GENERAL TERMS AND CONDITIONS

1. Provider and scope of the terms

1.1. The provider of AMLUM and the customer's contracting party is BITLUX s. r. o., company identification number (IČO) 54 256 496, with its registered office at Karpatské námestie 10A, 831 06 Bratislava – mestská časť Rača, entered in the Commercial Register, section Sro, entry No. 157273/B, registration court: Mestský súd Bratislava III (the “Provider”).

1.2. Further identification and contact details of the Provider:

• Tax identification number (DIČ): 2121619346.
• VAT identification number (IČ DPH) and registration status: SK2121619346, registered under Section 4 of the Slovak VAT Act.
• Service website: https://amlum.com.
• Contact email for contractual notices and complaints: contact@amlum.com.
• Telephone: +421 910 335 335.
• Technical support and security incident reporting: contact@amlum.com.

1.3. These general terms and conditions (the “Terms”) govern the conclusion of contracts, the provision and use of AMLUM, related software rights, data protection, liability and termination of service provision.

1.4. Under these Terms, AMLUM is provided exclusively to entrepreneurs, persons practising a profession and legal persons for purposes of their business, professional or institutional activities (the “Customer”). It is not intended for private consumer use. Providing a company identification number alone does not change the actual legal status of the party placing the order. Any mandatory consumer rights cannot be excluded by a declaration in the order.

1.5. AMLUM denotes the product, not a separate legal entity. Payments for the service are made to the Provider and contractual claims are directed to the Provider, unless a specific separate agreement provides for a different, transparently identified distribution arrangement.

1.6. Within its remit, the supervisory authority for electronic commerce is the Slovak Trade Inspection (Slovenská obchodná inšpekcia). For the registered office stated above, it is the SOI Inspectorate for the Bratislava Region, Bajkalská 21/A, P. O. BOX No. 5, 820 07 Bratislava. This supervision does not constitute approval of the AML methodology, certification of AMLUM or supervision of the Customer's compliance with its AML obligations.

2. Definitions

2.1. “Service” or “AMLUM” means a software service made available remotely via a web interface or, where separately agreed, an application programming interface, including the functions, storage, updates and support ordered. The Customer acquires a right to use the service, not ownership of the software or an automatic entitlement to its source code.

2.2. “Agreement” means the agreement between the Provider and the Customer for provision of the Service, consisting of an individual agreement or an accepted order and the documents duly incorporated into it.

2.3. The “Order” specifies, in particular, the Customer, scope of functions, supported legal and sector profile, price, limits, service period and any special services. “User” means a natural person to whom the Customer has granted access within the agreed scope. “Administrator” means a User authorised to manage the workspace and access rights.

2.4. “Customer Data” means the data, documents and records that the Customer or its authorised persons enter into the Service or that are created for the Customer in the course of providing the Service. They include its client documentation, factual findings, evidentiary links, assessment results, decisions and associated audit history. This neither determines ownership of personal data nor alters third-party rights.

2.5. “Methodology Package” means an identified version of the rules, factors, parameters, obligations and associated configurations used for an assessment. “External Source” means a third-party register, list, database or service. “Output” means an assessment, alert, record, report or other result of using the Service.

2.6. “DPA” means the data processing agreement, including its annexes. “SLA” means a separately agreed service level. “Working Day” means a day other than a Saturday, Sunday or statutory rest day in the Slovak Republic. The Europe/Bratislava time zone applies to operational deadlines. Statutory deadlines are determined under the applicable legislation.

3. Conclusion of the Agreement and contractual documents

3.1. The Agreement may be concluded by signing an individual agreement, by the Provider accepting an order, or through an electronic ordering process that clearly identifies when a binding Agreement is concluded. The person acting for the Customer must have the necessary authority. The Provider may require reasonable evidence of that authority.

3.2. Before placing a binding order, the Customer will receive information on the scope of the Service, the total price and how it is calculated, taxes, the term of the commitment, payment terms, limits, termination and the documents forming the Agreement. The Customer must be able to review and correct the order details and save and reproduce the contractual documents.

3.3. Automatic acknowledgement of receipt of an enquiry or order does not in itself constitute acceptance of the order unless it expressly confirms conclusion of the Agreement. For self-service orders, the acceptance rule will be displayed before submission. Registering an account, requesting a demonstration or expressing interest does not in itself establish a paid subscription.

3.4. The Provider will send confirmation that the Agreement has been concluded and the applicable version of the contractual documents to the Customer's contact email or make them available in a form that can be stored permanently. The Agreement is concluded in Slovak or in another expressly agreed language. The Provider retains a copy and will make it available to the Customer on request during the statutory retention period.

3.5. Individually agreed provisions take precedence over the Terms. On personal data processing, the DPA takes precedence over the other contractual documents. A separate regulatory addendum takes precedence on matters it regulates and the SLA on measurement and service levels. Price lists and technical documentation may not unilaterally alter agreed rights concerning liability, retention or data. Mandatory law always prevails.

