General Terms & Conditions

wflow.com Czech Republic s.r.o
Pobřežní 34

186 00 Praha 8

IČO: 072 12 241

Contact: 
gdpr@wflow.com
sales@wflow.com

The General Terms and Conditions are valid from 1 March 2025.

1. Terms of Service Provision

1.1. These Terms of Service (hereinafter referred to as the “Terms”) constitute an agreement between you (hereinafter referred to as “you” or “Customer”) and wflow.com Czech Republic s.r.o., ID No.: 072 12 241, with its registered office at Pobřežní 658/34, Karlín, 186 00 Prague 8, registered in the Commercial Register maintained by the Municipal Court in Prague, File No.: C 295488 (hereinafter referred to as “wflow” or “we”). wflow is an online platform that provides its users (“Customers”) with secure transmission and circulation of accounting documents as well as their reliable and secure archiving. To use our website wflow.com (hereinafter referred to as the “Website”) and all associated websites, including mobile websites and applications owned and operated by us, our predecessors, successors, or affiliated companies (collectively referred to as the “Platform”), and to use all services, applications, software, functionalities, and products accessible through the Platform that refer to this Agreement, whether provided by us or our affiliates (collectively referred to as “Services”), you must read, agree to, acknowledge, and accept these Terms. Your agreement with us also includes the Privacy Policy, available at http://wflow.com/en/privacy-policy, and the Cookie Policy, available under the Cookiebot icon in the left down corner of your screen.

1.2. By signing, otherwise confirming the Pricing Offer, or clicking the agreement button when presented with this option, you enter into a service usage agreement with wflow (hereinafter also referred to as the “Agreement”), which incorporates these Terms. By using our Services, you confirm that you have read, understood, and agree to these Terms. If you do not understand, do not accept, or do not agree with these Terms, you are not authorized to use the Services.

1.3. wflow reserves the right to modify, amend, add, or remove portions of these Terms at its sole discretion and within a reasonable scope, particularly in the event of changes in legislation or changes in contracts with its suppliers. Any modifications will be notified to you via email or a notification within the Platform. Changes take effect on the specified date, which will be at least 30 days from the notification date, and apply to all subsequent use of the Service.

1.4. If you do not agree with the changes, you may terminate the Agreement with effect upon the expiration of the notice period as defined in Articles 17.1 – 17.3, provided that your termination notice is delivered to wflow before the effective date of the change. If you terminate under this paragraph, the Terms in effect on the termination date shall apply during the notice period. Your continued use of the Services after the effective date of the changes constitutes your acceptance and agreement to these changes.

2. Customer Account

2.1. When creating an account, you must provide us with accurate information in good faith and agree to keep it updated in case of changes. By creating an account on behalf of a company, you guarantee that you have all the necessary authorizations to bind this company to these Terms (hereinafter referred to as the “Account”).

2.2. To create an Account, we will require the following information:

● Name;

● Company email address;

● Company name;

● Phone number;

● Password.

2.3. You are responsible for the security of your Account and for all activity on the Account while someone is logged in. If you suspect that your Account has been compromised, please contact us immediately at support@wflow.com.

3. Customers

3.1. You, as the Customer, or any end user to whom you grant access to your Account, are authorized to use the Services listed in the Pricing Offer (hereinafter referred to as “Users”).

3.2. When creating an Account, you will need to set up your login credentials. If we create an Account for you, we will send you an invitation, upon clicking which you will be prompted to create your login credentials.

3.3. You can update the list of Users by sending us an email at sales@wflow.com.

4. Account Deletion and Suspension

4.1. If you wish to permanently delete your Account, please contact us by email at support@wflow.com

4.2. We reserve the right to delete or suspend your Account at any time at our sole discretion.

4.3. These Terms remain in effect, even if you no longer have an Account with us.

5. Scope of Services

5.1. The services that wflow may provide to you include, among others, uploading accounting documents, data extraction, integration with other systems, invoice approval, and storage of these documents. The full scope of services is listed on our Website. The specific scope of Services that wflow will provide to you will be specified in the accepted Pricing Offer. Ordering additional Services is governed by the rules under Article 7.

5.2. wflow reserves the right to update, modify, or terminate certain features of the provided Services at its sole discretion. If wflow removes a feature without replacement, and such a change significantly affects the provided Services, we will attempt to notify you in advance if possible. In such a case, you may request the reinstatement of the functionality, and if your request is not granted within 1 month, you may terminate the Agreement with effect after the expiration of a 1-month notice period, which begins on the first day of the calendar month following the delivery of the written notice, provided that the termination notice is delivered to wflow within 1 month of the change.

