NEXIVO PLATFORM TERMS

§ 1. SERVICE PROVIDER AND CONTACT DETAILS

• The service provider of the Nexivo Platform is Marek Kupaj conducting business under the name Nivato Marek Kupaj, with a fixed place of business and correspondence address at Stara Kakawa 65, 62-872 Godziesze Małe, NIP 9681000625, REGON 388436395, referred to below as the “Service Provider” or “Nivato”.
• General contact, technical support and complaints: biuro@nivato.pl, tel. +48 537 959 799. Contact for invoices and settlements: faktury@nivato.pl. Contact for personal data protection: rodo@nivato.pl.
• The Terms are made available free of charge before a contract is concluded, in a way that allows them to be obtained, reproduced and stored. The User may save or print the Terms.
• If an individual offer, contract, order or the terms of a given plan contain a different arrangement agreed with the Customer, the individual provisions prevail over the Terms to the extent of that difference, subject to mandatory provisions of law.

§ 2. DEFINITIONS

• Platform - the Nexivo online system available in particular at nivato.app and on related subdomains and authentication services;
• SOGL - a Platform module intended in particular for handling energy consumption points (PPE), installations (MWE), measurement data, forecasts, availability schedules, outages and downtime and, within the integrations made available, for passing selected data to Operators;
• Customer - a natural person, entrepreneur or other organisational unit that has concluded a contract for use of the Platform directly with the Service Provider;
• User - a natural person using the Platform under their own account, including a Customer who is a natural person or a person acting under the authority of a Customer, Partner or Partner Customer;
• Partner - an entity that has concluded a partner contract with the Service Provider and makes Platform functions available to its customers on the terms of that contract;
• Partner Customer - an entity in a contractual relationship with a Partner and not, on that basis, a party to a commercial contract for use of the Platform concluded directly with the Service Provider;
• Workspace - a separate environment in the Platform assigned to a Customer or Partner, covering Users, roles, settings and operational data;
• OWNER, ADMIN, MEMBER - User roles that define the scope of permissions in a Workspace;
• Subscription - paid access to a specified plan, module or function of the Platform for a stated billing period;
• Consumer - a natural person who performs a legal act with the Service Provider that is not directly related to their business or professional activity;
• Trader with consumer rights - a natural person concluding a contract directly related to their business activity, where the contract shows that it does not have a professional character for that person, to the extent that the law grants that person consumer rights;
• User Content - data, documents, files, information and other materials entered, sent or maintained in the Platform by a Customer or User;
• Operator - a distribution system operator or transmission system operator, or another energy-market entity to which, according to a function activated by the Customer, the Platform passes operational data;
• Force Majeure - an external, extraordinary event beyond the reasonable control of a party, the effects of which could not have been prevented with due care, in particular a widespread failure, natural disaster, act of war, riot, extensive failure of telecommunications or energy infrastructure, a mass cyberattack, or an act of a public authority;

§ 3. TYPES AND SCOPE OF SERVICES

• The Platform enables, in particular: creating and maintaining an account; signing in and recovering access; managing the profile, sessions and additional authentication methods; creating and operating Workspaces; managing Users, roles and invitations; using the modules made available; placing orders and managing Subscriptions; handling payments and invoices; using notifications and contacting technical support.
• The SOGL module may cover, in particular, management of PPE and MWE, handling of photovoltaic, wind and cogeneration installations, processing of measurement data, preparation of production and demand forecasts, handling of availability, outage and downtime schedules, presentation of data and, if a given integration is active, passing forecasts and required operational data to the relevant Operators.
• The Platform may be developed with further modules and functions related to the scope of Nivato activity. Making a new function available does not automatically include every Customer; its availability may depend on the selected plan, the contract concluded, an individual offer, the User role and the Workspace configuration.
• Not all functions described in the Terms are available to every User. Information on the scope of a plan, its functions, price and limitations is provided before a paid contract is concluded.
• The Platform is available in Polish and English. Unless the contract provides otherwise, if the language versions of the Terms differ, the Polish version prevails, subject to rights that cannot be excluded in relation to a Consumer.

