Terms and Conditions of the Avanterro Service

Effective date: 12 August 2026 Version: 1.1 Provider: AVANTERRO SYSTEMS s.r.o.

1. Introductory provisions

These Terms and Conditions (hereinafter the "Terms") govern the mutual rights and obligations between AVANTERRO SYSTEMS s.r.o., Company ID (IČO) 24568082, with its registered office at Příčná 1892/4, Nové Město, 110 00 Prague 1, Czech Republic, registered in the Commercial Register kept by the Municipal Court in Prague, Section C, Insert 442318 (hereinafter the "Provider"), and any person using the Service (hereinafter the "Client"), in accordance with Section 1751 of Act No. 89/2012 Coll., the Civil Code (hereinafter the "Civil Code").

The Service is intended exclusively for entrepreneurs, legal entities and persons acting in connection with their business or professional activities. The Service is not intended for consumers.

The Provider's statutory body consists of executive directors registered in the Commercial Register. Contact: [email protected]. All payments for the Service are processed by Paddle.com Market Limited acting as the seller of record under the Merchant of Record model (see section 5); the Provider does not receive payments from the Client directly, which is why no bank account details are provided.

2. Definitions

For the purposes of these Terms:

• "Client" means a person who enters into the contract and uses the Service in connection with their business or professional activities.
• "Service" means the Avanterro cloud-based software application operated at https://avanterro.com and related domains, intended for the management of businesses and their operations.
• "Tenant" means a separately isolated workspace within the Service allocated to one Client, which is accessible only to authorised Users.
• "User" means a natural person to whom the Client has granted access credentials and who uses the Service within the Client's Tenant (typically an employee).
• "Subscription" means paid access to the Service for an agreed period.
• "Plan" means a specific price level of the Subscription with a defined scope of features and limits published at https://avanterro.com.
• "Trial" means a free trial period of 14 days from registration, during which the Service is available in the full scope of available features.

3. Subject matter of the contract and its conclusion

3.1 The subject matter of the contract is the Provider's undertaking to make the Service available to the Client within the scope of the chosen Plan and the Client's undertaking to pay the agreed price (with the exception of the Trial).

3.2 The contract is concluded electronically by completing the registration form and accepting these Terms and the Privacy Policy. The contract is concluded at the moment registration is completed.

3.3 The Client warrants that the data provided at registration is true. The Client is obliged to update changes to its data (in particular billing data) without undue delay in its account.

3.4 By concluding the contract, the Client confirms that it acts in connection with its business or professional activities and that it is not ordering the Service as a consumer.

4. Trial

4.1 Upon first registration, the Provider grants the Client a 14-day free Trial in the full scope of available features. After the Trial ends, the Service does not automatically convert to a paid Subscription – to continue, the Client must select and pay for a Plan.

4.2 If, after the Trial ends, the Client does not activate a paid Subscription, the Provider may restrict or suspend access to the Service. Data retention and deletion are governed by section 6.6 of these Terms.

4.3 The Trial cannot be claimed repeatedly by the same entity; the Provider reserves the right to refuse the Trial in case of suspected abuse.

5. Price and payment terms

5.1 The current prices of individual Plans are published at https://avanterro.com/#pricing. Prices are stated excluding VAT and VAT will be added in accordance with section 5.3 of these Terms.

5.2 The Subscription is paid on a monthly basis.

5.3 Payments are processed by Paddle.com Market Limited, IE 5023304, with its registered office in Dublin, Ireland, acting as the seller of record under the Merchant of Record (MoR) model. Paddle issues the invoice, collects VAT and locally applicable sales taxes in accordance with the rules of the Client's country, and handles refunds and chargebacks. The Client expressly acknowledges that:

• the legal payment relationship arises towards Paddle, while the substantive relationship for the Service exists towards the Provider,
• the invoice shows Paddle as the seller and the product as "Avanterro Subscription".

5.4 The Subscription is paid in advance. If payment is not successfully completed even after a second attempt, the Provider reserves the right to suspend access to paid features.

5.5 The Client expressly agrees to the issuance of invoices in electronic form (Section 35 of Act No. 235/2004 Coll.), delivered by e-mail and/or made available within the application.

