General Terms and Conditions of Use of the Imprion Business System

The General Terms and Conditions of Use of the Imprion Business System (hereinafter: the General Terms and Conditions) govern the relationship between the holder of the copyright in the Imprion Business System on the one hand and customers and users on the other, as well as the conditions of use of the Imprion Business System (hereinafter: the Imprion System).

The holder of the copyright and of the source code of the Imprion System is the company IMPRION d.o.o., Tržaška cesta 65, 2000 Maribor, company registration number: 7309694000, VAT number: SI17772427 (hereinafter: the Provider). Any user may use the Imprion System under the terms of these General Terms and Conditions. Unauthorised use of the Imprion System, or use contrary to the General Terms and Conditions, constitutes an infringement of the Provider's copyright.

PART I – GENERAL

1 Definition of terms

The terms used in these General Terms and Conditions have the following meaning:

1.1 The User is a natural person who is identified in the Imprion System by an e-mail address and a password, who agrees to and accepts these General Terms and Conditions, and who uses the Imprion System for business purposes in the name and on behalf of the Customer.

1.2 The Customer is a business entity which concludes the Subscription Agreement and undertakes to pay the Subscription Fee. For the purposes of the protection of personal data under these General Terms and Conditions, the Customer acts as the controller.

1.3 The Licence is the right to use the Imprion System to the extent determined by the Subscription Type and these General Terms and Conditions.

1.4 A Business Location is premises or a (movable or immovable) business unit through which the Customer issues invoices using the Imprion System.

1.5 An Electronic Device for Issuing Invoices is a device or cash register point in the Imprion System through which the User issues invoices.

1.6 An Additional Module is an additional feature of the Imprion System that the Customer activates on top of the basic use.

1.7 The Subscription Type is the definition of the set of Imprion System features and of the scope of use, determined by the number of active Business Locations and active Electronic Devices for issuing receipts, and by the Additional Modules that have been activated.

1.8 The Subscription Agreement is the agreement by which the Provider grants the Customer the Licence to use the Imprion System.

1.9 An Imprion Feature is a part of the Imprion System that constitutes a self-contained set of operations required to carry out a particular task relating to till operations and the issuing of receipts, e.g. issuing a receipt, daily takings, sales overview.

1.10 The Subscription Fee is the amount that the Customer must pay for the use of the Imprion System.

1.11 The Administrator is the User designated by the Customer (or the User who concludes the Subscription Agreement on the Customer's behalf) who manages, on the Customer's behalf, the settings and the rights of other Users, and who orders from the Provider the activation or deactivation of Business Locations, Electronic Devices for issuing receipts and Additional Modules.

1.12 User Support is the service that enables communication between Users and the Provider.

2 Copyright

2.1 The holder of all economic copyright in the Imprion System and in the source code of the Imprion System is the Provider. Imprion is a trade mark for computer applications, the holder of which is the Provider.

2.2 By accepting the General Terms and Conditions, the Customer and the User acquire the right to use the Imprion System in accordance with the General Terms and Conditions and the terms of the Licence.

3 User Requirements

3.1 Before using the Imprion System, the User is obliged to accept the General Terms and Conditions.

3.2 Before using the Imprion System for the first time, the User is obliged to carry out the registration procedure, in which the User is identified and accepts the General Terms and Conditions by ticking the box placed before the text “I accept the General Terms and Conditions of Use of the Imprion Business System”.

3.3 By accepting the General Terms and Conditions, the User agrees to and accepts the General Terms and Conditions in force at the time of each use of the Imprion System. The General Terms and Conditions may be amended during the term of the Subscription Agreement, of which the Customer will be notified at least 30 days in advance. If the Customer does not agree with the amendments to the General Terms and Conditions, it has the right to withdraw from the Subscription Agreement. If, after receiving the notice of the amendment of the General Terms and Conditions, it continues to use the Imprion System, it shall be deemed to agree with the amended terms.

3.4 Users who were already using the Imprion System before the entry into force or the most recent amendment of these General Terms and Conditions are obliged to accept these General Terms and Conditions upon their first subsequent login to the Imprion System. Until an existing User accepts these General Terms and Conditions, login to the Imprion System and further use are not possible.

