DMARCeye Terms of Service

Effective from: 22 September 2026

Contents

• TERMS AND DEFINITIONS
• 1. DECLARATIONS, SUBJECT MATTER OF THE CONTRACTUAL RELATIONSHIP, SCOPE OF THE SERVICE
• 2. INTELLECTUAL PROPERTY
• 3. USER REGISTRATION
• 4. REGISTRATION OF AN ADDITIONAL USER
• 5. AGENCY ACCOUNT
• 6. FEE FOR THE SERVICE AND METHOD OF PAYMENT
• 7. SUBSCRIPTION PLANS
• 8. RIGHTS AND OBLIGATIONS OF THE USER
• 9. RIGHTS AND OBLIGATIONS OF DMARCEYE
• 10. LIMITATION OF DMARCEYE'S LIABILITY
• 11. FORCE MAJEURE
• 12. NECESSARY MAINTENANCE
• 13. CUSTOMER SUPPORT AND DEVELOPMENT
• 14. DEFECTS OF THE SERVICE
• 15. RESTRICTION OR SUSPENSION OF THE PROVISION OF THE SERVICE
• 16. DURATION AND TERMINATION OPTIONS OF THE CONTRACTUAL RELATIONSHIP
• 17. HOW TO PROCEED WHEN SWITCHING PROVIDERS (EU DATA ACT)?
• 18. PERSONAL DATA PROTECTION
• 19. FINAL PROVISIONS
• DATA PROCESSING AGREEMENT
• 1. INTRODUCTION AND A BRIEF OVERVIEW OF THE CONTENTS OF THE AGREEMENT
• 2. JOINT OBLIGATIONS OF THE CONTROLLER AND THE PROCESSOR
• 3. RIGHTS AND OBLIGATIONS OF THE PROCESSOR
• 4. FINAL PROVISIONS
• ANNEX A TO THE DATA PROCESSING AGREEMENT
• ANNEX B TO THE DATA PROCESSING AGREEMENT
• ANNEX C TO THE DATA PROCESSING AGREEMENT

(hereinafter the "Terms")

issued by ECOMAIL.CZ, s.r.o., Company ID No. (IČO): 027 62 943, with its registered office at Na příkopě 388/1, Staré Město, 110 00 Praha 1, represented by Ing. Jakub Stupka, managing director, registered in the Commercial Register maintained by the Municipal Court in Prague under file No. C 223183 (hereinafter "DMARCeye" or "we"),

Before you start using our DMARCeye service, please read these Terms carefully. Your access to the service and your use of it are conditional on your accepting and complying with these Terms and the Data Processing Agreement (DPA). These Terms apply to all Users and to anyone else who accesses or uses the service.

By accessing or using the service, you agree to be bound by these Terms. At the moment you start using the service, these Terms, including the URL links they contain, become the complete legal agreement between you as the user of the service and us. If you do not agree with any part of the Terms or the DPA, you may not use our service.

TERMS AND DEFINITIONS

Unless these Terms provide otherwise below, or unless the context clearly requires otherwise, capitalized terms used in these Terms (including the annexes) are used in both the singular and the plural with the following meanings:

1. DECLARATIONS, SUBJECT MATTER OF THE CONTRACTUAL RELATIONSHIP, SCOPE OF THE SERVICE

1.1. Declarations of the User. You declare and undertake that:

1.1.1. you have full legal capacity,

1.1.2. all information you provide about yourself is true, complete, accurate and correct,

1.1.3. you will not use the Service in violation of the applicable legal regulations of the Czech Republic,

1.1.4. you will use the Service only for the purpose for which it is intended, in particular for DMARC monitoring, domain protection and analysis of e-mail authentication,

1.1.5. before starting to use the Service, you have thoroughly familiarized yourself with the applicable Terms, you agree to them without reservation, and you will not use the Service in violation of them.

1.2. Obligations of the Contracting Parties. DMARCeye provides the Service to the User under the conditions set out below. The User accepts the Service under the conditions set out below and undertakes to pay DMARCeye the Fee according to the Price List for its use.

1.3. Scope of the Service. The Service we provide consists in particular of:

1.3.1. the User's right to use the DMARCeye Service;

1.3.2. the User's right to have a User Account set up for the Application, and by extension for the Service, and to use it;

1.3.3. the User's right to set up and provide one or more accesses to the Service for Additional Users through the User Account;

1.3.4. the right of certain Users to have an Agency Account set up for the Application, and by extension for the Service, provided DMARCeye approves this in advance;

1.3.5. the User's right to use the Bart Feature, where the User must activate the use of this Bart Feature in the Dashboard;

1.3.6. the User's obligation to pay the agreed Fee according to the current Price List.

1.4. Age of the User. We declare that the Service is not intended for persons under 18 years of age.

1.5. The Service is not intended for Consumers. The Service is not intended for Consumers, but for businesses or persons independently exercising their profession, or for public authorities. You declare that you will use the Service as a business, as a public authority or on its behalf, exclusively for purposes connected with this activity.

1.6. Use of the Service by a Consumer. If you, as a Consumer, wish to use the Service, you are obliged to inform us of this before registration, so that we can advise you of your rights.

1.7. Manner of using the Service. The Service can be used under a Subscription Plan. Within the Subscription Plans, it is also possible to use the Service free of charge.

1.8. Component services within the Service. Within the Service, you may also be provided with component services that form part of it (e.g. AI analysis, MCP integration, DNS audit tools). For the avoidance of doubt, all rules set out in these Terms that concern the provision of the Service apply, as appropriate, to the provision of the component services that form part of the Service itself.

2. INTELLECTUAL PROPERTY

2.1. Service. The Service, as well as all software related to it, is the intellectual property of DMARCeye.

2.2. Conditions of use of the Service through the individual software solutions. No provision of these Terms may be interpreted as an assignment or as the grant of a license, sublicense or other right of use within the meaning of the Copyright Act, in particular with respect to those parts of the Service solution that we provide as software as a service (SaaS). You are only entitled to use the Service provided as a software solution. You do not, however, have the right to reproduce, download, install or in any way distribute the software solution (the Service). Nor do you have the right, without our written consent, to incorporate the Service into other software.

2.3. Infringement of intellectual property rights by the User. If you breach the obligations set out in this Article 2 of the Terms, we have the right to withdraw from the contractual relationship under these Terms and to claim from you compensation for all damage arising as a result of such a breach, including non-material harm.

2.4. Bart Feature. The Service also includes the Bart Feature. The basic text editor belongs to the licensed software and the outputs of the Bart Feature are considered the User's content; however, no license is granted to the code itself or to the data relating to the Bart Feature and its configuration, and these are governed by conditions similar to Section 2.2.

2.5. Other intellectual property. If, during the term of the contractual relationship under these Terms, any performance is created that is protected under the Copyright Act (in particular a work) or as any other protected intangible asset, such performance becomes part of the Service and the Terms governing the use of the Service also apply to such performance.