§ 4. CONCLUSION OF THE CONTRACT AND ITS TERM

• For a person using the Platform as a direct Customer or as a User of a direct Customer, an account is created after the required registration steps are successfully completed, including email verification. If an account is created by a natural person as a direct Customer, the contract for free maintenance of the account is concluded when the email address is successfully verified and is concluded for an indefinite period.
• An account of a User acting under the authority of a Customer, Partner or Partner Customer is technical and serves to exercise rights under the relevant contract concluded by the Customer or Partner. Creating such an account does not, by itself, cause the User or the Partner Customer to conclude a separate commercial contract for use of the Platform directly with the Service Provider.
• A contract for a paid Subscription or a paid module is concluded for the period indicated before the order is placed, after the steps required in the purchase process are successfully completed and the Service Provider confirms the order, unless an individual offer or contract provides a different moment of conclusion.
• Before placing an order, the Customer receives information on the main characteristics of the service, the price and taxes, the billing period, the term of the contract, the rules of renewal and cancellation, payment methods, the functionality of the digital service, and material technical requirements and limitations.
• After concluding a contract with a Consumer, the Service Provider provides confirmation of conclusion on a durable medium, in particular by email, to the extent required by law.
• If a person acting within a Workspace concludes a contract on behalf of a Customer, that person represents that they have the authority required for that act.

§ 5. TECHNICAL REQUIREMENTS AND RISKS

• Use of the Platform requires at least: a device with Internet access, an up-to-date browser that supports JavaScript, cookies and local storage and session storage, an active email address and, for selected functions, the ability to use authentication methods or external services indicated in the Platform.
• The Platform is a digital service provided as SaaS through a web browser and, as a rule, does not require separate software to be installed on the User device. Access to paid functions of the Platform lasts for the term of the relevant Subscription. Access to the Platform is protected by authentication and access-control mechanisms.
• Use of services provided by electronic means involves typical risks, in particular phishing, malware, attempts to take over an account, loss of authentication data, unauthorised access, and interruptions in networks or external services.
• The User should use up-to-date software, protect sign-in data, use unique and sufficiently strong passwords, verify the addresses of sign-in pages and, where possible, use additional authentication methods.
• The Platform uses necessary technical data stored on the User device to handle sign-in, the session, security, language settings and selected interface elements. Details are in the Nexivo Platform Privacy Policy.

§ 6. REGISTRATION, ACCOUNT AND SECURITY

• The account identifier is an email address that is unique in the Platform. During registration the User provides the data required in the form, in particular an email address, password, first name and surname. A telephone number is required only when it is necessary for a selected function, security or performance of the contract, or when it is provided for in a given business process.
• Email verification is a condition for activating a new account. The verification link is valid for 24 hours from when it is generated. An account that is not verified within 24 hours of registration, together with the data provided at registration, is deleted automatically. A password-reset link is valid for 15 minutes from when it is generated.
• The basic sign-in method is an email address and password. If the function is available, the User may sign in through an external provider, in particular Google or Facebook, and use additional security methods such as TOTP or WebAuthn.
• The User must provide true and up-to-date data, protect access data, not share the account with other persons, and promptly inform the Service Provider of any suspected unauthorised access to the account.
• The User may manage active sessions and the security settings made available in the Platform. How long a session is kept follows the current security configuration and may differ depending on the sign-in option chosen.
• The Service Provider may temporarily block an account, end a session or require authentication again if there are objective and justified grounds indicating account takeover, unauthorised access, an attempt to bypass security, use of malware, a serious breach of the Terms, or a threat to the security of the Platform or other Users.
• An account is intended for one natural person. Several people may work for one Customer through separate User accounts and the appropriate roles in the Workspace.

§ 7. WORKSPACES, ROLES AND INVITATIONS

• A Workspace is a separate environment of a Customer or Partner. The permissions of a User depend on the assigned role and on additional access settings.
• The OWNER role covers management of the Workspace, Users and key settings; the ADMIN role covers administration of the Workspace and data within the granted scope; the MEMBER role allows use of the functions and data made available to that User.
• A User with the appropriate permissions may send an invitation to a stated email address and assign a role to the invited person. An invitation is kept until it is accepted, rejected or cancelled by an authorised User, subject to deletion of data where required by law or by Platform security.
• The Customer is responsible for correctly granting, changing and revoking permissions of persons acting in its Workspace, and for ensuring that only authorised persons have access.
• Changing a role or revoking access may affect the ability to view and modify data or to perform actions in the Platform. The Customer should make such changes promptly after the basis for access of that person ends.

