffective provision, a valid and effective provision shall apply, the content of which, to the fullest extent permitted by law, corresponds to the economic purpose of the provision being replaced.

  5. The Terms were drawn up in Polish. The Polish version (https://getbrand.io/terms-of-service/pl) is the only binding version and constitutes the exclusive basis for interpretation. All translations of the Terms (including Annex No. 1) into other languages are for information and reference purposes only. In the event of any discrepancy, contradiction or interpretative doubt between the Polish version and its translation, the Polish version shall prevail.

  6. Termination or expiry of the Agreement shall not extinguish provisions which by their nature should continue to apply, in particular § 2(6)–(8) (prohibitions and license), § 2(14) (perpetual license to feedback), § 4(4) (license to the User’s materials), § 6 (liability and its limitation), § 9 (copyright), § 11(1)–(2) (governing law and jurisdiction) and confidentiality obligations.

  7. The User is not entitled to assign the rights or obligations arising from the Agreement to a third party without the prior consent of the Provider expressed in writing or by electronic means. The Provider is entitled to assign the rights and obligations arising from the Agreement to a third party, in particular in connection with the disposal of the enterprise or an organized part thereof, a merger, division or transformation, without the consent of the User, of which it shall inform the User by electronic means.

  8. Declarations and notices directed to the User at the e-mail address assigned to the Account shall be deemed effectively served upon their dispatch. The User shall maintain a current and operational e-mail address assigned to the Account; the consequences of failure to comply with this obligation shall be borne solely by the User.

  9. The Terms in this wording are effective as of 2026-07-15.

ANNEX NO. 1 TO THE TERMS: PERSONAL DATA PROCESSING AGREEMENT (DPA)

Concluded between the User, hereinafter referred to as the “Controller”, and the Provider, hereinafter referred to as the “Processor” (jointly: the “Parties”).

Capitalized terms not defined in this Agreement shall have the meaning ascribed to them in the Terms.

§ 1. CONCLUSION OF THE AGREEMENT, SUBJECT MATTER AND PURPOSE OF THE ENTRUSTMENT

  1. This Agreement is concluded upon acceptance of the Terms on registration of the Account (§ 10(6) of the Terms) and is binding for the term of the Agreement for the provision of the Services. The Agreement is concluded by each User regardless of whether and when it enters personal data as an Identifier; in the absence of the entry of such data, it remains without object.

  2. The Controller entrusts the Processor with the processing of the personal data specified in § 2 – solely for the purpose and for the duration of the performance of the Agreement for the Provision of Services.

  3. The Processor processes the entrusted personal data solely on the documented instruction of the Controller. A documented instruction is deemed to be, in particular, the submission of a Query (including through the API interface) by entering an Identifier containing personal data.

  4. The processing is of an automated and incidental nature. It comprises solely the following operations: receipt of the Identifier, extraction of the domain name from it, performance of the Query, recording of the Identifier in the logs in accordance with paragraph 5 and deletion.

  5. The processing comprises the recording of the full content of the Identifier (e-mail address, URL address or domain name) in system logs and security logs – solely to the extent necessary to ensure the security of processing and the ability to ensure the ongoing confidentiality, integrity and resilience of systems (Article 32 GDPR), including for the detection and investigation of security incidents and technical diagnostics. This recording constitutes an element of the performance of the Agreement and the fulfilment of the Processor’s obligation under Article 32 GDPR; the Processor does not process the entrusted data for its own purposes. The logs are subject to automatic, irreversible deletion upon the lapse of 30 days from recording. The Controller acknowledges and accepts this.

  6. The Processor does not record in the database of the Platform the full content of the Identifier in the form of an e-mail address or a URL address. Only the domain name extracted from the Identifier is saved in the database of the Platform – in this respect the Provider acts as an independent data controller in accordance with § 10(1)(2) of the Terms, on the basis of Article 6(1)(f) GDPR. The Controller acknowledges and accepts this.

§ 2. SCOPE OF THE ENTRUSTMENT

  1. The entrustment covers solely the personal data entered by the Controller into the Platform as an Identifier for the purpose of performing a Query.

  2. Categories of data subjects: natural persons whose personal data are contained in the Identifier entered by the Controller.

  3. Categories of data: personal data contained in the Identifier – in particular e-mail addresses, URL addresses and domain names, insofar as they allow the identification of a natural person. The entrustment does not cover special categories of data (Article 9 GDPR) or the data referred to in Article 10 GDPR; the entry of such data is prohibited.