2.6. Obligations of the User. When using the Service, the User is obliged to respect all rights of DMARCeye, of other Users and of third parties, in particular whenever the User in any way handles copyrighted works and other subjects of intellectual property rights while using the Service.

2.7. Infringement of intellectual property rights by the User. If you breach the obligations set out in this Article 2 of these Terms, we acquire, at the moment of the breach, the right to withdraw from the contractual relationship under these Terms and the right to claim from you compensation for the resulting damage, including non-material harm.

2.8. Outputs of the Bart Feature. All outputs of the Bart Feature obtained lawfully within the scope of use available in the Dashboard belong to the User. At the same time, DMARCeye gives no guarantee that such outputs will be protected by copyright or as intellectual property, or that they do not infringe the rights of third parties; the User may use and modify the outputs of the Bart Feature at the User's own discretion and with the awareness that the creation of a copyrighted work is not guaranteed.

3. USER REGISTRATION

3.1. User registration as a condition of using the Service. Registration is a necessary condition for the proper use of the Service; the User acknowledges this condition and undertakes to complete a proper registration.

3.2. Manner of completing User registration. Registration is completed by filling in the registration form at https://dmarceye.com/. By completing the registration, you confirm that you have read and agree to these Terms.

3.3. Correctness and completeness of information, and updates. You undertake to provide correct and complete information about yourself in the registration form and/or in the Application, or in any other situation arising in the course of using the Service. While using the Service, you have the right to change and supplement this information. You are also obliged to keep this information up to date so that it reflects the current state of affairs.

3.4. Secure password. When registering and/or changing your password, you are obliged to choose a password that is secure. Ideally, the password should consist of at least 8 characters, including lower-case and upper-case letters, digits and special characters, such as a hyphen, hash sign, question mark and others, so that it cannot be easily guessed.

3.5. Two-factor authentication. Our Service also offers the option of two-factor authentication, which you can set up in the Dashboard. If you do not use two-factor authentication, we are not liable for any damage (including non-material harm) caused in connection with a leak of your access credentials, even if it is wholly or partly caused by reasons on our side.

3.6. Duty to report misuse of access credentials. You are obliged to notify us without undue delay of any misuse, or even attempted misuse, of your access credentials. At the same time, you are obliged to choose new access credentials for the User Account without undue delay.

3.7. Deactivation of the User Account. If you wish to deactivate your User Account, please contact us, preferably by e-mail at support@dmarceye.com. If the User Account is deactivated during a Billing Period, the User Account will only be deactivated at the end of the Billing Period in which the deactivation took place. Our entitlement to the Fee for the Billing Period in which the User Account was deactivated remains unaffected. If you wish, we can convert your account to the free version after the User Account is deactivated.

3.8. Trial period. After you complete your registration, we automatically activate a free trial period of 14 days, that is, the Trial. The Trial does not require you to enter a payment card or any other payment instrument. During the Trial, you have access to all functions of the Service without restriction, as if you were using the Scale Subscription Plan.

3.9. End of the Trial. After the 14 days have elapsed, your account is automatically suspended. No payment is charged automatically. If you decide to continue using the Service free of charge (within the meaning of Section 6.2.), you must, after the end of the Trial, reduce the number of Domains in the Application to the number set by the Price List for free use of the Service. If you have more Domains in your account, you will be prompted to select the one you wish to keep. To continue with more Domains, you must switch to a paid Subscription Plan.

4. REGISTRATION OF AN ADDITIONAL USER

4.1. Inviting an Additional User. Within our Service, you have the option of inviting Additional Users into your User Account. In such a case, you are obliged to state the correct identification details of the new Additional User in the invitation.

4.2. Registration of an Additional User as a condition of using the Service. Registration is a necessary condition for the Additional User's access to the Service and its proper use. The Additional User acknowledges this condition and undertakes to complete a proper registration.

4.3. Agreement to the Terms. At the moment of registration, after clicking on the invitation sent by the User to the Additional User's e-mail address, the Additional User agrees to use the Service under these Terms, and all conditions of the provision of the Service that concern the User, including the relevant rights and obligations, apply, as appropriate, to the Additional User as well.

4.4. Access level of an Additional User. Within the Service, you also have the option of setting the access level of the Additional Users you have invited. The individual levels differ in the range of functions of the Service to which the given Additional User has access within the User Account. The access levels of an Additional User are as follows:

4.4.1. Administrator. Has access to all functions to which the User has access.

4.4.2. Editor. May work with domains, reports and the like, but has no rights to account settings or payments.

4.4.3. Viewer. Has access only to the statistics and overviews of the account, without the ability to make changes.

4.5. Liability for damage. We are not liable for any damage you incur as a result of, or in connection with, the setting of an Additional User's access level. Furthermore, we are not liable for any damage caused to you by an Additional User you have invited.

4.6. Liability for an Additional User. If an Additional User causes harm to DMARCeye or to a third party, full liability for that Additional User lies with the User within whose User Account the material damage or non-material harm was caused.

5. AGENCY ACCOUNT

5.1. Agency Account. Our Service can also be used through a so-called Agency Account. This account is intended primarily for agencies that wish to manage, through a single account, several User Accounts of their clients, who are at the same time Users of the Service.

5.2. Registration of an Agency Account. If you want to set up an Agency Account, you must first set up a regular User Account through the standard registration described in Article 3 of these Terms. You must then send a request to set up an Agency Account to our Customer Support. Only after we approve the request will an Agency Account be set up for you, which you can then start using.

5.3. Setting up a User Account within an Agency Account. If you use the Service through an Agency Account, you have the option of setting up your client's own User Account for the Service yourself. In such a case, you are obliged to fulfil all obligations concerning the registration of a User Account set out in Article 3 of these Terms, in particular to provide correct, complete and up-to-date information about your client and to choose a secure password.

5.4. Consent to the setting up of a User Account within an Agency Account. If you set up a User Account of a third party (typically your client), then at the moment of its creation you declare that you have all the necessary consents and/or authorizations to set up the User Account from the person whose User Account you are setting up. If the declaration under the preceding sentence proves to be untrue, or if you in any way exceed or otherwise breach the consent and/or authorization under the preceding sentence and we incur any damage as a result, you are obliged to compensate us for such damage, including non-material harm.

5.5. Adding an existing User Account to an Agency Account. If your client is already a User of our Service and has their own User Account, you can add their User Account to your Agency Account. To do so, however, both you and your client must send a request to our Customer Support. Only after we receive the request from both you and your client will the given User Account be assigned to your Agency Account.

5.6. Removing a User Account from an Agency Account. If you decide to end your cooperation with your client, or if for any other reason you decide to remove a specific User Account that you manage within your Agency Account, both you and your client must send a request to our Customer Support. Only after we receive the request from both you and your client will the given User Account be removed from your Agency Account. This does not apply if, in the specific situation, we consider the request for removal of the User Account to be justified even though it was not sent to us by both parties (e.g. if a dispute arises between you and your client and one of you attempts to improperly block the removal of the User Account from your Agency Account).