5.3. wflow undertakes to provide the Customer with a hotline (help-desk) service from Monday to Friday from 9:00 AM to 5:00 PM, except on public holidays in the Czech Republic, at support@wflow.com or via the INTERCOM platform integrated into the Website.

5.4. The subscription period begins on the date specified in the Agreement, and if not specified, then on the date the Service is accepted by the Customer. The Customer is required to accept the implemented Service with or without reservations. Acceptance occurs as soon as one of the following situations arises:

5.4.1. Confirmation by the Customer that the Service is correctly implemented, or

5.4.2. The expiration of 3 business days from the completion of admin training (or if the Customer states that they are not interested in admin training, then the expiration of 3 business days from the notification of implementation completion, which wflow may send to the Customer by email), provided that the Customer does not raise any objections preventing the use of wflow during this period, or

5.4.3. The expiration of 10 business days from the acceptance of the Pricing Offer, regardless of whether admin training was conducted or whether the connector was integrated. The Customer is required to designate an administrator who will be trained and provide cooperation for the completion of the implementation. If the Customer fails to do so, training may still be conducted later, but the subscription service will begin, and the service will be considered implemented.

5.5. Any objections regarding the implementation of the Service must be submitted in writing by email to sales@wflow.com. If the Customer does not submit objections within the specified period and to the specified address, they accept the implementation of the Service without reservation and are obliged to start paying for the use of the Service.

6. Obligations Regarding User Content Under EU Regulation

6.1. You are responsible for all activities on your Account. You may use your Account in a manner that is reasonable, customary, and does not abuse the rights or legitimate interests of wflow or third parties. Among other things, you may not upload documents that are illegal or irrelevant (e.g., personal photographs) while using the Services, and it is prohibited to misuse API endpoints by sending unnecessary queries. The Account is linked to you and may not be used by, sold to, or transferred to another entity. Violation of this paragraph is considered a material breach of this Agreement.

6.2. If we detect content on your Account that violates these Terms, we may, at our discretion, remove such content or suspend your access to the Services and User Account for a reasonable period after issuing prior notice. Additionally, if a notifier (which may be you or another User, hereinafter the "Notifier") frequently submits clearly unfounded notifications, wflow may suspend processing such notifications after issuing prior notice. When making such decisions, wflow will consider the number of clearly unlawful content items or clearly unfounded notifications submitted within a specific period, their ratio to the total number of information or notifications, the severity of the misuse, the nature of the unlawful content, the consequences of such misuse, and the intent of the service recipient, person, entity, or complainant, if it can be inferred.

6.3. wflow accepts all notifications containing information about the presence of user content (such as photographs, videos, review texts) within the Platform that the Notifier (e.g., a User) considers unlawful. The Notifier may send a notification to wflow at support@wflow.com. wflow allows the notification to contain at least the following information:

6.3.1. A sufficiently substantiated explanation of the reasons why the notifier claims that the concerned content is unlawful.

6.3.2. A clear indication of the exact electronic location of the content, such as the precise URL, and, if necessary, additional information enabling the identification of unlawful content depending on its type.

6.3.3. The name or designation of the person submitting the notification and their email address, unless the notification pertains to content that the notifier believes constitutes a criminal offense as defined in Articles 3 to 7 of Directive 2011/93/EU.

6.3.4. A statement confirming that the individual or entity submitting the notification believes in good faith that the information and claims contained in the notification are accurate and complete.

6.4. If the notification includes electronic contact information of the notifier, wflow will send an acknowledgment of receipt without undue delay. It will also notify the notifier of its decision regarding the reported information and provide details on available remedies related to this decision. If wflow becomes aware of unlawful activities, illegal content, or content incompatible with the Terms, it may take measures to remove or disable access to it. wflow may also impose restrictions on the User, such as downgrading the ranking of the content in search results, suspending, terminating, or otherwise restricting monetary payments, suspending or terminating the provision of the Service to the User, or suspending or deleting the User Account. In such a case, wflow will provide all affected Users with a clear and specific justification for the imposed restriction. However, if the content is deemed compliant with legal regulations and the Terms, wflow may also decide not to take action against the content.

7. Order, Pricing Offer, and Pricing

7.1. Unless otherwise stated, prices listed on our website are illustrative and are not binding on wflow.

7.2. You can order Services by filling out a form, requesting a phone call on our Website, or by contacting us via email at sales@wflow.com (hereinafter referred to as the "Order"). After submitting the Order, we will send you a Pricing Offer ("Pricing Offer"), and upon request, a draft contract. The Pricing Offer will include the ordered Services and will be valid for a specified period. If you wish to accept the Pricing Offer, return it signed or confirm it within the specified timeframe. The accepted Pricing Offer forms part of the Agreement and is governed by these Terms.

