sygnadesk Terms of Service

DRAFT FOR LEGAL REVIEW. Before publication this document requires review by a legal counsel or attorney.

Operator: Jeton Cloud spółka z ograniczoną odpowiedzialnością spółka komandytowa, ul. Domaniewska 37/2.43, 02-672 Warsaw, Poland, KRS 0000850403, NIP 5213901362, REGON 386529721 (the "Operator"). Contact: hello@sygnadesk.com, service website: https://sygnadesk.com.

1. What the service is and who these terms apply to

1.1. sygnadesk is a platform made available over the Internet on a subscription basis (SaaS) for receiving and handling reports of breaches of law and other irregularities, including reports made under the Polish Act of 14 June 2024 on the protection of whistleblowers. The platform makes it possible, in particular, to run reporting channels in a domain designated by the Client, to communicate anonymously with the reporter, to keep a register of reports, and to track the deadlines arising from the applicable regulations.

1.2. The service is intended solely for businesses, organisational units and institutions. The Operator does not enter into contracts with consumers, and these terms are not intended for consumer transactions.

1.3. The Client is the entity that has concluded an agreement with the Operator for the use of the service (the "Client"). A User is a natural person using the platform on the Client's behalf under the Client's authorisation. The Client is responsible for the acts and omissions of its Users as for its own and makes them familiar with these terms.

1.4. Content on the Operator's websites, including feature descriptions and the price list, constitutes an invitation to enter into an agreement and not an offer within the meaning of the Polish Civil Code.

1.5. The current price list and description of plans are available at https://sygnadesk.com. An agreement concluded individually in written or documentary form takes precedence over these terms and the price list to the extent it regulates a given matter differently.

2. Conclusion of the agreement and the Client account

2.1. The agreement is concluded upon creation of the Client account and acceptance of these terms by a person authorised to represent the Client, and in the case of paid plans upon payment for the first billing period, whichever occurs later.

2.2. Creating an account requires providing true data identifying the Client (at least: name, address, tax identification number, email address) and the data of the person creating the account. The Operator may delete an account created with false or fictitious data.

2.3. The Operator may offer a free trial period on the terms described in the price list. The trial period does not oblige the Client to enter into a paid agreement. After the trial ends, if the Client does not pay for a subscription, the trial account expires and data entered during the trial is deleted after the period indicated in the expiry notice.

2.4. The person creating the Client account becomes its first administrator. The Client independently manages its Users' accounts and permissions in the panel, within the limits of the chosen plan. One User account is intended for one person; sharing an account between several people is prohibited.

3. End-to-end encryption and the Client's sole responsibility for keys

3.1. The platform offers an optional end-to-end encryption mode (the "E2E mode"). Once enabled by the Client's administrator, report content, attachments and correspondence with the reporter are encrypted with keys held solely by authorised persons on the Client's side.

3.2. In E2E mode the Operator does not hold, does not store and is unable to reconstruct any key, passphrase or recovery code enabling the content to be read. The Operator has no mechanism for emergency access, recovery or decryption of the content, including at the request of the Client, its legal successors or third parties.

3.3. The Client acknowledges and accepts that in E2E mode the loss of passphrases and recovery codes by all authorised persons on the Client's side means permanent and irreversible loss of access to the encrypted content. Responsibility for storing passphrases and recovery codes, and for maintaining at least two persons with working access, rests solely with the Client. The Operator is not liable for the consequences of losing keys, passphrases or recovery codes, including loss of access to report content.

3.4. Enabling and disabling E2E mode requires completing the confirmation procedure described in the platform, including submitting declarations of understanding of the consequences. These declarations are recorded and form an integral part of the agreement.

3.5. In standard mode (without E2E) content is encrypted with keys managed by the platform. The Operator applies organisational and technical measures restricting access to content to cases necessary to provide the service.