5.7. Liability for damage caused in connection with the management of a User Account within an Agency Account. We bear no liability for any damage arising in connection with the management of a User Account within an Agency Account, including non-material harm (e.g. if you sought to claim damages on the grounds that we allowed an Agency to set up your User Account without your consent, or if an Agency acted within your User Account contrary to your wishes, etc.). We will, however, endeavour to provide you with all assistance so that you can assert your claim for damages against the Agency (if you are a regular User) or against the User (if you are an Agency).

6. FEE FOR THE SERVICE AND METHOD OF PAYMENT

6.1. Use of the Service for a charge. The Service is provided for a charge. You undertake to pay us the Fee for the provision of the Service, in accordance with the rules laid down by the Price List and these Terms. An exception to the obligation to pay the Fee is free use of the Service under the following section.

6.2. Free use of the Service. If you use our Service under the free Subscription Plan, you do not have to pay anything as long as you do not exceed the limits of the free Subscription Plan under the Price List. If the free Subscription Plan were to be exceeded (in the number of domains), we will temporarily block your User Account and will inform you of the exceeding of the Subscription Plan either by e-mail, through your User Account or by telephone.

6.3. Amount of the Fee and method of payment. The amount of the Fee and the method of its payment differ according to the chosen Subscription Plan. The amount of the Fee is set in the applicable Price List, published on our website at https://dmarceye.com/pricing.

6.4. VAT. Unless stated otherwise in the Price List, all prices contained in it are stated exclusive of VAT, which is charged on the stated price at the statutory rate. The amount of VAT charged may therefore change depending on changes in legislation.

6.5. Changes to the Price List. We may change the Price List unilaterally. Information about a planned change to the Price List will always be available on our website. A planned change to the Price List will be announced to the Users it affects at least 15 days before the changes take effect, either by means of a notice in the User Account or by e-mail. If you do not agree with the change to the Price List, you have the right to withdraw from the contractual relationship under these Terms.

6.6. Method of paying the Fee. You may choose the method of paying the Fee for our Service, exclusively from the following:

6.6.1. by the electronic payment instrument Paddle, which is available to you through the User Account, provided that you choose the payment method designated as "online card payment";

6.6.2. and further, at your express request (where you choose the "bank transfer" payment method in the Application), by transfer to our bank account on the basis of an advance invoice due 14 days from the date of issue. We will send the invoice to your e-mail on the day of issue, and at that moment the invoice is deemed to have been delivered.

6.7. Due date of the Fee. You are obliged to pay the Fee for the provision of our Service always in advance, for each Billing Period that has already begun (this applies to all Subscription Plans):

6.7.1. if you choose the payment method designated as "online card payment", the Fee will be automatically charged, always on the first day of each new Billing Period, to the payment card you have entered in your User Account; you consent to this at the moment you enter the payment card into the User Account.

6.7.2. if you choose the "bank transfer" payment method, you are obliged to pay us the Fee no later than the first day of each new Billing Period.

6.8. Payment details and information. When setting up the method of paying the Fee, you are obliged to provide accurate, valid and complete billing and payment information. If any such information changes, you are obliged to update this information in your User Account.

6.9. Moment of payment of the Fee and provision of the Service. The Fee is deemed paid once the funds in the agreed amount have been credited to our bank account. We are not obliged to begin providing the Service before the Fee has been paid in full.

6.10. Default by the User and temporary restriction of the provision of the Service. In the event of a delay in payment of the Fee, or any part of it, in particular but not exclusively where for any reason the automatic charge of the Fee to your payment card does not take place, lasting longer than 5 days from the due date of the Fee, we are entitled to restrict the provision of the Service to you under these Terms and to restore it only after the outstanding Fee has been paid and, where applicable, a new payment method has been chosen or the existing one corrected.

6.11. Overview of payments and tax documents. If we are obliged to issue a tax document, it will be issued electronically in PDF format and will be accessible to you in your User Account. An overview of payments is also available to you in your User Account.

7. SUBSCRIPTION PLANS

7.1. Subscription Plan. The scope of the Services you may use depends on the type of Subscription Plan you choose for using the Service. The Service is provided under Subscription Plans. DMARCeye is entitled to a Fee depending on the chosen Subscription Plan.

7.2. Functions included in the price of the chosen Subscription Plan. An overview of the functions included in the Subscription Plans is specified in the Price List.

7.3. Domain Slot as a billing unit. The Fee for using the Service under the paid Subscription Plans depends on the number of Domain Slots assigned to you in the given Billing Period. A Domain Slot is reserved capacity for monitoring one Domain; it remains occupied even if the Domain is not fully configured or does not receive DMARC reports.

7.4. Replacing a Domain within a Domain Slot. During a Billing Period, you may at any time remove a Domain from a Domain Slot and assign another Domain in its place, without any additional charge, provided that the total number of occupied slots does not exceed your paid limit.

7.5. Subdomains. Each subdomain added to the Service occupies its own Domain Slot in the same way as a main Domain. If you manage several subdomains alongside a main domain, each of them must be included in the total number of paid Domain Slots.

7.6. Temporarily deactivating a Domain. A Domain can be temporarily deactivated. Such a Domain does not receive DMARC reports, is not monitored, does not occupy a Domain Slot, and is not counted towards billing for the duration of the deactivation. This Domain can be reactivated at any time, provided you have a free Domain Slot in your User Account.

7.7. Changes in the number of Domain Slots during a Billing Period. If the number of Domain Slots changes during a Billing Period, then

7.7.1. with a monthly Billing Period, changes in the number of Domain Slots (both additions and removals) take effect only in the following billing cycle; the Fee does not change during the month;

7.7.2. with an annual Billing Period, newly added Domain Slots are billed pro rata for the remaining part of the period.

7.8. Exceeding the Subscription Plan. You manage the number of Domain Slots within your Subscription Plan yourself through the Dashboard. We do not automatically move you to a higher Subscription Plan. If you need to monitor more domains than your current plan allows, you are obliged to add Domain Slots yourself in the Dashboard. New Domain Slots are billed according to the rules set out in Section 7.7 of these Terms.

7.9. Additional payment of the Fee when upgrading the Subscription Plan. If you have chosen one year as the Billing Period under your chosen Subscription Plan, you are obliged to pay an additional amount corresponding to the amount by which the Fee for the Billing Period increased as a result of the upgrade of the Subscription Plan, reduced pro rata by the number of months of the current Billing Period that have already elapsed (so if you started using our Service on 1.1.2025 and paid CZK 1,000 per year for your Subscription Plan, and from 1.7.2025 your Subscription Plan is upgraded to a level for which we are entitled to CZK 1,500 per year, you will be obliged to pay us an additional CZK 750). For the purpose of this additional payment of the Fee, an invoice will be issued and sent to your e-mail address.

7.10. Minimum duration of a Subscription Plan. The minimum duration of a Subscription Plan is

7.10.1. 12 consecutive calendar months, in which case the Fee is payable once per calendar year;

7.10.2. 1 calendar month, in which case the Fee is payable once per calendar month.