  4. The entrustment does not cover, in particular:

    1. personal data acquired by the Processor from publicly available sources in the course of generating algorithmic results;

    2. the domain name saved in the database of the Platform after the performance of a Query;

    3. data stored in the cache of the Platform;

    4. Query results;

    5. data posted by Users under the Domain Takeover;

    6. User Account data and settlement data;

    7. aggregated and anonymized data.

  5. To the extent indicated in paragraph 4, the Processor acts as an independent data controller in accordance with § 10(1) of the Terms, and this Agreement does not apply to it.

§ 3. DECLARATIONS AND WARRANTIES OF THE CONTROLLER

  1. The Controller declares and warrants that, with respect to each Identifier constituting personal data:

    1. it has a valid legal basis for processing (Article 6 GDPR) and a legal basis for the entrustment;

    2. it has fulfilled towards the data subject the information obligation (Article 13 or 14 GDPR), including that it has informed the data subject of the transfer of the data to the Processor;

    3. the processing and the intended use of the Query results do not infringe the provisions on the protection of personal data or the provisions on unsolicited commercial communication and electronic communication;

    4. the data do not belong to the categories referred to in § 2(3), second sentence.

  2. The Controller bears sole responsibility for the lawfulness of the instructions directed to the Processor, including for the selection of the Identifiers.

  3. The Controller releases the Processor from liability and undertakes to cover all damage, administrative penalties, adjudicated compensation and compensation for non-pecuniary damage, costs of proceedings and the full costs of legal services and legal representation incurred by the Processor in connection with claims of data subjects or proceedings of supervisory authorities arising from a breach of the declarations referred to in paragraph 1, or from a breach of § 2(12) of the Terms. The Controller undertakes to join such proceedings on the side of the Processor at its own cost.

§ 4. OBLIGATIONS OF THE PROCESSOR

  1. The Processor undertakes to:

    1. process the entrusted data solely on the documented instruction of the Controller;

    2. promptly inform the Controller if, in its assessment, an issued instruction constitutes an infringement of the GDPR or of other provisions on the protection of personal data (Article 28(3), final sentence, GDPR); the Processor is then entitled to withhold performance of the instruction;

    3. implement and apply appropriate technical and organizational measures in accordance with Article 32 GDPR (§ 9 of this Agreement);

    4. ensure that the persons authorized to process the entrusted data have committed themselves to confidentiality or are under a statutory obligation of confidentiality;

    5. assist the Controller – insofar as technically and organizationally possible and taking into account the nature of the processing – in fulfilling the obligation to respond to requests of data subjects (Chapter III GDPR). The Controller acknowledges that, given the nature of the processing (§ 1(4)–(6)), the Processor’s possibilities in this respect are limited;

    6. assist the Controller in fulfilling the obligations set out in Articles 32–36 GDPR, taking into account the nature of the processing and the information available to the Processor.

§ 5. SUB-PROCESSING

  1. The Controller gives general consent to the Processor’s use of the services of further processors (“Sub-processors”) for the purpose of providing and maintaining the infrastructure of the Platform (in particular providers of hosting, CDN, logging and monitoring systems).

  2. The Processor imposes on the Sub-processors, by way of an agreement, data protection obligations corresponding to the obligations arising from this Agreement.

  3. The Processor uses the Sub-processors indicated in the List of Sub-processors set out below. The Processor shall inform the Controller of the planned addition or replacement of a Sub-processor with at least 7 days’ notice (by e-mail or by means of a message on the Platform). The update of the List of Sub-processors takes place in the manner set out in paragraphs 3–4 above and does not constitute an amendment of the Terms or of this Agreement. Some of the Sub-processors indicated in the List may process data outside the European Economic Area; in such a case the transfer takes place on the terms set out in paragraph 5 below and in § 4(3) of the Privacy Policy (Standard Contractual Clauses or the EU-U.S. Data Privacy Framework).

    List of Sub-processors:

    1. BunnyWay d.o.o (Slovenia)
      Hosting and CDN infrastructure;

    2. Google Cloud Poland Sp. z o.o (Poland)
      Operation of Workspace tools, including e-mail.

    3. DeploySentinel, Inc (United States of America)
      Logging and monitoring system.

  4. The Controller is entitled to raise a justified objection to the intended change within 7 days from the date of service of the notification. The ineffective lapse of the prescribed period is deemed to constitute the Controller’s consent. The effective raising of an objection absolutely bars the possibility of entrusting the processing of personal data to the new Sub-processor. In the event of an objection being raised, the Processor is entitled to:

    1. implement an alternative solution not requiring the participation of the contested Sub-processor, or

    2. terminate the agreement for the provision of services by notice with effect at the end of the current billing period.

