End User Licence Agreement

The terms on which you use Guardiso, what you may do with the documents produced in the platform, and what we are responsible for and what you are.

End User Licence Agreement

Document version: 15 September 2026 Previous version: 14 September 2026 Document effective from: 1 September 2026

This Agreement sets out the extent to which the Licensee may use the Guardiso platform, the content library contained within it and the materials produced by means of it. This Agreement also sets out the limits of such use and the consequences of exceeding them.

This Agreement is concluded at the moment the person authorised to represent the Licensee makes the declaration of its conclusion on the Platform, on the screen preceding the placing of the order. The same moment is indicated in § 6(5) of the Terms of Service. This Agreement is in force from that moment throughout the period of use of the Platform by the Licensee. Neither the mere creation of an Account nor the mere commencement of use of the Platform concludes this Agreement. During the Trial Period, which precedes the conclusion of this Agreement, use of the Platform takes place on the terms described in the Terms of Service.

Parties to the Agreement, definitions and the place of this Agreement among the documents
What the Platform is and what it is not
Scope of the licence
Maintaining more than one company on the Platform
Granting external access and sharing documents
The Application Programming Interface and usage limits
Prohibition on reverse engineering and on circumventing safeguards
The Content Library — protection and permitted use
Content created by artificial intelligence
Confidentiality
Infringement of third-party rights and mutual indemnity
Documents produced on the Platform and Licensee Data
Comments and suggestions submitted by the Licensee
Liability
Breach of the licence and the applicable procedure
Duration of the licence and consequences of termination
Final provisions

§ 1. Parties to the Agreement, definitions and the place of this Agreement among the documents

The Licensor is Guardiso Michał Lewandowski, ulica Święty Marcin 29 lokal 8, 61-806 Poznań, Poland, tax identification number (NIP) 6060011996, operating under the Guardiso brand.
The Licensee is the entity for which an Organisation has been created on the Platform and which is a Customer within the meaning of the Terms.
Electronic mail address for contact in all matters covered by this Agreement: kontakt@guardiso.com. The address for written correspondence is the same as the address indicated in paragraph 1. The address of the website at which the Platform is made available: https://guardiso.com.
Terms written in this Agreement with a capital letter which are not defined below have the meaning given to them in the Terms of Service for the Provision of Services by Electronic Means, available at https://guardiso.com/terms. This applies in particular to the terms: Service, Platform, Plan, Subscription, Billing Period, Trial Period, Account, Organisation, Account Owner, User, Customer, Protected Customer, Customer Data, Price List and Business Day.
In addition, in this Agreement:
1. Content Library — the set of materials prepared by the Licensor and made available on the Platform to all Licensees, comprising model policies and procedures, the risk catalogue together with proposed treatments, the control catalogues of the individual standards, mappings of controls between standards, implementation guides, model questionnaires and question banks, and descriptions of requirements. The Content Library does not include Licensee Data.
2. Licensee Data — Customer Data within the meaning of the Terms, that is to say all data, documents, registers, evidence and attachments entered into the Platform by the Licensee and by Users, as well as produced on the Platform at the Licensee's instruction.
3. Automatically Generated Content — material prepared on the Platform by an artificial intelligence mechanism at a User's instruction, before a creative contribution has been made to it by a human being.
4. Application Programming Interface — the means made available by the Licensor for connecting to the Platform by software, without the intermediation of a web browser.
5. Access Key — a string of characters issued on the Platform, serving to authenticate software using the Application Programming Interface on behalf of a single Organisation.
6. Consultant — a Licensee who maintains on the Platform at least one Organisation corresponding to an entity other than itself, in particular in connection with the provision of advisory, implementation or compliance management services to that entity.
7. Consultant's Client — the entity for which the Consultant maintains an Organisation on the Platform.
8. Partner Agreement — a separate agreement concluded by the Licensor with a Consultant, setting out the rules of commercial cooperation going beyond the scope described in § 4.
This Agreement supplements the Terms and does not replace them. In the event of a conflict between the documents, the order of precedence described in the Terms applies, whereby the scope of the licence and the rights to the Content Library are governed by this Agreement.
The Terms provide for a separate Acceptable Use Policy, available at https://guardiso.com/dozwolone-uzytkowanie. That Policy supplements §§ 5, 6, 7 and 8 of this Agreement and, in the event of a conflict with them, those sections prevail, in accordance with the order of precedence set out in § 23 of the Terms. Until the Policy is published, the rules on permitted use of the Platform are determined solely by §§ 5, 6, 7 and 8 of this Agreement. Publication of the Policy does not limit the rights granted to the Licensee under this Agreement.
The provisions of this Agreement also apply during the Trial Period, save that the licence is then limited to the duration of the Trial Period and to the scope made available during it.