3.6. The Customer's general terms do not apply merely because they appear in its order or billing portal. Acceptance requires express agreement. Before acceptance, the Provider may reject an order, in particular if the scope is unavailable, authority is missing, there is a security risk or a legal impediment applies.

4. Subject matter and limits of the Service

4.1. The Service provides technical support for processes designed to prevent money laundering and terrorist financing and for associated compliance procedures. Depending on the scope ordered, it includes, in particular, records of parties and business relationships, support for identification and verification, records of persons authorised to act and of representation, ownership structures and beneficial owners, work with documents and evidence, PEP and sanctions screening, risk assessment, monitoring, tasks and audit documentation.

4.2. The binding scope of functions and supported jurisdictions and profiles is set out in the Order and identified documentation. A sales presentation of future developments, a prototype or a non-binding plan does not create an entitlement to an undelivered function. This does not exclude specific features expressly promised by the Provider when concluding the Agreement.

4.3. Unless separately agreed, the Service does not include acting as the Customer's designated responsible person, legal representation, independent audit, individual legal or tax advice, provision of payment services, taking custody of clients' funds or acting on the Customer's behalf before public authorities. Recording a payment in AMLUM does not execute the payment.

4.4. Using AMLUM does not in itself constitute fulfilment of all AML obligations, confirmation of the legality of a transaction or a guarantee of a successful inspection. It does not constitute regulatory approval of the Service. The Provider remains obliged to deliver the agreed functions properly. The Customer's obligation to exercise professional judgement does not excuse a defect in the Service.

4.5. During an outage or unavailability of a particular source, the Customer must arrange an alternative means of performing time-sensitive statutory measures in accordance with its internal procedures. The Provider will give the agreed assistance and disclose known relevant limitations. An outage of the Service does not automatically extend statutory deadlines.

5. Workspaces, Users and access rights

5.1. The Service will be made available at the time and within the scope agreed in the Order once the agreed conditions have been met, in particular payment of any agreed advance, verification of authority and conclusion of a DPA if required. The Provider will distinguish production and test environments.

5.2. The Customer will appoint an Administrator, ensure rights are assigned appropriately and revoke access without undue delay when a person's authority ends. User accounts are personal. Sharing credentials and impersonating another person are prohibited. Separately agreed technical accounts must be identifiable and properly managed.

5.3. The Customer will protect its devices and credentials, use the available mandatory security measures and report any suspected compromise. Access granted by a technical role does not replace statutory or internal authority to make a specific AML decision.

5.4. A User may access only the data and functions for which they have authority. Use for other legal entities, branches or clients of an outsourcing provider must comply with the Order, authorisations and the DPA. Membership of the same corporate group alone does not confer a right to share data among group members.

5.5. The Customer is responsible for the acts of authorised Users to the extent prescribed by law. Activity logged against an account is not conclusive proof that a particular person carried it out. Any compromise or authorisation error must be investigated.

6. Right of use, intellectual property and Outputs

6.1. During the term of the Agreement, the Provider grants the Customer a non-exclusive, time-limited right to use the Service for the agreed purposes and within the agreed scope. Unless the parties expressly agree otherwise, this does not include resale, making the service publicly available to third parties, sublicensing or operating a copy of AMLUM.

6.2. Rights to the software, identifiers, interface, database structures, general methodology components and documentation belong to the Provider or the respective rights holders. Rights to materials provided by the Customer remain with the Customer or the relevant third parties. The Agreement does not transfer authors' moral rights or establish ownership of personal data.

6.3. The Customer must not circumvent security or licensing restrictions, obtain source code without authorisation, copy protected parts of the Service or carry out reverse engineering beyond what mandatory law expressly permits. This provision does not restrict statutory rights concerning interoperability, examination of the program or data transfer.

6.4. The Customer may retain and use duly created Outputs after the Agreement ends for its own lawful, documentation, inspection and defence purposes. To the extent necessary, it may disclose them to competent authorities, auditors, legal advisers and other authorised persons in compliance with data protection and confidentiality obligations. This does not permit resale of licensed databases or misleading presentation of an Output as an official certificate.

6.5. The Provider may process Customer Data solely for provision, security and support of the Service under the Agreement and the applicable legal bases. These Terms do not authorise selling client documentation, making it available to other customers, using it to create a shared commercial database or using it to train general artificial intelligence models.

6.6. Providing feedback does not transfer rights to the Customer's confidential materials. The Provider may not use the Customer's name, logo or the fact of the parties' cooperation as a public reference without prior consent.

7. Risk assessment and Customer decisions

7.1. AMLUM assessments are based on available input data, their status and evidentiary links, and the specific version of the active Methodology Package for the relevant jurisdiction and profile. The deterministic calculation should produce the same result for the same relevant inputs and the same version of the rules. The applicable factors and rules are determined by the case and agreed profile, not simply by the number of catalogue entries.