7.3. The total price you are required to pay to wflow will depend on the total number of users, organizations, extracted documents, and additional services and integrations ordered for the given subscription period (the "Price").

7.4. If you wish to change the number of active users/organizations, you can do so in your account or by contacting us via email at support@wflow.com. The rules for changing users/organizations are specified in the current price list available at https://www.wflow.com/en/pricing, and these rules are binding.

7.5. The Customer acknowledges that during the term of the Agreement, they may expand the scope of the Service (e.g., increase the number of extracted documents or timestamps, purchase additional integrations, modules, automatic backups, API connections, etc.) directly in the Platform administration. In such cases, there is no need to sign an amendment to the Agreement or a new Pricing Offer. By expressing consent (e.g., clicking the "order" button in the Service administration), the Customer accepts the price of such an extension and agrees to pay it. Unless otherwise agreed, the price is determined by the price list valid at the time of ordering.

7.6. All prices are stated excluding VAT, and VAT will always be added to the Price in accordance with applicable legal regulations.

7.7. wflow may, at its discretion, change prices, introduce new fees, or increase prices. Any changes will be notified to you via email or a notification in the Platform and will take effect at the beginning of the next subscription period. Clause 1.4 of the Terms shall apply accordingly, meaning that any termination must be delivered to wflow before the start date of the next subscription period. The exception is situations where you increase the number of users or other metrics; in such cases, the new prices apply to all users and other metrics purchased after the price change notification from the moment of purchase, not from the next subscription period.

7.8. In addition to the previous provisions, the Price is automatically increased annually on March 1st or another date designated by wflow by the inflation rate expressed as the increase in the average annual consumer price index for the previous calendar year, as announced by the Czech Statistical Office. If the Czech Statistical Office ceases to announce this figure, a substitute or the closest comparable figure will be used. The increase will be rounded up to the nearest ten crowns. The increase will only apply if the inflation rate exceeds 5% since the last price increase under this clause.

8. Payments

8.1. The price may include a certain number of extracted documents / timestamps / organizations / users / storage space / other units for the subscription period. You are required to pay for the subscription even if you do not use all the units. In such a case, unused units expire without compensation. In the event of contract termination, no refund will be issued for unused units.

8.2. If you exceed the agreed number of units in any period, you will be charged an overuse fee. Overuse fees are payable together with the next invoice; however, wflow may invoice them separately at any time.

8.3. The Agreement includes provisions regarding the selected subscription period. Unless expressly agreed otherwise, the subscription is payable in advance based on an invoice issued before the commencement or at the beginning of each subscription period for the Services provided during that period.

8.4. If you are late with the payment of any outstanding amount, wflow may charge you a contractual late payment penalty of 0.05% of the outstanding amount for each day of delay.

9. Security

9.1. wflow declares that it takes measures to ensure the security of the platform. These measures include encryption, regular monitoring, penetration testing, and compliance with ISO certifications (e.g., ISO 27001, 27007). Data security is implemented at the Platform level using standard attack protection (e.g., communication with the server is encrypted with an SSL security certificate, login to the application is performed via OAuth 2.0 protocol, data on servers is encrypted using a 256-bit AES algorithm). The Platform is hosted by a leading B2B infrastructure services provider, and necessary measures are taken to minimize the risk of any security or data integrity breach.

9.2. Each Customer is responsible for all data uploaded to wflow, including its protection against malicious software (e.g., viruses) and how they handle this data after downloading it from the platform. The Customer is fully responsible for the content uploaded to the wflow platform, both for its legality and for compliance with safe data handling practices. For example, the Customer is required to perform regular antivirus scans, protect their login credentials, and avoid opening suspicious files and attachments. In case of a security incident, the Customer must cooperate with wflow to resolve the issue.

9.3. wflow is not responsible for content (e.g., files or links) uploaded by users or third parties to the wflow platform. The wflow platform is designed and operated in compliance with ISO standards, particularly regarding infrastructure security. Despite all security measures, responsibility for the content remains solely with the Customer. wflow is not responsible for any damages arising from any breach of the Customer's data security or integrity.

9.4. Since the Platform is a cloud-based tool designed, among other things, for data processing, wflow may act as a data processor for the Customer when fulfilling the Agreement, processing personal data of third parties that the Customer has uploaded or collected via the Platform (“Personal Data”). This processing is governed by the data processing agreement, which forms Appendix No. 1 of these Terms and thus becomes an integral part of the Agreement. You are responsible for ensuring that you are authorized to provide all your data to wflow and that their use and processing to provide the Services do not violate third-party rights, including intellectual property rights, privacy rights, or legal obligations. You must inform individuals whose personal or other data you provide to wflow for the purpose of Service provision of such data transfer or obtain their consent if necessary.