§ 2. What the Platform is and what it is not

Guardiso is an IT tool supporting the management of information security and of compliance with selected standards and regulations.
The Licensor does not provide legal assistance within the meaning of the provisions on the legal professions, does not provide tax advice, and does not act as an auditor or as a certification body.
The Platform does not issue certificates and does not replace a certification body. Obtaining a certificate of conformity with any standard depends solely on the outcome of an independent audit carried out by an authorised external entity.
Compliance indicators, readiness assessments, proposed risk treatments and Automatically Generated Content are of an auxiliary nature. They do not constitute a statement that the Licensee meets the requirements of any standard or legal provision, and they require verification and approval by the Licensee.
This Agreement contains no undertaking as to any particular level of availability of the Platform, as to any particular response times or as to any particular time for restoring operation after a failure. Such undertakings arise solely where the parties have concluded a separate Service Level Agreement, and solely to the extent described therein.

§ 3. Scope of the licence

The Licensor grants the Licensee a licence that is non-exclusive, non-transferable and without the right to grant sub-licences, to use the Platform in accordance with its intended purpose, for the duration of the Subscription or of the Trial Period. The licence is not limited territorially.
The licence covers use of the Platform by Users to whom the Licensee has granted access in the Organisation, including its employees, contractors, persons performing tasks on its instruction, and an external auditor to whom the Licensee has granted access. Granting access to such persons does not constitute the grant of a sub-licence and does not require separate consent from the Licensor.
A User's Account is personal to the named individual. The Licensee ensures that log-in credentials are not shared with other persons and are not used by more than one person. The Licensee is liable for the acts and omissions of Users to whom it has granted access as for its own.
The number of Users in an Organisation is not limited under any Plan. The number of Organisations covered by the price of the Plan, the number of standards enabled at the same time and the monthly budget of queries to artificial intelligence mechanisms result from the selected Plan and from the Price List. Exceeding a limit requires a change of Plan or the release of a resource and does not automatically trigger an additional charge. These rules are described in § 4(6) and (7) of the Terms.
The licence does not transfer ownership of the software or of the Content Library. The Licensee acquires the right to use them, and not a right to the product itself.
Rights not expressly granted to the Licensee under this Agreement remain with the Licensor.
The rights concerning documents produced on the Platform, described in § 12, and the rights concerning Automatically Generated Content, described in § 9, are independent of the duration of the licence and are vested in the Licensee also after the licence has expired.

