General conditions of use Imprion business system

The General Terms of Use of the Imprion Business System (hereinafter: General Terms) govern the relationship between the copyright holder of the Imprion Business System on the one hand and subscribers and users on the other, as well as the terms of use of the Imprion Business System (hereinafter: the Imprion POS system).

The owner of the copyright and source code of the Imprion POS system is the company IMPRION d.o.o., Tržaška cesta 65, 2000 Maribor, registration number: 7309694000, tax number: SI17772427 (hereinafter: Provider). Any user may use the Imprion POS system under the terms of these General Terms and Conditions. Unauthorized use of the Imprion POS system or use contrary to the General Terms and Conditions constitutes a violation of the Provider's copyright.

PART I - GENERAL

1 Definition of terms

The terms used in these General Terms and Conditions have the following meaning:

1.1 The User is a natural person who identifies himself in the Imprion POS system with an email address and password, who agrees and accepts these General Terms and Conditions and uses the Imprion POS system for business purposes in the name and on behalf of the Subscriber.

1.2 The Subscriber is a business entity that concludes the Subscription Agreement and undertakes to pay the Subscription. In terms of the protection of personal data within the scope of these General Terms and Conditions, the Subscriber acts as an administrator.

1.3 The license is the right to use the Imprion POS system to the extent determined by the Subscription Type and these General Terms and Conditions.

1.4 A business premises is a place or a (movable or immovable) business unit through which the Customer issues invoices using the Imprion POS system.

1.5 An electronic invoicing device is a device or cash register in the Imprion POS system through which the User issues invoices.

1.6 An additional module is an additional functionality of the Imprion POS system that the Subscriber activates in addition to the basic usage.

1.7 The type of subscription is the definition of the set of functions of the Imprion POS system and the scope of use, which is determined according to the number of active Business Premises and active Electronic Invoicing Devices and according to the activated Additional Modules.

1.8 The subscription contract is the contract by which the Provider transfers the License for the use of the Imprion POS system to the Subscriber.

1.9 The Imprion function is part of the Imprion POS system, which means a complete set of tasks required to perform a specific task related to cashier operations and issuing invoices, e.g. invoicing, daily revenue, turnover review.

1.10 The subscription is the amount that the Subscriber must pay for using the Imprion POS system.

1.11 The Administrator is the User designated by the Subscriber (or the User who concludes the Subscription Agreement on behalf of the Subscriber) and who, on behalf of the Subscriber, manages the settings and rights of other Users and orders activation or deactivation of Business Premises, Electronic Invoicing Devices and Additional Modules from the Provider.

1.12 User support is a service that enables communication between Users and the Provider.

2 Copyright

2.1 The holder of all material copyrights on the Imprion POS system and the source code of the Imprion POS system is the Provider. Imprion is a trademark for computer applications owned by the Provider.

2.2 By accepting the General Terms and Conditions, the Subscriber and User acquire the right to use the Imprion POS system in accordance with the General Terms and Conditions of the License.

3 User conditions

3.1 The user is obliged to accept the General Conditions before using the Imprion POS system.

3.2 Before the first use of the Imprion POS system, the User is obliged to complete the registration process, in which he identifies himself and accepts the General Terms and Conditions by checking the box located in front of the text "I accept the General Terms and Conditions of Use of the Imprion Business System".

3.3 By accepting the General Terms and Conditions, the user agrees and accepts the General Terms and Conditions, which are valid each time the Imprion POS system is used. The General Terms and Conditions may change during the duration of the Subscription Agreement, of which the Subscriber will be notified at least 30 days in advance. If he does not agree with the changes to the General Terms and Conditions, he has the right to withdraw from the Subscription Agreement. If you continue to use the Imprion POS system after receiving notice of a change to the General Terms and Conditions, you are deemed to have agreed to the amended terms and conditions.

3.4 Users who use the Imprion POS system even before the entry into force or the last change of these General Terms and Conditions are obliged to accept these General Terms and Conditions at the first subsequent login to the Imprion POS system. As long as the existing User does not accept these General Terms and Conditions, logging into the Imprion POS system and further use is not possible.

