Terms and Conditions

The General Terms and Conditions are valid from 22/06/2026.

TERMS OF SERVICE

Terms of Service Provision

1.1 These Terms of Service (hereinafter referred to as the "Terms") constitute an agreement between you (hereinafter referred to as "you" or "Customer") and wflow.com Czech Republic s.r.o., ID No.: 072 12 241, with its registered office at Pobřežní 658/34, Karlín, 186 00 Prague 8, registered in the Commercial Register maintained by the Municipal Court in Prague, File No.: C 295488 (hereinafter referred to as "wflow" or "we"). wflow is an online platform that provides its users with secure transmission and circulation of accounting documents as well as their reliable and secure archiving. To use our website wflow.com (hereinafter referred to as the "Website") and all associated websites, including mobile websites and applications owned and operated by us, our predecessors, successors, or affiliated companies (collectively referred to as the "Platform"), and to use all services, applications, software, functionalities, and products accessible through the Platform that refer to this Agreement, whether provided by us or our affiliates (collectively referred to as "Services"), you must read, agree to, acknowledge, and accept these Terms. Your agreement with us also includes the Privacy Policy, available at http://wflow.com/en/privacy-policy, and the Cookie Policy, available at www.wflow.com/cookies.

‍

1.2 By signing, otherwise confirming the Pricing Offer, or clicking the agreement button when presented with this option, you enter into a service usage agreement with wflow (hereinafter also referred to as the "Agreement"), which incorporates these Terms. By using our Services, you confirm that you have read, understood, and agree to these Terms. If you do not understand, do not accept, or do not agree with these Terms, you are not authorized to use the Services.

‍

1.3 wflow reserves the right to modify, amend, add, or remove portions of these Terms at its sole discretion and within a reasonable scope, particularly in the event of changes in legislation or changes in contracts with its suppliers. Any modifications will be notified to you via email or a notification within the Platform. Changes take effect on the specified date, which will be at least 30 days from the notification date, and apply to all subsequent use of the Service.

‍

1.4 If you do not agree with the changes, you may terminate the Agreement with effect upon the expiration of the notice period as defined in Articles 17.1 – 17.3, provided that your termination notice is delivered to wflow before the effective date of the change. If you terminate under this paragraph, the Terms in effect on the termination date shall apply during the notice period. Your continued use of the Services after the effective date of the changes constitutes your acceptance and agreement to these changes.

2. Customer Account

2.1 When creating an account, you must provide us with accurate information in good faith and agree to keep it updated in case of changes. By creating an account on behalf of a company, you guarantee that you have all the necessary authorizations to bind this company to these Terms (hereinafter referred to as the "Account").

‍

2.2 To create an Account, we will require the following information: Name; Company email address; Company name; Phone number; Password.

‍

2.3 You are responsible for the security of your Account and for all activity on the Account while someone is logged in. If you suspect that your Account has been compromised, please contact us immediately at support@wflow.com.

3. Customers

3.1 You, as the Customer, or any end user to whom you grant access to your Account, are authorized to use the Services listed in the Pricing Offer (hereinafter referred to as "Users").

‍

3.2 When creating an Account, you will need to set up your login credentials. If we create an Account for you, we will send you an invitation, upon clicking which you will be prompted to create your login credentials.

‍

3.3 You can update the list of Users by sending us an email at sales@wflow.com.

4. Account Deletion and Suspension

4.1 If you wish to permanently delete your Account, please contact us by email at support@wflow.com.

‍

4.2 We reserve the right to delete or suspend your Account at any time at our sole discretion, especially in the situations under Article 17.5 of these Terms.

‍

4.3 These Terms remain in effect, even if you no longer have an Account with us.

5. Scope of Services

5.1 The services that wflow may provide to you include, among others, uploading accounting documents, data extraction, integration with other systems, invoice approval, and storage of these documents. The full scope of services is listed on our Website. The specific scope of Services that wflow will provide to you will be specified in the accepted Pricing Offer. Ordering additional Services is governed by the rules under Article 7.

‍

5.2 wflow reserves the right to update, modify, or terminate certain features of the provided Services at its sole discretion. If wflow removes a feature without replacement and such a change has a material effect on the provided Services, you may, within 30 days of the notification of the change or from the moment you could have learned of the removal of the functionality (whichever occurs first), request in writing the reinstatement of the removed functionality. If wflow does not comply within 30 days of the delivery of this request, you have the right to terminate the Agreement by written notice delivered to wflow no later than 15 days after the expiry of the period for complying with the request. The notice period is 1 month and begins on the first day of the calendar month following the delivery of the notice.

‍

5.3 wflow undertakes to provide the Customer with a hotline (help-desk) service from Monday to Friday from 9:00 AM to 5:00 PM, except on public holidays in the Czech Republic, at support@wflow.com or via the INTERCOM platform integrated into the Website.

‍

5.4 The subscription period begins on the date specified in the Agreement, and if not specified, then on the date the Service is accepted by the Customer. The Customer is required to accept the implemented Service with or without reservations. Acceptance occurs as soon as one of the following situations arises:

‍

5.4.1 Confirmation by the Customer that the Service is correctly implemented, or

5.4.2 The expiration of 3 business days from the completion of admin training (or if the Customer states that they are not interested in admin training, then the expiration of 3 business days from the notification of implementation completion, which wflow may send to the Customer by email), provided that the Customer does not raise any objections preventing the use of wflow during this period, or

5.4.3 The expiration of 10 business days from the acceptance of the Pricing Offer, regardless of whether admin training was conducted or whether the connector was integrated. The Customer is required to designate an administrator who will be trained and provide cooperation for the completion of the implementation. If the Customer fails to do so, training may still be conducted later, but the subscription service will begin, and the service will be considered implemented.

‍

5.5 Any objections regarding the implementation of the Service must be submitted in writing by email to support@wflow.com. If the Customer does not submit objections within the specified period and to the specified address, they accept the implementation of the Service without reservation and are obliged to start paying for the use of the Service.

6. Obligations Regarding User Content Under EU Regulation

6.1 You are responsible for all activities on your Account. You may use your Account in a manner that is reasonable, customary, and does not abuse the rights or legitimate interests of wflow or third parties. Among other things, you may not upload documents that are illegal or irrelevant (e.g., personal photographs) while using the Services, and it is prohibited to misuse API endpoints by sending unnecessary queries. The Account is linked to you and may not be used by, sold to, or transferred to another entity. Violation of this paragraph is considered a material breach of this Agreement.

‍

6.2 If we detect content on your Account that violates these Terms, we may, at our discretion, remove such content or suspend your access to the Services and User Account for a reasonable period after issuing prior notice. Additionally, if a notifier (which may be you or another User, hereinafter the "Notifier") frequently submits clearly unfounded notifications, wflow may suspend processing such notifications after issuing prior notice. When making such decisions, wflow will consider the number of clearly unlawful content items or clearly unfounded notifications submitted within a specific period, their ratio to the total number of information or notifications, the severity of the misuse, the nature of the unlawful content, the consequences of such misuse, and the intent of the service recipient, person, entity, or complainant, if it can be inferred.

‍

6.3 wflow accepts all notifications containing information about the presence of user content within the Platform that the Notifier (e.g., a User) considers unlawful. The Notifier may send a notification to wflow at support@wflow.com. wflow allows the notification to contain at least the following information:

‍

6.3.1 A sufficiently substantiated explanation of the reasons why the notifier claims that the concerned content is unlawful,

6.3.2 A clear indication of the exact electronic location of the content, such as the precise URL, and, if necessary, additional information enabling the identification of unlawful content depending on its type,

6.3.3 The name or designation of the person submitting the notification and their email address, unless the notification pertains to content that the notifier believes constitutes a criminal offense as defined in Articles 3 to 7 of Directive 2011/93/EU,

6.3.4 A statement confirming that the individual or entity submitting the notification believes in good faith that the information and claims contained in the notification are accurate and complete.

‍

6.4 If the notification includes electronic contact information of the notifier, wflow will send an acknowledgment of receipt without undue delay. It will also notify the notifier of its decision regarding the reported information and provide details on available remedies related to this decision. If wflow becomes aware of unlawful activities, illegal content, or content incompatible with the Terms, it may take measures to remove or disable access to it. wflow may also impose restrictions on the User, such as suspending, terminating, or otherwise restricting monetary payments, suspending or terminating the provision of the Service to the User, or suspending or deleting the User Account. In such a case, wflow will provide all affected Users with a clear and specific justification for the imposed restriction. However, if the content is deemed compliant with legal regulations and the Terms, wflow may also decide not to take action against the content.

7. Order, Pricing Offer, and Pricing

7.1 Unless otherwise stated, prices listed on our website are illustrative and are not binding on wflow.

‍

7.2 You can order Services by filling out a form, requesting a phone call on our Website, or by contacting us via email at sales@wflow.com (hereinafter referred to as the "Order"). After submitting the Order, we will send you a Pricing Offer ("Pricing Offer"), and upon request, a draft contract. The Pricing Offer will include the ordered Services and will be valid for a specified period. If you wish to accept the Pricing Offer, return it signed or otherwise confirm it within the specified timeframe. The accepted Pricing Offer forms part of the Agreement and is governed by these Terms.

‍

7.3 The total price you are required to pay to wflow will depend on the total number of users, organizations, extracted documents, and additional services and integrations ordered for the given subscription period (the "Price").

‍

7.4 If you wish to change the number of active users/organizations, you can do so in your account or by contacting us via email at support@wflow.com. The rules for changing users/organizations are specified in the current price list available at https://www.wflow.com/en/pricing, and these rules are binding.

‍

7.5 The Customer acknowledges that during the term of the Agreement, they may expand the scope of the Service (e.g., increase the number of extracted documents or timestamps, purchase additional integrations, modules, automatic backups, API connections, etc.) directly in the Platform administration. In such cases, there is no need to sign an amendment to the Agreement or a new Pricing Offer. By expressing consent (e.g., clicking the "order" button in the Service administration), the Customer accepts the price of such an extension and agrees to pay it. Unless otherwise agreed, the price is determined by the price list valid at the time of ordering.

