Terms of Use

1. Introductory provisions and scope

1.1. These Terms of Use (hereinafter: the "Terms") govern the rights and obligations between the Provider and any legal entity or natural person carrying out a registered business activity that uses the Vomi Board application (hereinafter: the "Client" or "User"), in relation to access to and use of the Vomi Board application in all of its editions (iOS, Android, desktop and web) — hereinafter: the "Application".

1.1.a. The Application was developed and is operated by Vomi d.o.o., which holds all rights in the Application and acts as the technical operator of the system. The Application is also used to manage, monitor and deliver services to clients of the sister company Vomi Consulting d.o.o., which uses the Application under an agreement with Vomi d.o.o. Both companies apply the same data protection and security standards set out in these Terms.

1.1.b. The Vomi Group company with which the Client has concluded the Accounting Services Agreement (hereinafter: the "Contracting Company") is, vis-à-vis the Client, the holder of all contractual rights and obligations under these Terms, including responsibility for the processing of personal data in the capacity of processor. The identity of the Contracting Company is visible to the Client within the Application and stated on the invoices the Client receives.

1.2. The Application is intended exclusively for business users (B2B). It is not intended for consumers within the meaning of the Croatian Consumer Protection Act, and consumer protection legislation does not apply to this relationship.

1.3. By registering, logging into the Application or otherwise using the Application, the Client confirms that it has read, understood and fully accepted these Terms, including Annex 1 (Data Processing Terms), which forms an integral part hereof.

1.4. These Terms supplement, and do not replace, the accounting services agreement concluded between the Contracting Company and the Client (hereinafter: the "Accounting Services Agreement"). In the event of any discrepancy between the Accounting Services Agreement and these Terms, these Terms shall prevail in matters relating to the Application itself and to the processing of data through the Application, unless expressly agreed otherwise in writing.

1.5. By accepting these Terms, the person accepting them represents and warrants that they are authorised to represent the Client and to assume obligations in the Client's name and on its behalf.

2. Definitions

3. Scope and functionality of the Application

3.1. Depending on the modules activated, the Application enables the Client to:

a) Register, deregister and amend employee records — submit requests to the Contracting Company for the registration of employees with the mandatory insurance schemes, their deregistration, and the notification of changes during the insurance period, together with the supporting documentation;

b) Maintain records of working time and absences — record and review working time, annual leave, sick leave, paid and unpaid leave and other absences;

c) Agree payroll calculation and payment dates — agree the calculation schedule, confirm the input data for payroll and review and download payroll calculations;

d) Receive notifications and documents — receive notifications about legislative changes, deadlines and obligations, and review, download and digitally sign reports and other documents;

e) Use any further functionality the Provider may make available from time to time.

3.2. The Application is a communication and organisational tool replacing the exchange of data by e-mail, telephone or on paper. Submission of a request through the Application does not constitute an independent filing with the competent authorities by the Client — registrations, deregistrations and change notifications are filed with the competent authorities by the Contracting Company, within the scope and subject to the conditions of the Accounting Services Agreement.

3.3. The Provider reserves the right to develop, modify, upgrade or discontinue individual functionalities of the Application. The Client will be notified of material changes affecting the manner of use through the Application or by e-mail.

4. Conditions of access — free of charge for Vomi clients

4.1. The Application is provided to the Client free of charge, solely as an ancillary benefit accompanying the accounting services contracted with the Vomi Group. The right to use the Application is reserved exclusively for business entities holding a valid Accounting Services Agreement with Vomi d.o.o. or Vomi Consulting d.o.o. and having duly settled all matured obligations under that agreement.

4.2. The Application is not offered as a standalone product, is not sold to third parties and may not be used independently of the accounting services of the Vomi Group.

4.2.a. Where the Client holds agreements with both Vomi Group companies, the conditions under this Article are assessed jointly — failure to settle matured obligations towards either Vomi Group company gives rise to the right to withhold access to the Application.

4.3. Withholding and suspension of access due to non-payment. If the Client fails to settle a matured obligation under the Accounting Services Agreement (including the monthly fee, additionally contracted work and costs):

a) the Contracting Company will send the Client a written reminder (through the Application or by e-mail) granting an additional payment period of 8 (eight) days;

b) if the obligation is not settled within that additional period, the Contracting Company is entitled, without further notice, to temporarily withhold (suspend) access to the Application for the Client and its Authorised Persons, in whole or in part;

c) access is restored within 2 (two) business days of the recorded settlement of the entire outstanding debt;

d) if the suspension lasts continuously for more than 90 (ninety) days, or if the Accounting Services Agreement terminates, the Contracting Company is entitled to permanently close the user accounts, subject to Article 17 of these Terms on data export and deletion.