  5. The Controller consents to the transfer of the entrusted data to third countries, provided that the requirements of Chapter V GDPR are met, in particular where the recipient participates in the EU-US Data Privacy Framework (or another program recognized by a decision of the European Commission) or where the transfer is based on Standard Contractual Clauses.

§ 6. AUDITS AND INSPECTIONS

  1. The Processor makes available to the Controller the information necessary to demonstrate compliance with the obligations under Article 28 GDPR and allows for audits, including inspections, to be carried out.

  2. The audit is carried out at the Controller’s cost, no more frequently than once every 12 months (unless the audit is a consequence of an established personal data breach) and consists in the first instance in: (a) the Processor providing a description of the technical and organizational measures applied (§ 9), or (b) the completion of a standard security questionnaire.

  3. An on-site audit is permissible solely where the information referred to in paragraph 2 is insufficient to demonstrate compliance with Article 28 GDPR. It requires the prior agreement of the date, scope and person of the independent auditor with at least 30 days’ notice, the signing of a separate confidentiality undertaking, and it may not disrupt the operational activity of the Processor or jeopardize the security of the data of other clients.

§ 7. PERSONAL DATA BREACHES

Upon establishing a breach of the protection of the entrusted personal data, the Processor reports it to the Controller without undue delay, where possible within 48 hours from confirmation of the breach, providing the information available to it at the time of the report, necessary for the Controller to make a possible notification to the supervisory authority.

§ 8. DELETION OF DATA

  1. Given the nature of the processing (§ 1(4)–(6)), the entrusted personal data are not recorded in the database of the Platform, but solely in the logs subject to automatic deletion.

  2. Fulfilment of the obligation to delete the entrusted data takes place through the lapse of the log retention period, not exceeding 30 days. The Processor has no technical possibility of selectively deleting a single record from the logs before the lapse of that period, of which the Controller is hereby informed and which it accepts.

  3. The domain name extracted from the Identifier, after the performance of a Query, is processed by the Provider as an independent controller in accordance with § 10(1)(2) of the Terms and is not covered by this Agreement.

  4. Upon the cessation of the provision of the Services and deletion of the Account, the entrusted data are deleted in accordance with paragraph 2. Given the nature of the processing, the return of the data to the Controller does not apply.

§ 9. TECHNICAL AND ORGANIZATIONAL MEASURES

  1. The Processor implements and applies appropriate technical and organizational measures ensuring a level of security appropriate to the risk, in accordance with Article 32 GDPR, taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of the processing.

  2. These measures include in particular:

    1. securing data transmission with encryption protocols (HTTPS/TLS);

    2. extracting the domain name from the Identifier (e-mail address or URL address) in the course of processing the Query and not recording the full address in the database of the Platform;

    3. limiting the retention period of logs containing personal data to a maximum of 30 days, with automatic deletion;

    4. limiting access to the processing systems (including to the logs) solely to authorized persons bound by confidentiality, with the use of multi-factor authentication;

    5. striving to ensure the ongoing confidentiality, integrity, availability and resilience of the processing systems;

    6. regularly testing and assessing the effectiveness of the measures applied.

  3. The Processor reserves the right to modify the measures applied, provided that the new measures ensure a level of security no lower than the previous one and compliant with Article 32 GDPR.

§ 10. LIABILITY

  1. Subject to mandatory provisions of law (including Article 82 GDPR and Article 473 § 2 of the Polish Civil Code), the liability of the Processor towards the Controller under this Agreement is subject to the limitations set out in § 6 of the Terms, including the monetary limitation referred to in § 6(4)(3) of the Terms. This limitation is aggregate with liability under the Agreement for the provision of the Services.

  2. The Processor’s liability for lost profits and for indirect and consequential damages is excluded.

  3. The provisions of this paragraph do not limit the liability of the Parties towards data subjects or towards the supervisory authority.

§ 11. FINAL PROVISIONS

  1. In matters not regulated, the GDPR, Polish law and the Terms shall apply.

  2. Termination or expiry of the Agreement for the provision of the Services results in termination of this Agreement; § 8 and § 10 shall continue to apply.

  3. Amendment of this Agreement takes place in the manner appropriate for amendment of the Terms (§ 11(3) of the Terms).

  4. If any of the provisions of this Agreement proves to be invalid, the remaining provisions shall remain in force; § 11(4) of the Terms shall apply mutatis mutandis.