3.5 Every User must meet the technical and factual requirements necessary for the effective and secure use of the Imprion System. The Imprion System consists of a web part and a local part of the application, to which different technical requirements apply, as set out in points 3.6 and 3.7.

3.6 In order to use the web part of the Imprion System, the User must provide at least:

(a) access to the internet;

(b) suitable hardware and software (a computer and/or a mobile device) for the use of the web part of the Imprion System;

(c) additional software, where such software is a condition for the use of certain Imprion Functions;

(d) means of identification (e-mail address and password), which are a precondition for identification and consequently for the use of the Imprion System.

3.7 For the installation and running of the local part of the application, which runs on the Customer's devices, the Customer must provide, for each individual device, at least:

(a) a stable internet connection with a speed of at least 2,5 Mbit/s;

(b) additional software, where such software is a condition for the use of certain Imprion Functions;

(c) a device meeting the following minimum system requirements:

3.8 When accessing the Imprion System, the User is identified by means of an e-mail address and a password.

3.9 The Customer or the User must provide the requirements set out in points 3.5 to 3.7 of the General Terms and Conditions themselves, including their own devices on which the local part of the application runs, and the security thereof. The Provider bears no obligation or liability whatsoever for ensuring the correct and uninterrupted operation of the equipment, services, products or computer programs falling within the scope of the requirements which the Customer or the User must provide themselves.

3.10 The Provider does not warrant the correct and secure operation of the Imprion System where the Customer or the User does not meet the requirements set out in points 3.5 to 3.7 of the General Terms and Conditions.

PART II – USE OF THE IMPRION SYSTEM

4 Conclusion of the subscription agreement and use of the licence

4.1 The Subscription Agreement is concluded when the person who is the legal representative of the Customer, or a person authorised by the latter, accepts the General Terms and Conditions on behalf of the Customer and completes the registration or the order. The Subscription Agreement is concluded for an indefinite period.

4.2 The User who concludes the Subscription Agreement on behalf of the Customer becomes the Administrator. The Customer may designate another User as the Administrator. The Administrator shall be deemed to carry out all activities through the Imprion System and in connection with the Imprion System with the Customer's authorisation.

4.3 By concluding the Subscription Agreement, the Customer acquires the Licence.

4.4 The Customer uses the Licence through Users. The Administrator has the right to enable other Users to use the Customer's Licence and to determine their access rights.

4.5 The scope of use, that is, the number of active Business Locations and Electronic Devices for Issuing Invoices and of activated Additional Modules, is ordered by the Customer, through the Administrator, from the Provider, who activates or deactivates that scope. The Subscription Type and the amount of the Subscription Fee are determined on the basis of the scope thus activated.

5 Use and payment

5.1 The use of the Imprion System is subject to payment. In order to use the Licence, the Customer must pay the Subscription Fee.

5.2 The Subscription Fee is determined by the price list adopted by the Provider. The price list is published on the website https://imprion.io. By means of the price list, the Provider also determines the price of additional services or of accesses to the Imprion System.

5.3 The Subscription Fee is charged monthly in arrears, in accordance with the Provider's price list applicable at any given time, which sets out the packages and the prices of the individual items. The billing takes into account the scope enabled in the Imprion System during the billing period (calendar month), namely the active Electronic Devices for Issuing Invoices, the active Business Locations and the activated Additional Modules.

(a) Every Electronic Device for Issuing Invoices, every Business Location and every Additional Module which is added to or activated in the Imprion System and is not disabled shall be deemed active or enabled.

(b) For billing purposes, it is irrelevant whether any invoice was issued through an individual Electronic Device for Issuing Invoices during the billing period, or whether the device was actually connected to the Imprion System (online) or in use. The mere presence of an activated and non-disabled item in the Imprion System is sufficient.

(c) For billing purposes, only that number of active Electronic Devices for Issuing Invoices which was maintained in the Imprion System for at least two (2) hours is taken into account. The Provider checks the status periodically; a status is deemed to have been maintained where two consecutive checks show the same number of active devices. Transitional changes in the number of devices which are not confirmed by two consecutive checks are not taken into account for billing purposes. This ensures, in particular, that where one Electronic Device for Issuing Invoices is replaced by another, both devices are not charged where they were simultaneously active only for a short time during the replacement procedure.