4.4. Suspension of access to the Application does not release the Client from its obligation to pay the matured fees, nor does it affect the Provider's right to collect its receivables, default interest and costs. Suspension likewise does not affect the rights and obligations of the parties under the Accounting Services Agreement, which continues to apply unchanged during that period, including the Contracting Company's right to suspend further provision of services in accordance with that agreement.

4.5. During suspension, Client Data remains stored and unaltered, and the Contracting Company continues to fulfil its statutory record-keeping obligations. The Provider is not liable for any damage, missed deadlines or costs incurred by the Client as a result of a suspension caused by non-payment.

4.6. Should the Provider introduce paid modules or packages in the future, it will notify the Client at least 30 (thirty) days in advance; functionalities previously provided free of charge will not be charged for without the Client's prior express consent.

5. User accounts, authorised persons and access security

5.1. Access to the Application is granted through personal user accounts. The Client determines which Authorised Persons will have access and with what level of permissions (e.g. administrator, data entry, signatory).

5.2. User accounts are personal and non-transferable. Sharing of credentials, the use of shared ("generic") accounts and granting access to the Application to persons not registered as Authorised Persons are prohibited.

5.3. The Client undertakes to:

a) ensure that each Authorised Person keeps their credentials confidential and uses multi-factor authentication where available;

b) notify the Provider without delay, and no later than the next business day, of the termination of any Authorised Person's authorisation (e.g. termination of employment, change of role) so that access can be revoked;

c) report without delay any suspicion of unauthorised access, loss of a device or compromise of credentials.

5.4. The Client is responsible for all actions taken through the user accounts assigned to its Authorised Persons as if they were its own actions.

5.5. The Provider is entitled to temporarily disable a user account where there is reasonable suspicion of misuse, unauthorised access or a threat to the security of the system, and will notify the Client without delay.

6. Client obligations and accuracy of data

6.1. The Client warrants that all data and documents it enters into or uploads to the Application are true, complete, accurate and up to date, and that it has a valid legal basis for providing them to the Provider.

6.2. The Client is solely responsible for:

a) the lawfulness of the collection of personal data of its employees and other data subjects, and for informing data subjects about the processing (Articles 13 and 14 GDPR), including the information that the Contracting Company acts as a processor;

b) the accuracy of data on working time, absences, contractual pay, deductions, enforcement orders, non-taxable payments and other payroll components;

c) the timely submission of requests and documentation.

6.3. The Client undertakes not to submit through the Application any personal data that is not necessary for the agreed purposes, and in particular not to upload documentation containing medical diagnoses or other special categories of data beyond the scope strictly necessary for the exercise of employment rights and obligations.

6.4. It is prohibited to use the Application in a manner that: compromises the security or availability of the system; involves unauthorised access, reverse engineering, decompilation, automated content extraction (scraping) or circumvention of security measures; infringes legislation or the rights of third parties; or introduces malicious code.

7. Registration, deregistration and change requests

7.1. The Client submits registration, deregistration and change requests through the relevant module of the Application, always enclosing the documentation required for processing (employment contract, decision, notice of termination, employee identification documents, etc.).

7.2. The Client must submit each request in good time, and no later than 2 (two) business days before the requested effective date, or within a period objectively enabling the Contracting Company to act within the statutory deadlines prescribed for registration, deregistration and change notifications to the mandatory insurance schemes. For requests received after that period, outside the Provider's business hours, on non-working days or public holidays, the Provider is not liable for any missed statutory deadline.

7.3. A request is deemed received at the moment the Application assigns it the status "received". The processing status of each request is visible to the Client in the Application.

7.4. The Provider is entitled to request the supplementation or correction of a request. The periods referred to in Article 7.2 do not run until the requested supplement is delivered.

7.5. The Provider is not liable for any damage, fines, misdemeanour or other sanctions arising from inaccurate, incomplete or untimely data and documentation submitted by the Client.

8. Payroll calculation and payment

8.1. The payroll calculation date and the proposed salary payment date are agreed through the Application. The agreed date does not release the Client from its obligation to pay salaries within the deadlines prescribed by the Croatian Labour Act and the employment contract.