7.11. Fee for the Bart Feature. The Bart Feature is not available under the free Subscription Plan, except that during a free trial period of the Service that is subsequently to be converted into a paid Subscription Plan, the Bart Feature may also be tried out with a volume of 10 messages. The Bart Feature is then available under a paid Subscription Plan, provided that if the use of the Bart Feature were to become economically burdensome relative to the amount of the Fee paid, DMARCeye may restrict the Bart Feature or notify the User that it will require an additional Fee.

8. RIGHTS AND OBLIGATIONS OF THE USER

8.1. The User's undertakings concerning the use of the Application and the use of the DMARCeye Service. You undertake that:

8.1.1. you will not take any action capable of disrupting or damaging the Application or of endangering or preventing the provision of our Service;

8.1.2. you will neither attempt to use nor use any interface other than the interface provided by us for accessing the Application, and by extension the Service;

8.1.3. you will not disclose to any third party any of the identification details and passwords necessary for access to the Application, and by extension the Service, and if you discover any misuse of your identification details and passwords by any third party, you will inform us of this immediately;

8.1.4. you will choose a password for the Application, and by extension the Service, that corresponds to a high level of security of the User Account.

8.2. Domain verification. You undertake to verify each Domain added to the Service, in particular to set up the relevant DNS records (DMARC, SPF, DKIM) according to our instructions.

8.3. Content and use of the Service. You further undertake to use the Service exclusively in accordance with legal regulations and these Terms. In particular, you undertake that, through the Service or in connection with it, you will not:

8.3.1. disrupt the security or integrity of networks, servers or other systems of third parties;

8.3.2. attempt to gain unauthorized access to the systems or data of other Users;

8.3.3. misuse the Service to spread malware, spam or other harmful content;

8.3.4. infringe the intellectual property rights of DMARCeye or of third parties;

8.3.5. act in any other respect contrary to good morals or applicable legal regulations.

8.4. Breach of these Terms by the User. It is not a breach of these Terms if the Service is not properly provided because you have breached any provision of these Terms. If you breach the obligations set out in Section 8.3 of these Terms, we have the right, even without prior notice, to immediately stop providing the Service to you, to deny you access to the Application, and by extension the Service, and to withdraw from the contractual relationship under these Terms.

8.5. Compensation for damage arising from a breach of the User's obligations. If you breach the obligations set out in these Terms, in particular in this Article 9 of these Terms, you are obliged to reimburse us for all costs and expenses we incur in connection with claims asserted against us by third parties as a result of such a breach by you. This is without prejudice to our claim, and the claims of third parties, for compensation for harm (both damage and non-material harm) arising as a result of the breach referred to in the preceding sentence, which you undertake to pay to us and/or to the third parties.

8.6. Technical equipment of the User. You are obliged to obtain appropriate technical equipment that will allow you to use the features of our Service in accordance with these Terms. You are also obliged to check whether your technical equipment meets the technical requirements of our Service before you start using it.

8.7. Use of the Bart Feature. The User undertakes not to use the Bart Feature in an unlawful manner or to prompt it to act in an inappropriate, degrading or other manner that could be legally, ethically or morally problematic. If we discover such use, we may block your access to the Bart Feature or your entire User Account.

9. RIGHTS AND OBLIGATIONS OF DMARCEYE

9.1. Changes to the Service. We are entitled to make changes (updates) to the content and functions of the Service at any time (both adding and removing content/functions). This takes place automatically, and these Terms also apply to the updated Service. You do not have the right to refuse these changes, as the Service is provided "as is". You will be informed of updates to the Service either by e-mail, through our website or through your User Account.

9.2. Disagreement with changes to the Service. If you do not agree with a change to the Service under the preceding section, you are obliged to stop using the Service and to withdraw from the contractual relationship under these Terms.

9.3. Service outages and DMARCeye's liability. We bear no liability for outages in the operation of the Service. We will, however, make such efforts as can reasonably be required of us to restore the Service to operation in the shortest possible time.

9.4. Inspection of the User Account. We have the right to inspect your User Account and, if we discover a breach of these Terms or of applicable legal regulations, to suspend the provision of the Service; where applicable, we will inform you of this promptly.

9.5. Procedure in the event of faults not on the side of DMARCeye. We reserve the right, in justified cases of faults of a technical nature on your side or in the Internet network, to restrict or temporarily stop the provision of the Service, of which we will inform you without undue delay. This concerns in particular Internet network outages or circumstances that require the cooperation of third parties.

9.6. Access via the API. If we allow you access to your data via the API interface, you are obliged to ensure that only authorized persons have access to this interface. We are not liable for any loss of data or breach of Personal Data protection in the event of misuse of API access.

9.7. Use of the User's marks in references. You agree that we may use any brands, logos and trade names in order to identify you as our user/customer, both in any marketing materials and on our website and/or within the Service. For this purpose, you grant us a non-exclusive, worldwide license to use such brands, logos or trade names for the duration of the contractual relationship under these Terms. You may revoke your consent at any time and withdraw from the granted license by sending an e-mail to support@dmarceye.com.

10. LIMITATION OF DMARCEYE'S LIABILITY

10.1. Exclusion of DMARCeye's liability. We bear no liability for the completeness and correctness of the data you provide to us in the course of using the Service. Furthermore, we bear no liability for any loss, corruption or destruction of the data so provided. It is entirely up to you to ensure a sufficient backup of all data and systems before you provide them to us for processing for the purpose of providing the Service, so that no one suffers harm.

10.2. Integrations. DMARCeye bears no liability for the properties, functionality or freedom from defects of any individual software that you decide to integrate within your User Account or configure to work with the Service. This liability is borne by the suppliers of that other software (those integrations), with whom you are obliged to conclude a separate agreement.

10.3. Exclusion of DMARCeye's liability for damage arising as a result of Necessary Maintenance. We are not liable for any financial losses you may incur as a result of the suspension of the Service due to its updating or due to Necessary Maintenance. You expressly acknowledge this.

10.4. Restriction or prevention of the Service beyond DMARCeye's control. We bear no liability for the prevention or restriction of the use of the Service due to any circumstances of a technical nature that we are unable to influence or whose resolution requires the cooperation of third parties.

10.5. Links to third-party websites or services. The Service may contain links to third-party websites or services that we do not own or control. We have no control over the content, privacy policies or practices of any third-party websites or services. We are therefore not responsible, directly or indirectly, for any damage or loss caused or allegedly caused by or through the use of any such content, goods or services available on or through such websites or services, or caused or allegedly caused by reliance on them.

10.6. Limitation of liability for the Bart Feature. By using the Bart Feature, you acknowledge that it uses generative artificial intelligence models; we therefore cannot be liable for its outputs, and thus neither for the accuracy of the communication and outputs of the Bart Feature. When using the Bart Feature, you are always transparently informed that you are communicating with an artificial intelligence, which can make mistakes.