5.4 The Provider has the right to amend the price list taking into account market conditions and price movements. The Provider shall announce a change to the price list at least 30 days before it takes effect.

5.5 The party liable for payment of the Subscription Fee is the Customer. The invoice for the Subscription Fee is issued by the Provider or, on its behalf, by its contractual partner. The Customer is obliged to pay the Subscription Fee within 10 days of the issue of the invoice. If the last day of the payment period falls on a Saturday, a Sunday or another non-working day, the period is extended to the first following working day.

5.6 Where the Customer has two outstanding overdue invoices for the Subscription Fee at the same time, the Provider may disable access to the Imprion System or the use of the Licence for any User. Before doing so, the Provider shall send the Customer two reminders and a final reminder prior to disconnection. During the period in which access is disabled, Users cannot use the Imprion Functions. The Provider shall re-enable access once the Customer has settled all overdue obligations.

6 Complaints

6.1 The Administrator may, on behalf of the Customer, lodge a complaint regarding the invoice for the Subscription Fee within 14 calendar days of the date of issue of the invoice. The complaint shall be sent to the address [email protected]. The Provider will respond to the complaint within 14 calendar days at the latest.

7 Prohibited purposes of use of the Imprion System

7.1 Customers and Users may use the Imprion System only for cash register operations and the issuing of invoices, and for keeping the related data of business entities. Any other purpose of use of the Imprion System is prohibited.

7.2 When using the Imprion System, it is expressly prohibited to:

(a) disable or hinder other Users in their use of the Imprion System;

(b) publish, transmit, distribute or disseminate any information, topics or materials which are unlawful, false, indecent, offensive or obscene, or which spread racial, sexual or any other form of intolerance;

(c) publish advertising messages, solicitations, chain letters, pyramid schemes, investment opportunities or schemes, or any other kind of promotional notices;

(d) abuse, threaten or otherwise infringe the rights of others;

(e) transfer to others content of the Imprion System protected by intellectual property rights, or otherwise enable access to such content, unless such transfer has been duly agreed with the Provider;

(f) use materials or information, including images or photographs, made available through the Imprion System in a manner that in any way infringes the copyright, trade marks, patents, trade secrets or other rights of the Provider, of other licensees, of users or of third parties;

(g) upload to the Imprion System files and other content containing viruses, Trojan horses, worms, time bombs, corrupted files or other similar software or data which may harm the operation of the Imprion System, the equipment on which or by means of which the Imprion System operates, or the Users' equipment;

(h) intentionally or unintentionally harm the Imprion System in any way, for example by attempting attacks on the server or by other acts which could result in degraded, incorrect or limited operation of the Imprion System or in its failure to operate;

(i) collect information about Customers and/or Users from the Imprion System in various ways;

(j) create or use false identities for the purpose of misleading others, in particular the Provider and User Support;

(k) use, transfer or otherwise copy and offer to other persons (for payment or free of charge) directories or any other data about Customers and/or Users, or data about the use of the Imprion System;

(l) collect or use, without the written permission of the Provider, information about the technology used, the ideas implemented, the approaches applied and any other content of the Imprion System which could be used in other commercial or non-commercial services or products.

8 Appropriate use, quality assurance and protection against overloading of the Imprion System

8.1 For the purpose of ensuring the undisturbed operation of the Imprion System and the quality of the services for every Customer or User, every Customer or User undertakes to use the Imprion System or individual Imprion Functions to an extent which will not cause excessive loads on the Imprion System and thereby prevent other Customers or Users from using it with the same quality.

8.2 In cases where the use of the Imprion System by a particular Customer or User in a particular limited period of time substantially deviates from the ordinary use by an average Customer or User, or where the Provider, on the basis of an analysis of use, assesses that a particular Customer or User is not using the Imprion System in accordance with usual patterns of use, the Provider reserves the right, for the purpose of protecting the quality of the services and of protection against overloading, to limit the possibility of use of the Imprion System or of the Imprion Functions by the individual Customer or User in the manner and to the extent which will ensure quality services and appropriate operation for the other Customers or Users.