7.2. A risk index or category is neither the probability of a criminal offence nor an independent legal conclusion. Scores, factual findings, evidence, human decisions and legal or procedural effects are distinct types of information. A low score does not override a statutory prohibition or an obligation to conduct enhanced due diligence, obtain approval, supplement data or take another measure.

7.3. The Customer will designate the persons authorised to assess Outputs and make decisions. An automatically created task, recommendation, flag or internal workflow restriction does not replace actual performance of the relevant action, approval by an authorised person, reporting to an authority or legally effective withholding or freezing of assets.

7.4. Missing, conflicting or outdated data must not be treated as proof of the absence of risk. When using a result, the Customer will consider the stated limitations, requirements for further evidence and the scope of the checks performed. If it doubts the accuracy of a particular Output, it will report the issue and use an appropriate alternative assessment until the issue is clarified.

7.5. A substantive change to methodology, weights, rules or approval conditions is subject to a separate approval and activation process. Acceptance of the Terms or of a routine technical update does not in itself approve a new customer methodology. The procedure for a necessary legal change must be recorded and must not allow inapplicable rules to be used as currently valid.

7.6. A change in methodology or data must not silently overwrite a historical assessment. A correction, new assessment or reasoned change of decision will be recorded with the relevant version, time, actor and available supporting material. The Customer must not remove or falsify the audit trail to conceal how an assessment actually took place.

8. External Sources, registers, PEP and sanctions screening

8.1. The scope of External Sources, their availability, licence terms, update arrangements and relevant limitations are specified in the Order or available documentation. The Service does not automatically include all domestic or foreign registers and lists. A separate chargeable check will only be performed within the agreed scope and at a price communicated in advance.

8.2. A search result based on a name or similarity is grounds for verifying identity, not confirmation that an entry relates to the person assessed. A positive result may be a false match. A search returning no result does not necessarily mean that the relevant fact is absent. The Customer will assess the identifiers, timing, legal context and search coverage.

8.3. An unavailable source, failed search or incomplete response must not be presented as a successful search with no findings. The Provider will ensure that, within the agreed scope, the Service distinguishes these states and preserves the necessary provenance and time of data acquisition.

8.4. A register entry on beneficial ownership, ownership, representation or a person holding public office may not in itself suffice to fulfil a particular verification obligation. Sanctions restrictions and obligations are assessed separately from the general risk score.

8.5. The Provider does not guarantee the objective accuracy of data created by an independent External Source. It is, however, responsible for proper performance of the agreed retrieval and processing, correct display, disclosure of known limitations and fulfilment of its own contractual obligations. Liability for its subcontractors is governed by the Agreement and the law. Designating a subcontractor an External Source does not automatically exclude that liability.

8.6. If an essential source ceases to be legally or technically available, the Provider will notify the Customer of the impact and propose a permissible substitute or revised procedure. Inability to provide an essential function ordered gives rise to the applicable rights under Articles 13 and 18. It does not confer a general entitlement to retain the full price for performance permanently discontinued.

9. Documents, verification and audit history

9.1. Uploading a document, automatically recognising its content or linking it to a client does not in itself confirm the document's authenticity, validity, completeness or legal sufficiency. The Customer will arrange verification by an authorised person to the extent required by law and its procedures.

9.2. A manual verification status, including the internal designation VERIFIED_MANUAL, means that a specific authorised verification action has been recorded. It does not in itself mean completed customer due diligence, approval of risk, permission to proceed with a transaction or legally effective consent to a business relationship.

9.3. After proper manual verification, the Service may automatically perform subsequent internal processing under the active rules without another identical confirmation from the User. A separate action requiring a human decision is not thereby approved or performed.

9.4. For minors and represented persons, members of statutory bodies, authorised representatives and ownership links, the Customer is responsible for substantiating identity, the relevant role and authority to act. A relationship recorded in the system does not replace the legal basis for representation or proof of its scope.

9.5. The audit history makes it possible to demonstrate which procedures were followed. Its protection does not imply indefinite retention of personal data. Corrections and erasures are carried out under the statutory retention regime and documented authorisations, preserving the required integrity of records and respecting data subjects' rights.

10. Obligations and permitted use

10.1. The Customer shall ensure that data are obtained and used lawfully, that the scope of processing is proportionate, that the data it provides are accurate, that individuals receive the necessary information and that it is authorised to use each source. The data subject's consent is neither automatically necessary nor automatically sufficient as a legal basis for AML processing. The Customer shall determine the legal basis for the specific purpose.

10.2. The Customer determines its legal status, activities, jurisdiction, internal procedures and authorised persons. It shall provide professional training for Users, assess alerts, meet statutory deadlines and keep records of actions actually taken. It shall promptly notify the Provider of changes affecting the agreed profile or provision of the Service.

10.3. The Service must not be used for unlawful surveillance of individuals, unauthorised data collection, discriminatory or other unlawful decision-making, evading sanctions, falsifying evidence, inserting malicious code or gaining unauthorised access to other parties' workspaces.