§ 4. Maintaining more than one company on the Platform

The licence covers maintaining more than one Organisation on the Platform, including Organisations of entities other than the Licensee, and using the Platform in the course of providing the Licensee's own services for consideration to those entities. The provisions of this section constitute the Licensor's express permission and prevail over any general wording of this Agreement concerning use of the Platform for the Licensee's own internal needs.
The permission referred to in paragraph 1 covers in particular:
1. a consultant or adviser implementing an information security management system or regulatory compliance at its clients;
2. an entity acting for its clients as data protection officer or as the person responsible for information security;
3. an entity maintaining the Organisations of companies belonging to the same capital group;
4. a law firm, an accounting office or another entity handling its clients' compliance documentation.
Each Organisation is separately chargeable. Maintaining each further Organisation under the same Account is subject to a fee in the amount specified in the Price List, charged independently of the Plan fee. The number of Organisations covered by the price of the Plan results from the Price List and from the Plan description. Maintaining an Organisation in respect of which the fee due has not been paid constitutes a breach of the licence with the consequences described in § 15.
Separation of data between Organisations. Each Organisation is a separate data space, and the personal data of each Organisation is encrypted with a separate key. A Licensee maintaining more than one Organisation:
1. does not transfer data between Organisations otherwise than by means of the functions made available on the Platform for that purpose, and solely where it has a legal basis for doing so;
2. does not use the data of one Consultant's Client for the benefit of another Consultant's Client, nor for its own purposes going beyond the servicing of that Organisation;
3. grants access to an Organisation solely to those persons who need it in order to perform tasks in that Organisation, and promptly withdraws access from persons who have ceased to perform those tasks.
Liability of the Consultant. The Consultant is liable to the Licensor for the manner in which each Organisation maintained by it is used, including for the acts and omissions of the Consultant's Clients and of Users to whom it has granted access, as for its own acts. The Consultant is also liable for payment of the fees for all Organisations maintained, irrespective of how it settles accounts with its own clients. Settlements between the Consultant and the Consultant's Client are a matter solely between them and do not affect the Consultant's obligations towards the Licensor.
Personal data in the consultancy model. Where the controller of the personal data collected in an Organisation is the Consultant's Client and not the Consultant, the Consultant declares that it is authorised to entrust the processing of that data to the Licensor and that it has concluded its own data processing agreement with the Consultant's Client. The Licensor then acts as a sub-processor, on the terms described in the Data Processing Agreement concluded with the Licensee.
End of the Consultant's cooperation with its client. The Consultant shall enable the Consultant's Client to obtain the documentation collected in the Organisation maintained for that client, using the export functions made available on the Platform. Upon a joint request of the Consultant and the Consultant's Client, the Licensor may transfer the Organisation to an Account indicated by the Consultant's Client. Such a transfer does not follow by operation of this Agreement and requires confirmation by the Licensor.
Marking materials with the Consultant's own brand. To the extent that the Platform makes this available, the Consultant may mark reports and assessments prepared for a Consultant's Client with its own name, graphic sign and colours. The Consultant declares that it holds the rights to the designations used and indemnifies the Licensor on the terms described in § 11(6). This entitlement does not constitute consent to presenting the Platform itself as the Consultant's software or service.
What the permission does not cover. Without concluding a Partner Agreement, the Licensee may not:
1. sell, resell, rent out or otherwise make available access to the Platform as a separate service, including acting as an intermediary in the sale of Subscriptions;
2. present the Platform as its own software or as its own service provided under its own brand, including making it available under its own domain or trade name;
3. make one paid-for Organisation available to several entities in order to avoid the fee for further Organisations;
4. offer access to the Platform as an element of its own offering in a situation in which the recipient pays the Licensee for access to the Platform as such, and not for a service of the Licensee performed by means of it.
Providing the Licensee's own advisory, implementation and support services for consideration by means of the Platform, in paid-for Organisations, is permitted and constitutes the essence of the permission under paragraph 1. Paragraph 9 concerns solely trading in access to the Platform as such.
Partner Agreement. The rules of partner cooperation, including the commercial terms, the rules on the use of the Licensor's designations, the scope of support and the manner of settlement, are set out in a separate Partner Agreement concluded in documentary form. Until it is concluded, only the rules described in this section apply. Expressing an interest in partner cooperation does not create an obligation on the part of either party.

§ 5. Granting external access and sharing documents

The Licensee may grant access to an Organisation to an external auditor, a certification body or another third party performing a task for the Licensee, within the scope of the functions provided for that purpose on the Platform. Such granting of access falls within the licence and does not require separate consent.
The Licensee may make documents produced on the Platform available to its counterparties, auditors and authorities, including by means of the trust portal and the document sharing functions.
Making documents available may not consist in transferring the Content Library in unprocessed form, on the terms described in § 8.
The Licensee does not remove or alter markings of origin, rights notices or watermarks placed on materials downloaded from the Platform or made available by means of it.
The Licensee is liable for the scope of access it has granted to a third party and for its choice of the persons to whom it grants such access.