8.3 Before taking any measure of permanent or temporary limitation of use, the Provider will call upon such Customer or User in writing (a notice by e-mail shall also be deemed a written notice) to cease such use or such extent of use within a reasonable period. If the Customer or the User does not cease such use or does not limit the extent of use to the stated limit within the period set, the Provider may permanently or temporarily limit such Customer's or User's use of the Imprion System.

8.4 In the event of a permanent or temporary limitation of the use of the Imprion System which occurs as a consequence of inappropriate use by the Customer or the User, the Customer is not entitled to a refund of the proportionate part of the Subscription Fee for the period in which the limitation of use occurred.

9 Operation of the Imprion System

9.1 The Provider endeavours to ensure the undisturbed operation of the Imprion System, except in the cases of:

(a) failure of the Customer's or the User's equipment, or any other case in which the Customer or the User does not meet the requirements set out in the chapter “3 User Requirements”;

(b) maintenance interventions (scheduled and unscheduled) on the Imprion System;

(c) upgrades of the software or hardware necessary for the operation of the Imprion System or otherwise connected with the operation of the Imprion System;

(d) failure of internet connections;

(e) force majeure.

9.2 The Provider endeavours to notify Customers and Users of scheduled interventions on the Imprion System in advance where possible. The Provider does not undertake to carry out interventions within a predetermined time window, but endeavours to carry out interventions in such a way as to affect the use of the Imprion System as little as possible.

9.3 The local part of the Imprion System application may also allow invoices to be issued during an outage of the internet connection or a temporary unavailability of the web part of the Imprion System; the data thus issued are synchronised with the web part of the Imprion System once the connection is re-established. The Customer is obliged to ensure that the devices on which the local part of the application runs allow regular synchronisation of the data.

10 Compliance of the Imprion System with legislation and upgrading

10.1 The Provider endeavours to ensure the compliance of the Imprion Functions with the applicable legislation for the use cases which the Imprion System supports or provides for.

10.2 The Provider endeavours to monitor regulations and to upgrade the Imprion Functions in accordance with changes in the regulations.

10.3 The Customer is responsible for the accuracy and completeness of the data which it enters into the Imprion System, and for the compliance of its business operations and of the invoices issued with the applicable legislation.

11 Assistance to users

11.1 Users who use the Customer's Licence are entitled to assistance in using the Imprion System.

11.2 The Provider provides assistance in connection with the operation of the Imprion System through User Support on working days between 8:00 and 16:00, namely by e-mail at the address [email protected] and by telephone at +386 2 292 8900.

11.3 The Provider endeavours to remedy defects which prevent the use of the Imprion Functions. The Provider will respond to every reported defect within a reasonable period, whereby only the time during which the Provider provides User Support is taken into account.

11.4 User Support is limited to assistance in using the Imprion System. Support does not cover, in particular: the entry of data, products or invoices on behalf of the Customer or the User; the editing or remedying of incorrect settings or configuration entered or determined by the Customer or the User; the remedying of defects or malfunctions of hardware, the internet connection, devices or other equipment or software which, in accordance with the chapter “3 User Requirements”, must be provided by the Customer or the User themselves; and accounting, tax, legal or other advice which is not directly connected with the use of the Imprion System.

12 Limitation of the Provider's liability

12.1 Customers and Users agree that they use the Imprion System, including the software, content and services accessible through the Imprion System, at their own risk.

12.2 The Provider's total liability for any loss event is limited to the amount of the Subscription Fee which the Customer paid for the use of the Imprion System for the month in which it notified the Provider of the loss event. The Provider and its contractual partners are not liable for any indirect, special, incidental or consequential damage (including, but not limited to, lost profit, income, investments or goodwill) arising from or connected with the use of the Imprion System or of related websites, products or services. The stated limitation also applies where the Provider was informed of the possibility of such damage occurring. This limitation of liability includes (but is not limited to): the transmission of viruses, hardware failure, connection errors, and the misuse or theft of a user identity.

