Customer terms

1. Parties and agreement

These terms govern business and organizational use of DTO Flow. The provider is HYPERPLANE SOLUTIONS, obrt za izradu softvera, vl. Filip Bebić, Zadar, Vlade Janjića Cape 11, Croatia (we or us). Contact: support@dtoflow.com.

The customer is the business or organization represented by the person creating the workspace. By checking acceptance and registering, that person confirms authority to bind the customer and accepts these terms, including the processing schedule. These are not consumer subscription terms.

Version 2026-10-02.4 applies from acceptance, without retrospectively changing accrued rights. We record the user, workspace, document versions, language and server acceptance time. A Contract Year is each 12-month period beginning on the initial acceptance of the customer agreement or its anniversary; accepting an updated version does not restart it.

2. Service and customer responsibilities

DTO Flow provides controlled recurring partner file exchanges, rule-based validation for supported Excel/CSV data, access controls, file archives, tracking and configured exchange paths. Other supported files can be tracked and handed off without deep content validation.

Validation evaluates configured rules. An accepted result does not establish that a file is complete, accurate, lawful, malware-free or suitable for a downstream purpose, and does not replace commercial, accounting or legal review. Customers select and test rules and review imports and downstream decisions.

The customer chooses feeds, users, partners, destinations and purposes; supplies accurate account information; protects credentials and tokens; promptly reports suspected misuse; and maintains appropriate independent copies and business-continuity arrangements. It is responsible for authorized users, recipient selection, external credentials, integrations and downstream systems.

We provide the service with reasonable care and skill. Except for express commitments in this agreement and obligations that cannot lawfully be excluded, we give no additional warranties. We do not warrant uninterrupted or error-free operation, compatibility with every customer system, detection of every error or harmful file, or a particular business result.

Guaranteed availability, support response times, recovery times, recovery points, service credits and additional security commitments apply only where expressly agreed in writing. Operational backups support service recovery and do not replace customer copies. This does not reduce our express security, recovery or data-protection obligations.

We are not responsible for the availability, functionality or terms of third-party services selected or contracted directly by the customer, except to the extent a failure results from our breach. This does not exclude our responsibility for subcontractors or subprocessors engaged by us.

3. Ownership and permitted use

Customers and their licensors retain ownership of their files and data. The customer permits us to host, copy, validate, transmit and otherwise process them only as needed to provide and secure the service and follow lawful instructions. DTO Flow software, branding and service materials remain ours or our licensors'. Customers receive a limited right to use the service during the agreement within their plan and authorized access.

Customers must have the rights, notices and lawful basis needed to submit and share data. They must not upload unlawful material or malware, infringe rights, bypass access controls or limits, test security without permission, or disrupt others. The customer agrees not to upload special-category personal data under GDPR Article 9, including health, genetic, identifying biometric, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, sex-life or sexual-orientation data, or criminal-conviction/offence data under Article 10. This is a customer obligation; file validation does not guarantee detection of such content.

4. Plans, payment, renewal and refunds

The selected plan and checkout or separately agreed order determine limits, prices, currency, taxes and billing interval. A Trial does not itself authorize a charge. Paid self-service subscriptions are billed through Stripe and renew according to checkout terms unless canceled. Customers must keep billing details current and pay amounts due.

Customers may cancel renewal through available billing controls or contact support. Cancellation normally takes effect at the paid period's end, with applicable plan access until then, subject to justified suspension. Cancellation alone does not request workspace closure or data deletion.

We may change subscription prices for a future renewal to reflect changes in service scope, operating costs or commercial pricing, by giving at least 30 calendar days' written notice. An increase does not affect an already-paid period. If the notice period cannot be met for the next renewal, the increase takes effect at a later renewal that meets it. Customers may cancel renewal before the increased price applies. Customer-requested plan changes and applicable tax changes are treated separately.

Fees are non-refundable except as expressly stated here or required by law. Ordinary customer cancellation creates no automatic prorated refund. If the customer validly terminates an affected service for our uncured material breach, or we permanently discontinue it for convenience, we return prepaid fees attributable to its unused period. Any damages claim remains subject to the liability provisions. Mandatory switching and termination rights remain available.