§ 6. The Application Programming Interface and usage limits

The Licensor makes the Application Programming Interface available in the scope and in the form in which it is available on the Platform. Use of the Application Programming Interface is covered by the licence on the terms described in this section.
Access Keys. An Access Key is created on the Platform by the Account Owner or by an administrator of the Organisation. The full form of an Access Key is displayed only once, at the moment of creation, and is not stored by the Licensor in a form allowing it to be reconstructed. An Access Key may be assigned an expiry date and a scope of permissions covering the reading, writing or deletion of data. An Access Key operates solely within the limits of a single Organisation.
Number of Access Keys. An Organisation may have no more than ten active Access Keys at any one time.
An Access Key is authentication data. The Licensee protects it in the same way as a password, does not place it in publicly available code or in messages transmitted without protection, and, if it suspects disclosure, promptly revokes it on the Platform and notifies the Licensor. The consequences of use of an Access Key are borne by the Licensee.
Limits. The Licensor may introduce limits on the number of queries, the frequency of connections and the volume of data transmitted, and may also temporarily restrict traffic which threatens the stability of the Platform or the security of other Licensees' data. Where the circumstances allow, the Licensor gives advance notice of the introduction of a limit. Restriction of traffic threatening the stability of the Platform may take place immediately, with notification after the event.
Prohibition on circumventing limits. The Licensee does not create additional Access Keys, Accounts or Organisations for the purpose of circumventing a limit resulting from the Plan, from the Price List or from paragraph 5.
Automated retrieval of the content of the Platform is permitted solely by means of the export functions made available and the Application Programming Interface, and solely within the limits of the permissions assigned to the Access Key. Retrieval of content by other means, including by automated reading of the Platform's pages, is not permitted.
Changes to the Application Programming Interface. The Licensor does not undertake to maintain the Application Programming Interface in an unchanged form. Changes to the Application Programming Interface are subject to the rules on changes to the scope and functions of the Service described in the Terms. A change necessary for reasons of security or in order to remedy a vulnerability may be introduced immediately.
The Licensor does not undertake to provide support in implementing the Application Programming Interface beyond the scope of support described in the Terms.

§ 7. Prohibition on reverse engineering and on circumventing safeguards

The Licensee does not carry out reverse engineering of the source code, decompilation or disassembly of the Platform, nor does it commission others to do so.
The prohibition under paragraph 1 is without prejudice to the rights arising from mandatory provisions of law, in particular:
1. the right to observe, study and test the functioning of a computer program in order to determine its ideas and principles — Article 75(2)(2) of the Polish Act of 4 February 1994 on Copyright and Related Rights (ustawa o prawie autorskim i prawach pokrewnych);
2. the right to reproduce the code or translate its form where this is indispensable to obtain the information necessary to achieve the interoperability of an independently created computer program with the Platform — Article 75(2)(3) and Article 75(3) of that Act.
Before exercising the right described in paragraph 2(2), the Licensee requests the Licensor to make available the information necessary for interoperability. The Licensor makes such information available within a reasonable time, to the extent that it holds it.
The Licensee does not circumvent and does not attempt to circumvent the safeguards of the Platform, in particular the authentication mechanisms, permission controls, separation of data between Organisations, restrictions resulting from the Plan, the limits described in § 6, and watermarks and markings of origin.
The Licensee does not carry out security testing of the Platform, including penetration testing, vulnerability scanning and load resilience testing, without the Licensor's prior consent expressed in documentary form, specifying the scope, the date and the manner of conducting the tests. The Licensor may make a separate test environment available for this purpose.
Reporting vulnerabilities. A person who identifies a vulnerability of the Platform may report it to security@guardiso.com — the same address is indicated in the file published at https://guardiso.com/.well-known/security.txt in accordance with the RFC 9116 standard. The detailed conditions are set out in § 10 of the Acceptable Use Policy. The Licensor will not pursue claims against such a person for breach of paragraphs 4 and 5, provided that the person acted in good faith, limited their activity to the extent necessary to demonstrate the vulnerability, did not extract or disclose the data of other Licensees, did not disrupt the operation of the Platform and did not disclose the vulnerability publicly before it was remedied or before the expiry of the agreed period.
The Licensee does not use the Platform in a manner threatening its operational continuity or the security of other Licensees' data, nor does it use it to transmit malicious software.