10.4. Load and penetration testing, automated collection beyond agreed limits and interference that jeopardises operations are prohibited without the Provider's prior written consent. This prohibition does not restrict statutory rights, safe disclosure of a vulnerability, cooperation with supervisory authorities or agreed audits.

10.5. The Customer shall not disclose information about a suspicion, a report being prepared or another protected procedure to unauthorised persons. The prohibition on disclosing protected information also applies when using support. Only the data needed to resolve the issue shall be supplied, through the designated secure channel.

11. Price, invoicing and subscription

11.1. The price, currency, billing period, limits and any one-off charges shall be agreed in the Order. Where the price is stated exclusive of VAT, VAT shall be added or another tax regime shall apply in accordance with binding rules. Before the Agreement is concluded, the total amount or an objective method for calculating it must be clear.

11.2. Unless the Order provides otherwise, the Service shall be invoiced monthly in advance and the invoice shall be payable within 14 calendar days of receipt. Billing starts when the Service is made available as agreed, and not merely upon receipt of a non-binding enquiry. The Customer agrees to electronic delivery of invoices.

11.3. Annual prepayment or a minimum commitment period applies only if expressly agreed. A fixed-term Agreement does not renew automatically unless the parties have separately, unambiguously and in advance agreed the renewal mechanism, the new term and how renewal can be declined. Merely storing a payment method does not constitute consent to a new paid product.

11.4. Automatic recurring payments may be used only on the basis of demonstrable authorisation and terms disclosed before activation. Revoking authorisation to collect a payment does not in itself terminate the Agreement or remove the obligation to settle a liability already incurred.

11.5. A plan upgrade, charges for usage exceeding limits or purchases of additional external services require prior agreement on how they are ordered and how the price is calculated. The Provider must not impose an undisclosed fee after the event simply because a function was technically available. Only an authorised person may change a plan.

11.6. In the event of late payment, the Provider may claim statutory interest on arrears and recovery of costs to the extent permitted by law. Before suspending for non-payment, it shall send a demand and allow an additional period of at least 10 calendar days. The parties shall review any reasonably disputed part of an invoice. The Customer shall pay the undisputed part and communicate its specific objections without undue delay.

11.7. The Customer's failure to use a properly available Service does not in itself entitle it to a refund. This is without prejudice to claims for defects, agreed credits, statutory rights or a refund of the unused prepaid price in the cases governed by these Terms.

12. Availability, support and updates

12.1. The Provider shall deliver the Service with professional care and within the agreed scope. A specific guaranteed availability percentage, response and recovery times, capacity parameters and service credits apply only where expressly agreed in an SLA or Order. The absence of a separate SLA does not relieve the Provider of its duty to provide the Service properly and remedy defects.

12.2. Support hours, escalation procedures and technical requirements shall be specified in the Order or in documentation made available before the Agreement is concluded. Without a separate agreement, the Provider does not promise round-the-clock availability of support staff or resolution of every defect within a fixed time. This does not defer a statutory obligation to report a security incident until support hours.

12.3. The Provider shall give reasonable advance notice of planned maintenance expected to have a material impact. Urgent security measures may be taken without advance notice if delay would increase the risk. An explanation and the known impact shall then be communicated without undue delay. Downtime must be proportionate and must not be used to circumvent agreed availability.

12.4. The Provider may implement technical, security and corrective updates. During a paid period, it must not unilaterally remove a material ordered function without an equivalent replacement or a corresponding right for the Customer to terminate and receive a proportionate financial settlement. Changes to methodology are also governed by Article 7.

12.5. Legal content updates are provided for expressly supported jurisdictions and profiles within the agreed scope. If the Provider establishes that a change in the law affects an ordered function, it shall communicate the relevant impact, limitations and further action required. Preparation for a future legal rule must not be presented as if the rule were already generally applicable.

12.6. A free demonstration, trial environment or experimental function must be clearly identified and its duration and limitations specified. Real personal data may be used in such an environment only with express agreement, after the necessary DPA has been concluded and appropriate measures are in place. A trial does not become a paid subscription without an agreement demonstrably accepted in advance.

13. Service defects and complaints

13.1. A defect is a failure of the Service to conform to an agreed function or characteristic. An adverse assessment result in itself, a correctly displayed need for further checks or a request for a function that was not ordered does not constitute a defect. This distinction does not exclude the possibility that an incorrect calculation, faulty authorisation, data loss or misleading display of a source's status may constitute a defect.

13.2. The Customer shall report a defect discovered without undue delay to the designated support contact or contact email address. It shall state the time, affected function, impact and available steps to reproduce the defect, avoiding unnecessary transmission of sensitive data. The Provider must not refuse to assess the substance solely because the notification was not submitted on its preferred form.

13.3. The Provider shall confirm receipt of the complaint and explain the next steps. It shall address defects according to severity and the agreed SLA. Where there is a serious impact on data, security or a decisive Output, it shall take appropriate measures without undue delay to limit the consequences. The Customer shall provide reasonable assistance but is not required to grant uncontrolled access to other systems or data.