§ 8. THE SOGL MODULE, OPERATIONAL DATA AND OPERATOR INTEGRATIONS

• The Customer is responsible for the lawfulness, accuracy and currency of data entered into the SOGL module, and for having the rights, legal bases and authorisations necessary to use and pass those data within active Platform functions.
• Forecasts, summaries, charts and model results made available in the Platform are operational and analytical. Unless an individual contract expressly provides otherwise, they are not a guarantee of actual production, consumption, installation availability, an Operator decision, or fulfilment of the regulatory obligations of the Customer.
• The Customer must verify data that are material to the performance of its operational, legal and contractual obligations, in particular before using them for acts that produce legal or economic effects.
• If an active function provides for forecasts or other operational data to be passed to an Operator, the Customer instructs and authorises the Service Provider to pass those data technically, in line with the Platform configuration and the instructions of the Customer. That authorisation is not a power of attorney to make other declarations of intent on behalf of the Customer or to assume the obligations of the Customer towards the Operator, unless a separate document expressly provides otherwise.
• Unless an individual contract expressly provides otherwise, the Customer remains the entity obliged towards the Operator to ensure that the data are correct, complete and timely, and to perform its own regulatory, contractual and technical obligations.
• The Service Provider is not liable for unavailability, delays or incorrect operation of APIs, ICT systems or infrastructure under the control of an Operator or another third party, if those events do not result from circumstances for which the Service Provider is liable. The Service Provider takes reasonable steps to retry transmission or to inform the Customer of the problem, if the given integration allows such steps.

§ 9. SUBSCRIPTIONS, ORDERS, PAYMENTS AND INVOICES

• The Platform may offer monthly, annual or other billing periods indicated in the price list or offer. The price, plan scope, billing period and renewal rules are presented before an order is placed. The Service Provider may also present individual offers.
• The Service Provider may provide a free trial. Its length, scope and conditions are indicated in the Platform before use begins and may be changed for future trials.
• Placing a paid order requires use of a function that clearly indicates that the order entails an obligation to pay, where the law requires such an indication.
• Electronic payments are handled by PayU or Stripe, depending on the payment method chosen by the User and the current availability of that method. The payment operator may apply its own terms, security rules and authentication methods. The Platform does not store full payment-card data.
• Access to the paid scope of the Platform is activated after confirmation of successful payment, without delay and no later than within one business day, unless a different activation date was indicated before the order was placed.
• The Customer must provide correct billing data. Invoices are issued and made available in accordance with applicable law, including through the National e-Invoicing System where the law requires it in a given case.
• If the fee depends on the number of installations, increasing that number during a billing period starts a new billing period. The Customer then pays the full fee applicable to the new total number of installations, and the previous billing period ends. No refund is due for the unused part of that period, unless a mandatory provision of law requires a refund.
• If a Subscription is renewable, the Customer may cancel renewal by a message to biuro@nivato.pl and, once the relevant function is available, also in the Platform panel. Cancellation takes effect at the end of the paid billing period and does not shorten the period of access.
• Subject to cases in which a refund is required by mandatory provisions of law, fees paid are not refundable.
• Cancelling renewal of a Subscription, ending use of the Platform, or stopping use before the paid billing period expires does not entitle the Customer to a refund of all or part of the fee for that period, except where a refund is required by mandatory provisions of law.
• Requests for a refund of a payment may be sent to biuro@nivato.pl or in writing to the correspondence address of the Service Provider indicated in § 1(1). Telephone contact about refunds is available at the number indicated in § 1(2). Because the service is digital, a refund does not require return of goods or shipping costs.
• If the law requires a refund of all or part of a payment, the refund is made using the same payment method the Customer used, unless the applicable law provides otherwise or the Customer has expressly agreed to another refund method that does not involve costs for the Customer. The refund may be made through the payment operator that processed the transaction.
• If a payment fails or is overdue, the Service Provider may repeat a request for payment, limit the ability to start new paid functions, or suspend access to the paid scope of the service, while preserving the rights of a Consumer and the provisions of an individual contract.