§ 8. The Content Library — protection and permitted use

The Content Library constitutes the most significant asset of the Platform. It is protected:
1. as a work — on the basis of Article 1(1) of the Polish Act of 4 February 1994 on Copyright and Related Rights (ustawa o prawie autorskim i prawach pokrewnych), to the extent that the individual materials are of a creative character;
2. as a database — on the basis of Article 6(1) of the Polish Act of 27 July 2001 on the Protection of Databases (ustawa o ochronie baz danych), which grants the maker of a database the exclusive right to extract and re-utilise the data in whole or in a substantial part;
3. as a trade secret — in respect of materials meeting the conditions of Article 11(2) of the Polish Act of 16 April 1993 on Combating Unfair Competition (ustawa o zwalczaniu nieuczciwej konkurencji).
What the Licensee is permitted to do. During the term of the licence and — to the extent described in § 12 — also after it has ended, the Licensee may:
1. use the materials of the Content Library for the needs of its own organisation;
2. process, supplement and adapt them to its own situation, thereby creating its own documentation;
3. present the documentation so created to auditors, certification bodies, counterparties and authorities;
4. if it is a Consultant — use the materials of the Content Library in its work for Consultant's Clients, within the limits of paid-for Organisations, and transfer the documentation so created to the Consultant's Client.
What the Licensee is not permitted to do. The Licensee may not:
1. extract or re-utilise the Content Library in whole or in a substantial part for a purpose other than that described in paragraph 2;
2. extract it repeatedly and systematically in a manner conflicting with normal use of the Platform and unreasonably prejudicing the legitimate interests of the Licensor — in accordance with Article 8(2) of the Act on the Protection of Databases;
3. transfer the Content Library in unprocessed form, as a set of models, a catalogue or mappings, to an entity other than the entity for which a paid-for Organisation is maintained;
4. use it to build a product or service competing with the Platform;
5. use it to train, fine-tune or evaluate artificial intelligence models;
6. publish it or make it publicly available, including in open repositories and document-sharing services.
The Licensee's right to extract and re-utilise an insubstantial part, evaluated qualitatively or quantitatively, of the Content Library, arising from Article 7 of the Act on the Protection of Databases, remains unaffected. Paragraph 3(2) concerns solely repeated and systematic extraction.
The prohibitions described in paragraph 3 apply also after the end of this Agreement.
The burden of demonstrating that material used by the Licensee was created independently of the Content Library rests on the Licensee only where the Licensor demonstrates a substantial similarity of that material to the Content Library and the Licensee's access to it.

§ 9. Content created by artificial intelligence

The Platform uses language models. Content created in this way is marked on the Platform and requires verification and approval by a human being before use.
No copyright in content without a creative human contribution. In accordance with Article 1(1) of the Act on Copyright and Related Rights, the subject matter of copyright is a manifestation of creative activity of an individual character. The parties accept that the automatic generation process alone, without a creative human contribution, does not create copyright either on the side of the Licensor or on the side of the Licensee. This provision is without prejudice to the rights of third parties in elements used or reproduced in Automatically Generated Content. The Licensee acknowledges that the output of the model may contain an element in which a third party holds rights, and that the verification of content before its use, referred to in paragraph 1, covers that circumstance as well.
Who may use such content. The Licensor asserts no rights whatsoever to Automatically Generated Content produced at the Licensee's instruction and does not restrict the Licensee's use of it — neither as to purpose, nor as to time, nor as to territory, including after the end of this Agreement. In particular, the Licensee may modify such content, combine it with its own materials, present it to auditors and authorities, and transfer it to the Consultant's Client for whom it was produced.
Use of such content by the Licensor. The Licensor does not use Automatically Generated Content produced at the Licensee's instruction beyond the extent necessary to provide the Service. The Licensee acknowledges, however, that in the absence of copyright protection the model may produce for another user content that is similar or identical, and that this does not constitute an infringement of the Licensee's rights or of this Agreement.
Creative human contribution. If a human being makes a creative contribution of an individual character to Automatically Generated Content, the work thereby created is protected on general principles. The rights to such a work are vested in the entity on whose side the person making that contribution acted. The Licensor acquires no rights to it.
Liability. The Licensor does not guarantee the correctness, completeness or currency of Automatically Generated Content. Responsibility for its verification, approval and use rests on the Licensee. The Licensee has no claims in respect of the consequences of using such content where it has not subjected it to verification.
Automatically Generated Content is not covered by the indemnity described in § 11(1), because its content depends on the instruction given by the User and is not subject to copyright protection on the Licensor's side.
Licensee Data is not used to train models — neither by the Licensor nor by a subcontractor providing artificial intelligence services.