13.4. Where a defect is attributable to the Provider, it shall be remedied free of charge. If a defect is not or cannot be remedied, the Customer is entitled, depending on its nature, to an appropriate price reduction, agreed substitute performance or termination of the affected Service in accordance with the Agreement and the law. A damages claim shall be assessed separately. The same harm shall not be compensated twice.

13.5. Assistance at an additional charge with a problem outside the agreed scope requires prior disclosure of the price and the Customer's consent. These Terms do not introduce a short forfeiture period after which late notification alone would automatically extinguish all statutory claims.

14. Personal data and DPA

14.1. The parties' roles are determined by the actual purpose of processing and who decides how it is carried out. For client documentation entered by the Customer, the Customer generally acts as controller and the Provider as processor. If the Customer processes data for another controller, it must secure authorisation to engage the Provider in the relevant chain of processors.

14.2. Before processing real personal data on the Customer's behalf begins, the parties must conclude a DPA meeting Article 28 of Regulation (EU) 2016/679. The DPA shall specify the subject matter, purpose, nature and duration of processing, categories of individuals and data, instructions, security measures, locations, subprocessors, incidents, assistance, audit and return or erasure of data. A general statement of GDPR compliance alone and these Terms are no substitute for a complete DPA.

14.3. When acting as processor, the Provider shall process data in accordance with documented instructions and only within lawful limits. It shall draw attention to any instruction which in its assessment infringes data protection rules. The Customer must not require processing without the necessary legal basis or an infringement of another person's rights.

14.4. Subprocessors shall be engaged in accordance with the DPA and the relevant authorisation. The Customer must receive the information needed to assess their engagement and, in the case of general authorisation, an opportunity to object to an intended change. The Provider remains responsible to the Customer for performance of the subprocessor's obligations to the extent provided by the GDPR.

14.5. The actual processing and backup locations, any transfers outside the European Economic Area and the safeguards used shall be specified in the DPA and the relevant information before processing begins. These Terms do not constitute a representation that every source and subcontractor operates exclusively in the EU. Transfers require the applicable legal conditions to be met. Acceptance of the Terms alone does not make a transfer lawful.

14.6. Data relating to minors, special categories of personal data and data relating to criminal convictions and offences may be processed only to the extent necessary, legally permitted and agreed. Provision of the Service does not constitute general authorisation to profile natural persons for unrelated purposes.

14.7. The Customer shall ensure that any profiling and decision-making producing legal or similarly significant effects is lawful, including compliance with the conditions in Article 22 of the GDPR where applicable. Where a human decision is required, it must involve a genuine professional assessment and not merely formal confirmation of an automated Output.

14.8. For invoicing, administering its own contracts and protecting its own legitimate interests, the Provider may act as an independent controller to the extent described in a separate personal data processing notice. This role must not be used for unauthorised secondary use of client documentation. Marketing and non-technical cookies are not treated as automatically covered by acceptance of the Terms.

15. Confidentiality and professional secrecy

15.1. Confidential information includes in particular client and business data, identification records, ownership relationships, risk findings, PEP and sanctions assessments, information on suspicions and reports, security measures and non-public contractual or technical materials.

15.2. Each party shall use confidential information solely to perform the Agreement or for another lawful purpose. It shall disclose such information only to persons who need it and are bound by appropriate confidentiality obligations. The Provider shall limit its staff's and subcontractors' access to customer data to what is necessary and ensure that access can be evidenced in accordance with the DPA.

15.3. Confidentiality does not apply to information lawfully in the public domain without a breach of duty, demonstrably developed independently or lawfully obtained without restriction. Each item of information shall be assessed separately for an exception, rather than applying an exception to an entire client file.

15.4. Disclosure under a legal obligation or a binding request from a competent authority is permitted after verifying authority and only to the extent necessary. The affected party shall be informed in advance if permitted by law. The prohibition on disclosing protected information and professional secrecy shall be respected in such communications as well.

15.5. Confidentiality continues after the Agreement ends for as long as the information remains confidential or protection is required by law. The Agreement does not authorise the Provider to decide at its discretion to lift legal professional, tax advisory, audit or other professional secrecy.

16. Security, incidents and continuity

16.1. The Provider shall ensure appropriate technical and organisational measures according to the risk and agreed scope. Their specific description, including access management, separation of customer workspaces, protection of data in transit and at rest, backup and recovery, shall form part of the DPA or its security annex. In the absence of express agreement, the Provider makes no claim to any specific certification or to the Service being impenetrable.

16.2. The Provider shall assess a detected incident, contain its impact, preserve relevant evidence and provide the Customer with the information necessary to protect its data and meet its obligations. When acting as processor, it shall notify a personal data breach without undue delay after becoming aware of it. It shall not automatically wait until 72 hours have elapsed or an investigation has been completed. It may supplement the information as it becomes available.

16.3. The Customer shall report an incident on its side if it may affect the Service or the data processed, and shall provide reasonable assistance. The party legally obliged to notify authorities or data subjects shall make the notifications with the necessary assistance of the other party.