§ 10. CONSUMER - RIGHT OF WITHDRAWAL

• A Consumer who concluded a distance contract may, as a rule, withdraw from it within 14 days of the day the contract was concluded, without giving a reason, subject to the exceptions provided in the Consumer Rights Act.
• A statement of withdrawal may be sent to biuro@nivato.pl or to the correspondence address of the Service Provider indicated in § 1(1). The model form is Annex 1; use of the model is not mandatory.
• To meet the deadline, it is sufficient to send the statement before it expires. After receiving an electronic statement, the Service Provider promptly provides the Consumer, on a durable medium, with confirmation of receipt containing at least the date of receipt.
• If withdrawal is effective, the Service Provider refunds to the Consumer all payments received from the Consumer that are subject to refund, promptly and no later than 14 days from receipt of the statement of withdrawal. The refund is made using the same means of payment as the Consumer used, unless the Consumer has expressly agreed to another means that does not involve any cost for the Consumer.
• If the Consumer expressly requests that paid performance begin before the withdrawal period expires, and then effectively withdraws before the service has been fully performed, the Consumer must pay an amount proportionate to the service performed until withdrawal, if the law requires such payment.
• The right to withdraw from a paid service contract may expire after the service has been fully performed, if performance began with the express prior consent of the Consumer and the Consumer was informed that the right of withdrawal would be lost after full performance and acknowledged that information. For digital content not supplied on a tangible medium, the specific rules on loss of the right of withdrawal apply only after the conditions set out in the Consumer Rights Act are met.
• After withdrawal from a contract for the supply of digital content or a digital service, the Service Provider deals with content other than personal data supplied or created by the Consumer in accordance with the Consumer Rights Act, including by not using it except in cases allowed by that Act and, at the request of the Consumer and subject to the statutory exceptions, by making returnable content available in a commonly used, machine-readable format.
• This section applies to a Trader with consumer rights to the extent provided by applicable law.

§ 11. CONFORMITY OF THE DIGITAL SERVICE WITH THE CONTRACT

• Towards a Consumer and a Trader with consumer rights, to the extent resulting from Article 7aa of the Consumer Rights Act, the Service Provider is liable for conformity of the digital service with the contract on the terms set out in that Act.
• A digital service conforms with the contract if it corresponds in particular to the agreed description, type, quantity, quality, functionality, compatibility, interoperability, availability of technical support and updates, and is fit for the purpose which the entitled person told the Service Provider about at the latest when the contract was concluded and which the Service Provider accepted.
• If there is a lack of conformity, the entitled person may demand that the service be brought into conformity with the contract. The Service Provider may refuse to bring it into conformity only in the cases provided by law, in particular where that is impossible or would require excessive costs.
• In the cases provided by law, the entitled person may make a statement reducing the price or withdrawing from the contract, in particular where bringing the service into conformity is impossible, has not been done within a reasonable time, the lack of conformity continues, or is serious enough to justify those rights without a prior demand to bring the service into conformity.
• The Service Provider supplies updates, including security updates, to the extent and for the period required by law or the contract. The User should install or apply the updates made available, in line with the instructions provided.

§ 12. AVAILABILITY, INTERRUPTIONS AND CHANGES TO THE PLATFORM

• The Service Provider maintains the Platform with due care, but does not guarantee uninterrupted and error-free availability, unless an individual contract expressly provides otherwise.
• Interruptions may result in particular from maintenance, updates, failures, security events, Force Majeure, problems with telecommunications infrastructure, or unavailability of third-party services.
• Where possible, planned work that materially affects Platform availability is communicated in advance, with notice appropriate to the circumstances.
• The Service Provider may develop and change the Platform for justified reasons, in particular security, legal requirements, development of technology, integrations, improvement of performance and functionality, or withdrawal of unsupported solutions.
• Towards a Consumer and a Trader with consumer rights, changes to the digital service that are not necessary to maintain conformity with the contract are made on the terms provided in the Consumer Rights Act. If a change materially and negatively affects access to the service or use of it, the entitled person receives, on a durable medium, information about the change and the rights available, to the extent required by law.

