Terms of Use

Welcome to the Kariqa application, available at https://kariqa.com (the “Application”, “Kariqa”).

Kariqa is a web-based (SaaS) application designed to support business users in complying with obligations relating to the Carbon Border Adjustment Mechanism (CBAM). Among other things, the Application enables the entry, processing and monitoring of import and embedded emissions data, the connection of authorised CBAM declarants, indirect customs representatives or other duly authorised persons with producers or operators of installations outside the European Union, the calculation of the estimated number of CBAM certificates required to fulfil CBAM obligations, and the preparation and export of related data and documentation required for compliance with CBAM obligations.

Certain functionalities of the Application are also available to producers or operators of installations outside the European Union for the purpose of registering their installations, entering and providing emissions data, and communicating and exchanging relevant data with connected authorised CBAM declarants, indirect customs representatives or other duly authorised persons.

The Application is intended exclusively for use in the course of the activities of legal entities (each an “Organisation”) and is not intended for consumers, sole traders or other natural persons acting in their own name.

These Terms of Use of the Kariqa Application during the test phase (the “Terms”) govern your access to and use of the Application and the services provided through it (the “Services”) during the free test or pilot phase (the “Test Phase”).

The Test Phase is intended for the testing and evaluation of the Application’s functionalities. During the Test Phase, users may enter actual business and other data relating to the Organisation on whose behalf they use the Application into the Application.

These Terms govern only the use of the Application during the Test Phase. They do not govern any future paid use of the Application, specific contractual arrangements with individual clients, or any consultancy, administrative or other professional services that we may provide separately.

The Application is operated by Kariqa solutions d.o.o., with its registered office in Rijeka at Milutina Barača 62 (“we”, “us” or “our”).

If you have any questions or comments regarding these Terms, the Application or the Services, you may contact us at [email protected].

1. Registration and Access to the Application

1.1. Acceptance of the Terms

Please read these Terms carefully before registering for and using the Application.

By registering for and accessing the Application, or by using the Services, you confirm that you have read, understood and accepted these Terms, as well as any documents expressly referred to in them.

1.2. Contractual Relationship

An agreement for the use of the Application between us and an individual Organisation (the “Agreement”) is entered into when these Terms are accepted on behalf of the Organisation by a person authorised to bind the Organisation to them.

During the Test Phase, each Organisation is provided access to the Application through one user account (the “Account”), which is linked to one person authorised to use the Application on behalf of the Organisation and to that person’s business email address.

The Agreement remains in effect until the end of the Test Phase, unless terminated earlier in accordance with these Terms.

1.3. Conditions for Access to the Application

The Application and the Services are intended exclusively for Organisations, i.e. legal entities acting in the course of their business activities. During the Test Phase, the Application may be accessed on behalf of each Organisation by only one person authorised by the Organisation to use the Application.

To access the Application and use the Services, you must:

• be at least 18 years old or otherwise have reached the age of majority under the laws applicable to you;

• be an employee, representative or other person authorised to use the Application on behalf of an Organisation;

• complete the registration process by providing all requested information and accepting these Terms; and

• use a business email address.

If you access the Application on behalf of an Organisation, you confirm that you are duly authorised to do so.

Depending on the role of the Organisation and the functionalities available to it, the Application may be used in particular in the capacity of:

1. an importer or authorised CBAM declarant;

2. an indirect customs representative acting as an authorised CBAM declarant or carrying out actions relating to CBAM obligations for another Organisation, in accordance with applicable laws and the authorisations granted to it;

3. another legal entity authorised to carry out certain actions in the name or on behalf of a CBAM declarant, within the scope of the authorisation granted to it (the categories under (a), (b) and (c) together, the “CBAM Authorised Party”); or

4. a producer or operator of an installation outside the European Union (the “Producer/Operator”), which may use the Application to register its installations, enter and provide product and embedded emissions data, and exchange such data with connected CBAM Authorised Parties.

The scope of the functionalities, permissions and data available to you may vary depending on the role of the Organisation, the user permissions granted to you and the functionalities of the Application.