§ 10. Confidentiality

Confidential Information means any information obtained by one party from the other in connection with this Agreement, irrespective of its form and the manner of its transmission, in particular:
1. on the Licensee's side — Licensee Data, information about its safeguards, vulnerabilities, incidents, audit results and risk assessments;
2. on the Licensor's side — the Content Library, technical documentation, information about the architecture and safeguards of the Platform, information about identified vulnerabilities, and individually agreed commercial terms.
Each party undertakes not to disclose Confidential Information to third parties and to use it solely for the purpose of performing this Agreement. A party may make Confidential Information available solely to those of its employees, contractors and subcontractors who need it in order to perform this Agreement, binding them to confidentiality to the same extent.
The confidentiality obligation does not cover information which:
1. is publicly available without a breach of this Agreement;
2. was known to the party before it was received, which that party is able to demonstrate;
3. was obtained from a third party entitled to disclose it;
4. was developed independently, without the use of the other party's Confidential Information;
5. the disclosure of which is required by a mandatory provision of law or by a decision of a competent authority.
In the case described in paragraph 3(5), the disclosing party notifies the other party before disclosure, unless the law prohibits this, and limits the disclosure to the extent required by the provision or the decision.
The parties treat information about vulnerabilities and security incidents concerning the Platform with particular care. Section 7(6) also applies to the disclosure of such information.
The confidentiality obligation binds for the term of this Agreement and for three years after its end. In respect of information constituting a trade secret within the meaning of Article 11(2) of the Act on Combating Unfair Competition, the obligation lasts for as long as the information retains that character.
After the end of this Agreement, each party, at the request of the other party, deletes or returns the Confidential Information in its possession, with the exception of copies whose retention is required by law and of copies contained in backups until they are overwritten in the ordinary course. The deletion of Licensee Data is subject to the Data Processing Agreement.
The Licensor may name the Licensee as a reference, indicating solely its name and trade mark, only after obtaining prior consent expressed in documentary form. Consent may be withdrawn at any time with effect for the future.
The Consultant's obligations towards the Consultant's Clients arise from the agreements concluded between them and are not the subject of this Agreement.

§ 11. Infringement of third-party rights and mutual indemnity

Indemnity by the Licensor. If a third party raises a claim against the Licensee based on an assertion that use of the Platform or of the Content Library in accordance with this Agreement infringes that third party's copyright, database rights, trade mark rights or a patent, the Licensor shall:
1. take over the conduct of the case at its own cost, if the Licensee enables it to do so;
2. cover the reasonable costs of the defence and the amounts finally awarded against the Licensee or agreed in a settlement concluded with the Licensor's consent.
The indemnity described in paragraph 1 is available on condition that the Licensee:
1. notifies the Licensor of the claim promptly, and no later than within seven days of the day on which it became aware of it, in a manner enabling a defence to be mounted;
2. does not acknowledge the claim or conclude a settlement without the Licensor's prior consent expressed in documentary form;
3. cooperates in the defence, including by providing the documents and information in its possession;
4. leaves the conduct of the defence and the decision as to how the case is to be concluded to the Licensor, save that the Licensor shall not, without the Licensee's consent, conclude a settlement imposing on the Licensee any obligation other than to cease using the Platform.
Remedies. If the claim proves to be well founded or if it becomes likely that it will be upheld, the Licensor shall, at its own choice: obtain a right permitting the Licensee to continue using the Platform, modify the Platform so that it does not infringe the third party's rights while retaining its essential purpose, or terminate this Agreement and refund the fee for the unused part of the Billing Period.
Exclusions. The indemnity described in paragraph 1 does not cover claims arising from:
1. changes made to the Platform by the Licensee or at its instruction;
2. use of the Platform contrary to this Agreement or to its intended purpose;
3. Licensee Data and materials entered by the Licensee into the Platform;
4. Automatically Generated Content, in accordance with § 9(7);
5. the combination of the Platform with third-party software or data, where the claim would not have arisen without that combination;
6. use of the Platform after receiving from the Licensor a demand to cease using it on account of a third-party claim, in respect of damage arising after that demand.
The Licensor's liability under paragraph 1 is subject to the limitation described in § 14(4).
Indemnity by the Licensee. The Licensee indemnifies the Licensor against liability towards third parties and covers the reasonable costs of the defence and the amounts finally awarded, where the third-party claim arises from:
1. Licensee Data or materials entered by the Licensee into the Platform, including from a lack of rights to those materials;
2. the use on the Platform of designations, trade marks or materials to which the Licensee did not hold the rights, including in the course of marking materials with its own brand in accordance with § 4(8);
3. use of the Platform in breach of §§ 4, 5, 6, 7 or 8;
4. the acts and omissions of Consultant's Clients and of Users to whom the Licensee granted access.
The conditions described in paragraph 2 apply mutatis mutandis to the indemnity described in paragraph 6, with the roles of the parties reversed.
Protected Customer. The provisions of paragraphs 6 and 7 apply to a Licensee who is a Protected Customer solely to the extent consistent with mandatory provisions of law. A provision not individually agreed with such a Licensee which would shape that Licensee's obligations in a manner contrary to good practice, grossly infringing that Licensee's interests, is not binding on that Licensee in accordance with Article 385¹ of the Polish Civil Code (Kodeks cywilny), applied on the basis of Article 385⁵ of the Civil Code.