16.4. Operational backups do not replace an agreed long-term archiving service. Backup frequency, retention periods, recovery tests and any guaranteed recovery times must be determined in the relevant annex. The Customer is responsible for its own continuity plan. The Provider is responsible for agreed backup and recovery and cannot transfer that responsibility to the Customer by a general notice.

17. Proportionate suspension of the Service

17.1. The Provider may temporarily restrict an affected account or function if necessary to avert a serious security risk, stop demonstrably unlawful use, comply with a binding order from an authority or in the event of failure to pay an amount due after a demand under Article 11.6.

17.2. The measure must be proportionate in grounds, scope and duration. Except in urgent cases or where disclosure is prohibited, the Provider shall communicate the grounds, affected scope and possibility of remedy before taking the measure. Otherwise it shall do so without undue delay afterwards. It shall restore access without undue delay once the grounds cease to apply.

17.3. Suspension does not in itself permit erasure of data, rewriting of audit history or withholding a legally required export. To the extent permitted by law and security requirements, limited read and export access shall be maintained or another verified method of handing over data shall be provided.

17.4. During a justified suspension for a reason attributable to the Customer, the obligation to pay the agreed price shall continue to the extent consistent with the Agreement and the law. An unjustified suspension does not deprive the Customer of its rights arising from breach of the Agreement. A payment dispute must not be used to circumvent data portability rights.

18. Duration and termination of the Agreement

18.1. If the Order does not stipulate a fixed term, the Agreement is concluded for an indefinite term. The Customer may terminate it on 30 calendar days' notice from delivery of notice. The Provider may give ordinary notice of termination with a notice period of 60 calendar days so as to allow a reasonable transition to another solution.

18.2. A fixed-term Agreement ends when the agreed period expires unless validly renewed. The right to end it earlier under the law, for material breach, in the event of a change not accepted or when switching under Article 19 is preserved. A general prohibition on leaving before expiry of a commitment period shall not apply in conflict with mandatory law.

18.3. In the event of material breach of the Agreement, the affected party may withdraw from it under the conditions laid down by law. For a remediable breach, it shall generally first allow a reasonable additional period of at least 15 calendar days unless the law or urgency justifies immediate action. This is without prejudice to immediate protective measures under Article 17.

18.4. The Customer may also terminate the affected Service if the Provider permanently ceases to provide a material ordered function and no suitable replacement is agreed, or if a serious defect is not remedied within a reasonable period. In the event of termination for breach by the Provider, ordinary notice by the Provider or justified rejection of an adverse change, the Provider shall refund the proportionate prepaid price for the period not provided within 30 calendar days of termination, after any lawful settlement of mutual claims.

18.5. Termination ends the right to ordinary production use but not the right to agreed data handover, assistance with switching, use of Outputs already created or pursuit of claims. Confidentiality, necessary provisions of the DPA, settlement of payments and dispute resolution survive according to their nature.

18.6. Before the Agreement ends, the Customer shall arrange to take receipt of its records and continue legally required retention. Expiry of the subscription does not cancel its AML retention obligations. Long-term storage in AMLUM after the production service ends requires a separate agreement on archive mode. The Provider must not present it as automatically included.

19. Data handover, switching and erasure

19.1. This Article governs exit from the standard software Service, including switching to another provider or moving to the Customer's own infrastructure. It applies in accordance with Chapter VI of Regulation (EU) 2023/2854 (the “Data Act”) if the Service falls within its scope. The Customer's mandatory rights take precedence over any agreement to the contrary. Rights to the return or erasure of personal data under the DPA remain in effect even outside the scope of the Data Act.

19.2. The Customer may use the contact email address to give notice of switching, transfer to its own infrastructure or termination accompanied by erasure. The Provider shall verify the requester's authority without unnecessary obstacles. A 30-day notice period applies to switching. At the Customer's request, the parties may agree on an earlier start. Without a request from the Customer, the notice period must not exceed two months.

19.3. After the notice period ends, the Provider shall enable the switch without undue delay and no later than within 30 calendar days. Where compliance with that period is demonstrably technically infeasible, it shall notify the Customer within 14 working days of the request of the specific reasons and an alternative transitional period, which must not exceed seven months. The Customer has the right to extend the transitional period once for a period appropriate to its needs in accordance with the Data Act.

19.4. The Agreement remains in force during the transitional period. The Provider shall maintain the agreed functions and reasonable continuity and security, disclose known risks, and provide the necessary assistance to the Customer and the new provider it authorises. It shall support the exit strategy within the scope of its own Service. The Customer shall provide destination contact details and the necessary cooperation without disclosing unnecessary secrets.

19.5. On switching, the Agreement for the affected Service is deemed terminated on successful completion of the switch. The Provider shall notify the Customer of termination. If erasure without switching is chosen, the Agreement shall terminate when the notice period expires. Data shall remain retrievable for at least 30 calendar days after the transitional period. The same minimum retrieval period applies to other forms of termination unless the Customer validly requests earlier erasure or the law requires another procedure.