10. Intellectual Property

10.1. wflow has invested significant effort and resources into developing its intellectual property, including but not limited to the Platform, Services, and any additional software, features, functionalities, designs, copyrighted works of any kind, information, or other materials made available to you (“Intellectual Property”). wflow grants you the right to use the Platform “as is” on a non-exclusive basis, with no other warranties beyond those specified in these Terms, for the duration of the Services. You acknowledge and agree that all Intellectual Property remains the exclusive property of wflow and its suppliers and that you do not acquire any rights other than those expressly granted to you by these Terms unless wflow provides prior written consent. wflow reserves the right to revoke Customer access to any Intellectual Property after the termination of the Services.

10.2. You also agree that you will not attempt to reverse engineer or otherwise access the source code of any Intellectual Property. Regardless of this restriction, you may not circumvent technical protections or other limitations associated with the Platform or Services, except where such actions are expressly permitted by applicable laws. You may not use Intellectual Property to create any software similar to the Services. You may not bypass any technological security measures within the Services and/or Platform or their related security features, nor may you enable unauthorized third-party applications to access the Services.

10.3. If you provide feedback regarding the Services, such as suggestions for improvements or new features, such feedback will not be considered confidential or protected, and the implementation of such feedback becomes the property of wflow and may become part of our Intellectual Property without any compensation to you.

10.4. Each party to this Agreement has the right to use the other party’s logo and name on their website and in marketing materials, granting the other party a revocable license to this extent.

11. Confidential Information

11.1. wflow and the Customer agree that all financial, business, and technical information (e.g., business and marketing plans and strategies, business relationships, supplier and customer information, source codes, and trade secrets), including any information disclosed by wflow or the Customer or on their behalf in connection with the provision of Services, which should reasonably be considered confidential and sensitive, constitutes "Confidential Information" of each party. wflow's Confidential Information includes the pricing terms of the Agreement. Confidential Information does not include data related to the use of the Service, including statistical and performance data related to the operation of the Service, which we use in anonymized form. By entering into the Agreement or at the moment such data is created, you assign to us the rights related to the data mentioned in the previous sentence.

11.2. wflow and the Customer declare and guarantee that they will keep Confidential Information secret, take all reasonable measures to prevent unauthorized access to it, and will not disclose or use it except for fulfilling their obligations and exercising their rights under this Agreement.

11.3. The above obligations do not apply to Confidential Information that is (a) demonstrably already known to the recipient without any restrictions; (b) demonstrably and lawfully provided to the recipient by a third party without any restrictions; (c) publicly available without violating these Terms; (d) independently developed by the recipient without reference to or use of the disclosing party’s Confidential Information; or (e) used or disclosed with the explicit consent of the disclosing party.

11.4. If the recipient is required to disclose Confidential Information under judicial or administrative proceedings or orders, they must provide sufficient notice to the other party as soon as possible before any such disclosure and provide reasonable assistance to challenge or appeal such requests or orders if desired.

11.5. The obligations under this Article remain in force even after the termination of this Agreement for a period of three (3) years.

12. Third-Party Services

12.1. To log into your user account and use certain additional features, you may grant wflow access to your third-party accounts, such as Google. You may revoke wflow’s access to these accounts at any time via the security settings page of the respective third-party provider.

12.2. To the extent that any third-party services, tools, or content (hereinafter referred to as "Third Parties") are accessible via the Platform, the terms and conditions of such Third Parties apply, and by using the Platform, you expressly acknowledge and agree to their terms. For example, applications such as Rossum, Dativery, Signi, or Prismatic are integrated into the Platform, and their terms of use can be found at:

• Rossum: https://drive.google.com/file/d/1Lr4WbcK216CGk_r9mjyNLWkSVV42udbM/view

• Dativery: https://www.dativery.com/cs/spolecnost/terms/

• Signi: https://signi.com/

• Prismatic: https://prismatic.io/legal/terms/.

Other Third Parties are listed on the Website.

12.3. If you use a feature from the "Corporate Expense Management" product category, you acknowledge that this service includes integration with products of Česká spořitelna ("ČS"). You acknowledge that all banking and payment services are provided solely by ČS based on a separate agreement entered into with you, which is governed by the terms available at https://www.csas.cz/cs/dokumenty-ke-stazeni#/954/Firemni-a-korporatni-klientela. To avoid any doubt, it is stated that:

12.3.1. wflow is not a provider of payment services or other banking products; any payment services, including the management of payment cards, are established and managed solely by ČS under its terms.