‍

7.6 All prices are stated excluding VAT, and VAT will always be added to the Price in accordance with applicable legal regulations.

‍

7.7 wflow may, at its discretion, change prices, introduce new fees, or increase prices. Any changes will be notified to you via email or a notification in the Platform at least 30 days before their effective date, stating the effective date of the new prices. Article 1.4 of the Terms shall apply accordingly, meaning that any termination must be delivered to wflow before the effective date of the change. The exception is situations where you increase the number of users or other metrics; in such cases, the newly notified prices apply to all users and other metrics purchased after the price change notification with immediate effect.

‍

7.8 In addition to the previous provisions, the Price is automatically increased annually on March 1st or another date designated by wflow by the inflation rate expressed as the increase in the average annual consumer price index for the previous calendar year, as announced by the Czech Statistical Office. If the Czech Statistical Office ceases to announce this figure, a substitute or the closest comparable figure will be used. The increase will be rounded up to the nearest ten crowns. The increase will only apply if the inflation rate exceeds 5% since the last price increase under this clause.

8. Payments

8.1 The price may include a certain number of extracted documents / timestamps / organizations / users / storage space / other units for the subscription period. You are required to pay for the subscription even if you do not use all the units. In such a case, unused units expire without compensation. In the event of contract termination, no refund will be issued for unused units.

‍

8.2 If you exceed the agreed number of units in any period, you will be charged an overuse fee. Overuse fees are payable together with the next invoice; however, wflow may invoice them separately at any time.

‍

8.3 The Agreement includes provisions regarding the selected subscription period. Unless expressly agreed otherwise, the subscription is payable in advance based on an invoice issued before the commencement or at the beginning of each subscription period for the Services provided during that period.

‍

8.4 If you are late with the payment of any outstanding amount, wflow may charge you a contractual late payment penalty of 0.05% of the outstanding amount for each day of delay.

9. Security

9.1 wflow declares that it takes measures to ensure the security of the platform. These measures include encryption, regular monitoring, penetration testing, and compliance with ISO certifications (e.g., ISO 27001, 27007). Data security is implemented at the Platform level using standard attack protection (e.g., communication with the server is encrypted with an SSL security certificate, login to the application is performed via OAuth 2.0 protocol, data on servers is encrypted using a 256-bit AES algorithm). The Platform is hosted by a leading B2B infrastructure services provider, and necessary measures are taken to minimize the risk of any security or data integrity breach.

‍

9.2 Each Customer is responsible for all data uploaded to wflow, including its protection against malicious software (e.g., viruses) and how they handle this data after downloading it from the platform. The Customer is fully responsible for the content uploaded to the wflow platform by the Customer or through its suppliers or customers, both for its legality and for compliance with safe data handling practices. For example, the Customer is required to perform regular antivirus scans, protect their login credentials, and avoid opening suspicious files and attachments. In case of a security incident, the Customer must cooperate with wflow to resolve the issue.

‍

9.3 wflow is not responsible for content (e.g., files or links) uploaded to the wflow platform via access established for the Customer, namely directly by the Customer or through its suppliers or customers. The wflow platform is designed and operated in compliance with ISO standards, particularly regarding infrastructure security. Despite all security measures, responsibility for the content remains solely with the Customer. The Customer's data is stored on the servers of leading cloud providers on the market, and wflow staff in most cases do not have access to it (e.g., apart from service interventions requested by the Customer); therefore, wflow is not responsible for any damages arising from any breach of the Customer's data security or integrity.

‍

9.4 Since the Platform is a cloud-based tool designed, among other things, for data processing, wflow may act as a data processor for the Customer when fulfilling the Agreement, processing personal data of third parties that the Customer has uploaded or collected via the Platform ("Personal Data"). This processing is governed by the data processing agreement, which forms Appendix No. 1 of these Terms and thus becomes an integral part of the Agreement. You are responsible for ensuring that you are authorized to provide all your data to wflow and that their use and processing to provide the Services do not violate third-party rights, including intellectual property rights, privacy rights, or legal obligations. You must inform individuals whose personal or other data you provide to wflow for the purpose of Service provision of such data transfer or obtain their consent if necessary.

10. Intellectual Property

10.1 wflow has invested significant effort and resources into developing its intellectual property, including but not limited to the Platform, Services, and any additional software, features, functionalities, designs, copyrighted works of any kind, information, or other materials made available to you ("Intellectual Property"). wflow grants you the right to use the Platform "as is" on a non-exclusive basis, with no other warranties beyond those specified in these Terms, for the duration of the Services. You acknowledge and agree that all Intellectual Property remains the exclusive property of wflow and its suppliers and that you do not acquire any rights other than those expressly granted to you by these Terms unless wflow provides prior written consent. wflow reserves the right to revoke Customer access to any Intellectual Property after the termination of the Services.

‍

10.2 You also agree that you will not attempt to reverse engineer or otherwise access the source code of any Intellectual Property. Regardless of this restriction, you may not circumvent technical protections or other limitations associated with the Platform or Services, except where such actions are expressly permitted by applicable laws. You may not use Intellectual Property to create any software similar to the Services. You may not bypass any technological security measures within the Services and/or Platform or their related security features, nor may you enable unauthorized third-party applications to access the Services.

‍

10.3 If you provide feedback regarding the Services, such as suggestions for improvements or new features, such feedback will not be considered confidential or protected, and the implementation of such feedback becomes the property of wflow and may become part of our Intellectual Property without any compensation to you.

‍

10.4 Each party to this Agreement has the right to use the other party's logo and name on their website and in marketing materials, granting the other party a revocable license to this extent.

11. Confidential Information

11.1 wflow and the Customer agree that all financial, business, and technical information (e.g., business and marketing plans and strategies, business relationships, supplier and customer information, source codes, and trade secrets), including any information disclosed by wflow or the Customer or on their behalf in connection with the provision of Services, which should reasonably be considered confidential and sensitive, constitutes "Confidential Information" of each party. wflow's Confidential Information includes the pricing terms of the Agreement. Confidential Information does not include data related to the use of the Service, including statistical and performance data related to the operation of the Service, which we use in anonymized form. By entering into the Agreement or at the moment such data is created, you assign to us the rights related to the data mentioned in the previous sentence.

‍

11.2 wflow and the Customer declare and guarantee that they will keep Confidential Information secret, take all reasonable measures to prevent unauthorized access to it, and will not disclose or use it except for fulfilling their obligations and exercising their rights under this Agreement.

‍

11.3 The above obligations do not apply to Confidential Information that is (a) demonstrably already known to the recipient without any restrictions; (b) demonstrably and lawfully provided to the recipient by a third party without any restrictions; (c) publicly available without violating these Terms; (d) independently developed by the recipient without reference to or use of the disclosing party's Confidential Information; or (e) used or disclosed with the explicit consent of the disclosing party.

‍

11.4 If the recipient is required to disclose Confidential Information under judicial or administrative proceedings or orders, they must provide sufficient notice to the other party as soon as possible before any such disclosure and provide reasonable assistance to challenge or appeal such requests or orders if desired.

‍

11.5 The obligations under this Article remain in force even after the termination of this Agreement for a period of three (3) years.

12. Third-Party Services

12.1 To log into your user account and use certain additional features, you may grant wflow access to your third-party accounts, such as Google. You may revoke wflow's access to these accounts at any time via the security settings page of the respective third-party provider.

‍

12.2 To the extent that any third-party services, tools, or content (hereinafter referred to as "Third Parties") are accessible via the Platform, the terms and conditions of such Third Parties apply, and by using the Platform, you expressly acknowledge and agree to their terms. For example, applications such as Rossum, Dativery, Signi, Prismatic, Gemini, Intercom, or Binarbase are integrated into the Platform, and their terms of use can be found at:

‍

12.2.1 https://drive.google.com/file/d/1Lr4WbcK216CGk_r9mjyNLWkSVV42udbM/view,

12.2.2 https://www.dativery.com/cs/spolecnost/terms/

12.2.3 https://signi.com/

12.2.4 https://prismatic.io/legal/terms/

12.2.5 https://policies.google.com/terms, https://policies.google.com/terms/service-specific

12.2.6 https://www.intercom.com/legal/terms-and-policies

12.2.7 https://binarbase.com/sk/terms-conditions.

‍

Other Third Parties are listed on the Website.

‍

12.3 If you use a feature from the "Corporate Expenses" product category, you acknowledge that this service includes integration with products of Česká spořitelna ("ČS"). You acknowledge that all banking and payment services are provided solely by ČS based on a separate agreement entered into with you, which is governed by the terms available at https://www.csas.cz/cs/dokumenty-ke-stazeni#/954/Firemni-a-korporatni-klientela. To avoid any doubt, it is stated that:

‍

12.3.1 wflow is not a provider of payment services or other banking products; any payment services, including the management of payment cards, are established and managed solely by ČS under its terms,

12.3.2 All responsibility for banking and card services lies with ČS (if the Customer uses them). The Customer acknowledges that to the extent they use ČS services (e.g., issuing payment cards to an account), their relationship with ČS is governed exclusively by ČS's terms. wflow is not responsible for any damages, losses, or lost profits associated with ČS products,

12.3.3 The Customer is required to familiarize themselves with ČS's general terms and conditions, which must be accepted to use payment cards or other banking products of ČS.

‍

12.4 wflow has no control over the operation of Third Parties. Therefore, you acknowledge and agree that wflow is not liable for damages caused by using or relying on content or services provided by Third Parties. If an issue arises with a Third Party, you may exercise any rights arising from the Third Party's terms and conditions.

13. Limitation of Liability

13.1 wflow is not liable for lost profits caused by outages or other issues related to the Services. The total liability of wflow arising from or related to this Agreement is limited to an amount equal to the Price you have paid for the use of the Services during the four (4) months immediately preceding the date of the event that gave rise to the claim, but not exceeding CZK 50,000. The existence of more than one claim does not increase this limit. You expressly waive any right to compensation exceeding this amount.

‍

13.2 To avoid any doubt, we are not responsible for the legal archiving of data, and we strongly recommend that you regularly back up all data contained in your Account.

‍

13.3 For the purposes of this article, the terms "we" and "our" (and other uses of the first-person plural) are defined to include our subsidiaries, affiliates, officers, directors, employees, agents, consultants, and third-party service providers.