4. Scope and development of the service

4.1. The scope of features depends on the chosen plan and is described on the service website. The Operator continually develops the platform and may change, add and withdraw features, in particular to adapt to legal requirements, security requirements, technological change or to remedy defects. Updates do not require the Client's consent. Changes may not deprive the Client of material features of a paid plan during the paid period; in such a case section 12.4 applies.

4.2. Using the platform requires a device with Internet access and a current version of one of the commonly used browsers. Connection costs are borne by the Client. The Client takes care of the security of the devices its Users use, including system updates and antivirus protection.

4.3. The Client and Users protect sign-in credentials and do not disclose them to third parties. The Client notifies the Operator without delay of any suspected unauthorised access to the account.

5. Payments

5.1. The subscription is payable in advance for the billing period chosen by the Client (monthly or annual), according to the price list in force on the first day of that period. The subscription fee does not change during a paid period.

5.2. Invoices are issued and delivered exclusively electronically, to the email address indicated by the Client, to which the Client consents. The Client updates its invoicing details without delay after any change.

5.3. In the event of non-payment by the due date, the Operator may, after a prior email reminder, suspend access to the Client account until the arrears are settled. Suspension does not interrupt the availability of the reporting channel to reporters to the extent required by law, for the period indicated in the reminder.

5.4. If the arrears are not settled within the additional period indicated in the reminder, of no less than 14 days, the Operator may terminate the agreement and delete the Client account together with its data, after first allowing the Client to export its data in accordance with section 8.3. Fees paid before termination are not refundable.

5.5. An agreement concluded for a fixed term is extended for successive terms of the same length unless the Client opts out of the extension no later than the last day of the current term. The Client may opt out of the extension in the panel or by email. After the extension, the price list in force on the first day of the new term applies.

6. Partner module (MSP)

6.1. The Operator may make available a partner module enabling entities that provide services to their own clients (for example IT companies, law firms) to create and administer service instances for those clients.

6.2. The Partner is responsible for the accuracy of its clients' data, for settlements with them under the model it adopts, and for obtaining the required consents and authorisations from them. The terms of settlement between the Operator and the Partner, including discount tiers, are set out in the price list or a separate partner agreement.

6.3. The provisions of these terms concerning the Client apply accordingly to the Partner's end clients, provided that the Partner is responsible for the performance of the Client's obligations towards the Operator, unless the partner agreement provides otherwise.

7. Rules of use and restrictions

7.1. It is prohibited to use the platform contrary to its purpose or the law, in particular: to supply unlawful content (beyond the extent to which whistleblower protection law protects the content of reports), to send spam, to attempt to breach security, to introduce malicious software, to impersonate other entities, to make the service available to third parties beyond the scope of the plan, and to take actions that disrupt the platform or endanger other clients.

7.2. Attachments undergo automatic antivirus scanning. The Operator may reject or quarantine a file identified as malicious; this does not constitute a guarantee that every threat will be detected.

7.3. In the event of a material breach of these terms, the Operator may suspend the service after calling on the Client to cease the breach, and, where the breach poses a direct threat to the platform, other clients or third parties, also without prior notice, informing the Client without delay. Sections 5.3 and 5.4 apply accordingly.

8. Client data, backups and export

8.1. Data entered into the platform within the Client account remains the property of the Client or, as applicable, of the persons to whom it relates. The Operator acquires no rights to this data and uses it solely to provide the service.

8.2. The Operator makes regular encrypted backups of platform data, stored with an independent provider in the European Economic Area in a form protected against premature deletion. Backups serve to restore the service after a failure; in E2E mode backups contain only encrypted content, which the Operator is unable to read.

8.3. During the term of the agreement and within 30 days of its termination, the Client may request an export of its data in a commonly used format. After that period the Operator deletes the account data, subject to data whose longer retention is required by law and to backups, which expire in accordance with their retention cycle.

8.4. Deletion of the account by the Client in the panel results in deletion of data in accordance with the platform's notices and does not entitle the Client to a refund of fees for the period already begun.