§ 13. USER CONTENT AND RULES OF USE

• The User uses the Platform in accordance with the law, the Terms, the purpose of the service, security rules and the permissions held.
• It is prohibited in particular to supply unlawful content, infringe third-party rights, enter data without the required legal basis or authorisation, bypass security, gain unauthorised access, introduce malicious code, or disrupt operation of the Platform.
• The Customer is responsible for correctly granting access to Users of its Workspace and should promptly revoke access of unauthorised persons.
• The Service Provider may block or delete User Content or restrict access to the Platform if required by law, by a decision of a competent authority, by Platform security, or by a material breach of the Terms or of third-party rights.
• To the extent that the hosting-provider obligations under Regulation (EU) 2022/2065 (DSA) apply to Nivato, notices of illegal content may be sent to biuro@nivato.pl. Notices and decisions concerning such content are handled in accordance with the DSA, including by providing a statement of reasons where required.
• The contact point of Nivato for recipients of the service and for competent authorities for DSA purposes is biuro@nivato.pl. Communication may be conducted in Polish or English.

§ 14. CUSTOMER DATA, BACKUPS AND DELETION

• The Customer retains rights to data and materials entered into the Platform. To the extent necessary to provide the service, the Customer authorises the Service Provider to store, process, copy and transmit them technically in accordance with the contract, the function configuration and the law.
• Platform data are covered by backups kept for up to 30 days. Backups are used to restore the Platform after a failure and are not an archiving service or a guarantee that data deleted at the request of the Customer will be restored.
• After a paid Subscription ends, the Customer may for 30 days obtain or export data from the Workspace within the available functions, or agree with the Service Provider how they will be handed over, unless an individual contract provides otherwise.
• After the period referred to in paragraph 3, data may be deleted or anonymised, except for data kept under the law, for settlements, security or protection of claims.
• Deletion of a Workspace by an authorised User deletes its operational data, including SOGL data, from current systems. Those data may remain in backups for up to 30 days.
• Deletion of a User account does not delete data on orders, payments and settlements kept under the law or for protection of claims, or technical logs, which may be kept for up to 2 years. Detailed retention rules are set out in the Privacy Policy.

§ 15. INTELLECTUAL PROPERTY

• Rights in the Platform, software, code, interface, documentation, signs, materials and databases made available by the Service Provider belong to the Service Provider or its licensors, except for User Content and other elements in which rights belong to third parties.
• For the term of the relevant contract, the Customer and the User receive a non-exclusive, non-transferable right, limited to the scope of the contract, to use the Platform in accordance with its purpose and the Terms.
• Without the prior consent of the Service Provider it is prohibited in particular to resell access to the Platform, make it available to unauthorised persons, create unauthorised integrations, copy or distribute protected elements, or attempt to decompile or reconstruct the code beyond the cases expressly allowed by mandatory provisions of law.
• The Terms do not transfer to the Service Provider any rights in User Content beyond the scope necessary to provide the service properly and to perform the contract.

§ 16. COMPLAINTS AND TECHNICAL SUPPORT

• Complaints about operation of the Platform, payments, a Subscription or performance of the contract may be sent to biuro@nivato.pl or in writing to the correspondence address of the Service Provider: Stara Kakawa 65, 62-872 Godziesze Małe.
• A complaint should contain information that allows the account, Workspace, order or contract to be identified, a description of the problem, the date it occurred and, if possible, the expected way of resolving it. The absence of data not required by law does not leave the complaint unexamined if it can be examined on the basis of the information available.
• A Consumer complaint is examined within 14 days of receipt, unless a specific provision provides another time limit. The reply is provided on paper or another durable medium.
• Complaints of other Customers are examined without undue delay, taking account of the nature and complexity of the matter. A Trader with consumer rights is covered by the provisions that grant consumer protection to the extent resulting from applicable law.
• A failure report or a question to technical support is not a complaint, unless the report contains a demand related to non-performance or improper performance of the contract.
• How a complaint is resolved depends on its subject, its basis and the content of the Customer demand. A complaint may be resolved in particular by removing the irregularity found or by another action appropriate to the report. If a complaint concerns lack of conformity of the digital service with the contract in the case of a Consumer or a Trader with consumer rights, the rules and rights set out in § 11 apply, including — where the law provides — bringing the service into conformity with the contract, a price reduction or withdrawal from the contract.