§ 12. Documents produced on the Platform and Licensee Data

Documents produced by the Licensee on the Platform — policies, procedures, registers, evidence and reports — may be freely used by the Licensee for the needs of its own organisation, including after the end of the Subscription, including by presenting them to auditors, certification bodies, counterparties and authorities.
The right described in paragraph 1 does not cover the transfer of the Content Library in unprocessed form, on the terms described in § 8(3)(3).
Licensee Data remains the property of the Licensee. The Licensor acquires no rights to it beyond the extent necessary to provide the Service and does not use it for its own purposes.
The rules on the processing of personal data contained in Licensee Data are set out in the Data Processing Agreement.
The Licensee may at any time download Licensee Data using the export functions made available on the Platform. The rules on access to data after the end of this Agreement are set out in the Terms and in the Data Processing Agreement.

§ 13. Comments and suggestions submitted by the Licensee

If the Licensee or a User submits to the Licensor comments, suggestions for improvements or bug reports, the Licensor may use them without remuneration and without territorial or time limitation, including by introducing them into the Platform.
The right described in paragraph 1 does not cover Licensee Data, the Licensee's documents or Confidential Information, even if these were submitted together with the report. From the report, the Licensor uses solely the description of the problem or of the idea.
The submission of a comment does not create on the Licensor's part any obligation to implement it or to respond within any particular time, beyond the time limits arising from the complaints procedure described in the Terms.

§ 14. Liability

The Licensor is liable for providing the Service with due professional care.
The assessment of compliance, decisions concerning risk and the content of the documentation are matters for the Licensee. Compliance indicators, readiness assessments, proposed risk treatments and Automatically Generated Content are of an auxiliary nature and do not constitute a statement that the Licensee meets the requirements of any standard or legal provision.
The Licensor is not liable for the outcome of any audit, inspection or certification proceedings conducted in relation to the Licensee, nor for administrative fines imposed on the Licensee, unless these resulted solely from a culpable breach of this Agreement by the Licensor.
In relation to a Licensee who is not a Protected Customer, the Licensor's total liability under this Agreement, including the liability described in § 11(1), is limited to the sum of the net fees paid in the twelve months preceding the event giving rise to the claim.
In relation to a Licensee who is not a Protected Customer, the Licensor is not liable for indirect damage, lost profits, loss of reputation or loss of anticipated savings. The Licensor is not liable for loss of data on the Licensee's side where the Licensee did not use the available export and copy functions.
The limitations described in paragraphs 4 and 5 do not apply in relation to a Protected Customer. In relation to a Protected Customer, the Licensor is liable on general principles and on the principles provided for in the provisions on consumer rights applied to that Customer on the basis of Article 7aa of the Polish Act of 30 May 2014 on Consumer Rights (ustawa o prawach konsumenta).
No provision of this Agreement excludes or limits liability for damage caused intentionally. A stipulation to the contrary would be invalid by operation of Article 473 § 2 of the Civil Code. Liability for gross negligence is likewise not excluded, nor is liability for personal injury, nor liability the exclusion of which is impermissible under mandatory provisions of law.
The limitations described in paragraphs 4 and 5 do not apply to the Licensor's claims for breach of the licence, in particular to the claims described in § 15.