Your access to the Application may be suspended or terminated in accordance with Section 4.6 of these Terms. If you wish to stop using the Services, you may request the deactivation of your Account.

1.4. Organisations

For the purposes of these Terms, an Organisation is the legal entity on whose behalf you access the Application and use the Services and which is the contracting party under Section 1.2.

By accessing or using Kariqa on behalf of an Organisation, you confirm that you are authorised to accept these Terms on behalf of that Organisation and to bind it to these Terms.

You also:

1. confirm that, to the extent necessary for the use of the Application, you are authorised on behalf of the Organisation to enter and upload data into the Application and to request, receive and share data through the Application;

2. acknowledge that your access to the Application may be suspended or terminated if you cease to be associated with that Organisation or if your authority to use the Application on its behalf ceases;

3. acknowledge that we may share with the Organisation or its relevant authorised representatives information about you and your use of the Application, including data entered through your Account; and

4. acknowledge that the terms “you” and “your” in these Terms refer, depending on the context, to the Organisation or to the person using the Application on its behalf.

Each Organisation is responsible for the data entered or otherwise made available through the Application on its behalf and for the manner in which it uses data received through the Application.

1.5. Registration Data and Privacy

When you register, we will ask you to provide certain information. You must ensure that all information you provide is accurate, current and complete, and update it as appropriate if it changes.

The processing of personal data for which we determine the purposes and means of processing is governed by our Privacy Notice, available on our website.

2. Your Account and the Test Phase

2.1. General

Your Account gives you access to the Services and to the features and functionalities of the Application that are available to you based on the role of the Organisation.

The access credentials for your Account are for your use only and must not be shared with any other person.

2.2. Account Security and Unauthorised Access

You are responsible for maintaining the confidentiality and security of the access credentials for your Account and must take reasonable measures to prevent unauthorised access.

We are not liable for any loss or damage resulting from unauthorised access to your Account where such access results from your acts or omissions, including inadequate protection of your login credentials.

If you become aware of or suspect any unauthorised access to your Account, you must notify us without undue delay.

We may temporarily suspend access to your Account if we reasonably suspect unauthorised access, misuse or another security risk.

2.3. Test Phase

During the Test Phase, Kariqa is made available free of charge as a time-limited test or pilot version for the purpose of testing and evaluating its functionalities.

The Test Phase will continue until 31 December 2026. We may, upon prior notice, extend it for an additional time-limited period.

During the Test Phase, the Application remains under development, and certain features, functionalities, calculations, regulatory parameters or other elements may be modified, supplemented or removed, and the Application may contain errors or incomplete functionalities.

During the Test Phase, you may enter actual business and other data relating to the Organisation’s business activities into the Application. The fact that the Application is in the Test Phase does not affect our obligations regarding confidentiality, security and data protection under these Terms and applicable laws.

The test version is not intended to serve, without appropriate verification, as the sole basis for complying with the Organisation’s legal or regulatory obligations.

If and to the extent that Kariqa constitutes a data processing service within the meaning of Regulation (EU) 2023/2854 (the “Data Act”), we inform you that, subject to the conditions set out in Article 31(2) of the Data Act, the obligations under Chapter VI of the Data Act do not apply to this time-limited non-production version provided for testing and evaluation purposes.

2.4. End of the Test Phase and Future Use

At the end of the Test Phase, we may offer you the option to continue using the Application under the terms then in effect, including on a paid basis. We will inform you in advance of the terms applicable to any such continued use. No fees will be charged without your prior acceptance of the applicable terms for paid use.

If you do not accept the terms for continued use of the Application, your right to actively use the Application will end upon expiry of the Test Phase.

Participation in the Test Phase does not entitle you to any particular future price, plan, functionality or continued availability of the Application.

2.5. Equipment and Technical Requirements

You are responsible for obtaining, maintaining and ensuring the compatibility of the hardware, software, internet connection and other technical resources required to access and use the Application.

We are not liable for any difficulties, costs or damage arising from your equipment, internet connection or other systems and services that you use to access the Application.

3. Our Services

3.1. Provision and Availability of the Services

We provide you with access to the Services in accordance with these Terms.