Unless mandatory law requires otherwise, an express refund under these terms is limited to prepaid subscription fees attributable to the unused portion of the affected service. It excludes fees for service already provided and does not compensate other loss. The same unused fees cannot be recovered twice. Other claims remain subject to the liability provisions and mandatory law.

A voluntary refund, credit or accommodation does not admit liability, amend the agreement or create an entitlement in another case. Separate written commercial terms apply where expressly agreed.

5. Confidentiality and safeguards

Each party protects the other's non-public business information with reasonable care, uses it only for the agreement and discloses it only to people or providers who need it and are bound by confidentiality, or as legally required. This excludes information already lawfully known, independently developed, publicly available without breach or lawfully received elsewhere.

We maintain access controls, transport encryption, private blob storage, provider-managed encryption at rest, tenant-scoped authorization, operational monitoring and recovery protections appropriate to the processing risks and our obligations. Operational access is limited to authorized personnel. Changes must not reduce protection below contractual or statutory requirements.

No system is free from risk. We do not promise that every malicious file, intrusion or vulnerability will be detected or prevented. We remain responsible for maintaining our agreed safeguards. These standard terms claim no certification or malware scanning on every upload.

6. Suspension, termination and closure

We may restrict affected access or operations where reasonably necessary for security threats, unlawful use, material breach, non-payment or plan limits. Urgent protective action may be immediate. Where practicable and lawful, we explain the reason and allow an opportunity to resolve other breaches before suspension.

Either party may terminate the affected service for a material breach that remains unremedied 30 calendar days after written notice describing the breach. Immediate termination remains available where the breach cannot be remedied or continued provision would be unlawful, without limiting mandatory remedies.

We may permanently discontinue a service for convenience on at least 60 calendar days' written notice and return its unused prepaid fees. We will allow any longer notice or exit period required by mandatory law. The closure and switching provisions continue to apply.

An authorized representative must contact support to close a workspace or instruct return or deletion. Subscription expiry does not automatically delete files or history. The processing schedule governs customer-controlled personal data; necessary accounting and other lawfully retained controller records are treated separately.

Accrued payment obligations and provisions intended to survive, including confidentiality, applicable liability, claims and disputes, survive termination.

7. Liability limits and mandatory exceptions

Subject to the mandatory exceptions below, our total aggregate liability to the customer arising from events first occurring in any Contract Year, whether in contract, tort or otherwise, is limited to the greater of EUR 100 or the fees paid by that customer under this agreement during the 12 months immediately preceding the first event giving rise to liability in that Contract Year. Related events are allocated to the Contract Year in which the first occurred. Multiple claims or legal grounds, including claims brought through the customer, do not increase that limit. It does not aggregate or restrict independent mandatory rights of individuals.

Where legally permitted, the same cap applies to contractual claims under the processing schedule; there is no separate enhanced cap unless expressly agreed. This is a ceiling on recoverable compensation, not an automatic payment. It does not limit performance of binding data-protection obligations or express refunds of unused prepaid fees.

Subject to the mandatory exceptions, we are not liable for loss of profit, revenue, anticipated savings, business opportunity or goodwill, or indirect or consequential loss, whether or not its possibility was disclosed. Direct loss otherwise recoverable, including direct data-restoration costs where recoverable, remains subject to the aggregate cap. This clause does not exclude all liability for lost customer files or failure to perform the core service.

Nothing in this agreement excludes or limits liability for intent, gross negligence or any liability that cannot lawfully be excluded or limited. Every cap, loss exclusion and remedy restriction is subject to this paragraph and Croatian rules on proportionality, the parties' position and standard terms, including the prohibition on compensation limits manifestly disproportionate to damage.

Nothing restricts supervisory authorities' powers, mandatory data-subject rights or mandatory rights of contribution. Each party remains responsible for its legal obligations; customer responsibilities do not excuse our breach.