12.3 In no event shall the Provider be liable for any loss or damage arising because the Customer or the User relied on information, products or services published in the Imprion System or on related websites, products or services.

12.4 The Customer is exclusively responsible for the accuracy and completeness of the data which it enters into the Imprion System, and for the compliance of the invoices issued and of its business operations with the applicable legislation. The Provider is not liable for any consequences of inaccurate or incomplete data, or of conduct of the Customer or the User contrary to the applicable legislation.

12.5 All claims arising from any errors or infringements that result from the conduct of third parties about whom information is published in the Imprion System shall be asserted exclusively against those parties.

12.6 The Provider is not liable for the operation of the Imprion System, nor for any damage in the part arising from the conditions that, pursuant to chapter "3 User conditions", must be ensured by the Customer or the User themselves. This covers in particular internet access, appropriate hardware and software and the devices on which the local part of the application runs, their security and the regular synchronisation of data, as well as the User's identification credentials.

13 Content and services offered by third parties

13.1 The Imprion System may provide links through which other websites, products and/or services connect to the Imprion System (hereinafter: Linked Systems). The Provider accepts no liability whatsoever for Linked Systems. The Provider is not responsible for the accuracy or the availability of information, products or services offered by third parties through Linked Systems.

13.2 The information on Linked Systems comes from a variety of sources. The Provider is not entitled to change, update or verify the content of the information on Linked Systems. The fact that the Provider provides a link to Linked Systems does not necessarily imply approval, authorisation, sponsorship or any other association in relation to those Linked Systems.

13.3 The Provider is not liable, either directly or indirectly, for any damage caused or allegedly caused by the use of, or by reliance on, any content, product or service of the Linked Systems.

13.4 In order to use Linked Systems, the User may have to accept terms and conditions of use that differ from these General Terms and Conditions and for which the Provider is not liable; in any event, these General Terms and Conditions prevail.

14 Collection and protection of users' personal data

14.1 The Imprion System is intended for till operations and for the issuing of receipts by business entities. For the purpose of identifying Users and communicating with them, the Provider, acting as the processor on behalf of the Customer, which acts as the controller within the meaning of the General Data Protection Regulation (EU) 2016/679, keeps the following personal data on an individual:

(a) the User's first name and surname,

(b) the User's email address.

14.2 By registering in the Imprion System, the User acknowledges that the Provider may, on the basis of its legitimate interest in improving the operation of the service, also collect data on visits to and use of the Imprion System for the purpose of analysing user behaviour and consequently improving the user experience, and for the purpose of communicating with customers by email or at the company's postal address.

14.3 The User declares and confirms that they are aware of the right to access, transcribe, copy, supplement and rectify the personal data relating to them, and to have its processing restricted or the data erased, in accordance with the provisions of Chapter III of the General Data Protection Regulation (EU) 2016/679. These rights are ensured by the Customer as the controller.

14.4 The personal data defined above may be retained for a further 5 years after use of the Imprion System ends.

14.5 The Provider also collects, keeps, processes and uses the personal data referred to in point 14.1 for the purposes of providing the Imprion System service, including, for example:

(a) to identify Users upon registration and on each subsequent use of the Imprion System, in order to ensure a higher level of security and of data authenticity, as well as a trustworthy means of communication with User Support and/or with other Users;

(b) to enable additional Imprion Features that are not required for basic use, or features relating to the user profile (e.g. changing the User's password);

(c) to allow User Support to notify Users where the Provider judges such communication to be more effective or more appropriate;

(d) to allow the Provider to notify Users and Customers, e.g. in relation to the Provider's products and services. The Provider does not pass the personal data it collects on to third parties, except to the sub-processors listed in Annex I. By accepting the General Terms and Conditions, the User expressly permits the Provider to collect and process personal data to the extent and for the purposes set out in this point of the General Terms and Conditions.

15 Data retention and erasure

15.1 The Provider shall take all reasonable measures to protect the data stored in the Imprion System against unauthorised access by third parties. In this connection, the Provider ensures that the data is stored in a suitably secured location where technical and physical security measures are in place to prevent access by unauthorised persons. The Provider ensures redundant data storage. In the event of any outage, the Provider undertakes to restore a working environment containing the data that existed no more than 24 hours before the outage.