8.2. The Client must confirm in the Application the data required for the calculation (working time records, absences, variable pay components, non-taxable payments, deductions) by the deadline indicated for each payroll period. By confirming the data, the Client assumes responsibility for its accuracy.

8.3. The Contracting Company prepares the payroll calculation, payslips and related reports and makes them available in the Application. The Client must review the calculation and raise any objections before payment is executed, and no later than 2 business days from the date the calculation is made available.

8.4. The Provider does not execute payment transactions (salary payments, payment of contributions and taxes) through the Application, unless expressly and separately agreed in writing. The Application may generate payment orders, forms or barcodes, the execution of which remains the sole obligation of the Client.

9. Digital signing of documents

9.1. The Application enables the electronic signing of reports, calculations, consents and other documents by the Client's Authorised Persons.

9.2. Electronic signatures in the Application are implemented as simple or advanced electronic signatures within the meaning of Regulation (EU) No 910/2014 (eIDAS) and the Croatian Act implementing that Regulation (Official Gazette 62/17). For documents for which specific legislation requires a qualified electronic signature, notarial form or a handwritten signature, the Client must use the appropriate form outside the Application.

9.3. The parties expressly agree that the signing records (audit trail) maintained by the Application — signatory identity, time of signature, IP address, device identifier and document hash — constitute credible evidence that signing has taken place.

9.4. The Client undertakes to ensure that electronic signing is performed exclusively by persons authorised to do so under its internal rules and applicable representation laws.

10. Notifications on legislative changes

10.1. Notifications on legislative and other regulatory changes published by the Provider in the Application are for information purposes only, are prepared on the basis of publicly available sources, and do not constitute legal, tax or financial advice tailored to the Client's specific circumstances.

10.2. For advice on a specific case, the Client should contact the Contracting Company under the Accounting Services Agreement or an appropriate professional adviser. The Provider is not liable for decisions taken by the Client solely on the basis of general notifications in the Application.

11. Protection of personal data — general provisions

11.1. Roles of the parties. In respect of the personal data of employees, former employees, candidates, external associates and other data subjects entered by the Client into the Application, the Client is the controller and the Contracting Company is the processor, processing the data exclusively on the documented instructions of the Client. The mutual rights and obligations are set out in Annex 1 to these Terms, which constitutes the contract required by Article 28(3) GDPR.

11.1.a. Relationship within the Vomi Group. Where the Contracting Company is Vomi Consulting d.o.o., Vomi d.o.o. acts as a sub-processor in respect of the Client's personal data (technical operator of the Application, hosting and maintenance) and is bound by contract with Vomi Consulting d.o.o. to the same data protection obligations as those set out in Annex 1. Client Data is not exchanged between Vomi Group companies for any other purpose, and staff of one company have no access to the client data of the other, except to the extent strictly necessary for technical maintenance of the system and subject to access logging.

11.2. Purpose limitation. By accepting these Terms, the Client authorises the Provider to handle the personal data supplied through the Application exclusively for the purpose of carrying out registrations, deregistrations and change notifications relating to mandatory insurance schemes, maintaining records of working time and absences, calculating salaries and allowances, and preparing, delivering and signing the related reports and documents, as well as fulfilling the Provider's related statutory obligations.

11.3. The Provider expressly undertakes not to:

a) use the personal data for its own purposes or for any purpose not listed in Article 11.2;

b) sell, lease, assign or otherwise make the data available to third parties, other than the sub-processors listed in Annex 1 and the competent authorities where required by law;

c) use the data for marketing purposes, profiling or automated decision-making;

d) use the data to develop, train or improve artificial intelligence models, except in fully anonymised form from which data subjects cannot be identified.

11.4. The Provider as an independent controller. The Contracting Company acts as an independent controller in respect of: (i) the data of the Client's Authorised Persons required to maintain user accounts and access records (legal basis: legitimate interest, Article 6(1)(f) GDPR, and performance of a contract, Article 6(1)(b)); and (ii) data it is required to process to fulfil its own statutory obligations (accounting legislation, anti-money-laundering legislation, archiving) — Article 6(1)(c) GDPR.

11.5. Data subject rights. Data subjects should address requests for the exercise of their rights (access, rectification, erasure, restriction of processing, portability, objection) to the Client as controller. The Provider will render the Client reasonable assistance in handling such requests in the manner set out in Annex 1.