8. Customer responsibility for third-party claims

The customer will reimburse us for damages finally awarded, settlements approved by the customer, and reasonable external defence costs resulting from third-party claims caused by customer content infringing rights, unlawful customer instructions or prohibited use of the service. This applies only to the extent attributable to the customer and excludes loss caused by our breach.

We will promptly notify the customer, reasonably cooperate at its expense and allow it to control the defence through competent counsel. No settlement may admit our liability, impose non-monetary obligations on us or fail to release us without our written consent. A delay in notice reduces this obligation only to the extent it materially prejudices the defence.

The provider's liability cap does not limit this customer obligation. This provision does not transfer regulatory powers, automatically make regulatory fines recoverable, or restrict mandatory rights of individuals or contribution. It remains subject to applicable law.

9. Extraordinary events

Neither party is liable for delay or failure to perform to the extent caused by external, extraordinary and unforeseeable circumstances arising after the agreement that it could not reasonably prevent, overcome or avoid. The affected party must notify the other and take reasonable steps to mitigate the effects. A supplier outage or cyberattack does not automatically qualify.

Accrued payment obligations and obligations that remain capable of performance continue. If the event prevents substantial performance for 60 consecutive calendar days, either party may terminate the affected service; unused prepaid fees will be returned. Mandatory obligations and the agreed exit arrangements remain applicable.

10. Notices, changes, negotiated terms and disputes

Contractual notices are sent by email to the customer's designated administrative or billing contact, as relevant; customers must keep those details current. Notices to us go to support@dtoflow.com. We preserve accepted versions.

We give reasonable advance written notice of proposed material contractual changes, taking account of their nature and impact and any minimum notice required by law. Changes take effect only through a valid agreement or renewal mechanism, with express acceptance where required. Existing terms continue until that replacement takes effect. A price-change notice does not itself replace the other accepted terms. Mandatory legal changes take effect as required by law. Updating the privacy notice does not amend the customer agreement.

Any increased liability limit, additional warranty, provider indemnity, service level or service credit must be expressly agreed in writing by an authorized provider representative and identify the standard provision it changes. Customer purchase-order terms do not amend this agreement unless expressly accepted. Discretionary accommodations do not establish a continuing entitlement. A waiver applies only to the specific matter identified in writing.

Individually agreed written terms prevail over conflicting standard commercial terms. The processing schedule prevails for its data-protection subject matter, subject to mandatory law; applicable mandatory international-transfer clauses prevail over conflicting provisions. If a provision is unenforceable, the rest continues to the extent legally possible.

Croatian law governs this B2B agreement. The parties first seek resolution through support, without preventing urgent relief or mandatory remedies. Competent courts in Zadar, Croatia have jurisdiction, subject to mandatory jurisdiction rules. These terms are available in English and Croatian. The Croatian version prevails if they differ, subject to mandatory law.

11. Processing schedule: scope and instructions

This schedule is part of the accepted terms where we process personal data on the customer's behalf. The customer is controller, or a processor authorized by its controller to engage us as subprocessor. Processing comprises hosting, organizing, validating, retrieving, transmitting and securing recurring partner files and related access/exchange records, for the service duration and agreed return/deletion period.

Data subjects may include customer/partner employees, representatives, suppliers and customers whose ordinary business data is included. Data may include names, business contacts, organizational identifiers, transactional references, file metadata and access/activity records. Customers select actual permitted content; the sensitive-data prohibition above applies.

The agreement, configured service actions and lawful written requests are documented instructions. We process only on those instructions, including concerning transfers, unless EU or Member State law requires otherwise; we inform the customer before such processing unless legally prohibited. If we believe an instruction infringes data-protection law, we inform the customer and may pause it pending clarification. Customers are responsible for lawful bases, notices, permitted data and authority to instruct us.

12. Provider register

Microsoft Azure: hosting, database and file storage, messaging, monitoring and transactional email. Role: subprocessor for customer-controlled data and provider for our own account and security processing. Relevant data includes submitted files, samples, outputs, exchange and access records, technical diagnostics and email content. Core database and file storage is in West Europe, application processing in Germany West Central, and transactional email uses the Europe data location. Documented Microsoft service and support exceptions may involve processing outside the EEA; applicable provider data-protection terms and transfer safeguards govern those operations.