15.2 The Provider may disclose data on the Customer or the User stored in the Imprion System only on the basis of a court order or a written request from a state authority that is legally authorised to access the data.

15.3 The Customer may transfer (export) data from the Imprion System to the extent and in the format supported by the Imprion Features.

15.4 After the Subscription Agreement ends, the Customer retains access to the data entered previously for viewing and export through the Imprion System portal, with no time limit, but without the possibility of issuing new receipts or of using other Imprion Features that are tied to a valid Licence. The Customer's data is erased solely at the Customer's request.

16 Breach of the General Terms and Conditions and termination of the Subscription Agreement

16.1 If a User breaches the General Terms and Conditions, the Provider may, after having warned the User of the breach, block that User's use of the Imprion System.

16.2 If the Customer, the Administrator or any User making use of the Customer's Licence breaches the General Terms and Conditions, the Provider may, after having warned the Administrator or the Customer of the breach, terminate the Subscription Agreement with the Customer unilaterally and without notice.

17 Termination of the Subscription Agreement

17.1 Either contracting party may withdraw from the Subscription Agreement. The termination takes effect at the end of the current billing period (month) in which it was given.

17.2 Withdrawal from the Subscription Agreement must be given in writing; notice sent by email also counts as written form. Where the Provider withdraws from the agreement, the Administrator is notified of this in writing.

17.3 Once the Subscription Agreement ceases to be valid, Users can no longer use the Imprion Features that are tied to a valid Licence, and in particular can no longer issue new receipts.

17.4 Notwithstanding the termination of the Subscription Agreement, the Customer retains access to the data entered previously through the Imprion System portal in accordance with point 15.4; the data is erased solely at the Customer's request.

18 Protection of trade secrets

18.1 The contracting parties are obliged to protect as a trade secret all information about the other party's business that is not publicly available and of which they become aware in the course of performing the Subscription Agreement, e.g. financial data, the working methodology and the tools used.

18.2 The contracting parties may disclose confidential information only to those persons who are directly involved in performing the Subscription Agreement, and only to the extent necessary for that purpose. In doing so, they must ensure that the recipients of the confidential information do not use it contrary to the provisions of the Subscription Agreement.

18.3 The duty to protect trade secrets applies both for the duration of the Subscription Agreement and after its termination.

18.4 The protection of personal data is regulated in more detail in Part III of these General Terms and Conditions (Processing of personal data).

19 Liability for damages

19.1 In performing the Subscription Agreement, the Provider is obliged to act with the diligence of a competent professional.

19.2 The Provider is not liable for damage caused by the Customer or the User in the course of performing the Subscription Agreement. Where the Customer, or anyone else for whom the Customer is responsible, is also at fault for the damage incurred, the Provider's liability for damages is reduced proportionately.

19.3 The Provider is not liable for the loss or corruption of data, or for any other form of alteration of data, that has occurred as a result of force majeure. Force majeure means unforeseen and unexpected events that occur independently of the will of the contracting parties, that the parties could not have foreseen when concluding the agreement, and that affect the performance of the contractual obligations in any way. The Provider shall notify the Customer in writing of the occurrence of force majeure within a reasonable time.

PART III – PROCESSING OF PERSONAL DATA

20 Processing of personal data

20.1 Purpose and scope

(a) The purpose of this chapter of the General Terms and Conditions (hereinafter: the clauses) is to ensure compliance with Article 28(3) and (4) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

(b) The Customer as the controller and the Provider as the processor agree to these clauses in order to ensure compliance with Article 28(3) and (4) of Regulation (EU) 2016/679.

(c) These clauses apply to the processing of personal data as specified in Article 14 and in point 20.4.

(d) These clauses are without prejudice to the obligations to which the controller is subject under Regulation (EU) 2016/679.

20.2 Interpretation

(a) Where these clauses use terms defined in Regulation (EU) 2016/679, those terms have the same meaning as in that Regulation.

(b) These clauses shall be read and interpreted in accordance with the provisions of Regulation (EU) 2016/679.