3.5 Each User must meet the technical and actual conditions necessary for effective and safe use of the Imprion POS system. The Imprion system consists of an online part and a local part of the application, which are subject to various technical requirements defined in points 3.6 and 3.7.

3.6 To use the online part of the Imprion POS system, the User must provide at least:

(a) access to the Internet;

(b) appropriate hardware and software (computer and/or mobile device) for using the online part of the Imprion POS system;

(c) additional software, if it is a condition for the use of certain Imprion Functions;

(d) means of identification (e-mail address and password), which are a prerequisite for identification and consequently for the use of the Imprion POS system.

3.7 To install and run the local part of the application that runs on the Subscriber's devices, the Subscriber must provide for each individual device at least:

(a) a stable Internet connection with a speed of at least 2.5 Mbit/s;

(b) additional software, if it is a condition for the use of certain Imprion Functions;

(c) a device that meets the following minimum system requirements:

3.8 When accessing the Imprion POS system, the User identifies himself with an email address and password.

3.9 The Subscriber or the User must himself ensure the conditions from points 3.5 to 3.7 of the General Terms and Conditions, including his own devices, on which the local part of the application runs, and their security. The provider does not bear any obligation or responsibility for ensuring the correct and continuous operation of equipment, services, products or computer programs that fall within the framework of the conditions that the Subscriber or User must provide himself.

3.10 The Provider does not guarantee the correct and safe operation of the Imprion POS system if the Subscriber or User does not meet the conditions from points 3.5 to 3.7 of the General Terms and Conditions.

II. PART - USE OF THE IMPRION SYSTEM

4 Conclusion of the subscription agreement and use of the license

4.1 The subscription contract is concluded when the person who is the legal representative of the Subscriber or the person authorized by the Subscriber accepts the General Terms and Conditions on behalf of the Subscriber and completes the registration or order. The subscription contract is concluded for an indefinite period.

4.2 The user who concludes the Subscription Agreement on behalf of the Subscriber becomes an Administrator. The Subscriber can designate another User as the Administrator. It is considered that the Administrator performs all activities through the Imprion POS system and in connection with the Imprion POS system with the authorization of the Subscriber.

4.3 By concluding the Subscription Agreement, the Subscriber acquires a License.

4.4 The Subscriber benefits from the License through the Users. The Administrator has the right to enable other Users to use the Subscriber's License and to determine their access rights.

4.5 Scope of use, i.e. the number of active Business Premises and Electronic Invoicing Devices and activated Additional Modules, the Subscriber orders through the Administrator from the Provider, who activates or deactivates the scope. The type of subscription and the amount of the Subscription are determined according to the scope thus activated.

5 Use and payment

5.1 Use of the Imprion POS system is chargeable. To use the License, the Subscriber must pay the Subscription Fee.

5.2 The subscription is determined by the price list accepted by the Provider. The price list is published on the website https://imprion.io. With the price list, the provider also determines the price of additional services or access to the Imprion POS system.

5.3 The subscription is billed monthly in retrospect, in accordance with the applicable price list of the Provider, which determines the packages and prices of individual items. For billing, the volume enabled in the Imprion POS system during the billing period (calendar month), namely active Electronic Billing Devices, active Business Premises and activated Additional Modules is taken into account.

(a) Every Electronic Invoicing Device, every Business Premises and every Additional Module that is added or activated in the Imprion POS system and is not disabled is considered active or enabled.

(b) For billing purposes, it is not important whether any invoice was issued through an individual Electronic Invoicing Device during the billing period, nor whether the device was actually connected to the Imprion POS system (online) or in use. The mere presence of an activated and non-disabled item in the Imprion POS system counts.

(c) Only the number of active Electronic Invoicing Devices that have been stored in the Imprion POS system for at least two (2) hours is taken into account for billing purposes. The provider checks the situation periodically; the status shown by two consecutive checks with the same number of active devices is considered preserved. Temporary changes in the number of devices that are not confirmed by two consecutive checks are not taken into account in the calculation. In particular, this ensures that when one Electronic Invoicing Device is replaced with another, both devices are not billed when they were simultaneously active for only a short time during the replacement process.