Stripe: subscription, payment and billing services. Relevant data includes billing contacts, subscription, payment-status and invoice information. Stripe acts as processor or independent controller according to the activity and its terms. Payment-card information is entered on Stripe-hosted pages. Partner-file contents are not sent to Stripe for billing. International operations and transfer safeguards are described in Stripe's privacy and data-protection terms.

The provider names above identify services, not a representation that every service has the same contracting entity or processing location. Contact support for the relevant contractual entity and supporting transfer documentation. Customer-selected recipients are listed in the customer's configuration and are not automatically our subprocessors.

13. Processing schedule: personnel and subprocessors

Authorized personnel are bound by confidentiality and receive access appropriate to their duties. Customers give general written authorization for the Microsoft Azure processing described in the provider register under appropriate contractual data-protection obligations. Stripe's billing role is not authorization to send partner-file contents to Stripe.

Before appointing a new or replacement subprocessor, we provide written information identifying its legal entity, purpose, relevant data, processing locations and transfer safeguards. The notice specifies a reasonable objection period that gives the customer a meaningful opportunity to raise documented data-protection objections before processing begins. That period starts only when the required information is complete.

We consider a reasonable alternative. If an objection cannot be resolved, either party may terminate only the affected service before that processing begins, with a refund of its unused prepaid fees. The proposed subprocessor will not process the objecting customer's data before resolution. We impose equivalent applicable protection obligations on subprocessors and remain responsible for their performance as required by this schedule and law.

14. Processing schedule: security, assistance and incidents

We maintain appropriate technical and organizational measures considering processing risks, including the safeguards above, tenant-scoped authorization, controlled file access, credential protection and recovery procedures. Existing measures can be reviewed through support; changes must not reduce protection below contractual or statutory requirements.

Considering the nature of processing and available information, we assist with individual rights requests, security, breach assessment and notification, data-protection impact assessments and prior consultation. We do not respond substantively to requests about customer-controlled data without instructions unless legally required.

We notify the customer without undue delay after becoming aware of a personal-data breach affecting data processed on its behalf. Initial notice provides information then available about the incident, likely consequences, measures and follow-up contact; we provide material further information as it becomes available. Notification does not by itself admit liability. The customer remains responsible for notifications it must make as controller, with our assistance as required by law.

15. Processing schedule: information, audits and assistance costs

We provide information reasonably needed to demonstrate compliance with this schedule and Article 28 GDPR, and allow and contribute to audits, including inspections, by the customer or its mandated independent auditor. Routine requests first use available documentation and remote review where sufficient; necessary inspections remain available. The customer retains the right to select appropriate verification in accordance with law.

Parties coordinate proportionate scope, reasonable notice, confidentiality and safe access to protect other customers and service security. Where legally permitted, we may charge reasonable, documented costs for exceptional assistance and customer-requested audits following an advance estimate. We do not charge for work required to remedy our breach or impose charges contrary to mandatory switching rules.

Arrangements and charges must not obstruct required assistance, necessary inspections, urgent investigations or supervisory authorities' lawful access. Contact support to arrange evidence, assistance or an audit.

16. Processing schedule: closure, return, deletion and transfers

An authorized customer representative may request closure, return or deletion through support. We verify authority proportionately and record the instruction, secure recipient, scope and deadlines without using verification or closure confirmation to postpone statutory obligations. Customers choose return or deletion and may change the choice before completion.

For closure requests outside the statutory switching procedure, we carry out return or deletion on the customer's lawful instructions without undue delay. Where permitted by law, we agree a reasonable timetable taking account of the scope and technical requirements. Agreement on a timetable is not a condition for meeting mandatory deadlines. The statutory switching procedure takes precedence where applicable.

After return, we delete remaining processor copies unless EU or Member State law requires retention; we explain the requirement and scope unless prohibited. Until completion, data remains protected and is processed only for return or deletion or legally required purposes. Necessary controller records are separately governed by the privacy notice. Subscription cancellation alone does not trigger closure or deletion.