14. Disclaimer

14.1 We reserve the right to make changes and update all information contained on our Platform without prior notice. We strive to provide the most accurate description of each Service offered on the Platform. However, we do not guarantee that the specifications of the Services, Prices, or any other content provided on our Platform are complete, accurate, reliable, current, or error-free, and we disclaim any liability to the maximum extent permitted by law.

‍

14.2 Unless explicitly agreed otherwise, the Platform and the Services offered on it are provided "as is" and "as available" without any warranties. Any warranty of merchantability, fitness for a particular purpose, non-infringement, or any other warranty is excluded to the maximum extent permitted by applicable law. If we agree to provide a warranty for the Services, such a warranty does not apply to problems arising from or related to events beyond the control of wflow.

‍

14.3 The disclaimer under this article also applies to our subsidiaries, affiliates, and third-party service providers.

15. Indemnification

15.1 Since wflow staff in most cases do not have access to the Customer's data (e.g., apart from service interventions requested by the Customer), to the extent permitted by applicable law, you agree to indemnify us against all losses and liabilities, including legal fees, arising from these Terms or related to your use of our Services and/or Platform. We accept this indemnification promise. We reserve the exclusive right to control the enforcement and defense of any claims covered by this article. If we choose to exercise this right, you agree to provide us with all necessary cooperation.

‍

15.2 Your obligation to indemnify us under this article also extends to our subsidiaries, affiliates, officers, directors, employees, other representatives, and third-party service providers.

16. Delivery

16.1 A notice or other communication is deemed to have been duly made and effective if:

‍

16.1.1 it was sent to the other party's email address; you agree that we may send you notices to the email address provided when creating the User Account, for sending the newsletter, or to another email address through which you communicate with us; or

16.1.2 the other party frustrated or refused delivery.

‍

16.2 If more than one day can be considered the date of delivery under the above rules, the effective date of delivery is the day that occurs first.

17. Term and Termination of the Agreement

17.1 The subscription period automatically renews for another subscription period of the same length, repeatedly. Renewal will not occur if either party notifies the other in writing (including by email) of their intention to terminate the Agreement. For annual and multi-year subscriptions, the termination notice must be delivered at least 1 month before the end of the subscription period, otherwise, the Agreement will be extended. For monthly subscriptions, the notice can be delivered at any time, and the subscription will be terminated in accordance with the notice period under Article 17.3, but not before the expiration of the minimum usage period of the Service.

‍

17.2 The minimum usage period of the Service is 12 (twelve) months from the start of the subscription. Due to the initial investment associated with implementation, a shorter period cannot be offered. Therefore, you agree that the Agreement cannot be terminated before this period expires; if you submit a termination notice or request to cancel the renewal of the subscription during this period, the Agreement will end only after the minimum usage period has elapsed. Throughout this period, you are required to pay the Price to wflow, and wflow is obligated to provide you with the Services.

‍

17.3 After the minimum usage period expires, you may terminate the subscription. The notice period is 2 months for monthly subscriptions and begins on the first day of the calendar month following the delivery of a written termination notice. Annual and multi-year subscriptions cannot be terminated before their expiration and may only be terminated in accordance with clauses 17.1, 17.4, or 17.8.

‍

17.4 Either party may also terminate the Agreement if the other party materially breaches the Agreement and is unable to remedy such a breach or, if capable of remedy, fails to do so within 30 days of receiving written notice of such a breach.

‍

17.5 In addition to other cases provided by the Agreement or legal regulations, wflow may suspend access to the Service for you or any User with immediate effect, without incurring any obligations or liabilities, if:

‍

17.5.1 wflow receives a court order or public authority directive requiring such action, or if wflow determines that a new or amended law, rule, regulation, interpretation, or decision makes the performance of any part of the Agreement unlawful or otherwise illegal,

17.5.2 you fail to comply with the Agreement, violate legal regulations, use the Service beyond the granted rights or for purposes not permitted by the Agreement, or engage in fraudulent or illegal activities,

17.5.3 you enter into bankruptcy or impending insolvency under applicable laws effective as of day of termination, file a bankruptcy petition against yourself, or enter liquidation,

17.5.4 you fail to pay any amount due to wflow within the due date and do not remedy the situation within 5 days of being requested to do so.

‍

17.6 The termination of the Agreement does not extinguish the obligations and claims of the parties that, according to the Agreement and applicable laws, survive the termination. For clarity, this includes intellectual property rights, confidentiality and data protection obligations, monetary claims, and damage compensation claims. If you terminate the Agreement under Articles 5.2 or 17.4, you will be released from the obligation to pay the subscription fees for the period after the effective date of such termination. In all other cases, all prices and other fees that would have become due if the Agreement had remained in effect until the end of the current billing period become immediately due, and you must pay them along with all previously incurred but unpaid amounts upon receipt of an invoice.

‍

17.7 After the termination of the Agreement, wflow will offer the Customer the option for long-term data archiving and/or a one-time data backup according to the current price list, in a commonly used database format. If the Customer does not pay for archiving after the Agreement ends, wflow may delete all Customer data.

‍

17.8 If and to the extent that the Services are considered a data processing service within the meaning of Regulation (EU) 2023/2854 of the European Parliament and of the Council on harmonised rules on fair access to and use of data (the "Data Act"), a Customer established in the EU is entitled to terminate the Agreement in order to initiate switching to another provider of such service, including migration to its own on-premise infrastructure, by means of a written notice delivered to wflow. In such a case, the Parties shall follow the provider-switching procedure set out in Appendix No. 2 of these Terms. If, as at the date of termination of the Agreement, the Customer has an active subscription or other contractual commitment (including the minimum usage period commitment under Article 17.2) with an agreed duration exceeding the notice period or the Transition Period (as defined in Appendix No. 2), once initiated, wflow is entitled to claim a contractual sanction for early termination of the Agreement. The amount of the contractual sanction corresponds to the Price the Customer would have paid had it used the Services until the end of the agreed duration of the subscription or other commitment (in particular the minimum usage period commitment under Article 17.2), and this sanction will be invoiced after the termination of the Agreement. For the avoidance of doubt, any unused performance provided within purchased packages (e.g., unused prepaid documents for extraction) is not refunded to the Customer and is likewise included in the contractual sanction under this article. If the notice period or the Transition Period exceeds the period for which the Customer has an active subscription or other contractual commitment with an agreed duration, the provision of the Services continues for this period at a price corresponding to the price of the Services under the price list valid on the date of delivery of the notice. The Services so provided will be invoiced to the Customer monthly or, at wflow's discretion, in a lump sum after the termination of the Agreement.

18. Dispute Resolution and Governing Law

18.1 These Terms are governed by and interpreted in accordance with the laws of the Czech Republic. The application of conflict of law rules is excluded.

‍

18.2 The parties will primarily seek an amicable resolution of any disputes arising from these Terms. If a dispute cannot be resolved amicably, it will be subject to the exclusive jurisdiction of the competent courts of the Czech Republic.

19. Miscellaneous

19.1 These Terms and policies constitute the entire agreement between you and us and supersede all prior contractual relationships. In the event of a conflict between the provisions of the Agreement, including its annexes (excluding these Terms), on one hand, and the text of these Terms on the other, the provisions of the Agreement, including its annexes (excluding these Terms), shall prevail.

‍

19.2 If any provision of the Agreement becomes or is deemed illegal, invalid, or unenforceable in any respect under the laws of any jurisdiction, it will not affect the legality, validity, or enforceability of any other provision of this Agreement in that jurisdiction. If any invalid, unenforceable, or illegal provision would be valid, enforceable, or legal if a part of it were removed, that provision shall apply with the minimum modifications necessary to make it legal, valid, and enforceable.

‍

19.3 No delay, act, or omission by either party in exercising any right or remedy shall be deemed a waiver of that or any other right or remedy.

‍

19.4 Without prior written consent from the other party, no party may assign the Agreement to a third party. However, wflow may assign the Agreement as a whole to its affiliated entity without your prior consent (e.g., in the case of a reorganization or acquisition).

‍

19.5 The headings of articles and sections do not affect the interpretation of the Agreement.

‍

APPENDIX NO. 1 TO THE TERMS OF SERVICETERMS OF PERSONAL DATA PROCESSING

1. Introductory Provisions

1.1 This agreement is concluded under Article 28(3) of Regulation (EU) 2016/679 of the European Parliament and the Council, the General Data Protection Regulation ("GDPR"), as part of the Agreement between wflow and the Customer, which is governed by the Terms ("DPA"). All terms used in the Terms or the Agreement have the same meaning for the purposes of this DPA unless otherwise stated in this DPA. The DPA concerns the processing of personal data for which the Customer acts as the data controller (or another processor), and wflow processes personal data for the Customer as a processor (or another processor).

1.2 If this DPA specifies that a particular action must be performed in writing, this includes email or written instructions via the Account in the Platform.

2. Subject of Processing, Categories of Data Subjects, and Types of Personal Data

2.1 In connection with the performance of the Agreement, personal data will also be processed as described in this DPA, specifically personal data related to digital accounting management. The Customer may, when using the Services, create an Account for Users, store documents in the Platform, and perform other actions that involve processing activities by wflow. The following categories of personal data may be processed:

‍

2.1.1 Identification data;

2.1.2 Contact details;

2.1.3 Data regarding the relationship with a Third Party;

2.1.4 Data contained in documents uploaded by the Customer or User to the Platform;

2.1.5 Data contained in the Account;

2.1.6 Payment information, transaction overviews, and related details and documents when using the "Corporate Expenses" add-on;

2.1.7 Information accessed by wflow through the HelpDesk;

2.1.8 Other information provided by the Customer or a specific User to wflow in connection with the provision of Services.