6. Term, cancellation and termination

6.1 The contract is concluded for an indefinite term. The Subscription automatically renews at the end of each billing period unless cancelled by the Client.

6.2 The Client may cancel the Subscription at any time within its account. Cancellation takes effect at the end of the current billing period; until then the Service remains available and no further Subscription fees will be charged. Cancellation does not automatically result in a refund; refund requests are governed by Section 6.4.

6.3 Trial as an evaluation period. The Trial serves to verify whether the Service meets the Client's needs. By activating a paid Subscription, the Client confirms that it had the opportunity to try the Service and wishes to continue using it on a paid basis.

6.4 Refund Policy

Refund requests must be submitted within 14 calendar days of the date of the relevant payment transaction. Refunds are administered by Paddle, our Merchant of Record, in accordance with Paddle's Refund Policy. A refund can be requested using the “View receipt” or “Manage subscription” link in Paddle's confirmation email, through the support link available on the billing page, or at paddle.net. Nothing in this Section limits any rights that cannot be excluded or restricted under applicable law.

6.5 The Provider may terminate the contract by giving 30 days' notice sent by e-mail to the Client's address. In the event of a material breach of the Terms (in particular failure to pay a due amount even after a request, serious breach of the AUP, suspicion of criminal activity), the Provider may withdraw from the contract with immediate effect and block access to the Service without compensation.

6.6 After termination of the Subscription, deactivation of the account or a longer period of inactivity, Client Data may be retained for a limited period to allow restoration of the Service and to comply with legal obligations. Before permanent deletion of data, the Provider sends a warning to the Client's contact e-mail, typically after 5 months of inactivity. If the Client does not extend data retention using the link in that e-mail, does not resume activity in the account and does not activate a Subscription, the data may be permanently deleted, typically after 6 months of inactivity. The link in the warning e-mail extends data retention by another 5 months. This does not affect data whose retention is required by law.

7. Service availability and support

7.1 The Provider undertakes to use reasonable efforts (best efforts) to ensure high availability of the Service. The Provider does not guarantee any specific SLA level at the time these Terms take effect.

7.2 The Provider is entitled to carry out scheduled maintenance, which may temporarily limit availability. Scheduled maintenance is announced in the application at least 24 hours in advance and is scheduled outside peak hours (typically between 22:00 and 06:00 CET).

7.3 The Provider provides technical support by e-mail at [email protected] on business days, usually within 24 hours.

8. Intellectual property rights

8.1 All intellectual property rights to the Service (in particular the source code, design, the "Avanterro" trademark, logo and documentation) belong to the Provider. The Client receives only a non-exclusive, non-transferable licence to use the Service within the scope of the chosen Plan for the duration of the Subscription.

8.2 The Client is the owner (or the controller) of all data that it uploads to the Service, creates within it or that is generated for its account (hereinafter the "Client Data"). The Provider receives only a limited licence necessary for the operation of the Service (storage, display, backup, anonymised diagnostics).

8.3 The Client undertakes not to remove copyright notices from the Service and not to make the Service available to third parties beyond the scope of normal operation.

9. Acceptable Use Policy (AUP)

Neither the Client nor any User may use the Service in a manner that:

• breaches the laws of the Czech Republic, the EU or the country in which the Service is used;
• serves to send unsolicited commercial communications (spam) or for phishing;
• stores or distributes content that infringes the rights of third parties, in particular copyright, trademarks, personality rights or know-how;
• stores content involving child pornography, promoting terrorism, violence, racial hatred or other unlawful content;
• constitutes an attempt at reverse engineering, decompilation, circumvention of security mechanisms, unauthorised acquisition of source code or circumvention of Plan limits;
• uses the Service for cryptocurrency mining, distributed attacks, scanning vulnerabilities of third-party systems or other activities that strain the infrastructure;
• results in a single User account being shared between multiple natural persons; each User must have their own account;
• disparages the Provider or harms the reputation of the Service.

In the event of suspected breach of the AUP, the Provider may restrict or suspend access to the Service; if the breach is material and continues even after a request to remedy it, the Provider may withdraw from the contract (clause 6.5).