We apply the documented 14-day database recovery-retention policy and blob or container soft-delete settings. Where legally permitted, restricted recovery copies may remain after active deletion and expire through the provider-managed lifecycle. A recovery-window setting is not itself confirmation that every copy has been physically erased. We confirm completed deletion actions and identify any remaining restricted recovery copies. Statements about provider-managed backup expiry or erasure are based on available provider documentation and evidence, with relevant limitations explained. Recovery copies remain protected and excluded from ordinary use, and restoration must reapply completed deletion instructions. This does not limit our subprocessor responsibilities or mandatory erasure duties.

Core hosting is in the EU as described in the privacy notice. Restricted international transfers we arrange on the customer's behalf follow documented instructions and applicable Chapter V GDPR safeguards. Relevant provider transfer information is available on request. This schedule does not replace a separately required international-transfer instrument.

17. Switching services and export formats

Where Chapter VI of the EU Data Act applies, the customer may notify support of its choice to switch to another provider, move exportable data and digital assets to its own infrastructure, or erase them. We record the chosen destination or erasure instruction. The maximum notice period before the transition begins is two months. The transition is completed without undue delay and within 30 calendar days after that notice period, unless an extension permitted below applies.

During transition we provide reasonable assistance to the customer and third parties it authorizes for switching, including the destination provider, act with due care to maintain business continuity and contracted functions, explain known continuity risks, and maintain security. We support the customer's exit strategy with relevant information and cooperate in good faith.

If the 30-day transition is technically unfeasible, we notify the customer within 14 working days of the switching request, with reasons and an alternative transition not exceeding seven months. The customer may extend transition once for a period it considers appropriate for its purposes. Extensions apply only as permitted by law.

The customer has 30 calendar days to retrieve data after transition ends, extended where agreed or required by law. On successful switching, the agreement ends as provided by applicable law and we notify the customer; retrieval rights continue. Provided that switching has completed successfully, after the retrieval period or a later agreed period we erase exportable customer data and assets subject only to legally required retention. If switching is unsuccessful or incomplete, expiry of the retrieval period alone does not authorize erasure; we follow the customer's lawful instructions and applicable duties and deadlines. This does not prevent us from carrying out a separate lawful erasure instruction. A choice of erasure instead ends the agreement at the end of the notice period in accordance with law. Ordinary closure periods do not shorten these rights or extend a mandatory erasure deadline.

Export register: submitted files and samples retain their stored formats; configured normalized outputs are CSV or JSON where generated. Customer-specific feed definitions, contract and schema versions, mapping and customer-specific integration settings, exchange and submission records, validation results, delivery and activity records, and organization contacts and access assignments are exportable categories with CSV or JSON record formats. Retrieval procedures use authorized downloads or API paths where available, with secure support-assisted delivery where needed to satisfy applicable switching duties.

For the categories listed above, we provide retained files and other exportable data in formats required by applicable law, using the documented export procedures. We provide legally required assistance and documentation. Bespoke transformations, destination configuration and additional consulting beyond those duties require a separate written agreement.

Excluded categories are service source code and provider-owned software, other customers' data, service authentication secrets that cannot lawfully or securely be transferred, and internal infrastructure, security or diagnostic information only to the extent lawfully excluded to protect provider intellectual property, trade secrets or service security. Customer-specific exportable data is not excluded merely because it is held in an internal system. Exclusions must not impede or delay lawful switching. We do not transfer our software or guarantee equivalent functionality in another service.

Before 12 January 2027, switching charges may apply only where clearly disclosed and agreed before entering this agreement, permitted by law, and no greater than directly incurred switching costs. Otherwise no separate switching charge applies. From 12 January 2027, no switching charges apply where prohibited by law. Interfaces and assistance that must legally be free remain free. Ordinary subscription charges during the applicable service period remain due. Work beyond contractual and statutory duties requires a separate written agreement and cannot be used to bypass applicable restrictions on switching charges.