We will use reasonable efforts to keep the Application functional and available. However, particularly given that the Application is in the Test Phase, we do not guarantee uninterrupted or error-free availability, or any specific response or resolution time.

Your use of the Application is not conditional on the availability of any announced or future functionality.

3.2. Changes to the Services

During the Test Phase, we may modify, develop, add, restrict or remove individual features and functionalities of the Application, including regulatory parameters, calculations and the user interface.

Where reasonably possible, we will notify you in advance of any change that may materially affect your use of the Application or access to data.

We may also temporarily restrict or suspend part or all of the Application for maintenance, error correction, security, compliance with regulatory requirements or other justified reasons.

3.3. CBAM Data, Calculations and Results

Kariqa is a software tool that enables the entry, processing and monitoring of import and embedded emissions data, the calculation of the estimated number of CBAM certificates required to fulfil CBAM obligations, and the preparation and export of related data and documentation.

Calculations, estimates, alerts, reports, documents and other outputs generated by the Application (the “Results”) are based on data entered into the Application by you or by a connected Producer/Operator, as well as on regulatory, reference and other parameters available in the Application at the time of calculation.

If actual embedded emissions data from a Producer/Operator are not available, the Application may, in the cases and in the manner provided for under applicable CBAM rules, use prescribed default values or other appropriate reference values.

We will use reasonable efforts to maintain the relevant regulatory and reference data and parameters of the Application. However, we do not guarantee that every data item, parameter, calculation or Result will at all times be complete, error-free or applicable to your specific circumstances.

The Organisation is responsible for the accuracy and completeness of the data entered or provided through the Application on its behalf and for appropriately verifying the Results before using them for regulatory or other business purposes.

If the Organisation uses the Application as a Producer/Operator, it is responsible for the data relating to its installations, products, embedded emissions and any other data entered or provided through the Application on its behalf.

Final responsibility for the content and submission of the CBAM declaration, the accuracy of the reported data, compliance with deadlines and fulfilment of any other obligations imposed on an authorised CBAM declarant under applicable laws remains with the relevant authorised CBAM declarant.

3.4. Additional Professional Services

These Terms apply to the use of the Application as a software tool.

Consultancy, administrative and other professional services that we may offer separately, such as assistance with data collection and verification, training, preparation and submission of CBAM declarations or services relating to the purchase of CBAM certificates, are not covered by these Terms.

Such services are provided only if separately agreed and may be subject to separately agreed scope, fees and other terms.

Your use of the Application alone does not mean that we have assumed any legal or regulatory obligations that apply to the Organisation.

3.5. Support

If you encounter any issue with the operation or availability of the Application, you may report it to us at [email protected].

During the Test Phase, support is provided subject to availability and without any guaranteed response or resolution time, unless expressly agreed otherwise with you.

3.6. External Service Providers

For the purpose of providing, maintaining and operating the Application and the Services, we may engage third parties that provide us with infrastructure, hosting, cloud, security, communications and other technical or support services, including services supporting individual functionalities of the Application, such as the verification or validation of data used in the Application.

The engagement of such providers does not affect our obligations to you under these Terms.

4. Use of the Application

4.1. Limited Right to Use the Application and Content

Subject to your compliance with these Terms, we grant you a limited, revocable, non-exclusive and non-transferable right to access and use the Application for the duration of the Agreement, for the purposes of the Organisation’s business activities and in accordance with the functionalities of the Application.

For the purposes of these Terms, “Content” means information, materials, regulatory and reference data, instructions, templates and other content that we make available through the Application, but does not include data or other content entered into the Application by you or by other persons.

You may use the Content to the extent necessary to use the Application and the Services.

Except for the rights expressly granted under these Terms, no other rights in or to the Application or the Content are transferred to you.

4.2. Use of the Results

You may use, download, retain and share the Results with third parties in the course of the Organisation’s business activities, including for the purpose of complying with CBAM-related obligations.

Your use of the Results is subject to Section 3.3, including the obligation to appropriately verify the Results before using them for regulatory or other business purposes.