‍

2.2 The data subjects whose personal data will be processed as specified above include:

‍

2.2.1 Users of the Service;

2.2.2 Entities whose Personal Data is contained in documents uploaded by the Customer to the Platform;

2.2.3 Contact persons of the Customer in connection with support services.

3. Nature and Purpose of Processing

3.1 wflow will process personal data electronically, automatically (and partially manually), and possibly using third-party tools listed below as additional processors. The scope of activities wflow will carry out with personal data corresponds to the scope of the Services. Specifically, the following activities will be performed:

‍

3.1.1 Collecting personal data;

3.1.2 Modifying, altering, and structuring personal data;

3.1.3 Organizing personal data;

3.1.4 Storing and archiving personal data;

3.1.5 Searching, sorting, and making personal data accessible;

3.1.6 Using personal data;

3.1.7 Deleting personal data;

3.1.8 Viewing personal data in connection with providing support services.

3.2 The purpose of processing is:

3.2.1 Processing and archiving accounting documents for the Customer;

3.2.2 Managing user Accounts and their permissions;

3.2.3 Logging access/changes made by Account Users;

3.2.4 Extracting data from documents uploaded by Customers to the Platform;

3.2.5 Performing other activities related to the provision of Services and fulfilling obligations under the Agreement.

‍

3.3 If the Customer orders the separately paid "Corporate Expenses" add-on, the Customer authorizes wflow to transfer the Customer's personal data, including identification data, contact details, and other data (such as transaction volumes, offers, etc.), to Česká spořitelna, a.s., ID No.: 45244782, with its registered office at Olbrachtova 1929/62, 140 00 Prague 4 ("ČS"), which acts as an independent controller of the personal data provided by the Customer. wflow declares that in using this paid add-on, it will obtain information from ČS as specified in section 2.1.6 of this DPA, and wflow will process this data as a personal data processor based on the instructions provided for using the "Corporate Expenses" add-on. The purpose of the processing is to ensure transaction recording, provide notifications, and maintain a transparent overview of the Customer's expenses.

4. Duration and Termination of Processing

4.1 wflow will process personal data for the duration of the Agreement or as long as necessary to execute a specific instruction from the Customer or perform an action related to the provided Service unless the Customer, as the data controller, removes the personal data earlier.

‍

‍

4.2 Upon termination of cooperation and the DPA, regardless of the manner and reason for its termination, wflow will delete all personal data processed under the DPA (from all devices and storage media except those owned by the Customer or a Third Party), unless the retention of such data is required by European Union or Czech Republic law. The Customer may also opt for additional paid services for exporting and transferring personal data from the Platform. If wflow is required to return personal data after processing ends, the data will be returned within a timeframe and in a format specified by wflow.

5. Additional Obligations

5.1 The Customer, as the data controller, agrees to maintain a valid legal basis for the processing of personal data within the Platform at all times and to fulfill all legal obligations towards data subjects, particularly the duty to inform. The Customer also agrees to promptly remove any personal data from the Platform that does not have a valid legal basis for processing.

‍

5.2 Personal data will not be transferred to countries outside the EU, i.e., third countries.

‍

5.3 wflow agrees to comply with the obligations under Article 28 of the GDPR as follows:

‍

5.3.1 Process personal data strictly based on documented instructions from the Customer arising from the DPA or the Agreement; to eliminate any doubt, processing personal data in accordance with the provision of Services is considered to be in compliance with documented instructions; a written instruction also includes an instruction issued via the Account by a User; to avoid any ambiguity, every User is authorized to issue instructions on behalf of the Customer, and wflow will not verify the User's authorization to act on behalf of the Customer;

5.3.2 Inform the Customer if it believes that the Customer's instructions violate legal regulations; to avoid any doubt, the Customer expressly confirms that the provision of Services defined in this DPA cannot compromise the security, confidentiality, and protection of personal data;

5.3.3 Follow the Customer's instructions regarding the transfer of personal data to a third country or an international organization unless such processing is required by European Union or Member State law applicable to wflow; in such a case, wflow will inform the Customer of this legal requirement before processing;

5.3.4 Ensure that persons authorized to process personal data have committed to confidentiality or are subject to a statutory confidentiality obligation; this duty of confidentiality continues even after the termination of the DPA;

5.3.5 Assist the Customer through cooperation and appropriate technical and organizational measures to fulfill its obligation to respond to data subject rights requests, no later than 14 days from the date the Customer submits such a request via email;

5.3.6 Assist the Customer, no later than 14 days from the date the Customer submits such a request via email, in ensuring compliance with obligations including (i) securing the level of processing security, (ii) reporting personal data breaches to the Data Protection Authority and, where applicable, to data subjects, (iii) conducting data protection impact assessments, and (iv) performing prior consultations with the Data Protection Authority. However, wflow will always comply with the Customer's requests only to the extent of the information it has available.

‍

5.4 In compliance with the GDPR, wflow must allow the Customer to conduct audits (including inspections and examinations) and provide all necessary information to demonstrate compliance with the obligations outlined in Article 28 of the GDPR, for the purpose of verifying adherence to this DPA and related obligations. Any audit request may be sent by the Customer to support@wflow.com, and wflow and the Customer will electronically agree on the conditions of the audit, particularly security measures and methods for ensuring confidentiality obligations during the inspection. If no agreement is reached within 30 days of the audit request, wflow will determine the audit conditions.

‍

5.5 The Customer, as the data controller, grants wflow general authorization to modify the engagement of sub-processors. If the Customer acts as another processor, they confirm that they have obtained permission from the data controller to engage wflow as another processor. wflow will notify the Customer at least thirty (30) days before adding or replacing a sub-processor. The Customer may object to changes involving sub-processors involved in processing within ten (10) calendar days of such notification. In such a case, wflow and the Customer will work in good faith to resolve the reasons for the objection. If wflow determines the objections are valid, it will refrain from engaging the sub-processor for processing or may choose not to provide a specific type of Service or terminate the contractual relationship with the Customer concerning the relevant processing.

‍

5.6 The processing of Personal Data involves additional processors engaged by wflow under a contractual relationship, provided you choose to use them. The additional processors include:

Microsoft Azure — Type of activity: Operation of the Platform and storage of personal data. Additional information: Data centers in Ireland and the Netherlands are used.

Rossum Ltd (a Coupa Company) — Type of activity: Part of the Service integrated into the Platform. Additional information: The company is established in a country with adequate protection within the meaning of Article 45 GDPR.

Intercom, Inc. — Type of activity: Provision of the platform for collecting information within the helpdesk. Additional information: The company is registered under the Data Privacy Framework.

Signi.com (Digital factory s.r.o.) — Type of activity: Provision of electronic document signing.

Google LLC, Google Ireland Limited — Type of activity: Processing of accounting documents via the Gemini AI tool, which serves to ensure the wflow AI function. Additional information: The company is registered under the Data Privacy Framework and in connection with the Gemini API there is a specific data processing addendum containing standard contractual clauses.

‍

5.7 Any additional processor involved in processing carried out by wflow is contractually bound by the same obligations as set out in this DPA.

‍

5.8 wflow is not liable for any damage caused in connection with the processing of personal data, including damage resulting from a breach of obligations under this DPA. Damage includes those arising from extraordinary, unforeseen, and insurmountable obstacles and circumstances beyond the control of wflow or individuals authorized to act on behalf of wflow. If wflow is liable for any damage, the total compensation shall be limited to the same extent as provided in the Terms. The total liability of wflow arising from the DPA, the Agreement, or related matters, whether based on the DPA, the Agreement, tort, or otherwise, shall in no case exceed the Price paid by the Customer to wflow for using the Platform and/or Services in the four months immediately preceding the date of the event leading to the claim and shall not exceed CZK 50,000. The limitation of liability under the DPA and the Agreement does not combine (i.e., the maximum claimable amount remains CZK 50,000 regardless of the nature of the damage).

‍

5.9 wflow is entitled to charge the Customer reasonable costs incurred in handling any request and fulfilling any obligation under this DPA at an hourly rate of CZK 2,000.

6. Technical and Organizational Measures

6.1 wflow commits to implementing and maintaining technical and organizational measures in connection with processing, at a minimum as follows: Secure data center certified with ISO 27001 located within the EU, with logical (firewall, passwords, roles, and permissions) and physical access control measures (doors, locks, reception/security staff, electronic security, CCTV surveillance); Encryption of transmitted Customer data; Strong password policy within the Platform and password encryption; Confidentiality obligations for all wflow employees with access to personal data; Execution of data processing agreements in compliance with Article 28 of the GDPR with all processors; Internal data protection policies, including an access control system for personal data; Regular automatic backups; Periodic review of security policies. Other measures listed in Article 9 of the Agreement.

‍

6.2 If wflow detects a breach of personal data security, it will notify the Customer in writing without undue delay, but no later than 72 hours after becoming aware of the breach, providing all available information. To eliminate any doubts, wflow will make reasonable efforts to provide information under Article 33(3) of the GDPR but is not required to provide all details under this article if the information is not available to it.

‍

APPENDIX NO. 2 TO THE TERMS OF SERVICEPROVIDER SWITCHING PROCEDURE

‍

This Appendix governs, if and to the extent that the Service is considered a data processing service within the meaning of Regulation (EU) 2023/2854 of the European Parliament and of the Council on harmonised rules on fair access to and use of data (the "Data Act"), the procedure for switching the provider of data processing services in accordance with Articles 23 et seq. of the Data Act. To the extent that the provision of the Service does not meet the definition of a data processing service under the Data Act, this Appendix does not apply and does not establish any special rights or claims for the Customer under the Data Act.

1. Basic Information

1.1 The notice period for terminating the Agreement under the Data Act is two (2) months from the date of delivery of the written notice to wflow in accordance with the Terms.

‍

1.2 During the notice period, the Customer is obliged to notify wflow whether it intends to:

‍

1.2.1 switch to another provider of data processing services, in which case the Customer shall provide the necessary identification and technical details of the new provider;

1.2.2 migrate to the Customer's own on-premise infrastructure; and/or

1.2.3 erase the exportable data and digital assets.

‍

1.3 If the Customer notifies wflow of its intention under clause 1.2.1 or 1.2.2, wflow shall enable the Customer to switch to another data processing service with another service provider or to transfer the Customer's exportable data and digital assets to the Customer's own on-premise infrastructure without undue delay, but no later than by the end of a transition period of thirty (30) calendar days commencing upon the expiry of the notice period under clause 1.1 (the "Transition Period").