12.3.2. All responsibility for banking and card services lies with ČS (if the Customer uses them). The Customer acknowledges that to the extent they use ČS services (e.g., issuing payment cards to an account), their relationship with ČS is governed exclusively by ČS’s terms. wflow is not responsible for any damages, losses, or lost profits associated with ČS products.

12.3.3. The Customer is required to familiarize themselves with ČS’s general terms and conditions, which must be accepted to use payment cards or other banking products of ČS.

12.4. wflow has no control over the operation of Third Parties. Therefore, you acknowledge and agree that wflow is not liable for damages caused by using or relying on content or services provided by Third Parties. If an issue arises with a Third Party, you may exercise any rights arising from the Third Party’s terms and conditions.

13. Limitation of Liability

13.1. wflow is not liable for lost profits caused by outages or other issues related to the Services. The total liability of wflow arising from or related to this Agreement is limited to an amount equal to the Price you have paid for the use of the Services during the four (4) months immediately preceding the date of the event that gave rise to the claim, but not exceeding CZK 50,000. The existence of more than one claim does not increase this limit. You expressly waive any right to compensation exceeding this amount.

13.2. To avoid any doubt, we are not responsible for the legal archiving of data, and we strongly recommend that you regularly back up all Data contained in your Account.

13.3. For the purposes of this article, the terms "we" and "our" (and other uses of the first-person plural) are defined to include our subsidiaries, affiliates, officers, directors, employees, agents, consultants, and third-party service providers.

14. Disclaimer

14.1. We reserve the right to make changes and update all information contained on our Platform without prior notice. We strive to provide the most accurate description of each Service offered on the Platform. However, we do not guarantee that the specifications of the Services, Prices, or any other content provided on our Platform are complete, accurate, reliable, current, or error-free, and we disclaim any liability to the maximum extent permitted by law.

14.2. Unless explicitly agreed otherwise, the Platform and the Services offered on it are provided "as is" and "as available" without any warranties. Any warranty of merchantability, fitness for a particular purpose, non-infringement, or any other warranty is excluded to the maximum extent permitted by applicable law. If we agree to provide a warranty for the Services, such a warranty does not apply to problems arising from or related to events beyond the control of wflow.

14.3. The disclaimer under this article also applies to our subsidiaries, affiliates, and third-party service providers.

15. Indemnification

15.1. To the extent permitted by applicable law, you agree to indemnify us against all losses and liabilities, including legal fees, arising from these Terms or related to your use of our Services and/or Platform. We accept this indemnification promise. We reserve the exclusive right to control the enforcement and defense of any claims covered by this article. If we choose to exercise this right, you agree to provide us with all necessary cooperation.

15.2. Your obligation to indemnify us under this article also extends to our subsidiaries, affiliates, officers, directors, employees, other representatives, and third-party service providers.

16. Doručování

16.1. Oznámení nebo jiné sdělení se považuje za řádně učiněné a účinné, pokud:

16.1.1. bylo odesláno na e-mailovou adresu druhé strany, souhlasíte s tím, že vám můžeme zasílat oznámení na e-mailovou adresu zadanou při vytváření Uživatelského účtu, pro zasílání newsletteru, nebo jinou e-mailovou adresu, prostřednictvím které s námi komunikujete; nebo

16.1.2. druhá strana doručení zmařila nebo odmítla.

16.2. Pokud lze za den doručení podle výše uvedených pravidel považovat více než jeden den, je dnem účinného doručení ten den, který nastane dříve.

17. Term and Termination of the Agreement

17.1. The subscription period automatically renews for another subscription period of the same length, repeatedly. Renewal will not occur if either party notifies the other in writing (including by email) of their intention to terminate the Agreement. For annual and multi-year subscriptions, the termination notice must be delivered at least 1 month before the end of the subscription period, otherwise, the Agreement will be extended. For monthly subscriptions, the notice can be delivered at any time, and the subscription will be terminated in accordance with the notice period under clause 17.3, but not before the expiration of the minimum usage period of the Service.

17.2. The minimum usage period of the Service is 12 (twelve) months from the start of the subscription. Due to the initial investment associated with implementation, a shorter period cannot be offered. Therefore, you agree that the Agreement cannot be terminated before this period expires; if you submit a termination notice or request to cancel the renewal of the subscription during this period, the Agreement will end only after the minimum usage period has elapsed. Throughout this period, you are required to pay the Price to wflow, and wflow is obligated to provide you with the Services.

17.3. After the minimum usage period expires, you may terminate the subscription. The notice period is 3 months for monthly subscriptions and begins on the first day of the calendar month following the delivery of a written termination notice. Annual and multi-year subscriptions may be terminated in accordance with clause 17.1.