§ 17. CANCELLATION, TERMINATION AND SUSPENSION OF ACCESS

• A direct Customer who is a natural person may end the contract for free maintenance of the account by deleting the account or by sending an appropriate instruction to the Service Provider. A User acting under the authority of a Customer, Partner or Partner Customer may request deletion of their own account, which does not automatically terminate the contract concluded by the Customer or Partner.
• The Customer may cancel renewal of a Subscription by a message to biuro@nivato.pl and, once the relevant function is available, also in the Platform panel. Unless indicated otherwise before the contract was concluded, cancellation takes effect at the end of the paid billing period.
• If a plan is not renewable, paid access expires at the end of the paid period, unless the Customer purchases a further period or the parties agree to continue the service on other terms. After paid access ends, the data export and deletion rules in § 14 apply.
• The Service Provider may immediately suspend access in whole or in part if that is necessary to counter an ongoing cyberattack, account takeover, malware, unauthorised access, a serious threat to the integrity of the Platform, or to comply with a binding order of an authority.
• In the case of other material breaches of the Terms, in particular persistent infringement of third-party rights, use of the Platform for unlawful activity, deliberate bypassing of security, causing material technical disruption, or delay in payment, the Service Provider as a rule calls for the breach to stop or for the obligation to be performed within at least 7 days. After that period expires without effect, the Service Provider may suspend access or terminate the contract, unless the nature or effects of the breach justify immediate action.
• Suspension or termination does not limit the rights of a Consumer or a Trader with consumer rights under mandatory provisions, in particular the right of withdrawal and rights related to lack of conformity of the digital service with the contract.

§ 18. PARTNER MODEL

• In the partner model, the party to the commercial contract for making the Platform available to a Partner Customer is the Partner, not Nivato. A Partner Customer does not, on that basis, acquire a paid Subscription directly from Nivato, unless it separately concludes with Nivato another contract for a different scope of services.
• The Partner is responsible towards its Customers for commercial terms, prices, settlements, contract handling and information duties arising from the contract concluded by the Partner with the Partner Customer, unless the partner contract expressly assigns a given duty to Nivato.
• Nivato is responsible towards the Partner for making the Platform available to the extent and on the terms of the partner contract. A User account of a Partner Customer is technical and serves to implement access granted by the Partner or the Partner Customer. Users must follow the security and acceptable-use rules set out in the Terms.
• If the Terms conflict with an individual partner contract, the partner contract prevails in the relationship between Nivato and the Partner, unless the law requires another rule.

§ 19. LIABILITY

• The Service Provider is liable for non-performance or improper performance of the contract on the terms resulting from applicable law and the contract. The Terms do not exclude or limit liability towards a Consumer or a Trader with consumer rights to the extent that such an exclusion or limitation would be impermissible.
• The Service Provider is not liable for the effects of incorrect, incomplete or outdated data provided by a Customer or User, unauthorised granting of access, failure to secure sign-in data, actions of persons using permissions granted by the Customer, failures of devices or connections on the User side, or events beyond the control of the Service Provider, to the extent that such liability does not result from mandatory provisions.
• The Service Provider is not liable for business, operational, technical or regulatory decisions taken solely on the basis of forecasts, summaries or model results available in the Platform, if they were not verified by the Customer despite the professional nature of its activity and the importance of the decision, subject to liability that cannot be excluded under the law or an individual contract.
• In relations with a Customer who is neither a Consumer nor a Trader with consumer rights, the Service Provider is not liable for lost profits or for indirect or consequential damage, including lost revenue, loss of an opportunity to conclude a contract, financing costs, imbalance costs or sanctions imposed by third parties, unless the damage was caused intentionally or a mandatory provision provides otherwise.
• Subject to paragraph 6, the total liability of the Service Provider in damages towards a Customer who is neither a Consumer nor a Trader with consumer rights, for all events arising in a successive 12-month period, is limited to the net amount of fees payable to the Service Provider by that Customer for use of the Platform in the 12 months immediately preceding the event causing the damage or, if the contract is shorter, to the net amount of fees payable for the period from the start of paid use of the Platform until the day of the event.
• The limitations in paragraphs 4 and 5 do not apply to damage caused intentionally, to liability the limitation of which is prohibited by mandatory provisions, or to the obligation to pay remuneration due, to return an undue performance, or to perform other obligations that are not damages.
• The Service Provider is not liable for failure to perform an obligation caused by Force Majeure, or for unavailability of systems or interfaces of an Operator or another external provider, if it exercised due care in the area under its control, unless an individual contract provides otherwise.
• An individual B2B contract may set different rules for support, liability or Platform availability. In the event of a conflict, the individually agreed document prevails.