‍

1.4 The Customer has the right to extend the Transition Period once by such additional period as it considers more suitable. The notice of extension must be delivered to wflow no later than on the last day of the Transition Period.

‍

1.5 If the Transition Period of the length under clause 1.3 is technically unfeasible, wflow shall inform the Customer within 14 working days of the submission of the request to switch providers, duly justifying such technical unfeasibility and stating an alternative transition period, which may not exceed seven months.

‍

1.6 During the Transition Period, the Agreement remains in effect and wflow shall:

1.6.1 provide the Customer and third parties approved by the Customer with reasonable assistance in the provider-switching process;

1.6.2 act with due care with a view to maintaining business continuity and continue to provide the Services under the Agreement;

1.6.3 provide clear information about known risks to the continuity of the provision of the services;

1.6.4 maintain a high level of security, in particular the security of data during its transfer and the continuous security of data during the Transition Period and the period of Additional Availability referred to below, in accordance with applicable Union or national law.

‍

1.7 wflow shall support the Customer's exit strategy relating to the contractually agreed services by providing the information that is reasonably necessary for the switch.

‍

1.8 After the end of the Transition Period, wflow shall provide an additional period of thirty (30) calendar days for the retention and availability of data (read-only access or an export interface) so that the Customer can complete the retrieval of the data (the "Additional Availability"). After the expiry of this period, unless otherwise agreed between the Parties, and provided that the provider switch has been successfully completed, wflow shall erase all exportable data and digital assets created directly by the Customer or relating to the Customer; this obligation does not apply to any data that wflow is required to retain under applicable legal regulations or is entitled to retain even after the termination of the Agreement.

‍

1.9 The Agreement will be terminated, and wflow will notify the Customer thereof, upon the successful completion of the provider-switching process; or, if the Customer does not wish to switch providers, upon the expiry of the notice period.

2. Additional Information

2.1 wflow informs the Customer that the following are available at https://www.wflow.com:

‍

a) a detailed specification of all categories of data and digital assets that can be transferred during the provider-switching process, including at least all exportable data;

b) an exhaustive specification of the categories of data specific to the internal functioning of the service that are to be excluded from the exportable data under point a) of this clause,

c) information on the available procedures for switching the provider of data processing services and transferring data, including information on the available switching methods and transfer formats and on technical and other limitations known to wflow;

d) a current online register maintained by wflow with details of all data structures and data formats, as well as the relevant standards and open specifications for interoperability, in which the exportable data referred to in Article 25(2)(e) of the Data Act is available,

e) information on the jurisdiction to which the information and communication technology infrastructure used for the processing of data of its individual services is subject,

f) a general description of the technical, organisational, and contractual measures that wflow has taken in order to prevent international governmental access to or transfer of non-personal data held in the European Union, where such access or transfer could be in conflict with Union law or the national law of the relevant Member State.

‍

2.2 No provision of the Agreement obliges wflow to disclose its trade secrets, technologies protected by intellectual property rights, or other confidential information.

3. Provider-Switching Fees

3.1 With effect from 12 January 2027, wflow will not charge any fees for the provider-switching process within the meaning of Article 29(1) of the Data Act. This is without prejudice to wflow's right to charge fees for other professional services that do not relate to the switch itself (for example, development work, integration with other systems, fees for converting data to another format).

‍

3.2 The following are considered part of the reasonable assistance provided by wflow in connection with the Data Act:

‍

3.2.1 access to the standard self-service export tools and documentation under clause 2.1 enabling the export of data and digital assets;

3.2.2 one (1) basic orientation meeting (of up to sixty (60) minutes) for the purpose of planning the export and verifying the transfer procedure.

‍

3.3 The Parties agree that the following activities are not considered to be required by the Data Act, and their provision by wflow may therefore be charged on a time and material (T&M) basis, i.e., the time actually worked multiplied by wflow's hourly rate plus costs (unless otherwise agreed, wflow's hourly rate is CZK 2,500 + VAT):

‍

3.3.1 coordination and project management of the provider-switching process beyond the initial orientation meeting;

3.3.2 conversion of data into data formats other than those specified in the documentation under clause 2.1 and conversion of data for reasons required on the side of the target environment,

3.3.3 export and import tests, and resolution of import errors not caused by wflow,

3.3.4 any other activities requested by the Customer that are not necessary for the standard self-service export or are not included among the activities under clause 3.2 of this Appendix.

3.4 For the avoidance of doubt, during the notice period and during the Transition Period, the Customer is obliged to continue paying the subscription and other fees for the services in accordance with the pricing terms valid on the date of submission of the notice.

‍

1.2. By signing, otherwise confirming the Pricing Offer, or clicking the agreement button when presented with this option, you enter into a service usage agreement with wflow (hereinafter also referred to as the “Agreement”), which incorporates these Terms. By using our Services, you confirm that you have read, understood, and agree to these Terms. If you do not understand, do not accept, or do not agree with these Terms, you are not authorized to use the Services.

‍

1.3. wflow reserves the right to modify, amend, add, or remove portions of these Terms at its sole discretion and within a reasonable scope, particularly in the event of changes in legislation or changes in contracts with its suppliers. Any modifications will be notified to you via email or a notification within the Platform. Changes take effect on the specified date, which will be at least 30 days from the notification date, and apply to all subsequent use of the Service.

‍

1.4. If you do not agree with the changes, you may terminate the Agreement with effect upon the expiration of the notice period as defined in Articles 17.1 – 17.3, provided that your termination notice is delivered to wflow before the effective date of the change. If you terminate under this paragraph, the Terms in effect on the termination date shall apply during the notice period. Your continued use of the Services after the effective date of the changes constitutes your acceptance and agreement to these changes.

‍

2. Customer Account

‍

2.1. When creating an account, you must provide us with accurate information in good faith and agree to keep it updated in case of changes. By creating an account on behalf of a company, you guarantee that you have all the necessary authorizations to bind this company to these Terms (hereinafter referred to as the “Account”).

‍

2.2. To create an Account, we will require the following information:

● Name;

● Company email address;

● Company name;

● Phone number;

● Password.

‍

2.3. You are responsible for the security of your Account and for all activity on the Account while someone is logged in. If you suspect that your Account has been compromised, please contact us immediately at support@wflow.com.

‍

3. Customers

‍

3.1. You, as the Customer, or any end user to whom you grant access to your Account, are authorized to use the Services listed in the Pricing Offer (hereinafter referred to as “Users”).

‍

3.2. When creating an Account, you will need to set up your login credentials. If we create an Account for you, we will send you an invitation, upon clicking which you will be prompted to create your login credentials.

‍

3.3. You can update the list of Users by sending us an email at sales@wflow.com.

‍

4. Account Deletion and Suspension

‍

4.1. If you wish to permanently delete your Account, please contact us by email at support@wflow.com

4.2. We reserve the right to delete or suspend your Account at any time at our sole discretion.

4.3. These Terms remain in effect, even if you no longer have an Account with us.

‍

5. Scope of Services

‍

5.1. The services that wflow may provide to you include, among others, uploading accounting documents, data extraction, integration with other systems, invoice approval, and storage of these documents. The full scope of services is listed on our Website. The specific scope of Services that wflow will provide to you will be specified in the accepted Pricing Offer. Ordering additional Services is governed by the rules under Article 7.

‍

5.2. wflow reserves the right to update, modify, or terminate certain features of the provided Services at its sole discretion. If wflow removes a feature without replacement, and such a change significantly affects the provided Services, we will attempt to notify you in advance if possible. In such a case, you may request the reinstatement of the functionality, and if your request is not granted within 1 month, you may terminate the Agreement with effect after the expiration of a 1-month notice period, which begins on the first day of the calendar month following the delivery of the written notice, provided that the termination notice is delivered to wflow within 1 month of the change.

‍

5.3. wflow undertakes to provide the Customer with a hotline (help-desk) service from Monday to Friday from 9:00 AM to 5:00 PM, except on public holidays in the Czech Republic, at support@wflow.com or via the INTERCOM platform integrated into the Website.

‍

5.4. The subscription period begins on the date specified in the Agreement, and if not specified, then on the date the Service is accepted by the Customer. The Customer is required to accept the implemented Service with or without reservations. Acceptance occurs as soon as one of the following situations arises:

‍

5.4.1. Confirmation by the Customer that the Service is correctly implemented, or

5.4.2. The expiration of 3 business days from the completion of admin training (or if the Customer states that they are not interested in admin training, then the expiration of 3 business days from the notification of implementation completion, which wflow may send to the Customer by email), provided that the Customer does not raise any objections preventing the use of wflow during this period, or

5.4.3. The expiration of 10 business days from the acceptance of the Pricing Offer, regardless of whether admin training was conducted or whether the connector was integrated. The Customer is required to designate an administrator who will be trained and provide cooperation for the completion of the implementation. If the Customer fails to do so, training may still be conducted later, but the subscription service will begin, and the service will be considered implemented.

‍

5.5. Any objections regarding the implementation of the Service must be submitted in writing by email to sales@wflow.com. If the Customer does not submit objections within the specified period and to the specified address, they accept the implementation of the Service without reservation and are obliged to start paying for the use of the Service.

‍

6. Obligations Regarding User Content Under EU Regulation

‍

6.1. You are responsible for all activities on your Account. You may use your Account in a manner that is reasonable, customary, and does not abuse the rights or legitimate interests of wflow or third parties. Among other things, you may not upload documents that are illegal or irrelevant (e.g., personal photographs) while using the Services, and it is prohibited to misuse API endpoints by sending unnecessary queries. The Account is linked to you and may not be used by, sold to, or transferred to another entity. Violation of this paragraph is considered a material breach of this Agreement.

‍

6.2. If we detect content on your Account that violates these Terms, we may, at our discretion, remove such content or suspend your access to the Services and User Account for a reasonable period after issuing prior notice. Additionally, if a notifier (which may be you or another User, hereinafter the "Notifier") frequently submits clearly unfounded notifications, wflow may suspend processing such notifications after issuing prior notice. When making such decisions, wflow will consider the number of clearly unlawful content items or clearly unfounded notifications submitted within a specific period, their ratio to the total number of information or notifications, the severity of the misuse, the nature of the unlawful content, the consequences of such misuse, and the intent of the service recipient, person, entity, or complainant, if it can be inferred.