By using the Results, you do not acquire any rights in or to the Application or in the technology, functionalities or other elements of the Application used to generate them.

4.3. Restrictions on Use and Prohibited Activities

You may access and use the Application only for lawful purposes and in accordance with these Terms.

To protect the integrity and security of the Application and our rights and interests, you must not:

1. reverse engineer, decompile, disassemble or attempt to discover or reconstruct any source code, object code, underlying structure, ideas, algorithms or know-how relevant to the Application, except to the extent such activity is expressly permitted by applicable law;

2. share, distribute, sublicense, rent, resell, transfer or otherwise make the Application or the Services, including the Content or any part of it, available to unauthorised third parties;

3. copy, reproduce, republish, modify, adapt, translate or create derivative works of the Application, the Services or the Content, or remove any proprietary notices or markings, except to the extent expressly permitted by these Terms;

4. use the Application, the Services or the Content for the purpose of creating or improving any product, service or application that directly or indirectly competes with Kariqa;

5. access or attempt to access the Application by means other than the user interface that we make available to you, including through automated means such as bots, spiders, scrapers or crawlers, unless we have previously permitted such access;

6. circumvent, disable or otherwise interfere with any security or technical measures or restrictions of the Application;

7. engage in any activity that may damage, disable, overload or interfere with the operation of the Application or related infrastructure;

8. integrate any part of the Application into another website, application or service without our prior consent; or

9. use the Application, the Services or the Content in a manner that violates applicable laws or the rights of third parties, or unreasonably interferes with the use of the Application by other users.

4.4. Application Security

We will implement appropriate technical and organisational measures, taking into account the nature of the Application and the associated risks, to protect the security, confidentiality, integrity and availability of the Application and the data processed through it.

We will take reasonable measures to support the continuity of the Application and recovery in the event of a technical or security incident, and will maintain reasonable processes for identifying, assessing and addressing security vulnerabilities that may materially affect the Application.

If we become aware of a security incident that materially affects, or may materially affect, the security of the Application, the data you have entered into the Application, or the safe use of the Application, we will notify you without undue delay and provide you with reasonably available information necessary to assess its consequences.

4.5. Monitoring of Use

For the purposes of protecting the security of the Application, preventing misuse and verifying compliance with these Terms, we may monitor use of the Application to the extent permitted by applicable law.

4.6. Suspension and Permanent Termination of Access

We may temporarily suspend your access to the Application if we reasonably suspect a breach of these Terms or if suspension is reasonably necessary to protect the security of the Application or other users, prevent misuse, comply with a legal obligation, or address a significant technical or security risk.

We may permanently terminate your access to the Application and deactivate your Account if a material breach of these Terms cannot be remedied, if you fail to remedy a material breach within a reasonable period after we notify you of it, or if you repeatedly breach these Terms.

We may also permanently terminate your access where this is necessary to comply with a legal obligation or where your continued access presents a significant security risk that cannot reasonably be addressed through temporary suspension.

Where reasonably possible, before permanently terminating your access we will notify you of the reason and give you an opportunity to remedy the breach, unless the breach cannot be remedied or the circumstances require immediate action.

You may, at any time, stop using the Application and request the deactivation of your Account.

In the circumstances set out in this Section, the Agreement terminates upon the permanent termination of your access to the Application or upon the deactivation of the Account at your request.

Termination of your right to access the Application does not affect your right to use any Results that you lawfully downloaded before termination of the Agreement, in accordance with these Terms.

4.7. Data Following Termination of Use

If you do not continue using the Application after the end of the Test Phase, or if the Agreement terminates earlier in accordance with these Terms, we will allow you at least 30 (thirty) days to export the data and Results that the Application allows you to export before such data are permanently deleted.

After that period has expired, we may delete or anonymise the data, unless we are required or permitted under applicable law to retain them for a longer period, including to the extent that such retention is reasonably necessary for the establishment, exercise or defence of legal claims, or unless otherwise agreed with you.

Regardless of the period for which we retain data in accordance with this Section, you remain responsible for retaining any documents and records that you are required to retain under applicable law.