(c) These clauses shall not be interpreted in a way that conflicts with the rights and obligations set out in Regulation (EU) 2016/679, or in a way that prejudices the fundamental rights or freedoms of the data subjects.

20.3 Description of the processing (nature, purpose and duration)

As the processor, the Provider offers the Customer, as the controller, the use of the Imprion System as part of the service, together with content-related and technical support, in the course of which access to or other processing of personal data may also be necessary in order to resolve individual tasks. The Provider will carry out the processing solely for the purpose of ensuring the operation of the Imprion System and of providing support, as set out in these General Terms and Conditions. The processing of data in the context of support takes place occasionally, when the Customer requests technical or content-related support, and lasts at most until the completion of the specific task.

20.4 Types of personal data and categories of data subjects

20.5 Technical and organisational measures to ensure data security

(a) The Provider implements appropriate technical and organisational measures to ensure the security of processing in accordance with Article 32 of Regulation (EU) 2016/679.

(b) The data is stored on the Provider's own or managed infrastructure, which can be accessed only by the Provider's authorised personnel and by the authorised sub-processors listed in Annex I.

(c) The transfer of data between the User's devices and the Imprion System is protected by encryption.

(d) Access to the data is protected by passwords and by restricted employee permissions based on the principle of the least privilege necessary.

(e) The Provider ensures the traceability of processing operations through processing logs and performs regular data backups.

(f) The Provider regularly reviews, assesses and evaluates the effectiveness of the technical and organisational measures for ensuring the security of processing.

20.6 Obligations of the parties

Instructions

(a) The processor shall process personal data only on documented instructions from the controller, submitted through User Support, unless required to do so by Union law or the law of a Member State to which the processor is subject. In such a case, the processor shall inform the controller of that legal requirement before processing the data, unless the law in question prohibits this on important grounds of public interest. The controller may issue further instructions throughout the duration of the processing, and such instructions shall be documented.

(b) The processor shall inform the controller immediately if, in its opinion, the controller's instructions infringe Regulation (EU) 2016/679 or other applicable data protection provisions of the Union or of the Republic of Slovenia.

Purpose limitation

The processor shall process the personal data only for the specific purposes of the processing, as set out in Article 14 and point 20.4, unless it receives further instructions from the controller.

Duration of the processing

The processor shall process the personal data only for as long as is necessary for the performance of the task.

Security of the processing

(a) The processor shall implement at least the technical and organisational measures set out in point 20.5 in order to ensure the security of the personal data, including protection against a breach of security resulting in accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to the data.

(b) The processor shall grant the members of its personnel access to the personal data only to the extent strictly necessary for the implementation, management and monitoring of the contract, and shall ensure that the authorised persons are bound by confidentiality.

Special categories of data

Where the processing involves special categories of personal data (sensitive data) within the meaning of Regulation (EU) 2016/679, the processor shall apply specific restrictions and/or additional safeguards.

Documentation and compliance

(a) The Parties shall be able to demonstrate compliance with these clauses.

(b) The processor shall deal promptly and adequately with the controller's enquiries concerning the processing of the data.

(c) The processor shall make available to the controller all information necessary to demonstrate compliance with the obligations set out in these clauses and shall, at the controller's request, allow for and contribute to audits. The controller shall notify the processor of an announced audit at least 10 working days before the announced date.

Use of sub-processors

(a) The processor has the controller's general authorisation for the engagement of sub-processors from the agreed list set out in Annex I. The processor shall notify the controller in writing of any intended changes to that list through the addition or replacement of sub-processors at least 30 days in advance, thereby giving the controller sufficient time to object before the engagement of the sub-processor concerned. If the controller does not object within that period, it shall be deemed to have consented to the engagement.

(b) The processor shall engage the sub-processor by means of a contract which imposes on the sub-processor, in substance, the same data protection obligations as those to which the processor is subject under these clauses.

(c) The processor shall remain fully liable to the controller for the performance of the sub-processor's obligations.

International data transfers

The Provider does not transfer personal data to third countries or international organisations; the processing takes place within the European Economic Area. Any transfer to a third country or an international organisation shall be carried out only on the basis of documented instructions from the controller and in accordance with Chapter V of Regulation (EU) 2016/679.