‍

6.3. wflow accepts all notifications containing information about the presence of user content (such as photographs, videos, review texts) within the Platform that the Notifier (e.g., a User) considers unlawful. The Notifier may send a notification to wflow at support@wflow.com. wflow allows the notification to contain at least the following information:

‍

6.3.1. A sufficiently substantiated explanation of the reasons why the notifier claims that the concerned content is unlawful.

6.3.2. A clear indication of the exact electronic location of the content, such as the precise URL, and, if necessary, additional information enabling the identification of unlawful content depending on its type.

6.3.3. The name or designation of the person submitting the notification and their email address, unless the notification pertains to content that the notifier believes constitutes a criminal offense as defined in Articles 3 to 7 of Directive 2011/93/EU.

6.3.4. A statement confirming that the individual or entity submitting the notification believes in good faith that the information and claims contained in the notification are accurate and complete.

‍

6.4. If the notification includes electronic contact information of the notifier, wflow will send an acknowledgment of receipt without undue delay. It will also notify the notifier of its decision regarding the reported information and provide details on available remedies related to this decision. If wflow becomes aware of unlawful activities, illegal content, or content incompatible with the Terms, it may take measures to remove or disable access to it. wflow may also impose restrictions on the User, such as downgrading the ranking of the content in search results, suspending, terminating, or otherwise restricting monetary payments, suspending or terminating the provision of the Service to the User, or suspending or deleting the User Account. In such a case, wflow will provide all affected Users with a clear and specific justification for the imposed restriction. However, if the content is deemed compliant with legal regulations and the Terms, wflow may also decide not to take action against the content.

‍

7. Order, Pricing Offer, and Pricing

‍

7.1. Unless otherwise stated, prices listed on our website are illustrative and are not binding on wflow.

‍

7.2. You can order Services by filling out a form, requesting a phone call on our Website, or by contacting us via email at sales@wflow.com (hereinafter referred to as the "Order"). After submitting the Order, we will send you a Pricing Offer ("Pricing Offer"), and upon request, a draft contract. The Pricing Offer will include the ordered Services and will be valid for a specified period. If you wish to accept the Pricing Offer, return it signed or confirm it within the specified timeframe. The accepted Pricing Offer forms part of the Agreement and is governed by these Terms.

‍

7.3. The total price you are required to pay to wflow will depend on the total number of users, organizations, extracted documents, and additional services and integrations ordered for the given subscription period (the "Price").

‍

7.4. If you wish to change the number of active users/organizations, you can do so in your account or by contacting us via email at support@wflow.com. The rules for changing users/organizations are specified in the current price list available at https://www.wflow.com/en/pricing, and these rules are binding.

‍

7.5. The Customer acknowledges that during the term of the Agreement, they may expand the scope of the Service (e.g., increase the number of extracted documents or timestamps, purchase additional integrations, modules, automatic backups, API connections, etc.) directly in the Platform administration. In such cases, there is no need to sign an amendment to the Agreement or a new Pricing Offer. By expressing consent (e.g., clicking the "order" button in the Service administration), the Customer accepts the price of such an extension and agrees to pay it. Unless otherwise agreed, the price is determined by the price list valid at the time of ordering.

‍

7.6. All prices are stated excluding VAT, and VAT will always be added to the Price in accordance with applicable legal regulations.

‍

7.7. wflow may, at its discretion, change prices, introduce new fees, or increase prices. Any changes will be notified to you via email or a notification in the Platform and will take effect at the beginning of the next subscription period. Clause 1.4 of the Terms shall apply accordingly, meaning that any termination must be delivered to wflow before the start date of the next subscription period. The exception is situations where you increase the number of users or other metrics; in such cases, the new prices apply to all users and other metrics purchased after the price change notification from the moment of purchase, not from the next subscription period.

‍

7.8. In addition to the previous provisions, the Price is automatically increased annually on March 1st or another date designated by wflow by the inflation rate expressed as the increase in the average annual consumer price index for the previous calendar year, as announced by the Czech Statistical Office. If the Czech Statistical Office ceases to announce this figure, a substitute or the closest comparable figure will be used. The increase will be rounded up to the nearest ten crowns. The increase will only apply if the inflation rate exceeds 5% since the last price increase under this clause.

‍

8. Payments

‍

8.1. The price may include a certain number of extracted documents / timestamps / organizations / users / storage space / other units for the subscription period. You are required to pay for the subscription even if you do not use all the units. In such a case, unused units expire without compensation. In the event of contract termination, no refund will be issued for unused units.

‍

8.2. If you exceed the agreed number of units in any period, you will be charged an overuse fee. Overuse fees are payable together with the next invoice; however, wflow may invoice them separately at any time.

‍

8.3. The Agreement includes provisions regarding the selected subscription period. Unless expressly agreed otherwise, the subscription is payable in advance based on an invoice issued before the commencement or at the beginning of each subscription period for the Services provided during that period.

‍

8.4. If you are late with the payment of any outstanding amount, wflow may charge you a contractual late payment penalty of 0.05% of the outstanding amount for each day of delay.

‍

9. Security

‍

9.1. wflow declares that it takes measures to ensure the security of the platform. These measures include encryption, regular monitoring, penetration testing, and compliance with ISO certifications (e.g., ISO 27001, 27007). Data security is implemented at the Platform level using standard attack protection (e.g., communication with the server is encrypted with an SSL security certificate, login to the application is performed via OAuth 2.0 protocol, data on servers is encrypted using a 256-bit AES algorithm). The Platform is hosted by a leading B2B infrastructure services provider, and necessary measures are taken to minimize the risk of any security or data integrity breach.

‍

9.2. Each Customer is responsible for all data uploaded to wflow, including its protection against malicious software (e.g., viruses) and how they handle this data after downloading it from the platform. The Customer is fully responsible for the content uploaded to the wflow platform, both for its legality and for compliance with safe data handling practices. For example, the Customer is required to perform regular antivirus scans, protect their login credentials, and avoid opening suspicious files and attachments. In case of a security incident, the Customer must cooperate with wflow to resolve the issue.

‍

9.3. wflow is not responsible for content (e.g., files or links) uploaded by users or third parties to the wflow platform. The wflow platform is designed and operated in compliance with ISO standards, particularly regarding infrastructure security. Despite all security measures, responsibility for the content remains solely with the Customer. wflow is not responsible for any damages arising from any breach of the Customer's data security or integrity.

‍

9.4. Since the Platform is a cloud-based tool designed, among other things, for data processing, wflow may act as a data processor for the Customer when fulfilling the Agreement, processing personal data of third parties that the Customer has uploaded or collected via the Platform (“Personal Data”). This processing is governed by the data processing agreement, which forms Appendix No. 1 of these Terms and thus becomes an integral part of the Agreement. You are responsible for ensuring that you are authorized to provide all your data to wflow and that their use and processing to provide the Services do not violate third-party rights, including intellectual property rights, privacy rights, or legal obligations. You must inform individuals whose personal or other data you provide to wflow for the purpose of Service provision of such data transfer or obtain their consent if necessary.

‍

10. Intellectual Property

‍

10.1. wflow has invested significant effort and resources into developing its intellectual property, including but not limited to the Platform, Services, and any additional software, features, functionalities, designs, copyrighted works of any kind, information, or other materials made available to you (“Intellectual Property”). wflow grants you the right to use the Platform “as is” on a non-exclusive basis, with no other warranties beyond those specified in these Terms, for the duration of the Services. You acknowledge and agree that all Intellectual Property remains the exclusive property of wflow and its suppliers and that you do not acquire any rights other than those expressly granted to you by these Terms unless wflow provides prior written consent. wflow reserves the right to revoke Customer access to any Intellectual Property after the termination of the Services.

‍

10.2. You also agree that you will not attempt to reverse engineer or otherwise access the source code of any Intellectual Property. Regardless of this restriction, you may not circumvent technical protections or other limitations associated with the Platform or Services, except where such actions are expressly permitted by applicable laws. You may not use Intellectual Property to create any software similar to the Services. You may not bypass any technological security measures within the Services and/or Platform or their related security features, nor may you enable unauthorized third-party applications to access the Services.

‍

10.3. If you provide feedback regarding the Services, such as suggestions for improvements or new features, such feedback will not be considered confidential or protected, and the implementation of such feedback becomes the property of wflow and may become part of our Intellectual Property without any compensation to you.

‍

10.4. Each party to this Agreement has the right to use the other party’s logo and name on their website and in marketing materials, granting the other party a revocable license to this extent.

‍

11. Confidential Information

‍

11.1. wflow and the Customer agree that all financial, business, and technical information (e.g., business and marketing plans and strategies, business relationships, supplier and customer information, source codes, and trade secrets), including any information disclosed by wflow or the Customer or on their behalf in connection with the provision of Services, which should reasonably be considered confidential and sensitive, constitutes "Confidential Information" of each party. wflow's Confidential Information includes the pricing terms of the Agreement. Confidential Information does not include data related to the use of the Service, including statistical and performance data related to the operation of the Service, which we use in anonymized form. By entering into the Agreement or at the moment such data is created, you assign to us the rights related to the data mentioned in the previous sentence.

‍

11.2. wflow and the Customer declare and guarantee that they will keep Confidential Information secret, take all reasonable measures to prevent unauthorized access to it, and will not disclose or use it except for fulfilling their obligations and exercising their rights under this Agreement.

‍

11.3. The above obligations do not apply to Confidential Information that is (a) demonstrably already known to the recipient without any restrictions; (b) demonstrably and lawfully provided to the recipient by a third party without any restrictions; (c) publicly available without violating these Terms; (d) independently developed by the recipient without reference to or use of the disclosing party’s Confidential Information; or (e) used or disclosed with the explicit consent of the disclosing party.

‍

11.4. If the recipient is required to disclose Confidential Information under judicial or administrative proceedings or orders, they must provide sufficient notice to the other party as soon as possible before any such disclosure and provide reasonable assistance to challenge or appeal such requests or orders if desired.

‍

11.5. The obligations under this Article remain in force even after the termination of this Agreement for a period of three (3) years.