5. Data and User Content

5.1. User Content and Responsibility

When using the Application, you may, on behalf of the Organisation, enter, upload, submit or otherwise make available data, files, documents and other content, including data relating to imports, Producers/Operators, installations, products, emissions and contact persons (the “User Content”).

The Organisation retains all rights that it has in the User Content. These Terms do not transfer to us any ownership or other rights in the User Content, except for the limited rights necessary to provide the Services as set out in Section 5.3.

The Organisation is responsible for the accuracy, completeness and lawfulness of the User Content entered or provided through the Application on its behalf.

We are not required to verify the accuracy or completeness of the User Content that you enter.

You confirm that you have all rights, authorisations and other legal bases necessary to enter, use and, where applicable, share such User Content through the Application.

If the User Content includes personal data relating to third parties, the Organisation is responsible for ensuring that it has an appropriate legal basis for processing such data and for complying with any other obligations imposed on it as a controller under applicable data protection laws.

5.2. Prohibited User Content

You must not enter, upload or otherwise make available through the Application any User Content that:

1. is unlawful or whose use through the Application would violate applicable law;

2. infringes intellectual property rights, data protection rights, confidentiality obligations or other rights of third parties;

3. contains malicious code, viruses or other elements that may compromise the security or operation of the Application or related systems; or

4. is fraudulent, intentionally misleading or otherwise used for the purpose of misusing the Application.

We may remove or disable access to User Content if we reasonably believe that it breaches this Section or if this is necessary to protect the security of the Application or to comply with a legal obligation.

5.3. Use of User Content

We may use and process User Content to the extent necessary to provide, maintain, secure and operate the Application and the Services, including for the purposes of storing, organising, structuring, technically adapting and processing data, linking data within the Application, generating Results, enabling the exchange of data with users with whom you are connected through the Application, providing support and complying with our legal obligations. During the Test Phase, we may also use User Content, to the extent necessary, for testing the functionalities of the Application, identifying and correcting errors, and developing and improving the Application and the Services. Personal data contained in User Content will not be used for these additional purposes unless they have first been anonymised.

For these purposes, you grant us a non-exclusive, worldwide and royalty-free right to use, reproduce, store, organise, structure, adapt, combine, process, display and transmit User Content, solely to the extent necessary for the purposes described above. This right includes the right to allow our service providers to use User Content in this manner to the extent necessary for the purposes described above and in accordance with these Terms.

This right applies for the duration of the Agreement and, following its termination, only for so long as we are authorised or required to retain or process User Content under these Terms or applicable law. You may not revoke the right granted under this Section for as long as its exercise is necessary for the provision of the Services or for us to fulfil our obligations under these Terms.

These Terms do not give us the right to use User Content for any other purpose, unless such use is expressly provided for in these Terms or subsequently agreed with you.

5.4. Usage Data and Feedback

We may collect and use technical data generated through the use of the Application, such as system logs, data relating to interactions with the Application, performance data and diagnostic data (the “Usage Data”), for the purposes of operating, maintaining and securing the Application, analysing its use, and developing and improving the Application and the Services.

We may also use data relating to the conduct and results of the Test Phase for the purpose of documenting and demonstrating the testing and validation of the Application to funding bodies, funding programmes and other relevant institutions. For this purpose, where necessary, we may also identify the Organisation that participated in the Test Phase, but we will not disclose its User Content, other Confidential Information of the Organisation, personal data that could identify individual natural persons, or other data that are not necessary for that purpose.

If you voluntarily provide us with suggestions, comments, ideas or other feedback regarding the Application (the “Feedback”), we may use such Feedback, without any obligation to pay compensation or provide attribution, to develop, modify and improve the Application and the Services.

5.5. Processing of Personal Data on Behalf of the Organisation

If and to the extent that, in providing the Services, we process personal data contained in User Content on behalf of the Organisation, the Organisation acts as the controller and we act as the processor within the meaning of Regulation (EU) 2016/679 (the “GDPR”).