5.4 The provider has the right to change the price list taking into account market conditions and price trends. The Provider announces a change in the price list at least 30 days before its implementation.

5.5 The Subscriber is liable for the payment of the Subscription. The invoice for the Subscription is issued by the Provider or its contractual partner on its behalf. The Subscriber is obliged to pay the Subscription within 10 days of issuing the invoice. If the last day of the payment deadline falls on a Saturday, Sunday or other non-working day, the deadline is extended to the first following working day.

5.6 In the event that the Subscriber has two open overdue Subscription accounts at the same time, the Provider may disable access to the Imprion POS system or the use of the License to any User. Prior to this, the Provider sends the Subscriber two reminders and a reminder before the exclusion. During the period of disabled access, Users cannot use Imprion Functions. The Provider re-enables access when the Subscriber settles all due obligations.

6 Complaints

6.1 The Administrator can complain about the Subscription invoice on behalf of the Subscriber within 14 calendar days from the date of issue of the invoice. Report the complaint to the address [email protected]. The provider will respond to the complaint within 14 calendar days at the latest.

7 Unauthorized purposes of using the Imprion POS system

7.1 Subscribers and Users may use the Imprion POS system only for cash operations and issuing invoices, as well as managing the related data of business entities. Any other purpose of using the Imprion POS system is prohibited.

7.2 When using the Imprion POS system, it is expressly forbidden to:

(a) disable or hinder other Users in their use of the Imprion POS system;

(b) post, transmit, distribute or distribute any information, topics or materials that are illegal, false, obscene, offensive, obscene or promote racial, sexual or any other intolerance;

(c) publish advertising messages, solicitations, chain letters, pyramid schemes, investment opportunities or schemes or any other advertising notices;

(d) abuse, threaten or otherwise violate the rights of others;

(e) transfer to others the contents of the Imprion POS system, protected by intellectual property rights, or otherwise provide access to these contents, unless such transfer is duly agreed with the Provider;

(f) use materials or information, including images or photographs, available through the Imprion POS system in a way that in any way violates the copyrights, trademarks, patents, trade secrets or other rights of the Provider, other licensees, users or third parties;

(g) upload to the Imprion POS system files and other content that contain viruses, Trojan horses, worms, time bombs, corrupted files or other similar software or data that may harm the operation of the Imprion POS system, the equipment on which or with the help of which the Imprion POS system operates, or the equipment of the Users;

(h) intentionally or unintentionally harm the Imprion POS system in any way, e.g. by attempting to attack the server and other actions, the result of which could be a worse, incorrect, limited operation or non-operation of the Imprion POS system;

(i) collect information about Subscribers and/or Users from the Imprion POS system in various ways;

(j) create or use false identities for the purpose of misleading others, especially the Provider and User Support;

(k) use, transfer or otherwise copy and offer (for a fee or free of charge) to other persons directories or any other information about Subscribers and/or Users or information about the use of the Imprion POS system;

(l) without the written permission of the Provider, collect or use information about the technology used, ideas implemented, approaches used and any other contents of the Imprion POS system that could be used in other commercial or non-commercial services or products.

8 Appropriate use and quality assurance and protection against overloading of the Imprion POS system

8.1 In order to ensure the uninterrupted operation of the Imprion POS system and the quality of services for each Subscriber or User, each Subscriber or User undertakes to use the Imprion POS system or individual Imprion Functions to the extent that it does not cause excessive loads on the Imprion POS system and thereby prevent quality use by other Subscribers or Users.

8.2 In cases where the use of the Imprion POS system by a specific Subscriber or User during a certain time-limited period significantly deviates from the other usage of the average Subscriber or User, or when the Provider, based on a usage analysis, assesses that a specific Subscriber or User does not use the Imprion POS system in accordance with normal usage patterns, the Provider reserves the right to limit the possibility of using the Imprion POS system or the Imprion Functions of an individual Subscriber or User in a way and to the extent that quality services and proper operation will be ensured for other Subscribers or Users.