9. Protection of personal data

9.1. With respect to the personal data of the Client and its Users, the Operator is the controller. With respect to personal data contained in reports and the data of persons to whom reports relate, the Client is the controller and the Operator acts as processor on the basis of a data processing agreement, which is a separate document available on the service website.

9.2. Details of data processing by the Operator, including the list of sub-processors, are set out in the privacy policy and the list of sub-processors on the service website.

9.3. The Operator informs the Client without delay of any request for disclosure of the Client's data addressed to the Operator by a competent authority, unless mandatory provisions of law prohibit this. In E2E mode the Operator does not hold report content and is unable to disclose it regardless of the basis of the request.

10. Service availability and maintenance

10.1. The Operator makes every effort to keep the service continuously available, but does not guarantee uninterrupted or error-free operation of the platform. The Operator may carry out maintenance work; it gives advance notice of planned work that may materially reduce availability on the service website or by email.

10.2. The Operator is not liable for unavailability or malfunction of the service resulting from causes beyond its control, including failures of telecommunications links, acts or omissions of third-party providers, misconfiguration or failure on the Client's side (including its domain or DNS), acts of third parties, and force majeure.

11. Operator's liability

11.1. The Operator is liable towards the Client solely for actual loss caused by wilful misconduct or gross negligence. The Operator's liability for lost profits is excluded.

11.2. The Operator's aggregate liability towards the Client on all grounds connected with the agreement is limited to the subscription fees paid by the Client for the 12 months preceding the event giving rise to the loss, or, if the agreement has lasted less than that, to the subscription fees actually paid.

11.3. The limitations in sections 11.1 and 11.2 do not apply to the extent that mandatory provisions of law do not permit liability to be limited.

11.4. The Operator is not liable for the content of reports, their accuracy, or the way the Client handles reports, including the Client's compliance with the deadlines and obligations imposed on it by whistleblower protection law. The platform supports the handling of those obligations, but the Client remains their addressee.

11.5. The Operator is not liable for the consequences of decisions taken by the Client on the basis of data from the platform, or for the acts and omissions of reporters and third parties.

12. Complaints and termination of the agreement

12.1. The Client submits complaints concerning the service to the Operator's email address indicated on the service website, describing the event and when it occurred, no later than 14 days after the event or after becoming aware of it.

12.2. The Operator considers the complaint and informs the Client of the outcome by email within 14 days of receiving a complete submission.

12.3. The Client may terminate an agreement concluded for an indefinite term with one month's notice, effective at the end of the billing period. An agreement for a fixed term expires at the end of the term for which it was concluded, subject to section 5.5.

12.4. If a change to the service, these terms or the price list is unfavourable to the Client, the Client may terminate the agreement within 14 days of being notified of the change, with effect from the day preceding the change taking effect. In that case the Operator refunds a proportionate part of the subscription fee for the period after termination.

13. Changes to the terms and the price list

13.1. The Operator may change these terms and the price list, in particular due to changes in law, technological or organisational changes, or changes to the scope of the service. The Operator notifies the Client of changes by email and by publishing the new text on the service website at least 14 days before the changes take effect.

13.2. A change to the price list does not affect the subscription fee for a billing period already paid. Section 5.5 applies to the extension of the agreement.

13.3. Failure to terminate the agreement under section 12.4 constitutes acceptance of the changes.

14. Final provisions

14.1. Copyright and other intellectual property rights in the platform, its code, interface and documentation belong to the Operator. The Client obtains only a non-exclusive, non-transferable right to use the service for the term of the agreement, within the limits of the chosen plan. The Client is not entitled to copy, decompile or make the platform available beyond the scope of the agreement.

14.2. Matters not regulated here are governed by Polish law. Disputes are resolved by the common court having jurisdiction over the Operator's registered seat.

14.3. These terms are available at https://sygnadesk.com in a form that allows them to be downloaded, saved and reproduced.

14.4. The invalidity or ineffectiveness of individual provisions does not affect the validity of the remaining provisions; an invalid provision is replaced by the rule closest to its purpose that is consistent with the law.

Warsaw, [date to be completed]