Such processing is governed by Schedule 1 (Processing of Personal Data), which forms an integral part of these Terms. In the event of any conflict between Schedule 1 and the other provisions of these Terms regarding the processing of personal data on behalf of the Organisation, Schedule 1 will prevail.

6. Intellectual Property Rights

6.1. Our Rights

We retain all rights, including intellectual property rights, in and to the Application, the Services and the Content. This includes, in particular, the technology, algorithms, structure and functionalities of the Application, the user interface, design, databases, tools and documentation, as well as any modifications, upgrades and improvements to them. The same applies to the Kariqa name, logos and other elements of its visual identity.

We do not acquire ownership of the User Content. The Organisation retains all rights that it has in the User Content, and grants us only the rights of use expressly provided for in Section 5 of these Terms.

Certain elements of the Application, the Services or the Content may include third-party technologies, content or materials. Rights in such elements belong to their respective rights holders.

Except for the limited right of use granted under Section 4.1 and any other rights expressly provided for in these Terms, you acquire no other rights in or to the Application, the Services or the Content.

6.2. Protection of Intellectual Property Rights

You must not use or exploit the Application or the Content beyond the scope of the rights expressly granted under these Terms or in any manner that infringes our intellectual property rights or the rights of third parties.

You must not remove, alter or obscure any copyright, trade mark or other intellectual property notices appearing in the Application or the Content.

Other restrictions on the use of the Application and the Content are set out in Section 4.3 of these Terms.

If, through your use of the Application, you infringe our intellectual property rights or the rights of third parties, we may restrict or terminate your access to the Application in accordance with Section 4.6 and take any other appropriate steps to protect our rights.

If you become aware of any unauthorised use of the Application or the Content that may infringe our intellectual property rights, you must notify us without undue delay and, at our reasonable request, provide reasonable cooperation necessary to protect those rights.

7. Confidentiality

7.1. Confidential Information

“Confidential Information” means any information disclosed by one party to the other in connection with the Application, the Services or the Agreement, whether orally, in writing or electronically, regardless of whether it is marked as confidential or, by its nature and the circumstances of its disclosure, should reasonably be considered confidential.

This includes, in particular:

1. software, source code, algorithms, methods, processes, design, architecture and technologies;

2. business plans, strategies, forecasts, financial information and projections;

3. user data and Account information;

4. Content of a confidential nature;

5. Usage Data, including technical data relating to the use of the Application;

6. metrics, logs, performance statistics and other system-related information; and

7. User Content of a confidential nature, including business, commercial and other data entered, provided or exchanged through the Application.

Confidential Information does not include information that the receiving party can demonstrate:

1. is publicly available without breach of these Terms;

2. was lawfully known to it before being received from the other party;

3. was lawfully received from a third party without any obligation of confidentiality; or

4. was independently developed without use of the other party’s Confidential Information.

7.2. Confidentiality Obligations

Both parties undertake to keep the other party’s Confidential Information confidential and not to disclose it to third parties, except as permitted under these Terms or with the other party’s prior written consent.

Each party must apply reasonable measures to protect the other party’s Confidential Information, using at least the same degree of care as it uses to protect its own confidential information of a similar nature.

Confidential Information may be used only for purposes related to the performance of the Agreement and the use or provision of the Application and the Services, unless its use for another purpose is expressly provided for in these Terms.

Access to Confidential Information may be provided to employees, contractors, professional advisers and service providers who need such access for those purposes, provided that they are subject to obligations to keep such information confidential.

Each party may disclose Confidential Information where required to do so by law, a court order, a competent authority or another binding requirement. Where permitted by applicable law, that party will notify the other party in advance of such requirement and limit the disclosure to what is strictly necessary.

Notwithstanding the limitation on purpose set out in this Section, we may use and process Confidential Information contained in User Content only to the extent and for the purposes set out in Section 5 of these Terms.

Upon termination of the Agreement, each party will, at the other party’s request, return or delete the other party’s Confidential Information that it is no longer authorised or required to retain, except to the extent that continued retention is permitted under these Terms or required by applicable law. The handling of User Content following termination of use of the Application is governed in particular by Section 4.7 of these Terms and, in relation to personal data, by Schedule 1.