10. Liability and its limitation

10.1 The Provider is liable for damage caused by breach of an obligation under the contract. The aggregate compensation for damage towards the Client is limited to an amount equal to the price of the Subscription paid by the Client for the 12 months preceding the occurrence of the damage.

10.2 The Provider is not liable for indirect, consequential or lost profits, loss of data, or for damage caused by force majeure, outages of third-party services or the fault of the Client or a third party.

10.3 The limitations of liability do not apply to the extent that their application would conflict with Section 2898 of the Civil Code, in particular in cases of damage caused intentionally or by gross negligence.

10.4 The Client is liable to the Provider in full for damage caused by breach of the AUP or by use of the Service in conflict with the contract.

11. Complaints and dispute resolution

11.1 The Client may exercise rights arising from defective performance by writing to [email protected]. The complaint must contain a description of the defect and contact details. The Provider shall assess the complaint without undue delay.

11.2 In the case of a justified complaint, the Client is entitled to have the defect remedied. If the defect cannot be remedied, the Client may request a reasonable discount from the price for the affected period or terminate the contract, if such right belongs to the Client under the contract or applicable law.

11.3 The parties undertake to first attempt to resolve any dispute amicably. This does not affect the right of either party to turn to the competent court under section 14.

12. Personal data protection

12.1 The rules for processing personal data in cases where the Provider acts as a controller are described in the Privacy Policy at https://avanterro.com/privacy.

12.2 Where the Provider processes personal data on behalf of the Client as a processor (in particular data of the Client's end customers stored within the Service), Annex 1 – Data Processing Terms under Article 28 GDPR below applies. The Annex forms an integral part of these Terms and the Service contract; no separate document needs to be signed.

12.3 The current register of approved providers and recipients is available to authenticated Client administrators in Settings → Legal documents. The register forms part of the general authorisation of sub-processors under Annex 1.

13. Changes to the Terms

13.1 The Provider is entitled to amend these Terms in response to changes in legislation, technological developments, expansion of the Service or market conditions.

13.2 The Provider shall notify the Client of any change to the Terms by a notice in the application with sufficient advance notice before the change takes effect.

13.3 The Client has the right to reject a change by terminating the contract by notice delivered before the change takes effect; in such a case, until the end of the Subscription, the relationship is governed by the previous Terms.

13.4 If the Client continues to use the Service after the change takes effect, the Client is deemed to have accepted the change.

14. Final provisions

14.1 The contract and these Terms are governed by the laws of the Czech Republic, in particular the Civil Code. The United Nations Convention on Contracts for the International Sale of Goods (CISG) shall not apply.

14.2 Any disputes that cannot be resolved amicably or by the procedure under section 11 shall fall within the jurisdiction of the Provider's general court in the Czech Republic.

14.3 Should any provision of these Terms become invalid, ineffective or unenforceable, this shall not affect the validity of the remaining provisions. The Parties shall replace such provision with one that most closely approximates the original purpose.

14.4 These Terms are drawn up in the Czech language version, which is the binding version. The English and other language versions are provided solely for the Client's convenience.

Annex 1 – Data Processing Terms under Article 28 GDPR

1. Application and roles of the Parties

1.1 This Annex applies where the Provider processes personal data on behalf of the Client when providing the Service. The Client is the controller and the Provider is the processor within the meaning of the GDPR. The Parties are identified by the Client account, order and these Terms.

1.2 This Annex together with the Terms constitutes a written data processing agreement under Article 28 GDPR. Electronic acceptance of the Terms also covers this Annex.

2. Subject matter, duration, nature and purpose

2.1 The processing concerns operating, securing, supporting, backing up and making the Service available under the Client's documented instructions. It lasts for the term of the contract and subsequent retention or deletion under section 6.6 and this Annex.

2.2 Processing may include storage, organisation, retrieval, display, transmission, backup, correction and deletion within the functions of the Service. The Provider will not use the data for its own marketing, sale of data or training of general-purpose artificial intelligence models.

3. Data subjects and categories of data

3.1 Data subjects may include Users, the Client's employees and contractors, its customers and suppliers, and other persons whose data the Client enters into the Service.

3.2 Data may include identification and contact details, job, booking, task, document and communication data, technical and audit data, and other information entered by the Client. The Client is responsible for the lawfulness of its instructions and for not entering special categories of data unless it has an appropriate legal basis and safeguards.