‍

12. Third-Party Services

‍

12.1. To log into your user account and use certain additional features, you may grant wflow access to your third-party accounts, such as Google. You may revoke wflow’s access to these accounts at any time via the security settings page of the respective third-party provider.

‍

12.2. To the extent that any third-party services, tools, or content (hereinafter referred to as "Third Parties") are accessible via the Platform, the terms and conditions of such Third Parties apply, and by using the Platform, you expressly acknowledge and agree to their terms. For example, applications such as Rossum, Dativery, Signi, or Prismatic are integrated into the Platform, and their terms of use can be found at:

‍

• Rossum: https://drive.google.com/file/d/1Lr4WbcK216CGk_r9mjyNLWkSVV42udbM/view

• Dativery: https://www.dativery.com/cs/spolecnost/terms/

• Signi: https://signi.com/

• Prismatic: https://prismatic.io/legal/terms/.

Other Third Parties are listed on the Website.

‍

12.3. If you use a feature from the "Corporate Expense Management" product category, you acknowledge that this service includes integration with products of Česká spořitelna ("ČS"). You acknowledge that all banking and payment services are provided solely by ČS based on a separate agreement entered into with you, which is governed by the terms available at https://www.csas.cz/cs/dokumenty-ke-stazeni#/954/Firemni-a-korporatni-klientela. To avoid any doubt, it is stated that:

‍

12.3.1. wflow is not a provider of payment services or other banking products; any payment services, including the management of payment cards, are established and managed solely by ČS under its terms.

12.3.2. All responsibility for banking and card services lies with ČS (if the Customer uses them). The Customer acknowledges that to the extent they use ČS services (e.g., issuing payment cards to an account), their relationship with ČS is governed exclusively by ČS’s terms. wflow is not responsible for any damages, losses, or lost profits associated with ČS products.

12.3.3. The Customer is required to familiarize themselves with ČS’s general terms and conditions, which must be accepted to use payment cards or other banking products of ČS.

‍

12.4. wflow has no control over the operation of Third Parties. Therefore, you acknowledge and agree that wflow is not liable for damages caused by using or relying on content or services provided by Third Parties. If an issue arises with a Third Party, you may exercise any rights arising from the Third Party’s terms and conditions.

‍

13. Limitation of Liability

‍

13.1. wflow is not liable for lost profits caused by outages or other issues related to the Services. The total liability of wflow arising from or related to this Agreement is limited to an amount equal to the Price you have paid for the use of the Services during the four (4) months immediately preceding the date of the event that gave rise to the claim, but not exceeding CZK 50,000. The existence of more than one claim does not increase this limit. You expressly waive any right to compensation exceeding this amount.

‍

13.2. To avoid any doubt, we are not responsible for the legal archiving of data, and we strongly recommend that you regularly back up all Data contained in your Account.

‍

13.3. For the purposes of this article, the terms "we" and "our" (and other uses of the first-person plural) are defined to include our subsidiaries, affiliates, officers, directors, employees, agents, consultants, and third-party service providers.

‍

14. Disclaimer

‍

14.1. We reserve the right to make changes and update all information contained on our Platform without prior notice. We strive to provide the most accurate description of each Service offered on the Platform. However, we do not guarantee that the specifications of the Services, Prices, or any other content provided on our Platform are complete, accurate, reliable, current, or error-free, and we disclaim any liability to the maximum extent permitted by law.

‍

14.2. Unless explicitly agreed otherwise, the Platform and the Services offered on it are provided "as is" and "as available" without any warranties. Any warranty of merchantability, fitness for a particular purpose, non-infringement, or any other warranty is excluded to the maximum extent permitted by applicable law. If we agree to provide a warranty for the Services, such a warranty does not apply to problems arising from or related to events beyond the control of wflow.

‍

14.3. The disclaimer under this article also applies to our subsidiaries, affiliates, and third-party service providers.

‍

15. Indemnification

‍

15.1. To the extent permitted by applicable law, you agree to indemnify us against all losses and liabilities, including legal fees, arising from these Terms or related to your use of our Services and/or Platform. We accept this indemnification promise. We reserve the exclusive right to control the enforcement and defense of any claims covered by this article. If we choose to exercise this right, you agree to provide us with all necessary cooperation.

‍

15.2. Your obligation to indemnify us under this article also extends to our subsidiaries, affiliates, officers, directors, employees, other representatives, and third-party service providers.

‍

16. Doručování

‍

16.1. A notice or other communication is deemed to have been duly made and effective if:

‍

16.1.1 it was sent to the other party’s email address; you agree that we may send you notices to the email address provided when creating the User Account, for sending the newsletter, or to another email address through which you communicate with us; or

16.1.2 the other party frustrated or refused delivery.

‍

16.2 If more than one day can be considered the date of delivery under the above rules, the effective date of delivery is the day that occurs first.

‍

‍

17. Term and Termination of the Agreement

‍

17.1. The subscription period automatically renews for another subscription period of the same length, repeatedly. Renewal will not occur if either party notifies the other in writing (including by email) of their intention to terminate the Agreement. For annual and multi-year subscriptions, the termination notice must be delivered at least 1 month before the end of the subscription period, otherwise, the Agreement will be extended. For monthly subscriptions, the notice can be delivered at any time, and the subscription will be terminated in accordance with the notice period under clause 17.3, but not before the expiration of the minimum usage period of the Service.

‍

17.2. The minimum usage period of the Service is 12 (twelve) months from the start of the subscription. Due to the initial investment associated with implementation, a shorter period cannot be offered. Therefore, you agree that the Agreement cannot be terminated before this period expires; if you submit a termination notice or request to cancel the renewal of the subscription during this period, the Agreement will end only after the minimum usage period has elapsed. Throughout this period, you are required to pay the Price to wflow, and wflow is obligated to provide you with the Services.

‍

17.3. After the minimum usage period expires, you may terminate the subscription. The notice period is 3 months for monthly subscriptions and begins on the first day of the calendar month following the delivery of a written termination notice. Annual and multi-year subscriptions may be terminated in accordance with clause 17.1.

‍

17.4. Either party may also terminate the Agreement if the other party materially breaches the Agreement and is unable to remedy such a breach or, if capable of remedy, fails to do so within 30 days of receiving written notice of such a breach.

‍

17.5. In addition to other cases provided by the Agreement or legal regulations, wflow may suspend access to the Service for you or any User with immediate effect, without incurring any obligations or liabilities, if:

‍

17.5.1. wflow receives a court order or public authority directive requiring such action, or if wflow determines that a new or amended law, rule, regulation, interpretation, or decision makes the performance of any part of the Agreement unlawful or otherwise illegal;

17.5.2. you fail to comply with the Agreement, violate legal regulations, use the Service beyond the granted rights or for purposes not permitted by the Agreement, or engage in fraudulent or illegal activities;

17.5.3. you enter into bankruptcy or impending insolvency under applicable laws, file a bankruptcy petition against yourself, or enter liquidation;

17.5.4. you fail to pay any amount due to wflow within the due date and do not remedy the situation within 5 days of being requested to do so.

‍

17.6. The termination of the Agreement does not extinguish the obligations and claims of the parties that, according to the Agreement and applicable laws, survive the termination. For clarity, this includes intellectual property rights, confidentiality and data protection obligations, monetary claims, and damage compensation claims. If you terminate the Agreement under clause 5.2 or 17.4, you will be released from the obligation to pay the subscription fees for the period after the effective date of such termination. In all other cases, all prices and other fees that would have become due if the Agreement had remained in effect until the end of the current billing period become immediately due, and you must pay them along with all previously incurred but unpaid amounts upon receipt of an invoice.

‍

17.7. After the termination of the Agreement, wflow will offer the Customer the option for long-term data archiving and/or a one-time data backup according to the current price list, in a commonly used database format. If the Customer does not pay for archiving after the Agreement ends, wflow may delete all Customer data.

‍

17.8. Customers who ordered the Service before the effective date of this version of the general terms and conditions may terminate the Service under the previous version of the general terms and conditions. The provisions of this article regarding the minimum usage period of the Service apply only to Service orders placed from the effective date of this version of the general terms and conditions.

‍

18. Dispute Resolution and Governing Law

‍

18.1. These Terms are governed by and interpreted in accordance with the laws of the Czech Republic. The application of conflict of law rules is excluded.

‍

18.2. The parties will primarily seek an amicable resolution of any disputes arising from these Terms. If a dispute cannot be resolved amicably, it will be subject to the exclusive jurisdiction of the competent courts of the Czech Republic.

‍

19. Miscellaneous

‍

19.1. These Terms and policies constitute the entire agreement between you and us and supersede all prior contractual relationships. In the event of a conflict between the provisions of the Agreement, including its annexes (excluding these Terms), on one hand, and the text of these Terms on the other, the provisions of the Agreement, including its annexes (excluding these Terms), shall prevail.

‍

19.2. If any provision of the Agreement becomes or is deemed illegal, invalid, or unenforceable in any respect under the laws of any jurisdiction, it will not affect the legality, validity, or enforceability of any other provision of this Agreement in that jurisdiction. If any invalid, unenforceable, or illegal provision would be valid, enforceable, or legal if a part of it were removed, that provision shall apply with the minimum modifications necessary to make it legal, valid, and enforceable.

‍

19.3. No delay, act, or omission by either party in exercising any right or remedy shall be deemed a waiver of that or any other right or remedy.

‍

19.4. Without prior written consent from the other party, no party may assign the Agreement to a third party. However, wflow may assign the Agreement as a whole to its affiliated entity without your prior consent (e.g., in the case of a reorganization or acquisition).

‍

19.5. The headings of articles and sections do not affect the interpretation of the Agreement.

APPENDIX NO. 1 TO THE TERMS AND CONDITIONS

TERMS OF PERSONAL DATA PROCESSING

‍

1. Introductory Provisions

‍

1.1. his agreement is concluded under Article 28(3) of Regulation (EU) 2016/679 of the European Parliament and the Council, the General Data Protection Regulation ("GDPR"), as part of the Agreement between wflow and the Customer, which is governed by the Terms ("DPA"). All terms used in the Terms or the Agreement have the same meaning for the purposes of this DPA unless otherwise stated in this DPA. The DPA concerns the processing of personal data for which the Customer acts as the data controller (or another processor), and wflow processes personal data for the Customer as a processor (or another processor).