11.6. Supervisory authority. Data subjects have the right to lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop@azop.hr.

11.7. Data protection contact: vomi@vomi.hr, marked "Data protection".

12. Confidentiality and trade secrets

12.1. All information exchanged by the parties through the Application, including data on salaries, business operations, customers, pricing and technical solutions, is deemed a trade secret within the meaning of the Croatian Act on the Protection of Undisclosed Information with Market Value.

12.2. The confidentiality obligation applies throughout the term of the contractual relationship and for 5 (five) years thereafter; in respect of personal data and data constituting a trade secret under specific legislation, it applies without time limit for as long as their protection subsists.

12.3. The Provider warrants that all persons processing Client Data on its behalf are bound by a written confidentiality undertaking or an equivalent statutory duty of confidentiality.

13. Intellectual property and licence

13.1. The Application, its source and object code, database, design, interfaces, names, logos and documentation are the exclusive property of Vomi d.o.o. and are protected by copyright and industrial property legislation.

13.2. These Terms grant the Client a non-exclusive, non-transferable, time-limited and revocable right of use of the Application, solely for its own business needs and for the term of the Accounting Services Agreement. No other rights are transferred.

13.3. Client Data remains the property of the Client. The Provider acquires no rights in it other than the limited right of processing necessary to provide the service in accordance with Article 11.2.

13.4. The Provider is entitled to use aggregated and anonymised statistical data on the use of the Application (e.g. number of requests processed, average processing time) to improve the service, provided that neither the Client nor any data subject can be identified from it.

14. Availability, maintenance and support

14.1. The Provider will endeavour to ensure high availability of the Application but, given that the Application is provided free of charge, it does not guarantee uninterrupted or error-free availability and does not undertake any service level agreement (SLA), unless separately agreed in writing.

14.2. Where feasible, scheduled maintenance will be carried out outside business hours and announced at least 24 hours in advance through the Application.

14.3. User support is available on business days from 08:00 to 16:00 by e-mail at vomi@vomi.hr and through the support system within the Application.

14.4. Unavailability of the Application does not release the Client from its statutory obligations. In the event of a prolonged outage, the Client must submit its requests and data to the Contracting Company through an alternative channel (e-mail), and the Contracting Company must process them as if they had been received through the Application.

15. Liability and limitation of liability

15.1. The Contracting Company is liable for the professional quality and timeliness of the accounting work performed in accordance with the Accounting Services Agreement and applicable legislation. These Terms neither exclude nor limit that liability.

15.2. In respect of the Application itself, as a tool provided free of charge, the Provider is not liable for:

a) damage arising from inaccurate, incomplete or untimely data entered by the Client;

b) damage arising from unauthorised access caused by failings on the Client's side (shared passwords, unreported termination of authorisations, compromised devices);

c) temporary unavailability of the Application, interruptions of internet service, faults in the Client's equipment or force majeure;

d) loss of profit, loss of business opportunity, loss of reputation, or indirect and consequential damage.

15.3. The limitations of liability under this Article do not apply in cases of intent or gross negligence on the part of the Provider, breach of personal data protection obligations, or in any other case where limitation of liability is not permitted by mandatory law.

15.4. The Client undertakes to indemnify the Provider for any damage and costs (including costs of proceedings and fines) arising from a breach of these Terms by the Client or its Authorised Persons, or from the submission of data without a valid legal basis.

16. Term, termination and consequences

16.1. The right to use the Application subsists for as long as the Accounting Services Agreement is in force and the conditions under Article 4 of these Terms are met.

16.2. The Client may cease using the Application at any time and request closure of its user accounts by written notice to the Contracting Company; this does not terminate the Accounting Services Agreement.

16.3. The Provider may terminate the right to use the Application upon 30 (thirty) days' notice, and with immediate effect in the event of: (i) termination of the Accounting Services Agreement; (ii) non-payment under the conditions set out in Article 4.3; or (iii) a material breach of these Terms, in particular misuse of the Application or a threat to the security of the system.

17. Data export and deletion after termination

17.1. Following termination of the right to use the Application, the Client has 30 (thirty) days to download (export) its data and documents in machine-readable format (CSV/XLSX) and in PDF format for documents. On request, the Contracting Company will prepare and deliver the export; for extensive exports outside the standard formats, a reasonable charge for the work involved may apply.