17.4. Either party may also terminate the Agreement if the other party materially breaches the Agreement and is unable to remedy such a breach or, if capable of remedy, fails to do so within 30 days of receiving written notice of such a breach.

17.5. In addition to other cases provided by the Agreement or legal regulations, wflow may suspend access to the Service for you or any User with immediate effect, without incurring any obligations or liabilities, if:

17.5.1. wflow receives a court order or public authority directive requiring such action, or if wflow determines that a new or amended law, rule, regulation, interpretation, or decision makes the performance of any part of the Agreement unlawful or otherwise illegal;

17.5.2. you fail to comply with the Agreement, violate legal regulations, use the Service beyond the granted rights or for purposes not permitted by the Agreement, or engage in fraudulent or illegal activities;

17.5.3. you enter into bankruptcy or impending insolvency under applicable laws, file a bankruptcy petition against yourself, or enter liquidation;

17.5.4. you fail to pay any amount due to wflow within the due date and do not remedy the situation within 5 days of being requested to do so.

17.6. The termination of the Agreement does not extinguish the obligations and claims of the parties that, according to the Agreement and applicable laws, survive the termination. For clarity, this includes intellectual property rights, confidentiality and data protection obligations, monetary claims, and damage compensation claims. If you terminate the Agreement under clause 5.2 or 17.4, you will be released from the obligation to pay the subscription fees for the period after the effective date of such termination. In all other cases, all prices and other fees that would have become due if the Agreement had remained in effect until the end of the current billing period become immediately due, and you must pay them along with all previously incurred but unpaid amounts upon receipt of an invoice.

17.7. After the termination of the Agreement, wflow will offer the Customer the option for long-term data archiving and/or a one-time data backup according to the current price list, in a commonly used database format. If the Customer does not pay for archiving after the Agreement ends, wflow may delete all Customer data.

17.8. Customers who ordered the Service before the effective date of this version of the general terms and conditions may terminate the Service under the previous version of the general terms and conditions. The provisions of this article regarding the minimum usage period of the Service apply only to Service orders placed from the effective date of this version of the general terms and conditions.

18. Dispute Resolution and Governing Law

18.1. These Terms are governed by and interpreted in accordance with the laws of the Czech Republic. The application of conflict of law rules is excluded.

18.2. The parties will primarily seek an amicable resolution of any disputes arising from these Terms. If a dispute cannot be resolved amicably, it will be subject to the exclusive jurisdiction of the competent courts of the Czech Republic.

19. Miscellaneous

19.1. These Terms and policies constitute the entire agreement between you and us and supersede all prior contractual relationships. In the event of a conflict between the provisions of the Agreement, including its annexes (excluding these Terms), on one hand, and the text of these Terms on the other, the provisions of the Agreement, including its annexes (excluding these Terms), shall prevail.

19.2. If any provision of the Agreement becomes or is deemed illegal, invalid, or unenforceable in any respect under the laws of any jurisdiction, it will not affect the legality, validity, or enforceability of any other provision of this Agreement in that jurisdiction. If any invalid, unenforceable, or illegal provision would be valid, enforceable, or legal if a part of it were removed, that provision shall apply with the minimum modifications necessary to make it legal, valid, and enforceable.

19.3. No delay, act, or omission by either party in exercising any right or remedy shall be deemed a waiver of that or any other right or remedy.

19.4. Without prior written consent from the other party, no party may assign the Agreement to a third party. However, wflow may assign the Agreement as a whole to its affiliated entity without your prior consent (e.g., in the case of a reorganization or acquisition).

19.5. The headings of articles and sections do not affect the interpretation of the Agreement.

APPENDIX NO. 1 TO THE TERMS AND CONDITIONS

TERMS OF PERSONAL DATA PROCESSING

1. Introductory Provisions

1.1. his agreement is concluded under Article 28(3) of Regulation (EU) 2016/679 of the European Parliament and the Council, the General Data Protection Regulation ("GDPR"), as part of the Agreement between wflow and the Customer, which is governed by the Terms ("DPA"). All terms used in the Terms or the Agreement have the same meaning for the purposes of this DPA unless otherwise stated in this DPA. The DPA concerns the processing of personal data for which the Customer acts as the data controller (or another processor), and wflow processes personal data for the Customer as a processor (or another processor).

1.2. If this DPA specifies that a particular action must be performed in writing, this includes email or written instructions via the Account in the Platform.