10.7. Use of the output of the Bart Feature. You are fully responsible for the use of the output of the Bart Feature. DMARCeye does not guarantee that the output of the Bart Feature does not infringe the rights of third parties, in particular in the area of intellectual property and personality rights. As the User, you are responsible for checking the outputs before using them. DMARCeye is not liable for any harm caused to third parties by the use of the output of the Bart Feature; you are obliged to compensate such harm.

10.8. Limitation of liability for damage caused by the Bart Feature. The Bart Feature is a consulting AI that helps with the use of the Service; it is not, however, an expert, nor does it provide binding information or advice. If you follow a procedure suggested by the Bart Feature, or use wording it produced, and this causes you harm, we as DMARCeye are not liable for it. This limitation covers harm caused to you, private-law claims of third parties, and public-law sanctions that may arise from inappropriate use of the outputs of the Bart Feature or from carrying out a suggested procedure.

10.9. Limitation of damages. If we were liable to compensate damage or harm that might arise in connection with the provision of the Service, our liability is limited to the amount of the Fee you have paid over the last 6 months. Damage arising after the end of the contractual relationship under these Terms is also counted towards this limitation of damages. If you use the free Subscription Plan, DMARCeye's obligation to compensate any damage is entirely excluded.

11. FORCE MAJEURE

11.1. Conditions for invoking Force Majeure. We are not liable for a breach of obligations under these Terms caused by Force Majeure, unless these Terms provide otherwise.

11.2. What is Force Majeure? Force Majeure means any obstacle that has arisen independently of our will and that prevents us from fulfilling our obligation, where it cannot reasonably be assumed that we could have averted or overcome this obstacle or its consequences, or that we could have foreseen this obstacle at the time the obligation arose.

12. NECESSARY MAINTENANCE

12.1. Necessary Maintenance. It is not a breach of these Terms if the Service is not provided as a result of Necessary Maintenance. Necessary Maintenance is generally announced in advance through the User Account.

12.2. Notice of Necessary Maintenance. You are obliged to tolerate a short-term outage of the Service consisting in its restriction or interruption; you will generally be informed of this by a notice in your User Account or by e-mail at least 12 hours before it takes place. In such a notice, we will state what kind of maintenance will be involved and the expected start and end times of the work.

12.3. Updates. In addition to Necessary Maintenance, we will also carry out free updates of the Application. The aim of these updates is to improve the provision of the Service and make it easier to operate in the User Account. We are also entitled to restrict or suspend the provision of the Service for the time strictly necessary to carry out an update. We will generally notify you of updates through your User Account or by e-mail.

13. CUSTOMER SUPPORT AND DEVELOPMENT

13.1. Provision of Customer Support. You have the right to use our Customer Support through the chat box in the Dashboard or by e-mail at support@dmarceye.com, and we will try to resolve your request as quickly as possible. If you contact technical support on business days between 9:00 and 17:00, there is a greater chance that your request will be resolved more quickly. We provide no guarantees in connection with the provision of Customer Support.

13.2. Development requests. If we determine that a request you have raised with our Customer Support requires the work of our developers or other professional specialists, we may require you to pay a Fee for the work of these staff, in the form of a Fee per hour of such a staff member's work (a so-called person-hour), whereby we will first agree with you in writing by e-mail on the estimate of the total time spent resolving your request and on the hourly rate of the specific staff member.

14. DEFECTS OF THE SERVICE

14.1. Rights when Defects arise. If the Service is provided defectively or is not provided in accordance with these Terms, you have the right to submit a complaint to us about the defect in the provision of the Service.

14.2. Time limit for submitting a complaint. A complaint about Defects must be submitted in writing, no later than 2 days from the moment you discover the deficiency of the Service, but in any case no later than 24 hours from the restoration of the Service, by e-mail to support@dmarceye.com. A complaint submitted later will not be accepted, and you thereby lose any claims to compensation.

14.3. Required contents of a complaint. In the complaint, you are obliged to state your identification, a detailed description of the grounds of the complaint and the time they arose, and, where applicable, the time the Service was restored.

14.4. Handling of a complaint. We are obliged to resolve your complaint no later than 30 days after receiving it. If the complaint is justified, you have the right to compensation for the defectively provided Service. A submitted complaint has no effect on the due date of the Fee.

15. RESTRICTION OR SUSPENSION OF THE PROVISION OF THE SERVICE

15.1. Restriction or suspension of the Service. We reserve the right to restrict or suspend the provision of the Service if we consider that you are breaching these Terms and/or legal regulations. Such a decision will be sent to you no later than the moment the restriction or suspension of the Service takes effect, either through your User Account or by e-mail (generally 15 days in advance). We are not required to provide the reasons for the suspension or restriction of the service, in particular if we are able to prove that you have repeatedly breached these Terms or legal regulations and this has led to the termination of the provision of the Service.

15.2. Exceptions to the notification obligation. You acknowledge that we are not obliged to notify you of a decision to restrict or suspend the Service at least 15 days in advance, provided that:

15.2.1. we are subject to a legal or regulatory obligation requiring us to terminate the provision of the Services to a particular business User in a manner that does not allow us to comply with the notification period;

15.2.2. we exercise a right to terminate the provision of the Services for a serious reason in accordance with applicable legal regulations; or

15.2.3. we are able to prove that you have repeatedly breached these Terms or legal regulations and this has led to the termination of the provision of the Service.

15.3. Termination of the provision of the Service. We reserve the right to make the Service permanently inaccessible at any time. In such a case, we are obliged to notify you of this decision, together with the reasons for it, at least 30 days before the termination decision takes effect. In such a case, we will send the notice to you either through your User Account or by e-mail.

16. DURATION AND TERMINATION OPTIONS OF THE CONTRACTUAL RELATIONSHIP

16.1. Duration of the contractual relationship. This contractual relationship is concluded for an indefinite period, at the moment of your registration for the Service.

16.2. Termination by the User. You have the right to unilaterally terminate the contractual relationship under these Terms without stating a reason, in such a way that, at your request, we deactivate your User Account. The contractual relationship under these Terms is deemed terminated as of the last day of the Billing Period in which the User Account was deactivated.

16.3. Termination by DMARCeye. We have the right to unilaterally terminate the contractual relationship under these Terms without stating a reason, either by a written notice of termination sent to the e-mail address you have entered in your User Account, or by deactivating your User Account. We will inform you of any deactivation of the User Account via the e-mail address entered in the User Account, no later than on the day of its deactivation. The contractual relationship under these Terms is deemed terminated as of the last day of the Billing Period in which the notice of termination was delivered to the User, or in which the User's User Account was deactivated.

16.4. Deemed termination of the contractual relationship. The contractual relationship under these Terms is deemed terminated upon the expiry of 2 years from your last login to the User Account. In such a case, we are entitled to remove your User Account.