§ 20. PERSONAL DATA PROTECTION

• The rules for processing personal data in connection with the Platform, including the roles of Nivato Marek Kupaj and Nivato sp. z o.o., are set out in the Nexivo Platform Privacy Policy.
• If a Customer or Partner entrusts the Service Provider with the processing of personal data in connection with use of the Platform, the personal data processing agreement in Annex 2 to the Terms applies. If the parties have concluded a separate processing agreement, the separate agreement prevails.
• The rules for using cookies, local storage and session storage are set out in the Privacy Policy.

§ 21. CHANGES TO THE TERMS

• The Service Provider may change the Terms for justified reasons, in particular a change in the law, security requirements, technology or infrastructure, the scope of Platform functions, or settlement rules.
• The Service Provider informs the Customer of a change that affects the rights or obligations of the parties before it takes effect, in a way that allows the Customer to read it. If mandatory provisions of law so require, the information is provided on a durable medium and with appropriate notice.
• A change of price or other economic terms does not cover a billing period that has already been paid. Towards a Consumer, a price change requires the express acceptance of the Consumer. In other cases, a change may apply at the earliest to the next billing period or a new order, in accordance with the Terms or an individual contract.
• Towards a Consumer and a Trader with consumer rights, changes to the digital service that are not necessary to keep it in conformity with the contract may be made only for the justified reasons indicated in the Terms and without additional cost on their side. If a change materially and negatively affects access to the Platform or use of it, the Service Provider informs them in advance on a durable medium, stating the features of the change, the date it will be made, and the rights available. A Consumer or a Trader with consumer rights may in that case terminate the contract without a notice period within the time provided by applicable law.

§ 22. FINAL PROVISIONS

• Polish law applies to the Terms and to contracts concluded on their basis, subject to provisions protecting a Consumer that cannot be excluded by a choice of law.
• Disputes with Consumers and with Traders with consumer rights, to the extent covered by consumer protection, are decided by the courts having jurisdiction under the law. A Consumer may also use out-of-court complaint and redress procedures on the terms set by applicable law and the competent consumer-protection institutions.
• In purely B2B relations, disputes arising from the contract or the Terms will be decided by the common court with territorial jurisdiction for the fixed place of business of the Service Provider, unless an individual contract provides otherwise or a mandatory provision provides for the exclusive jurisdiction of another court.
• If any provision of the Terms is invalid, ineffective or unenforceable, that does not affect the validity of the remaining provisions to the extent permitted by law.
• The Terms apply to contracts concluded after they have been made available to the Customer. For contracts concluded earlier, the Terms take effect after the period provided in § 21(2), counted from the day the information about the change was provided, unless the Customer exercises a right of termination or a mandatory provision requires another time limit.

ANNEX 1 - MODEL FORM FOR WITHDRAWAL FROM THE CONTRACT

Annex 2 – Personal data processing agreement

PERSONAL DATA PROCESSING AGREEMENT

concerning the Nexivo Platform (nivato.app)

This Agreement sets out the rules for processing personal data by Marek Kupaj conducting business under the name Nivato Marek Kupaj, Stara Kakawa 65, 62-872 Godziesze Małe, NIP 9681000625, REGON 388436395 (“Nivato”), on behalf of a Customer or Partner using the Nexivo Platform with whom Nivato has concluded a contract for use of the Platform (the “Entrusting Party”). This Agreement forms part of the contract for use of the Platform, unless the Parties have concluded a separate processing agreement.

If the Entrusting Party acts towards its customers as a processor, this Agreement applies accordingly to further entrustment, and the Entrusting Party represents that it is entitled to engage Nivato as a further processor.

§ 1. SUBJECT, SCOPE AND DURATION OF PROCESSING

• The Entrusting Party entrusts Nivato with the processing of personal data to the extent necessary to make the Platform available, maintain and secure it, operate the functions selected by the Entrusting Party, provide technical support, and carry out other documented instructions consistent with the contract and the law.
• Processing lasts for the period of services that require access to the data and, after that period ends, for the period necessary to return, export or delete them in accordance with § 6.
• Processing may include in particular recording, organising, storing, reviewing, using, transmitting, disclosing in line with instructions, restricting and deleting data.