8.3 Before taking any measure of permanent or temporary restriction of use, the Provider will ask such Subscriber or User in writing (a written notice also counts as a notice by e-mail) to stop such use or such scope of use within a reasonable time. If the Subscriber or User does not stop such use within the set deadline or does not limit the scope of use to the specified limit, the Provider may permanently or temporarily limit the use of the Imprion POS system to such Subscriber or User.

8.4 In the event of a permanent or temporary restriction of the use of the Imprion POS system, which would occur as a result of inappropriate use by the Subscriber or User, the Subscriber is not entitled to a refund of a proportionate part of the Subscription for the period during which the restriction of use occurred.

9 Operation of the Imprion POS system

9.1 The provider strives to ensure the uninterrupted operation of the Imprion POS system, except in the following cases:

(a) failure of the Subscriber's or User's equipment or in any other case where the Subscriber or User does not meet the conditions from chapter "3 User conditions";

(b) maintenance operations (planned and unplanned) on the Imprion POS system;

(c) software or hardware upgrades necessary for the operation of the Imprion POS system or otherwise related to the operation of the Imprion POS system;

(d) failure of Internet connections;

(e) force majeure.

9.2 The Provider endeavors to inform Subscribers and Users about planned interventions on the Imprion POS system as far in advance as possible. The provider does not undertake to carry out interventions in a predetermined time window, but strives to carry out interventions in such a way that they affect the use of the Imprion POS system as little as possible.

9.3 The local part of the Imprion POS system application can enable the issuing of invoices even when the Internet connection is down or the online part of the Imprion POS system is temporarily unavailable; data released in this way are synchronized with the online part of the Imprion POS system when the connection is re-established. The subscriber is obliged to ensure that the devices on which the local part of the application runs enable regular data synchronization.

10 Compliance of the Imprion POS system with legislation and upgrading

10.1 The Provider strives to ensure compliance of the Imprion Functions with applicable legislation for the use cases that the Imprion POS system supports or foresees.

10.2 The Provider strives to monitor the regulations and upgrade the Imprion Functions in accordance with the changes in the regulations.

10.3 The client is responsible for the correctness and completeness of the data entered into the Imprion POS system, as well as for the compliance of its operations and issued invoices with applicable legislation.

11 Help for users

11.1 Users using the Subscriber's License are entitled to assistance in using the Imprion POS system.

11.2 The Provider provides assistance in connection with the operation of the Imprion POS system through Support to users on weekdays between 8:00 a.m. and 4:00 p.m., namely by e-mail to the address [email protected] and by phone +386 2 292 8900.

11.3 The Provider strives to eliminate errors that prevent the use of Imprion Functions. The Provider will respond to any reported error within a reasonable time, taking into account only the time when the Provider provides Support to users.

11.4 User support is limited to assistance in using the Imprion POS system. In particular, support does not include: entering data, products or invoices on behalf of the Subscriber or User; editing or correcting incorrect settings or configurations entered or specified by the Subscriber or User; elimination of errors or malfunctions of hardware, internet connection, devices or other equipment or software, which must be provided by the Subscriber or the User himself in accordance with chapter "3 User Conditions"; and accounting, tax, legal or other advice that is not directly related to the use of the Imprion POS system.

12 Limitation of the Provider's liability

12.1 Subscribers and Users agree to use the Imprion POS system, including software, content and services accessible through the Imprion POS system, at their own risk.

12.2 The total liability of the Provider for any damage is limited by the amount of the Subscription paid by the Subscriber for the use of the Imprion POS system for the month in which he notified the Provider of the damage. The provider and its contractual partners are not liable for any indirect, special, incidental or consequential damages (including but not limited to lost profits, income, investments, goodwill) arising from the use of the Imprion POS system or related websites, products or services or related to their use. The stated limitation also applies if the Provider was aware of the possibility of such damage. This limitation of liability includes (but is not limited to): transmission of viruses, hardware failure, connection errors, misuse or theft of user identity.

12.3 In no case shall the Provider be liable for any loss or damage caused by the Subscriber or User relying on information, products or services published in the Imprion POS system or related websites, products or services.

12.4 The customer is solely responsible for the correctness and completeness of the data he enters into the Imprion POS system, as well as for the compliance of the issued invoices and his business with applicable legislation. The Provider is not responsible for the possible consequences of incorrect or incomplete data, or for the behavior of the Subscriber or the User in violation of applicable legislation.