16.5. Loss of capacity to provide the Service. You agree that, in the event that we lose, through no fault of our own, the capacity to provide the Service, for example due to a change in legal regulations, the contractual relationship under these Terms is deemed terminated as of that moment, and this is not considered a breach of these Terms.

16.6. Material breach of the Terms or of applicable legal regulations. We have the right to restrict or not provide the Service, to block your User Account and to immediately withdraw from the contractual relationship under these Terms as soon as we discover a material breach of these Terms or of applicable legal regulations. A material breach under the preceding sentence means in particular:

16.6.1. conduct capable of endangering, in any way, the software necessary for the provision of the Service;

16.6.2. conduct by which you attempt to circumvent the Price List (for example, splitting the number of Domains so as to create multiple User Accounts operating under the Free Subscription Plan, or splitting the number of Domains so as to reduce the Subscription Plan;

16.6.3. misuse of the Service for illegal purposes or for spreading harmful content;

16.6.4. if you act contrary to these Terms or applicable legal regulations;

16.6.5. if you use the Service in a manner that may harm us, and/or if you even merely attempt to misuse, block, modify or otherwise alter any part of our Service;

16.6.6. an attempt to gain unauthorized access to the systems or data of other Users;

16.6.7. if you even merely attempt to obtain the login names and/or passwords of other Users of the Service;

16.6.8. use of Personal Data of third parties that you have no legal ground to process.

16.7. Fee already paid and material breach of the Terms. If the contractual relationship under these Terms is terminated due to a material breach under the preceding section, you have no right to a refund of the pro rata part of the Fee already paid for the use of the Service.

17. HOW TO PROCEED WHEN SWITCHING PROVIDERS (EU DATA ACT)?

17.1. Switching to another provider. You may notify us at any time that you wish to switch to another provider of a similar service, transfer your Exportable Data to your own local infrastructure, or have it erased. In all of these cases, we are obliged to provide you with your Exportable Data, to cooperate on your exit strategy and to provide relevant information. During the switching process, we ensure the security of the Exportable Data during its transfer, storage and disclosure.

17.2. Notice period and transitional period. After the notification under Section 17.1, a notice period runs, which begins on the day the notification is delivered and expires on the last day of the month following the month in which you made the notification under Section 17.1, meaning this period will not exceed two months. This is followed by a transitional period of 30 calendar days, during which we will provide you with reasonable assistance with the migration. You have the right to extend the transitional period once.

17.3. Termination of the agreement. When the procedure under this Article is followed, the Agreement is deemed terminated: (i) on the day we confirm the successful completion of the migration/export of the Exportable Data, or (ii) upon the expiry of the transitional period. We will inform you of the termination by e-mail.

17.4. Handover of Exportable Data. We will hand over your Exportable Data to you in machine-readable formats or via the API. A detailed and up-to-date list of categories, technical formats and available APIs is described in our online data registry available on our website. There you will also find a detailed explanation of how to switch to another provider, in what formats the Exportable Data can be transferred, and what the limitations of the transfer are.

17.5. What data is not transferred. We do not hand over any data or information that is ours. This means in particular data concerning the Application, the user interface, other software, internal models and methodologies, and licensed third-party data.

17.6. Continuity of provision. During the notice period, we provide the Services under the Agreement. After it expires, we also ensure the continuity of the provision of the Services during the transitional period, to the extent necessary to complete the migration. This is without prejudice to our rights to suspend or restrict the Service in the cases set out in these Terms (e.g. delay in payment) and to our rights regarding Necessary Maintenance.

17.7. Data availability and erasure. After the end of the transitional period, we will retain the exportable data and keep it accessible for a further 30 calendar days. After this period expires, we will carry out a complete erasure of all Exportable Data and digital assets created directly by the customer or directly related to the customer, provided the transfer has been successfully completed.

17.8. Discounts and early termination. If you obtained a discount on the Fee conditional on a longer period (e.g. an annual plan) and you terminate the agreement earlier under this Article, you are obliged to pay the difference between (i) the discounted price for the period used, and (ii) the standard price without the discount for the period used. The amount will be calculated according to the Price List. This difference will be deducted when the overpayment is refunded under Section 17.9.

17.9. Overpayment. If the agreement is terminated early under Section 17.1 and we record an overpayment of the Fee on your account, we will refund this overpayment to you within 14 days of the termination of the agreement.

17.10. Transparency of international access. We store and process Exportable Data in the EU, or the EEA. We publish the current list of countries and involved subcontractors in our online data registry. If authorities outside the EEA request access to data, we will assess the lawfulness of the request and inform the customer of the disclosure, where legal regulations permit. We share data only to the extent necessary and ensure its protection through appropriate technical and legal measures.

18. PERSONAL DATA PROTECTION

18.1. Data Processing Agreement. The protection of Personal Data is addressed in the Data Processing Agreement, which is Annex No. 1 to, and an integral part of, these Terms.

18.2. Privacy Policy. The protection of Personal Data by DMARCeye is further described in the Privacy Policy.

19. FINAL PROVISIONS

19.1. Governing law. These Terms are governed by the law of the Czech Republic, and the conflict-of-law rules of private international law are excluded.

19.2. Amicable dispute resolution, jurisdiction of courts. We will always attempt to resolve any dispute arising between us amicably. If an amicable resolution of the matter cannot be reached, the courts will take over. We agree that any disputes arising in connection with the use of the Service will be resolved by the court with subject-matter and territorial jurisdiction for the territory of the District Court for Prague 1 in the Czech Republic.

19.3. Survival of provisions after termination of the contractual relationship under these Terms. The rights and obligations set out in the provisions of Articles 2., 10., 11. and Sections 4.5., 5.7., 8.5., 16.7. remain in force even after the termination of the contractual relationship under these Terms.

19.4. Amendments to the Terms. These Terms may be unilaterally amended or cancelled by DMARCeye in writing. DMARCeye will announce an amendment to the Terms on its website, in the Dashboard or by e-mail.

19.5. Declaration of legal succession. Both DMARCeye and the User declare and agree that the rights and obligations arising for them from these Terms pass to their legal successors in the event of their dissolution or of any other legal events resulting in a transfer of rights and obligations.

19.6. Validity and effect. These Terms enter into force and take effect on 22 September 2026.

DATA PROCESSING AGREEMENT
ANNEX NO. 1 TO THE DMARCEYE TERMS OF SERVICE

(hereinafter the "Data Processing Agreement") concluded between:

A. You, who have decided to use the DMARCeye service

(hereinafter the "Controller" or "you")

and

B. ECOMAIL.CZ, s.r.o., Company ID No. (IČO): 027 62 943, with its registered office at Na příkopě 388/1, Staré Město, 110 00 Praha 1, represented by Ing. Jakub Stupka, managing director, registered in the Commercial Register maintained by the Municipal Court in Prague under file No. C 223183,

(also as the "Processor", "DMARCeye" or "we")

(the Processor and the Controller hereinafter jointly the "Contracting Parties" and individually a "Contracting Party").