19.6. The Service’s ordinary functionality allows export of the subject’s final risk assessment with an explanation. Bulk export of the entire database, AML documentation and all records is not an ordinary Service function. This does not restrict the Customer’s mandatory rights to data handover, in particular under the Data Act and DPA. Annex 2 sets out the scope.

19.7. Legally required handover shall cover all exportable data and relevant digital assets to the extent required by applicable law, including input and output data and metadata. Where required by the Data Act, data shall be handed over in a structured, commonly used, machine-readable format and legally required open interfaces shall be made available. A risk assessment alone does not replace that handover.

19.8. Where the Data Act applies, the Provider must give the Customer information on available switching procedures, methods and formats and known technical limitations, and a reference to an up-to-date online register under Article 26 of the Data Act. Under Article 28 of the Data Act, it must publish and update the actual infrastructure jurisdiction and a general description of adopted technical, organisational and contractual safeguards against unlawful international governmental access to or transfer of non-personal data on the website identified in Article 1.2. This information must be available before the Contract is concluded. Mandatory interfaces shall be provided free of charge to the extent required by the Data Act.

19.9. Standard export, assistance with switching required by law and retrieval of data are provided under these Terms without a separate fee. During the transitional period only the ordinary agreed price for continued Service is charged. These Terms do not impose an early exit penalty. Any separate individual agreement must respect mandatory law and must not disguise a prohibited switching charge. When switching, the subscription fee for the period after effective termination shall be settled pro rata within 30 calendar days, taking into account claims validly agreed and permitted by law.

19.10. Separately ordered new development, modification of the destination system or transformation of data beyond legal and contractual requirements may be charged for only by prior agreement. Mandatory removal of an obstacle to switching cannot be relabelled as such work. The Provider does not guarantee identical functionality in third-party software but must fulfil its own interoperability and assistance obligations.

19.11. After the retrieval period has expired and the switch has been completed successfully, or in accordance with a valid instruction for erasure, the Provider shall erase the relevant data and digital assets in accordance with the DPA and binding law. The schedule for removal from backups must be determined in advance and must not circumvent the obligation to erase. If a backup is restored, erasures lawfully carried out must be reapplied.

19.12. After that point, data may be retained only to the specific extent and for the period required by law, or on another independently permissible and documented basis. The Provider's own accounting records do not justify retaining entire AML files. Lawfully retained data shall be separated from ordinary use and retention shall end when the grounds cease to apply. Upon request, confirmation of the handover or erasure carried out shall be provided to the relevant extent.

20. Liability and circumstances excluding liability

20.1. Each party is liable under applicable law for breach of its statutory and contractual duties. The Provider is responsible for properly providing the agreed Service, including its processing of inputs, authorisation, data protection and agreed calculations. The Customer is responsible for its own professional and legal decisions and for its obligations under the law.

20.2. The Provider does not give a general guarantee that the Customer will never breach AML rules or be sanctioned. The imposition of a sanction does not in itself establish a breach of duty by the Provider. The existence and extent of any claim shall be assessed according to the specific breach, causation, nature of the harm and statutory conditions. These Terms do not exclude such a claim across the board in advance.

20.3. Where inputs are incorrect, an intervention is unauthorised, an obligation flagged in a notice is not fulfilled or necessary assistance is not provided, account shall be taken of the actual causal significance of those matters. The Provider may not rely on the Customer's error to exclude its own independent breach or a duty it has assumed.

20.4. Each party shall take reasonable measures to prevent damage and mitigate its consequences, and shall give timely notice of a known impediment to performance. Compensation shall be assessed in accordance with the law. These Terms do not introduce a general waiver of future damages, an automatic exclusion of loss of profit or a blanket financial cap on liability.

20.5. A circumstance excluding liability shall be assessed against the statutory conditions, in particular whether the impediment is independent, foreseeable and avoidable. An ordinary malfunction, inadequate security or subcontractor failure does not become such a circumstance merely by being described as one. The affected party shall communicate the impact and continue performing the remaining obligations unaffected by the impediment.

20.6. If agreed use of the Service becomes impermissible because of a legal defect attributable to the Provider, the Provider shall secure the necessary right or a suitable replacement without undue delay. If a remedy is impossible, it shall permit termination of the affected Service and a pro rata refund of subscription fees, without prejudice to other statutory claims.

21. Changes to prices and contractual terms

21.1. A new version of the Terms published on the website does not in itself amend an Agreement already concluded. The Provider shall keep identifiable versions and keep the version used to conclude the Agreement available.

21.2. The Provider shall give notice of a change justified by a change in law, security or a reasonable operational need, describing its reasons and impact, at least 30 calendar days before the proposed effective date. It shall give at least 45 calendar days' notice of an increase in a recurring price. The increase must not retrospectively change a period already paid for or a price agreed for a fixed period.