17.2. Upon expiry of the period referred to in Article 17.1, the Contracting Company will delete or return all personal data processed in its capacity as processor, in accordance with the Client's instruction, including existing copies.

17.3. Exception: the Contracting Company will retain documentation and data subject to a statutory retention obligation, solely for that purpose and with appropriate safeguards, in particular:

• accounting records and documents — for the periods prescribed by the Croatian Accounting Act and tax legislation;

• payroll calculations, payroll documents and data relevant to pension insurance entitlements — for the periods prescribed by pension insurance and labour legislation;

• employee and working time records — for the periods prescribed by the Croatian Labour Act and its implementing ordinance;

• documentation prescribed by anti-money-laundering and counter-terrorist-financing legislation.

17.4. Suspension of access due to non-payment (Article 4.3) does not constitute termination of the right of use within the meaning of this Article; data is not deleted during such a period.

18. Amendments to the Terms

18.1. The Provider reserves the right to amend these Terms. The Client will be notified of amendments through the Application and/or by e-mail at least 15 (fifteen) days before they take effect, together with the consolidated text.

18.2. If the Client does not accept the amendments, it may cease using the Application and request closure of its user accounts before the amendments take effect. Continued use of the Application after the amendments take effect constitutes acceptance of the amended Terms.

18.3. Amendments required to comply with legislation or decisions of the competent authorities take effect on the date prescribed by such legislation or decision.

19. Governing law and dispute resolution

19.1. These Terms are governed by the law of the Republic of Croatia, excluding its conflict-of-law rules.

19.2. The parties will endeavour to resolve disputes amicably. Failing that, the competent court in Osijek, Republic of Croatia, shall have jurisdiction.

20. Final provisions

20.1. If any provision of these Terms becomes null or unenforceable, this does not affect the validity of the remaining provisions; the invalid provision will be replaced by a valid provision that comes closest to its economic purpose.

20.2. The Client may not assign its rights and obligations under these Terms to a third party without the prior written consent of the Contracting Company.

20.3. All notices are delivered through the Application or to the e-mail addresses stated in the user account and are deemed received on the business day following dispatch.

20.4. These Terms were drawn up in Croatian and English. In the event of any discrepancy, the Croatian version prevails.

20.5. These Terms take effect on the date of their publication in the Application and apply to all Clients from the date of acceptance.

Annex 1 — Data Processing Terms

(Processing agreement within the meaning of Article 28(3) GDPR)

Controller: the Client

Processor: the Contracting Company, namely:

— VOMI d.o.o., Županijska ulica 42, 31000 Osijek, OIB: 36946449172, or

— VOMI CONSULTING d.o.o., Zrinjevac 4, 31000 Osijek, OIB: 54258390599

Sub-processor (where the Contracting Company is Vomi Consulting d.o.o.): VOMI d.o.o. — technical operator of the Application.

A. Subject matter, duration, nature and purpose of processing

Subject matter: processing of personal data necessary for the provision of services through the Vomi Board Application and of accounting services relating to payroll and HR record-keeping.

Duration: for the term of the Accounting Services Agreement and use of the Application, extended by the statutory retention periods set out in Article 17.3 of the Terms.

Nature and purpose of processing: collection, recording, organisation, structuring, storage, consultation, use, alteration, transmission to competent authorities and erasure of personal data for the purposes of:

1. registration, deregistration and notification of changes to the mandatory insurance schemes;

2. maintaining records of working time and absences;

3. calculating salaries, salary compensations, other income and deductions;

4. preparing and submitting prescribed reports (e.g. the JOPPD form) and preparing payslips;

5. delivering, reviewing and electronically signing documents;

6. communicating with the Client in relation to the above.

Any processing outside these purposes is prohibited.

B. Categories of data subjects

Employees of the Client (including former employees), persons engaged under contracts outside an employment relationship, members of the management board and executive directors, dependent family members of employees (to the extent required for the personal allowance), legal representatives and Authorised Persons of the Client.

C. Types of personal data

Special categories of data (Article 9 GDPR): processed only exceptionally and to the minimum extent necessary — the existence of a disability or reduced working capacity, and the code/reason for absence due to illness, solely to the extent required to calculate salary compensation and to exercise employment rights and obligations, on the basis of Article 9(2)(b) GDPR. Medical diagnoses are not entered or processed.