If you use the DMARCeye service (hereinafter the "Service"), then DMARCeye will be the processor of the Personal Data you entrust to us. The Service is provided under the DMARCeye Terms of Service (hereinafter the "Terms"). By accepting the Terms, you confirm that you have read and agree to the Data Processing Agreement and that it is legally binding on you.

Please read this Data Processing Agreement carefully, as it defines the conditions of the processing of Personal Data under which the Service is provided. If you have any questions concerning the processing of Personal Data, you can contact us at any time at support@dmarceye.com.

The Contracting Parties process Personal Data in connection with the concluded Agreement in accordance with legal regulations, in particular in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter the "GDPR"). Under the GDPR, the Contracting Parties must set out the rules of processing in writing, which they do in this Data Processing Agreement.

1. INTRODUCTION AND A BRIEF OVERVIEW OF THE CONTENTS OF THE AGREEMENT

1.1. Subject matter and purpose of the Data Processing Agreement. By concluding this Data Processing Agreement, you as the Controller instruct the Processor to carry out the processing of Personal Data for you in connection with the provision of the Service. The aim is to ensure the protection of Personal Data to the extent required by legal regulations. The scope of the Personal Data processed can be found in Annex A to this Data Processing Agreement.

1.2. The DMARCeye Service. The DMARCeye Service consists in particular of the provision of electronic tools for DMARC (Domain-based Message Authentication, Reporting and Conformance) monitoring, analysis of XML reports, management of e-mail authentication policies and protection of a domain against unauthorized use, e-mail spoofing and phishing attacks, as defined in more detail in the Terms.

1.3. What the positions of Processor and Controller mean. When using the Service, you provide us with Personal Data of which you are the Controller, and we then process that data on your instruction and to the extent you have chosen. In the processing of Personal Data, you are in the position of controller of Personal Data under Article 4(7) of the GDPR and DMARCeye is in the position of processor under Article 4(8) of the GDPR.

1.4. Written form. In accordance with Article 28 of the GDPR, the Contracting Parties set out the rules of processing in writing in this Data Processing Agreement.

1.5. Definitions. The definitions of terms in the Terms are adopted with the same meaning in this Data Processing Agreement.

1.6. Duration. This Data Processing Agreement is concluded for the duration of the contractual relationship under the Terms.

1.7. Moment of conclusion and termination of the Data Processing Agreement. The Data Processing Agreement is concluded at the moment the registration for the purpose of using the Service is completed. The Data Processing Agreement may be terminated under the same conditions as the termination of the use of the Service under the Terms.

1.8. Effects of termination. Termination of this Data Processing Agreement simultaneously results in the termination of the contractual relationship in the areas to which this Data Processing Agreement relates, unless the Contracting Parties agree otherwise. Termination of the contractual relationship under the Terms also terminates this Data Processing Agreement. However, termination of this Data Processing Agreement is without prejudice to the Processor's obligations regarding the handover (return) of Personal Data to the Controller or its disposal, and regarding the maintenance of the confidentiality of information.

2. JOINT OBLIGATIONS OF THE CONTROLLER AND THE PROCESSOR

2.1. Lawfulness of processing. The Controller and the Processor undertake to comply with the regulations governing the protection of Personal Data.

2.2. Cooperation. The Controller and the Processor undertake to assist each other, to the necessary and reasonable extent, in fulfilling the obligations relating to the processing of Personal Data that arise from the agreements concluded between them and from legal regulations, in particular in connection with responses to the exercise of data subjects' rights, with security incidents, and also with the preparation of impact assessments and with dealings with supervisory authorities. The Contracting Parties undertake to provide the documents necessary for handling a request concerning the processing of Personal Data under the Terms. A Contracting Party will provide these documents without undue delay, but no later than within 10 business days of receiving the other Contracting Party's request for cooperation.

2.3. Incidents. A Contracting Party will notify the other party that it has become aware of a security breach within 48 hours of the moment it becomes aware of the breach. A breach means any case of a breach of the security of Personal Data that may potentially lead to the accidental or unlawful destruction or alteration of, or the unauthorized disclosure of or access to, Personal Data processed under the Terms.

3. RIGHTS AND OBLIGATIONS OF THE PROCESSOR

3.1. Restriction of access. The Processor will ensure that access to Personal Data is restricted solely to (a) employees who process Personal Data within the scope of their job duties, and further (b) persons who cooperate with the Processor and who, within that cooperation, may process Personal Data for the Processor, in accordance with the conditions of this Data Processing Agreement and for the purpose of providing the Services under the Terms. If these persons are not subject to a statutory duty of confidentiality, the Processor will ensure their confidentiality by contract.

3.2. The Processor's undertaking concerning the measures adopted. The Processor has adopted, and undertakes to maintain for the entire duration of this Data Processing Agreement, appropriate technical and organizational measures under the GDPR that apply to the Processor. An overview of the adopted measures can be found in Annex B to this Data Processing Agreement.

3.3. Undertakings of the Processor. The Processor undertakes:

3.3.1. when processing Personal Data, to comply with all obligations arising for processors of Personal Data from the relevant legal regulations;

3.3.2. to process Personal Data exclusively on the basis of the Controller's instructions given under this Data Processing Agreement, including with regard to transfers of Personal Data to a third country or to an international organization;

3.3.3. to notify the Controller without undue delay of any cases in which the Office for Personal Data Protection or another administrative authority initiates an inspection or other administrative proceedings in relation to the processing of Personal Data by the Processor, and to provide the Controller with all information on the course and results of this inspection, or the course and results of such proceedings;

3.3.4. to assist the Controller in ensuring compliance with the Controller's obligations concerning the security of Personal Data under Articles 32 to 36 of the GDPR, taking into account the nature of the processing to be carried out by the Processor;

3.3.5. to allow the Controller to conduct internal audits, including inspections, carried out by the Controller or by another auditor mandated by the Controller, on the condition that these are announced to the Processor one month before they take place; the Processor may raise objections against any auditor mandated by the Controller if the auditor is not independent, or is in a competitive or similar position vis-a-vis the Processor. On the basis of an objection raised by the Processor, the Controller is obliged to mandate a different auditor;

3.3.6. to report to the Controller every breach of the security of Personal Data of which it becomes aware, without undue delay and no later than within 48 hours of the moment it becomes aware of the security breach. The minimum scope of this notification is set out in Article 33(3) of the GDPR;

3.3.7. to keep records of all breaches of the security of Personal Data and of the corrective measures adopted to ensure an adequate level of security of processing. The Processor is obliged to provide the Controller with all necessary cooperation connected with the investigation of a security breach and with the fulfilment of the Controller's obligations under Articles 33 to 34 of the GDPR;

3.3.8. to assist the Controller in providing evidence of the processes or documents demonstrating that the Controller complies with the GDPR.

3.4. Reimbursement of costs. The Contracting Parties have agreed that the Processor is entitled, as against the Controller, to reimbursement of the reasonable costs connected with providing cooperation.