12.5 All claims due to any errors or violations resulting from the conduct of third parties, regarding which information is published in the Imprion POS system, are asserted exclusively against these persons.

12.6 The Provider is not responsible for the operation of the Imprion POS system and for possible damage to the work resulting from the conditions that must be provided by the Client or the User himself in accordance with the chapter "3 User Conditions". This includes, in particular, access to the Internet, appropriate hardware and software, and the devices on which the local part of the application runs, their security and regular data synchronization, as well as the User's identification means.

13 Contents and services offered by third parties

13.1 The Imprion POS system may enable a connection through which other websites, products and/or services connect to the Imprion POS system (hereinafter: Linked Systems). The Provider assumes no responsibility for the Connected Systems. The provider is not responsible for the correctness or availability of information, products or services offered by third parties through the Linked Systems.

13.2 The information on the Linked Systems comes from various sources. The Provider is not entitled to change, update or check the content of the information on the Linked Systems. The fact that the Provider provides a connection to the Linked Systems does not necessarily imply approval, authorization, sponsorship or other connection with respect to the Linked Systems.

13.3 The Provider is not responsible either directly or indirectly for any damage caused or alleged to be caused by the use of or reliance on any content, product or service of the Linked Systems.

13.4 In order to use the Linked Systems, the User may have to accept general conditions of use that differ from these General Conditions and for which the Provider is not responsible, but in any case these General Conditions prevail.

14 Collection and protection of users' personal data

14.1 The Imprion system is intended for cashier operations and issuing invoices for business entities. For the purpose of identification of Users and communication with them, the Provider as a processor on behalf of the Client, who in the sense of the General Regulation (EU) 2016/679 acts as an administrator, maintains the following personal data about the individual:

(a) name and surname of the User,

(b) the User's email address.

14.2 By registering in the Imprion POS system, the User is aware that, based on its legitimate interest in improving the operation of the service, the Provider may also collect data on visits and use of the Imprion POS system for the purposes of analyzing user behavior and consequently improving the user experience, as well as for the purpose of communicating with customers via e-mail or the company's postal address.

14.3 The user declares and confirms that he is aware of the right to view, copy, copy, supplement, correct, limit the processing and delete personal data relating to him, in accordance with the provisions of Chapter III of the General Regulation (EU) 2016/679. Rights are provided by the Subscriber as administrator.

14.4 The personal data defined above may be kept for 5 years after the use of the Imprion POS system has ceased.

14.5 The provider collects, maintains, processes and uses personal data from point 14.1 also for the purposes of providing the Imprion POS system service, for example:

(a) for the identification of Users upon registration and each time the Imprion POS system is used in order to ensure a higher level of data security and credibility and a trustworthy way of communicating with User Support and/or other Users;

(b) to enable additional, optional Imprion Functions for basic use or functions related to the user profile (e.g. to change the User's password);

(c) to inform Users by User Support when the Provider judges that such communication is more effective or more appropriate;

(d) for informing Users and Subscribers by the Provider, e.g. in relation to the Provider's products and services. The Provider does not forward the collected personal data to third parties, except for sub-processors from Annex I. By accepting the General Terms and Conditions, the User expressly allows the Provider to collect and process personal data to the extent and for the purposes specified in this point of the General Terms and Conditions.

15 Storage and deletion of data

15.1 The Provider will use all reasonable measures to protect the data stored in the Imprion POS system from unauthorized access by third parties. In this regard, the Provider ensures that the data is stored in an adequately protected place, where technical and physical protection is provided to prevent access by unauthorized persons. The provider provides redundant data storage. In the event of any outage, the Provider undertakes to establish a working environment with data that existed no more than 24 hours before the outage.

15.2 The Provider may disclose information about the Subscriber or User, which is stored in the Imprion POS system, only on the basis of a court decision or a written request from a state authority that has the legal authority to view the data.

15.3 The Subscriber can transfer (export) data from the Imprion POS system in the scope and format allowed by the Imprion Functions.