§ 15. Breach of the licence and the applicable procedure

Demand. Where a breach of this Agreement is established, the Licensor calls upon the Licensee to cease the breach and to remedy its effects, setting a period of not less than fourteen days. The demand indicates what the breach consists in and what the Licensor requires.
Immediate suspension. The Licensor may suspend access without a prior demand solely where the breach:
1. threatens the security of other Licensees' data or the operational continuity of the Platform;
2. consists in mass extraction of the Content Library or in circumvention of safeguards as described in § 7(4);
3. consists in granting access to the Platform to unauthorised persons in a manner giving rise to a real risk to data.
The Licensor then notifies the Licensee of the suspension and of its reason promptly, and no later than on the following Business Day.
Termination. After the period set in the demand has expired without effect, the Licensor may suspend access or terminate this Agreement with immediate effect, retaining its claim for compensation for damage.
Access to data. Before access is suspended, the Licensee is given the opportunity to download Licensee Data, unless the breach threatens the security of other Licensees' data. In the latter case, the Licensor makes the data available by another means, once the threat has ceased.
The Licensor's claims. Irrespective of suspension and termination, the Licensor is entitled to:
1. a claim for the cessation of the breach and for the remedying of its effects;
2. a claim for payment of the fees for Organisations maintained without payment of the fee due, for the entire period of such use, according to the Price List in force during that period;
3. a claim for compensation for damage on general principles;
4. claims arising from the provisions on copyright, on the protection of databases and on combating unfair competition.
Deletion of copied materials. In the event of a breach of § 8, the Licensor may demand the deletion of all copies of the Content Library going beyond permitted use, together with a statement by the Licensee that they have been deleted, submitted in documentary form within fourteen days.
Statement on the manner of use. Upon a justified request of the Licensor, the Licensee submits a statement as to the number of Organisations maintained, the entities for which they are maintained, and the manner in which the Application Programming Interface is used. The request must indicate the circumstances justifying the suspicion of a breach. The Licensor is not entitled to audit the Licensee's IT systems.
Restoration of access. The Licensor restores access promptly after the breach and its effects have been remedied, and no later than within two Business Days of establishing that circumstance.
Challenging a suspension. The Licensee may challenge the merits of a suspension or termination under the complaints procedure described in the Terms. The lodging of a complaint does not stay the effects of the suspension, unless the Licensor decides otherwise.
In relation to a Protected Customer, the rights described in this section are exercised having regard to mandatory provisions on consumer protection.

§ 16. Duration of the licence and consequences of termination

The licence is in force for the duration of the Subscription or of the Trial Period and is renewed together with the renewal of the Subscription.
Upon the end of this Agreement, the right to use the Platform expires. The rights described in § 9(3) and in § 12(1) do not, however, expire.
After the end of this Agreement, the Licensee has 30 days to download Licensee Data and to submit a statement of its choice between the return of the data and its deletion. After that period has expired, the data is deleted on the terms described in § 11 of the Data Processing Agreement and in the document "Service Exit and Data Portability Rules", that is to say within fourteen days after the expiry of the download period.
The following continue to apply after the end of this Agreement: § 8 in respect of the prohibitions, § 9(2) to (5), § 10, § 11, § 12, § 13(1), § 14, and § 15(5) and (6).

§ 17. Final provisions

The governing law is Polish law. The choice of Polish law does not deprive a Protected Customer whose place of residence is in another Member State of the European Union of the protection resulting from mandatory provisions of the law of the country of that Customer's place of residence.
The resolution of disputes arising from this Agreement is subject to the rules described in the Terms, including the rules on out-of-court dispute resolution methods available to a Protected Customer.
Amendments to this Agreement are announced by the Licensor 30 days in advance, with notification to the Licensee by electronic mail to the Account Owner's address and by means of a notice on the Platform. The absence of an objection within that period means acceptance of the amendment. An objection entitles the Licensee to terminate this Agreement with a refund of the fee for the unused part of the Billing Period.
An amendment to this Agreement does not affect rights acquired before the day on which it enters into force, in particular the rights to documents produced on the Platform and to Automatically Generated Content.
The Licensee may not transfer the rights and obligations arising from this Agreement without the Licensor's prior consent expressed in documentary form. Such a transfer is subject to the rules described in the Terms, including the rules on legal succession.
If any provision of this Agreement proves to be invalid or ineffective, the remaining provisions remain in force. In place of the invalid provision, the applicable provision of law applies and, in the absence of such a provision, the provision closest to the intended economic purpose.
Acceptance of this Agreement is recorded together with the date, the document version and the identification of the person accepting it.
This Agreement is drawn up in the Polish language and made available free of charge in a form allowing it to be downloaded, reproduced and recorded, at https://guardiso.com/umowa-licencyjna. Where a translation into another language is made available, the Polish version prevails in the event of any discrepancy.

End User Licence Agreement