3.5. Confidentiality of the Processor. The Processor undertakes to observe a duty of confidentiality with respect to all Personal Data provided by the Controller, and will keep it secret and will not publish it or make it accessible to any third party, either in whole or in part, unless it is to be handed over on the basis of the Controller's instruction or where a legal regulation so provides.

3.6. Trade secrets. All information and documents that the Processor makes accessible to the Controller in connection with an audit or inspection form part of the Processor's trade secrets and, unless provided otherwise, are subject to the confidentiality requirements under this Data Processing Agreement. This information and these documents may be made accessible only to a competent supervisory authority.

3.7. Lawfulness of processing. The Processor undertakes to fulfil the Processor's obligations concerning the protection of Personal Data for the entire period during which the Terms are in effect, unless it follows from the provisions of the Terms, of this Data Processing Agreement or of the relevant legal regulations that they are to continue even after the Terms cease to be in effect.

3.8. Engaged processors and the engagement of a new processor. The Processor has further engaged in the processing of Personal Data the providers listed in Annex C. If the Processor engages other processors, it will inform the Controller of this before the change, by e-mail or directly in the Application. If the Controller does not agree with the engagement of the new processor, the Controller may raise an objection, no later than 5 days from the delivery of the Processor's notice. Raising an objection, and thus the non-engagement of the new (sub-)processor, may result in it becoming impossible to use the Service.

3.9. Programmers and other specialists of the Processor. The Controller expressly agrees to the engagement of additional processors - programmers and other specialists of the Processor acting as self-employed natural persons who provide services to the Processor on the basis of a cooperation agreement.

3.10. Obligations of the Processor upon termination of the cooperation. The Processor undertakes that, if the provision of the Services is terminated, it will erase all Personal Data and, at the Controller's request, return it, including all copies, unless EU or Czech law requires its storage. If the Controller so wishes, the Processor will ensure that all routinely exported data is transferred to the Controller, as standard within 60 days of the termination of the Agreement; after this period, the Processor will make the Controller's data inaccessible.

4. FINAL PROVISIONS

4.1. Governing law. Issues not specifically regulated in this Data Processing Agreement are governed by generally binding legal regulations. The Data Processing Agreement is governed by, and will be interpreted in accordance with, the law of the Czech Republic, in particular Act No. 89/2012 Coll., the Civil Code, as amended. The Contracting Parties have agreed that commercial customs do not take precedence over any provisions of the law, not even over provisions of the law that do not have mandatory effect.

4.2. Force Majeure. The Processor bears no liability for situations in which it was unable to fulfil an obligation arising from the Data Processing Agreement due to an event designated as Force Majeure (war, unrest, terrorism, uprisings, strikes, fires, epidemics or natural disasters).

4.3. Communication between the Contracting Parties. The Contracting Parties have agreed that their communication concerning the Data Processing Agreement (including notification of a security incident) will take place via the following e-mail addresses:

4.3.1. the Controller: the e-mail address with which the Controller registered for the Service;

4.3.2. the Processor: support@dmarceye.com.

4.4. Prohibition of assignment. Neither Contracting Party may in any way assign or transfer the rights and obligations arising from this Data Processing Agreement or related to this Data Processing Agreement without the prior written consent of the other Contracting Party.

4.5. Updates and changes. The Processor reserves the right to modify or update this Data Processing Agreement. If we make changes that alter the rights and obligations under the Data Processing Agreement, you will be informed of this in good time by an e-mail we send to you. If you continue to use the Service, you agree to the updated version of the Data Processing Agreement. If you do not agree with the changes, please stop using the Service.

4.6. Effect. This Data Processing Agreement takes effect on the same day as the Terms.

4.7. Annexes. The Data Processing Agreement includes the following annexes:

• Annex A: Nature, scope, duration and purpose of the processing of Personal Data,
• Annex B: Technical and organizational measures.
• Annex C: List of processors

ANNEX A TO THE DATA PROCESSING AGREEMENT
NATURE, SCOPE, DURATION AND PURPOSE OF THE PROCESSING OF PERSONAL DATA

Nature of the processing. Personal Data is processed in an automated manner through the Processor's systems used by the Processor for the provision of the Service.

Purpose. The purpose of the processing is to enable Controllers to use the Service (performance of the agreement).

Legal ground for the processing. The legal ground for the processing of Personal Data within the provision of the Service is the performance of the agreement.

Scope of the processing: Depending on how the Controller uses the Service, the following Personal Data in particular may be processed in connection with the provision of the Service:

• Contact details: first name, surname, e-mail, telephone number, address, date of birth, academic title, Company ID No. (IČO), registered office;
• Technical data: IP address, browser type, information about domains, DMARC/SPF/DKIM records;
• Any other Personal Data, processed exclusively on the instruction of the Controller, which the Controller considers necessary for fulfilling the purpose of the agreement as set out in the Terms, or other data attributable to data subjects.

Special categories of Personal Data. The Controller undertakes not to make accessible to the Processor any Personal Data falling within the special categories of Personal Data within the meaning of Article 9 of the GDPR. Special categories of Personal Data may be processed only after express prior agreement with the Processor. What are special categories of Personal Data? They are Personal Data revealing the racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, state of health, or sex life or sexual orientation of a natural person. Genetic and biometric data are also considered a special category of data where they are processed for the purpose of uniquely identifying a natural person.

Data subjects. As a rule, this concerns the Personal Data of the Controller's customers or clients, the Controller's employees and other cooperating persons including suppliers, users of the Controller's websites, and business partners or their employees or representatives.

Duration of the processing. Personal Data is processed for the period set out in Section 3.10. of the Data Processing Agreement, unless an agreement of the Contracting Parties provides otherwise.

ANNEX B TO THE DATA PROCESSING AGREEMENT
TECHNICAL AND ORGANIZATIONAL MEASURES

Technical measures. Security is very important to us, and we therefore work continuously to keep your Personal Data protected. When choosing measures, we take into account the scope of the processing, the riskiness of the processing and the state of our technology.

• We back up data regularly;
• we update our antivirus software systems;
• we encrypt data using SSL/TLS ("secure sockets layer / transport layer security") for all data transmission;
• we use the secure https protocol;
• our data on the servers is encrypted;
• we develop our technology with personal data protection in mind (privacy by design);
• access passwords to the information systems (where Personal Data will be processed) and access authorizations are controlled at the level of individuals.

Organizational measures. We have adopted, and undertake to comply with, the following measures:

• Our employees and our service suppliers are bound by confidentiality;
• our employees are properly trained, and also regularly retrained, on the GDPR and are familiarized with the rules for safe work on work devices;
• where API Keys are stored, we remove authorization data;
• access to all systems, including the information system, is personalized and protected by secure passwords;
• we keep passwords in the production environment in a separate location (safe store), for which logs are recorded, so that we can monitor employees' access to the individual Personal Data of Users.

ANNEX C TO THE DATA PROCESSING AGREEMENT
LIST OF PROCESSORS

This is a translation. The governing version is the Czech original.