2. Subject of Processing, Categories of Data Subjects, and Types of Personal Data

2.1. In connection with the performance of the Agreement, personal data will also be processed as described in this DPA, specifically personal data related to digital accounting management. The Customer may, when using the Services, create an Account for Users, store documents in the Platform, and perform other actions that involve processing activities by wflow. The following categories of personal data may be processed:

2.1.1. Identification data;

2.1.2. Contact details;

2.1.3. Data regarding the relationship with a Third Party;

2.1.4. Data contained in documents uploaded by the Customer or User to the Platform;

2.1.5. Data contained in the Account;

2.1.6. Payment information, transaction overviews, and related details and documents when using the "Corporate Expenses" add-on;

2.1.7. Information accessed by wflow through the HelpDesk;

2.1.8. Other information provided by the Customer or a specific User to wflow in connection with the provision of Services.

2.2. The data subjects whose personal data will be processed as specified above include:

2.2.1. Users of the Service;

2.2.2. Entities whose Personal Data is contained in documents uploaded by the Customer to the Platform;

2.2.3. Contact persons of the Customer in connection with support services.

3. Nature and Purpose of Processing

3.1. wflow will process personal data electronically, automatically (and partially manually), and possibly using third-party tools listed below as additional processors. The scope of activities wflow will carry out with personal data corresponds to the scope of the Services. Specifically, the following activities will be performed:

3.1.1. Collecting personal data;

3.1.2. Modifying, altering, and structuring personal data;

3.1.3. Organizing personal data;

3.1.4. Storing and archiving personal data;

3.1.5. Searching, sorting, and making personal data accessible;

3.1.6. Using personal data;

3.1.7. Deleting personal data;

3.1.8. Viewing personal data in connection with providing support services.

3.2. The purpose of processing is:

3.2.1. Processing and archiving accounting documents for the Customer;

3.2.2. Managing user Accounts and their permissions;

3.2.3. Logging access/changes made by Account Users;

3.2.4. Extracting data from documents uploaded by Customers to the Platform;

3.2.5. Performing other activities related to the provision of Services and fulfilling obligations under the Agreement.

3.3. If the Customer orders the separately paid "Corporate Expenses" add-on, the Customer authorizes wflow to transfer the Customer’s personal data, including identification data, contact details, and other data (such as transaction volumes, offers, etc.), to Česká spořitelna, a.s., ID No.: 45244782, with its registered office at Olbrachtova 1929/62, 140 00 Prague 4 ("ČS"), which acts as an independent controller of the personal data provided by the Customer. wflow declares that in using this paid add-on, it will obtain information from ČS as specified in section 2.1.6 of this DPA, and wflow will process this data as a personal data processor based on the instructions provided for using the "Corporate Expenses" add-on. The purpose of the processing is to ensure transaction recording, provide notifications, and maintain a transparent overview of the Customer’s expenses.

4. Duration and Termination of Processing

4.1. wflow will process personal data for the duration of the Agreement or as long as necessary to execute a specific instruction from the Customer or perform an action related to the provided Service unless the Customer, as the data controller, removes the personal data earlier.

4.2. Upon termination of cooperation and the DPA, regardless of the manner and reason for its termination, wflow will delete all personal data processed under the DPA (from all devices and storage media except those owned by the Customer or a Third Party), unless the retention of such data is required by European Union or Czech Republic law. The Customer may also opt for additional paid services for exporting and transferring personal data from the Platform. If wflow is required to return personal data after processing ends, the data will be returned within a timeframe and in a format specified by wflow.

5. Additional Obligations

5.1. The Customer, as the data controller, agrees to maintain a valid legal basis for the processing of personal data within the Platform at all times and to fulfill all legal obligations towards data subjects, particularly the duty to inform. The Customer also agrees to promptly remove any personal data from the Platform that does not have a valid legal basis for processing.

5.2. Personal data will not be transferred to countries outside the EU, i.e., third countries.

5.3. wflow agrees to comply with the obligations under Article 28 of the GDPR as follows:

5.3.1. Process personal data strictly based on documented instructions from the Customer arising from the DPA or the Agreement; to eliminate any doubt, processing personal data in accordance with the provision of Services is considered to be in compliance with documented instructions; a written instruction also includes an instruction issued via the Account by a User; to avoid any ambiguity, every User is authorized to issue instructions on behalf of the Customer, and wflow will not verify the User’s authorization to act on behalf of the Customer.

5.3.2. Inform the Customer if it believes that the Customer's instructions violate legal regulations; to avoid any doubt, the Customer expressly confirms that the provision of Services defined in this DPA cannot compromise the security, confidentiality, and protection of personal data.

5.3.3. Follow the Customer’s instructions regarding the transfer of personal data to a third country or an international organization unless such processing is required by European Union or Member State law applicable to wflow; in such a case, wflow will inform the Customer of this legal requirement before processing.