20.7 Assistance to the controller

(a) The processor shall promptly notify the controller of every request it has received from a data subject. It shall not respond to that request itself, unless it has been authorised to do so by the controller.

(b) The processor shall assist the controller in fulfilling the controller's obligations to respond to data subjects' requests for the exercise of their rights, taking into account the nature of the processing and acting in accordance with the controller's instructions.

(c) The processor shall also assist the controller in ensuring compliance with the obligations under Articles 32 to 36 of Regulation (EU) 2016/679 (security of processing, notification of breaches, data protection impact assessment and prior consultation), taking into account the nature of the processing and the information available to it.

20.8 Notification of a personal data breach

(a) In the event of a personal data breach, the processor shall cooperate with the controller and assist it in fulfilling its obligations under Articles 33 and 34 of Regulation (EU) 2016/679, taking into account the nature of the processing and the information available to it.

(b) In the event of a personal data breach concerning data processed by the processor, the processor shall notify the controller thereof without undue delay after having become aware of the breach. The notification shall contain at least: a description of the nature of the breach, the details of a contact point, the likely consequences of the breach, and the measures taken or to be taken to address it.

20.9 Non-compliance with the clauses and termination of the contract

(a) Where the processor is in breach of its obligations under these clauses, the controller may instruct the processor to suspend the processing of the personal data until it ensures compliance, failing which the controller shall terminate the contract. The processor shall immediately inform the controller if, for whatever reason, it is unable to ensure compliance.

(b) The controller shall be entitled to terminate the contract, in so far as it concerns the processing of personal data, if the processor is in substantial or persistent breach of these clauses or of its obligations under Regulation (EU) 2016/679, or fails to comply with a binding decision of a competent court or supervisory authority.

(c) Following termination of the contract, the processor shall, at the controller's choice, delete or return all personal data which it processed on behalf of the controller in the course of providing support, and shall delete the existing copies, except to the extent that Union law or the law of a Member State requires their retention, or in so far as the Customer retains access to the data in accordance with point 15.4.

PART IV – VALIDITY AND FINAL PROVISIONS

21 Validity and amendment of the General Terms and Conditions

21.1 The Provider shall publish the applicable General Terms and Conditions and/or amendments to the General Terms and Conditions on the website https://imprion.io. Every User may request the Provider to grant them access to the General Terms and Conditions that were in force in a particular period of time.

21.2 The General Terms and Conditions shall enter into force on the date determined by the Provider. The General Terms and Conditions and amendments to the General Terms and Conditions must be published at least 30 days before they enter into force.

21.3 The Provider has the right to amend the General Terms and Conditions unilaterally and to publish the amendments to the General Terms and Conditions in the manner set out in point 21.1 and to notify the Customers or Users within the period set out in point 21.2.

22 Final provisions

22.1 The law of the Republic of Slovenia shall apply to the interpretation of the General Terms and Conditions and in the event that a particular matter is not regulated by the General Terms and Conditions.

22.2 The court in Maribor shall have jurisdiction over the settlement of any disputes arising from the use of the Imprion System or in connection with its use.

22.3 These General Terms and Conditions are in force as of 1. 7. 2026.

ANNEX I

List of the parties to the processing of personal data

Controllers

By concluding the Subscription Agreement, of which these General Terms and Conditions form an integral part, the Customer becomes, in relation to the Provider, the controller of personal data in accordance with the provisions of the General Data Protection Regulation (EU) 2016/679 and of these General Terms and Conditions.

Processor

Under these General Terms and Conditions, the Provider is the processor of the personal data.

Sub-processors

For the purpose of performing the tasks under these General Terms and Conditions, the Provider cooperates with the following sub-processors:

The Provider shall notify the Customer of any changes to the list of sub-processors in accordance with point 20.6 of these General Terms and Conditions.

Data protection officer

The Provider has not appointed a data protection officer, as the conditions set out in Article 37 of the General Data Protection Regulation (EU) 2016/679 are not met. For questions relating to the protection of personal data, the e-mail address [email protected] is available.