21.3. A material change in the subject matter of performance, the scope of data use or liability, or the introduction of a new commitment period, requires express agreement. In the event of a notified adverse change, the Customer is entitled to terminate the affected Service no later than the proposed effective date without a separate penalty and with pro rata settlement of the subscription fee. Silence is not considered consent to extending the purposes of processing or to a new paid product.

21.4. Only a change directly required by law or a necessary urgent protective measure may be implemented without advance notice. The Provider shall communicate the reason and scope without undue delay. This exception does not permit an undisclosed commercial change or subsequent release from liability for an earlier breach.

22. Customers subject to special regulation

22.1. Before concluding the Agreement, the Customer shall disclose any special contractual requirements under its regulatory regime, including Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (“DORA”) where applicable to it. The Provider shall indicate which of these requirements it is able to meet contractually and operationally.

22.2. Where use requires specific provisions on locations, subcontractors, availability, incidents, audits, access by supervisors, continuity testing or exit, these must be agreed before the relevant use. The basic Terms do not constitute a complete regulatory addendum or confirmation of DORA compliance.

22.3. The Provider must not contractually restrict the binding powers of the competent supervisory authority. Customer audits shall be proportionate and protect other customers' data and trade secrets. Those safeguards must not obstruct an effective audit or supervision required by law.

23. Communication and delivery of notices

23.1. The parties shall use the contact details given in the Order and Article 1. The Customer shall notify changes to the contact person, billing details and address for contractual notices without undue delay. The Provider shall notify changes to its own contact details in the same way.

23.2. Routine operational communications may take place in the Service or through support. Notice of termination, withdrawal, changes to price or the Terms, and notifications affecting the duration of the Agreement shall also be delivered to the designated contact email address or by other verifiable means. A notice on the website alone does not constitute such delivery.

23.3. The effects of delivery shall be assessed according to applicable law and verifiable circumstances. A message that could not be delivered is not deemed delivered merely because it was sent. Where authority is in doubt or erasure or export is requested, the Provider may require reasonable verification but not unjustified repetition of information already verified.

23.4. The parties shall not send passwords, access keys, complete identity documents or extensive AML files in ordinary unsecured email communications. They shall use the agreed secure channel for sensitive materials.

24. Governing law, disputes and final provisions

24.1. The Agreement is governed by the law of the Slovak Republic, primarily the Commercial Code within its scope. For a legal entity whose relationship is not a commercial obligation by operation of law, the parties shall agree to the application of the Commercial Code in the required written form. This is without prejudice to mandatory provisions or directly applicable European Union law.

24.2. The choice of Slovak contract law does not change the Customer's obligations under applicable Czech or other AML, sanctions, professional and data law. Its actual activities and legal regime are decisive, irrespective of the chosen interface language.

24.3. The parties shall attempt to resolve disputes through negotiations between authorised representatives. Such negotiations do not suspend statutory deadlines or preclude an application for urgent relief. For cross-border disputes, the parties agree in the form required by law to the jurisdiction of the courts of the Slovak Republic unless a mandatory rule confers different or exclusive jurisdiction. Subject-matter and territorial jurisdiction shall be determined under the rules of procedure.

24.4. Invalidity or unenforceability of a severable provision shall not affect the other provisions. The parties shall replace it with a valid provision reasonably preserving its lawful purpose. This rule does not automatically cure a prohibited term or allow a party's position to be worsened retrospectively.

24.5. The Customer may not transfer the Agreement or access to another person without agreement unless the law provides otherwise. The Provider shall notify any intended change of contractual provider and comply with the statutory conditions for transfer. This must not reduce data rights, security or the ability to exit. A change of subprocessor is separately governed by the DPA.

24.6. Annexes 1 and 2 form part of these Terms to the extent validly incorporated into the Agreement. Fictitious parameters shall not be entered. Information necessary to determine the subject matter, price, processing and exit must be specified before the relevant Agreement is concluded. These Terms take effect on the date indicated in the heading following approval by the Provider.

Annex 1 – Mandatory content of the Order and related annexes

This annex specifies the information that must be supplied to the Customer before a binding order is placed. Specific values shall be stated in the Order, SLA or DPA. The list below does not itself constitute agreement on a value that has been left blank.

Annex 2 – Scope of data handover

1. Ordinary export covers the subject’s final risk assessment with an explanation under Article 19.6.

2. For statutory switching, exportable data is not limited to ordinary export. It includes input and output data, including metadata generated or co-generated through use of the Service, and relevant digital assets to the extent required by applicable law.

3. Before the Contract is concluded, the actual categories of exportable data and digital assets processed and the exhaustive list of lawful exclusions must be specified to the extent required by Article 25(2)(e) and (f) of the Data Act. Information and the register reference shall be provided under Article 19.8.

4. Handover does not disclose other customers’ data, authentication secrets or protected assets of the Provider or third parties beyond legal requirements. An exclusion must not obstruct or delay statutory switching. Rights to return or erasure of personal data under the DPA remain unaffected.