5.3.4. Ensure that persons authorized to process personal data have committed to confidentiality or are subject to a statutory confidentiality obligation; this duty of confidentiality continues even after the termination of the DPA.

5.3.5. Assist the Customer through cooperation and appropriate technical and organizational measures to fulfill its obligation to respond to data subject rights requests, no later than 14 days from the date the Customer submits such a request via email.

5.3.6. Assist the Customer, no later than 14 days from the date the Customer submits such a request via email, in ensuring compliance with obligations including (i) securing the level of processing security, (ii) reporting personal data breaches to the Data Protection Authority and, where applicable, to data subjects, (iii) conducting data protection impact assessments, and (iv) performing prior consultations with the Data Protection Authority. However, wflow will always comply with the Customer’s requests only to the extent of the information it has available.

5.4. In compliance with the GDPR, wflow must allow the Customer to conduct audits (including inspections and examinations) and provide all necessary information to demonstrate compliance with the obligations outlined in Article 28 of the GDPR, for the purpose of verifying adherence to this DPA and related obligations. Any audit request may be sent by the Customer to support@wflow.com, and wflow and the Customer will electronically agree on the conditions of the audit, particularly security measures and methods for ensuring confidentiality obligations during the inspection. If no agreement is reached within 30 days of the audit request, wflow will determine the audit conditions.

5.5. The Customer, as the data controller, grants wflow general authorization to modify the engagement of sub-processors. If the Customer acts as another processor, they confirm that they have obtained permission from the data controller to engage wflow as another processor. wflow will notify the Customer at least thirty (30) days before adding or replacing a sub-processor. The Customer may object to changes involving sub-processors involved in processing within ten (10) calendar days of such notification. In such a case, wflow and the Customer will work in good faith to resolve the reasons for the objection. If wflow determines the objections are valid, it will refrain from engaging the sub-processor for processing or may choose not to provide a specific type of Service or terminate the contractual relationship with the Customer concerning the relevant processing.

5.6. The processing of Personal Data involves additional processors engaged by wflow under a contractual relationship, provided you choose to use them. The additional processors include:

Additional Processor Type of Activity Provided by the Additional Processor Additional Information

Microsoft Azure Platform operation and storage of personal data Data centers located in Ireland and the Netherlands.

Rossum Ltd Part of the Service integrated into the Platform Company based in a country with adequate protection under Article 45 of the GDPR.

Intercom, Inc. Platform for gathering information via helpdesk Company registered under the Data Privacy Framework.

Signi.com Electronic document signing

5.7. Any additional processor involved in processing carried out by wflow is contractually bound by the same obligations as set out in this DPA.

5.8. wflow is not liable for any damage caused in connection with the processing of personal data, including damage resulting from a breach of obligations under this DPA. Damage includes those arising from extraordinary, unforeseen, and insurmountable obstacles and circumstances beyond the control of wflow or individuals authorized to act on behalf of wflow. If wflow is liable for any damage, the total compensation shall be limited to the same extent as provided in the Terms. The total liability of wflow arising from the DPA, the Agreement, or related matters, whether based on the DPA, the Agreement, tort, or otherwise, shall in no case exceed the Price paid by the Customer to wflow for using the Platform and/or Services in the four months immediately preceding the date of the event leading to the claim and shall not exceed CZK 50,000. The limitation of liability under the DPA and the Agreement does not combine (i.e., the maximum claimable amount remains CZK 50,000 regardless of the nature of the damage).

5.9. wflow is entitled to charge the Customer reasonable costs incurred in handling any request and fulfilling any obligation under this DPA at an hourly rate of CZK 2,000.

6. Technical and Organizational Measures

6.1. wflow commits to implementing and maintaining technical and organizational measures in connection with processing, at a minimum as follows:

● Secure data center certified with ISO 27001 located within the EU, with logical (firewall, passwords, roles, and permissions) and physical access control measures (doors, locks, reception/security staff, electronic security, CCTV surveillance);

● Encryption of transmitted Customer data;

● Strong password policy within the Platform and password encryption;

● Confidentiality obligations for all wflow employees with access to personal data;

● Execution of data processing agreements in compliance with Article 28 of the GDPR with all processors;

● Internal data protection policies, including an access control system for personal data;

● Regular automatic backups;

● Periodic review of security policies;

● Other measures listed in Article 9 of the Agreement.

6.2. If wflow detects a breach of personal data security, it will notify the Customer in writing without undue delay, but no later than 72 hours after becoming aware of the breach, providing all available information. To eliminate any doubts, wflow will make reasonable efforts to provide information under Article 33(3) of the GDPR but is not required to provide all details under this article if the information is not available to it.

‍

‍