D. Obligations of the processor

The Processor undertakes to:

a) process personal data only on documented instructions from the Client, including instructions contained in these Terms and in requests submitted through the Application, unless required to do so by EU or Croatian law — in which case it will inform the Client before processing, unless such notice is prohibited;

b) inform the Client without delay if, in its opinion, an instruction infringes the GDPR or other data protection legislation;

c) ensure that all persons authorised to process the data are bound by confidentiality obligations and appropriately trained;

d) implement the appropriate technical and organisational measures set out in Section F of this Annex (Article 32 GDPR);

e) respect the conditions for engaging sub-processors set out in Section E;

f) taking into account the nature of the processing, assist the Client by appropriate technical and organisational measures in fulfilling its obligation to respond to data subject requests — the Processor will provide the requested information or carry out the requested action within 5 (five) business days of receipt of the Client's request;

g) assist the Client in complying with Articles 32 to 36 GDPR (security of processing, notification of breaches, data protection impact assessment, prior consultation);

h) at the Client's choice, delete or return all personal data after the end of the provision of services, subject to statutory retention obligations (Article 17.3 of the Terms);

i) make available to the Client all information necessary to demonstrate compliance with Article 28 GDPR and allow for and contribute to audits;

j) maintain a record of the categories of processing activities carried out on behalf of the Client (Article 30(2) GDPR).

E. Sub-processors

E.1. The Client grants the Processor general written authorisation to engage sub-processors for individual technical aspects of the service (hosting, backup, e-mail delivery, support system, electronic signing platform, software maintenance).

E.2. The Processor will conclude a contract with each sub-processor imposing on it the same data protection obligations as those set out in this Annex, and remains fully liable to the Client for the sub-processor's performance.

E.3. The Processor will notify the Client of any intended addition or replacement of a sub-processor at least 15 (fifteen) days in advance. The Client may object on reasonable data protection grounds within 15 days; if no agreement is reached, the Client may terminate use of the Application without liability for damages.

E.4. The current list of sub-processors is available in the Application and comprises:

F. Technical and organisational measures (Article 32 GDPR)

Access control: individual user accounts, strong password policy, multi-factor authentication, role-based permissions on a least-privilege basis, automatic revocation of access upon termination of authorisation.

Cryptography: encryption of data in transit (TLS 1.2 or higher) and encryption of data at rest; password hashing.

Logging and traceability: logging of access to and operations on data (audit trail), protected against alteration, with an appropriate retention period.

Availability and recovery: regular backups, geographically separated backup storage, testing of the recovery procedure, business continuity plan.

System security: regular updates and patching, malware protection, firewall, separation of production and test environments, pseudonymisation of data in test environments.

Organisational measures: internal data protection and information security policies, confidentiality undertakings, regular staff training, incident management procedure, physical access control to business premises and archives.

Data segregation: logical separation of individual Clients' data (multi-tenant isolation) such that a Client can access only its own data.

G. Personal data breach

G.1. The Processor will notify the Client of any personal data breach without undue delay and no later than 24 hours after becoming aware of it, so that the Client can meet its obligation to notify AZOP within 72 hours (Article 33 GDPR).

G.2. The notification will contain: a description of the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken and proposed, and the contact point for further information.

G.3. Notifying data subjects and the supervisory authority is the obligation of the Client as controller; the Processor will provide full cooperation.

H. Transfers outside the EEA

Personal data is processed and stored within the European Economic Area. Transfer to a third country is permitted only upon prior notice to the Client and subject to a valid mechanism under Chapter V GDPR (adequacy decision or standard contractual clauses together with a transfer impact assessment).

I. Audit

I.1. The Client has the right, once per year and additionally following a personal data breach, to verify the Processor's compliance with the obligations under this Annex, upon written notice of at least 30 (thirty) days.

I.2. Audits are conducted during business hours, with minimal disruption to operations and subject to the obligation to maintain the confidentiality of other clients' data. The Processor may demonstrate compliance by providing valid certifications, independent auditor reports or a completed compliance questionnaire.

I.3. The costs of the audit are borne by the Client, unless the audit establishes a material breach of obligations on the part of the Processor.

Acceptance of the Terms

By accepting these Terms in the Application, the Client confirms that it is fully acquainted with and agrees to them and to Annex 1. The electronic record of acceptance (identity of the person, date and time, version of the Terms) is stored in the system and has the evidentiary force of a written declaration of intent.