§ 2. CATEGORIES OF PERSONS AND DATA

• Processing may concern data of Users, employees, collaborators, customers, contractors, owners or users of installations, and other persons whose data the Entrusting Party lawfully enters into the Platform.
• The data may include identification and contact data, data on role and permissions, identifiers of installations and energy consumption points, measurement and operational data, information contained in documents and reports, and other data entered into Platform functions.
• Special categories of personal data and data relating to criminal convictions and offences should not be entered into the Platform, unless the Parties have previously agreed that scope and the requirements of the law are met.

§ 3. OBLIGATIONS OF NIVATO

• Nivato processes data only on documented instructions of the Entrusting Party, including as regards transfers to third countries, unless processing is required by European Union law or the law of a Member State. In that case, unless the law prohibits it, Nivato informs the Entrusting Party before processing begins.
• Nivato ensures that persons with access to the data are appropriately authorised and bound by confidentiality.
• The processor applies technical and organisational measures appropriate to the risk, in accordance with Article 32 GDPR, in particular:
  • access and permission control, including the principle of least privilege and the use of individual accounts;
  • authentication mechanisms and protection of access to accounts;
  • encrypted connections to the Platform and session-management mechanisms;
  • recording of material technical events and security events, and restriction of access to logs to authorised persons;
  • encrypted backups and procedures that allow data to be restored after a failure;
  • procedures for responding to security incidents;
  • periodic review of whether the measures are adequate, and adjustment of them to the risk and to technological development.
• Taking into account the nature of the processing and the information available, Nivato assists the Entrusting Party in responding to requests to exercise data-subject rights and in complying with the obligations under Articles 32 to 36 GDPR.
• If Nivato considers that an instruction infringes the GDPR or other data-protection law, it promptly informs the Entrusting Party and may suspend performance of the instruction until the doubt is removed.

§ 4. FURTHER PROCESSORS AND TRANSFERS

• The Entrusting Party gives Nivato general authorisation to use further processors to the extent necessary to provide the Platform.
• Nivato provides the Entrusting Party with the current list of further processors on request and informs it of any intended addition or replacement of such a processor at least 14 days before that processor starts processing, allowing a reasoned objection relating to data protection.
• Nivato ensures that a further processor is bound by data-protection obligations corresponding to those under this Agreement, and remains liable to the Entrusting Party for performance of those obligations in accordance with Article 28 GDPR.
• Data are transferred outside the European Economic Area only using a mechanism permitted by Chapter V GDPR.

§ 5. BREACHES, INFORMATION AND AUDIT

• Nivato informs the Entrusting Party without undue delay of a personal data breach concerning the entrusted data and provides the available information necessary to comply with the GDPR.
• Nivato makes available the information necessary to demonstrate compliance with Article 28 GDPR and allows an audit within a reasonable scope, after the date and method have been agreed in advance. In the first instance the audit is based on documentation or remote verification, unless the nature of the matter justifies an on-site audit.
• An audit must not compromise the security of the Platform, the secrets of other customers or the rights of third parties. If an additional audit, not resulting from a breach or a justified suspicion of a breach, causes material costs on the part of Nivato, the Parties may agree that the Entrusting Party will cover them.

§ 6. END OF PROCESSING

• After the services end, Nivato, in accordance with the choice of the Entrusting Party and taking account of the Platform functions, enables return or export of the data and then deletes them, unless the law requires further storage.
• Data deleted from current systems may remain in encrypted backups for the period resulting from the standard retention cycle, and no longer than 30 days. During that time they are not used for purposes other than ensuring continuity of operation or restoring the Platform after a failure, and they are deleted when the given backup expires.
• If the Entrusting Party or an authorised User starts a function for irreversible deletion of data, Nivato carries out the deletion in accordance with the instruction, subject to paragraph 2 and to obligations under the law.

§ 7. FINAL PROVISIONS

• The Entrusting Party is responsible for the lawfulness of transferring data to the Platform, in particular for having a proper legal basis and for performing the duties of a controller or, in the case of further entrustment, for having the right to entrust the data to Nivato.
• Matters not regulated by this Agreement are governed by the GDPR and the contract for use of the Platform. If there is a conflict on matters of entrustment, this Agreement prevails, unless the Parties have concluded a separate processing agreement.
• This Agreement applies from the day the Entrusting Party becomes bound by the contract for use of the Platform, or from the day of separate acceptance of this Agreement, depending on how the main contract is concluded.