The obligations under this Section will survive termination of the Agreement.

8. Limitation of Liability

8.1. Exclusion of Certain Types of Loss

To the fullest extent permitted by applicable law, we are not liable for any indirect or consequential loss, or for any loss of profit, revenue, business, contracts, anticipated savings or reputation arising out of or in connection with the use of the Application or the Services.

In assessing our liability, account will be taken of the fact that, during the Test Phase, the Application is made available free of charge for testing and evaluation purposes and that the limitations and verification obligations set out in Section 3.3 of these Terms apply to its Results.

8.2. Limitation of Aggregate Liability

Except in the circumstances set out in Section 8.3, our total aggregate liability arising out of or in connection with the Agreement, the Application or the Services, regardless of the legal basis of the claim, is limited to EUR 1 (one euro).

8.3. Liability That Cannot Be Limited

Nothing in these Terms excludes or limits our liability for loss or damage caused intentionally or by gross negligence, or any other liability that cannot validly be excluded or limited under applicable law.

8.4. Force Majeure

We are not liable for any delay in or failure to perform our obligations where this results from circumstances beyond our reasonable control that we could not reasonably have prevented, remedied or avoided.

If such circumstances materially affect the provision of the Services, we will take reasonable measures to limit their consequences and, where appropriate, inform you of their impact on the Application.

8.5. Indemnification and Third-Party Claims

If a third party brings a claim against us as a result of unlawful use of the Application on behalf of the Organisation, a breach of these Terms, or User Content entered or provided on behalf of the Organisation, the Organisation is responsible for any loss or damage and reasonable costs that we incur as a result of such claim, to the extent caused by the acts or omissions of the Organisation or the person using the Application on its behalf.

This applies in particular to claims arising from infringement of intellectual property rights, data protection rights, confidentiality obligations or other rights of third parties, or from the fact that you did not have the necessary rights, authorisations or legal bases to enter, use or share User Content through the Application.

9. Final Provisions

9.1. Assignment or Transfer

You may not assign or transfer your rights or obligations under the Agreement to any third party without our prior written consent.

We may assign or transfer our rights and obligations under the Agreement to another person as part of a transfer of business, corporate reorganisation or other appropriate business arrangement, and will notify you accordingly.

9.2. Severability

If any provision of these Terms is found to be invalid, unlawful or unenforceable, this will not affect the validity or enforceability of the remaining provisions. Where possible, such provision will be interpreted or applied to the maximum extent permitted in a manner that most closely reflects its intended purpose.

9.3. Changes to these Terms

We may amend these Terms from time to time, in particular to reflect changes to the Application or the Services, for security reasons, due to changes in applicable law, or for other justified reasons.

We will notify you in advance of any material changes by email sent to the address associated with your Account or through the Application. If you continue to use the Application after the changes take effect, you will be deemed to have accepted the amended Terms.

If you do not accept the changes, you may stop using the Application and request the deactivation of your Account.

9.4. Survival of Certain Provisions

Any provisions of these Terms which by their nature are intended to continue to apply after termination of the Agreement will remain in effect after its termination, including in particular the provisions relating to intellectual property, confidentiality and liability.

9.5. Governing Law and Jurisdiction

These Terms and the Agreement are governed by the laws of the Republic of Croatia.

Any dispute arising out of or in connection with these Terms or the Agreement will be subject to the jurisdiction of the competent court in Rijeka.

9.6. Communications Between Us

We may send notices and other communications relating to these Terms, the Agreement or your use of the Application to the email address associated with your Account or through the Application. Such communications will be deemed duly delivered when sent or made available through the Application, as applicable.

You are responsible for ensuring that the email address and other contact details associated with your Account are accurate and up to date, and for regularly checking messages we send you, including your spam or junk folder, so that you do not miss important notices relating to the Application or the Services.

You may send any questions, requests or other notices relating to these Terms to us at [email protected], or to any other contact address that we may subsequently notify to you.