4. Instructions and Client obligations

4.1 The Provider processes data only on the Client's documented instructions contained in the Terms, settings and ordinary use of the Service or in a written Client request. It will inform the Client if it considers an instruction to infringe the GDPR or other EU or Member State law, unless prohibited by law.

4.2 The Client determines the purposes and means of processing, ensures the legal basis and transparency, handles data subject rights and manages its Users' permissions.

5. Provider obligations

5.1 The Provider shall in particular:

• ensure that authorised persons are bound by confidentiality;
• implement appropriate technical and organisational measures under Article 32 GDPR;
• reasonably assist the Client, taking into account the nature of processing, with data subject rights and obligations under Articles 32 to 36 GDPR;
• notify the Client without undue delay of a personal data breach affecting data processed for the Client and provide available supporting information;
• return or delete data at the end of processing under section 9, unless EU or Member State law requires retention;
• provide information reasonably necessary to demonstrate compliance with Article 28 GDPR and permit audits under section 10.

6. Sub-processors and recipients

6.1 The Client grants the Provider general written authorisation to engage sub-processors necessary to operate the Service. The exact current register of approved providers and recipients is available only to authenticated Client administrators in Settings → Legal documents.

6.2 The Provider will notify Client administrators of an intended addition or replacement of a sub-processor at least 30 days in advance. The Client may raise a reasoned data-protection objection within that period. The Parties will seek a reasonable solution; if none is possible, the Client may stop using the affected feature or terminate the contract before the new sub-processor is engaged.

6.3 The Provider will impose substantially the same data protection obligations on each sub-processor and remains responsible to the Client for its performance to the extent required by the GDPR.

7. Security of processing

7.1 The Provider maintains risk-appropriate measures including access and least-privilege controls, separation of company workspaces through companyId and ownership checks, protection of data in transit, backup and recovery, logging of relevant events, vulnerability management, secure development and incident-response procedures.

7.2 Measures may evolve with technology but must not materially reduce the overall level of protection of the Service.

8. Assistance and incidents

8.1 The Client sends data subject requests to the Provider through support. Taking into account the nature of processing and the capabilities of the Service, the Provider will provide reasonable assistance; unusually extensive assistance may be charged at reasonable cost by prior agreement.

8.2 To the extent available, a breach notice will describe the nature of the incident, affected categories of data and persons, likely consequences and measures taken or proposed. Information may be supplied in phases.

9. Return, export and deletion

9.1 Before termination, the Client may use available export functions or request reasonable export assistance. On departure, a Client administrator may request prompt deletion of Client Data instead of the standard retention period, unless continued retention is required by law.

9.2 Unless earlier deletion is requested, the standard regime under section 6.6 applies: data may generally be deleted after 6 months of inactivity and the Client may extend retention as stated there. After production deletion, backup copies are removed through rolling rotation no later than 35 days, unless isolated for a security incident or legal obligation.

10. Information and audit

10.1 Once per year, and additionally following a serious incident, the Client may request reasonable information demonstrating compliance. Security documentation, certifications and remote assessment take precedence.

10.2 Where an on-site audit is necessary, it must be agreed in writing in advance, take place during business hours, avoid disruption and protect other clients' information, and be subject to confidentiality. The Client bears its costs and the Provider's reasonable costs unless the audit proves a material breach of this Annex.

11. International transfers

11.1 The Provider will ensure that personal data is transferred outside the EU/EEA only under a valid Chapter V GDPR mechanism, in particular an adequacy decision, the EU–US Data Privacy Framework where applicable, or Standard Contractual Clauses supplemented by additional measures as appropriate to the risk.

12. Term, precedence and governing law

12.1 This Annex continues for as long as the Provider processes personal data on behalf of the Client. It prevails over conflicting provisions of the other Terms in matters of personal data processing; the remaining Terms, including liability limitations to the extent permitted by law, continue to apply.

12.2 This Annex is governed by Czech law and the GDPR. Amendments are notified in the same way as changes to the Terms; changes to the sub-processor register follow section 6.2 of this Annex.

This document takes effect on 12 August 2026. Version 1.1.