‍

1.2. If this DPA specifies that a particular action must be performed in writing, this includes email or written instructions via the Account in the Platform.

‍

2. Subject of Processing, Categories of Data Subjects, and Types of Personal Data

‍

2.1. In connection with the performance of the Agreement, personal data will also be processed as described in this DPA, specifically personal data related to digital accounting management. The Customer may, when using the Services, create an Account for Users, store documents in the Platform, and perform other actions that involve processing activities by wflow. The following categories of personal data may be processed:

‍

2.1.1. Identification data;

2.1.2. Contact details;

2.1.3. Data regarding the relationship with a Third Party;

2.1.4. Data contained in documents uploaded by the Customer or User to the Platform;

2.1.5. Data contained in the Account;

2.1.6. Payment information, transaction overviews, and related details and documents when using the "Corporate Expenses" add-on;

2.1.7. Information accessed by wflow through the HelpDesk;

2.1.8. Other information provided by the Customer or a specific User to wflow in connection with the provision of Services.

‍

2.2. The data subjects whose personal data will be processed as specified above include:

‍

2.2.1. Users of the Service;

2.2.2. Entities whose Personal Data is contained in documents uploaded by the Customer to the Platform;

2.2.3. Contact persons of the Customer in connection with support services.

‍

3. Nature and Purpose of Processing

‍

3.1. wflow will process personal data electronically, automatically (and partially manually), and possibly using third-party tools listed below as additional processors. The scope of activities wflow will carry out with personal data corresponds to the scope of the Services. Specifically, the following activities will be performed:

‍

3.1.1. Collecting personal data;

3.1.2. Modifying, altering, and structuring personal data;

3.1.3. Organizing personal data;

3.1.4. Storing and archiving personal data;

3.1.5. Searching, sorting, and making personal data accessible;

3.1.6. Using personal data;

3.1.7. Deleting personal data;

3.1.8. Viewing personal data in connection with providing support services.

‍

3.2. The purpose of processing is:

‍

3.2.1. Processing and archiving accounting documents for the Customer;

3.2.2. Managing user Accounts and their permissions;

3.2.3. Logging access/changes made by Account Users;

3.2.4. Extracting data from documents uploaded by Customers to the Platform;

3.2.5. Performing other activities related to the provision of Services and fulfilling obligations under the Agreement.

‍

3.3. If the Customer orders the separately paid "Corporate Expenses" add-on, the Customer authorizes wflow to transfer the Customer’s personal data, including identification data, contact details, and other data (such as transaction volumes, offers, etc.), to Česká spořitelna, a.s., ID No.: 45244782, with its registered office at Olbrachtova 1929/62, 140 00 Prague 4 ("ČS"), which acts as an independent controller of the personal data provided by the Customer. wflow declares that in using this paid add-on, it will obtain information from ČS as specified in section 2.1.6 of this DPA, and wflow will process this data as a personal data processor based on the instructions provided for using the "Corporate Expenses" add-on. The purpose of the processing is to ensure transaction recording, provide notifications, and maintain a transparent overview of the Customer’s expenses.

‍

4. Duration and Termination of Processing

‍

4.1. wflow will process personal data for the duration of the Agreement or as long as necessary to execute a specific instruction from the Customer or perform an action related to the provided Service unless the Customer, as the data controller, removes the personal data earlier.

‍

4.2. Upon termination of cooperation and the DPA, regardless of the manner and reason for its termination, wflow will delete all personal data processed under the DPA (from all devices and storage media except those owned by the Customer or a Third Party), unless the retention of such data is required by European Union or Czech Republic law. The Customer may also opt for additional paid services for exporting and transferring personal data from the Platform. If wflow is required to return personal data after processing ends, the data will be returned within a timeframe and in a format specified by wflow.

‍

5. Additional Obligations

‍

5.1. The Customer, as the data controller, agrees to maintain a valid legal basis for the processing of personal data within the Platform at all times and to fulfill all legal obligations towards data subjects, particularly the duty to inform. The Customer also agrees to promptly remove any personal data from the Platform that does not have a valid legal basis for processing.

‍

5.2. Personal data will not be transferred to countries outside the EU, i.e., third countries.

‍

5.3. wflow agrees to comply with the obligations under Article 28 of the GDPR as follows:

‍

5.3.1. Process personal data strictly based on documented instructions from the Customer arising from the DPA or the Agreement; to eliminate any doubt, processing personal data in accordance with the provision of Services is considered to be in compliance with documented instructions; a written instruction also includes an instruction issued via the Account by a User; to avoid any ambiguity, every User is authorized to issue instructions on behalf of the Customer, and wflow will not verify the User’s authorization to act on behalf of the Customer.

5.3.2. Inform the Customer if it believes that the Customer's instructions violate legal regulations; to avoid any doubt, the Customer expressly confirms that the provision of Services defined in this DPA cannot compromise the security, confidentiality, and protection of personal data.

5.3.3. Follow the Customer’s instructions regarding the transfer of personal data to a third country or an international organization unless such processing is required by European Union or Member State law applicable to wflow; in such a case, wflow will inform the Customer of this legal requirement before processing.

5.3.4. Ensure that persons authorized to process personal data have committed to confidentiality or are subject to a statutory confidentiality obligation; this duty of confidentiality continues even after the termination of the DPA.

5.3.5. Assist the Customer through cooperation and appropriate technical and organizational measures to fulfill its obligation to respond to data subject rights requests, no later than 14 days from the date the Customer submits such a request via email.

5.3.6. Assist the Customer, no later than 14 days from the date the Customer submits such a request via email, in ensuring compliance with obligations including (i) securing the level of processing security, (ii) reporting personal data breaches to the Data Protection Authority and, where applicable, to data subjects, (iii) conducting data protection impact assessments, and (iv) performing prior consultations with the Data Protection Authority. However, wflow will always comply with the Customer’s requests only to the extent of the information it has available.

‍

5.4. In compliance with the GDPR, wflow must allow the Customer to conduct audits (including inspections and examinations) and provide all necessary information to demonstrate compliance with the obligations outlined in Article 28 of the GDPR, for the purpose of verifying adherence to this DPA and related obligations. Any audit request may be sent by the Customer to support@wflow.com, and wflow and the Customer will electronically agree on the conditions of the audit, particularly security measures and methods for ensuring confidentiality obligations during the inspection. If no agreement is reached within 30 days of the audit request, wflow will determine the audit conditions.

‍

5.5. The Customer, as the data controller, grants wflow general authorization to modify the engagement of sub-processors. If the Customer acts as another processor, they confirm that they have obtained permission from the data controller to engage wflow as another processor. wflow will notify the Customer at least thirty (30) days before adding or replacing a sub-processor. The Customer may object to changes involving sub-processors involved in processing within ten (10) calendar days of such notification. In such a case, wflow and the Customer will work in good faith to resolve the reasons for the objection. If wflow determines the objections are valid, it will refrain from engaging the sub-processor for processing or may choose not to provide a specific type of Service or terminate the contractual relationship with the Customer concerning the relevant processing.

‍

5.6. The processing of Personal Data involves additional processors engaged by wflow under a contractual relationship, provided you choose to use them. The additional processors include:

‍

Microsoft Azure

Platform operation and storage of personal data

Data centers located in Ireland and the Netherlands.

‍

Rossum Ltd

Part of the Service integrated into the Platform

Company based in a country with adequate protection under Article 45 of the GDPR.

‍

Intercom, Inc.

Platform for gathering information via helpdesk

Company registered under the Data Privacy Framework.

‍

Signi.com

Electronic document signing

‍

Google LLC, Google Ireland Limited

Processing of accounting documents via the Gemini AI tool, which serves to provide the wflow AI function.

The company is registered under the Data Privacy Framework, and in connection with the Gemini API there is a specific addendum to the processing of personal data containing standard contractual clauses.

‍

5.7. Any additional processor involved in processing carried out by wflow is contractually bound by the same obligations as set out in this DPA.

‍

5.8. wflow is not liable for any damage caused in connection with the processing of personal data, including damage resulting from a breach of obligations under this DPA. Damage includes those arising from extraordinary, unforeseen, and insurmountable obstacles and circumstances beyond the control of wflow or individuals authorized to act on behalf of wflow. If wflow is liable for any damage, the total compensation shall be limited to the same extent as provided in the Terms. The total liability of wflow arising from the DPA, the Agreement, or related matters, whether based on the DPA, the Agreement, tort, or otherwise, shall in no case exceed the Price paid by the Customer to wflow for using the Platform and/or Services in the four months immediately preceding the date of the event leading to the claim and shall not exceed CZK 50,000. The limitation of liability under the DPA and the Agreement does not combine (i.e., the maximum claimable amount remains CZK 50,000 regardless of the nature of the damage).

‍

5.9. wflow is entitled to charge the Customer reasonable costs incurred in handling any request and fulfilling any obligation under this DPA at an hourly rate of CZK 2,000.

‍

6. Technical and Organizational Measures

‍

6.1. wflow commits to implementing and maintaining technical and organizational measures in connection with processing, at a minimum as follows:

‍

● Secure data center certified with ISO 27001 located within the EU, with logical (firewall, passwords, roles, and permissions) and physical access control measures (doors, locks, reception/security staff, electronic security, CCTV surveillance);

● Encryption of transmitted Customer data;

● Strong password policy within the Platform and password encryption;

● Confidentiality obligations for all wflow employees with access to personal data;

● Execution of data processing agreements in compliance with Article 28 of the GDPR with all processors;

● Internal data protection policies, including an access control system for personal data;

● Regular automatic backups;

● Periodic review of security policies;

● Other measures listed in Article 9 of the Agreement.

‍

6.2. If wflow detects a breach of personal data security, it will notify the Customer in writing without undue delay, but no later than 72 hours after becoming aware of the breach, providing all available information. To eliminate any doubts, wflow will make reasonable efforts to provide information under Article 33(3) of the GDPR but is not required to provide all details under this article if the information is not available to it.

‍