SCHEDULE 1 (PROCESSING OF PERSONAL DATA)

1. Application and Roles

This Schedule 1 applies if and to the extent that Kariqa solutions d.o.o. (the “Processor”), in the course of providing the Services, processes personal data on behalf of the Organisation (the “Controller”).

The Controller is responsible for the lawfulness of the personal data and the processing entrusted to the Processor, including ensuring that an appropriate legal basis exists and that any instructions given for the processing are lawful.

The rights and obligations of the Controller in relation to such processing are governed by the Terms, this Schedule 1 and applicable data protection laws.

2. Description of the Processing

Subject matter and purpose of the processing: processing of personal data contained in User Content for the purpose of providing, maintaining, securing and operating the Application and the Services in accordance with the Terms.

Duration: for the duration of the Agreement and, following its termination, for any period during which we are authorised or required to retain the personal data for the purposes of their return, export or deletion in accordance with the Terms or applicable law.

Nature of the processing: collection, storage, organisation, structuring, access, use, alteration, transmission, making available, export and deletion of personal data, as well as other processing activities necessary for the provision of the Services.

Types of personal data: business contact details, information relating to business roles or functions, and other personal data contained in User Content that the Controller enters, uploads, provides or otherwise makes available through the Application.

Categories of data subjects: contact persons, representatives and other natural persons associated with the Controller, Producers/Operators or other business entities whose personal data are contained in User Content.

3. Obligations of the Processor

The Processor will:

1. process personal data only on documented instructions from the Controller. Such instructions include instructions set out in the Terms and instructions given by the Controller through the use of the functionalities of the Application. This also applies to transfers of personal data to third countries. If the Processor is required to carry out certain processing under applicable law, it will inform the Controller before such processing, unless such notification is prohibited by law;

2. ensure that persons authorised to process personal data are subject to confidentiality obligations;

3. implement appropriate technical and organisational measures in accordance with Section 4 of this Schedule;

4. taking into account the nature of the processing, assist the Controller, insofar as possible through appropriate technical and organisational measures, in fulfilling its obligations in relation to the exercise of data subjects’ rights and, taking into account the nature of the processing and the information available to it, assist the Controller in fulfilling its obligations under Articles 32 to 36 of the GDPR;

5. without undue delay after becoming aware of a personal data breach affecting personal data processed on behalf of the Controller, notify the Controller and provide it with reasonably available information necessary for the Controller to fulfil its obligations in relation to such breach;

6. upon termination of the provision of the Services, at the Controller’s choice, delete the personal data or return them or enable their export, and delete existing copies, unless applicable law requires their continued retention;

7. make available to the Controller all information necessary to demonstrate compliance with the obligations set out in Article 28 of the GDPR and allow for and contribute to audits, including inspections, conducted by the Controller or an auditor authorised by the Controller; and

8. inform the Controller without delay if it considers that an instruction infringes the GDPR or other applicable data protection laws.

4. Security of the Processing

The Processor will implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the nature, scope, context and purposes of the processing, in accordance with Article 32 of the GDPR. Such measures will include, as appropriate, measures for controlling and restricting access, protecting the confidentiality, integrity and availability of personal data, backup and recovery, and detecting and managing security incidents. The Processor will regularly review the appropriateness of the measures implemented.

5. Subprocessors

The Controller grants the Processor general written authorisation to engage other processors (the “Subprocessors”) as necessary for the provision of the Services.

The Processor will inform the Controller in advance of any intended engagement of a new Subprocessor or replacement of an existing Subprocessor and will give the Controller an opportunity to object on reasonable grounds relating to the protection of personal data.

The Processor will impose on each Subprocessor, by contract, data protection obligations corresponding to those set out in this Schedule, including in particular the obligation to implement appropriate technical and organisational measures so that the processing complies with the GDPR. The Processor will remain liable to the Controller for the performance of the Subprocessor’s obligations.

6. Current Subprocessors

As at the date of acceptance of the Terms, the Processor uses the following Subprocessors:

7. International Transfers

The Processor will not transfer personal data outside the European Economic Area, or permit such a transfer through a Subprocessor, except in accordance with the applicable requirements of the GDPR and using an appropriate transfer mechanism where required.