15.4 After termination of the Subscription Agreement, the Subscriber retains access to previously entered data for viewing and export through the Imprion POS system portal without time limit, but without the possibility of issuing new accounts or using other Imprion Functions that are tied to the valid License. The Subscriber's data is deleted exclusively on the basis of the Subscriber's request.

16 Violation of the General Terms and termination of the Subscription Agreement

16.1 If the User violates the General Conditions, the Provider may, after warning the User about the violation, disable the User from using the Imprion POS system.

16.2 If the Subscriber, Administrator or any User using the Subscriber's License violates the General Conditions, the Provider, after warning the Administrator or the Subscriber about the violation, may terminate the Subscription Agreement with the Subscriber unilaterally and without notice.

17 Termination of Subscription Agreement

17.1 Any contracting party may withdraw from the Subscription Agreement. The cancellation takes effect at the end of the current billing (monthly) period in which it was given.

17.2 Withdrawal from the Subscription Agreement must be given in writing; notification by e-mail is also considered to be in written form. In case of withdrawal from the contract by the Provider, the Administrator shall be notified of this in writing.

17.3 After the Subscription Agreement expires, Users can no longer use the Imprion Functions that are tied to the valid License, in particular not issue new invoices.

17.4 Regardless of the termination of the Subscription Agreement, the Subscriber retains access to previously entered data through the Imprion POS system portal in accordance with point 15.4; the data is deleted exclusively on the basis of the request of the Subscriber.

18 Protection of trade secrets

18.1 The parties to the contract are obliged to protect as a business secret all information about the business of the other party which is not publicly available and which they learn about during the implementation of the Subscription Agreement, e.g. financial data, working methodology and tools used.

18.2 The contracting parties may disclose confidential information only to those persons who directly participate in the implementation of the Subscription Agreement, and only to the extent necessary for this. In doing so, they must ensure that the recipients of the confidential data do not use it contrary to the provisions of the Subscription Agreement.

18.3 The obligation to protect business secrecy applies both during the duration of the Subscription Agreement and after its termination.

18.4 The protection of personal data is regulated in more detail in III. part of these General Terms and Conditions (Processing of personal data).

19 Liability for damages

19.1 The Provider is obliged to act with the care of a good expert when completing the Subscription Agreement.

19.2 The Provider is not responsible for damage caused by the Subscriber or the User during the implementation of the Subscription Agreement. If the Client or someone else for whom the Client is responsible is also to blame for the resulting damage, the Provider's liability for compensation is reduced proportionately.

19.3 The provider is not responsible for the loss, damage or other form of data change that occurred due to force majeure. Force majeure is considered to be unforeseen and unexpected events that occur independently of the will of the contracting parties and that the parties could not have foreseen at the time of the conclusion of the contract and that in any way affect the performance of the contractual obligations. The Provider shall notify the Client in writing of the occurrence of force majeure within a reasonable period of time.

III. PART - PERSONAL DATA PROCESSING

20 Processing of personal data

20.1 Purpose and areas of application

(a) The purpose of this chapter of the General Terms and Conditions (hereinafter: provisions) is to ensure compliance with Article 28(3) and (4) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals in the processing of personal data and on the free flow of such data and on the repeal of Directive 95/46/EC (General Data Protection Regulation).

(b) The Client as controller and the Provider as processor agree to these provisions to ensure compliance with Article 28(3) and (4) of Regulation (EU) 2016/679.

(c) These provisions apply to the processing of personal data, as specified in Article 14 and in point 20.4.

(d) These provisions do not affect the obligations that apply to the controller based on Regulation (EU) 2016/679.

20.2 Interpretation

(a) Where terms defined in Regulation (EU) 2016/679 are used in these Terms, these terms shall have the same meaning as in that Regulation.

(b) These Terms shall be read and interpreted in accordance with the provisions of Regulation (EU) 2016/679.

(c) These provisions shall not be interpreted in a way that conflicts with the rights and obligations under Regulation (EU) 2016/679, or in a way that interferes with the fundamental rights or freedoms of individuals to whom personal data refer.

20.3 Description of processing (nature, purpose and duration)

As part of the service, the Provider as a processor offers the Subscriber as an administrator the use of the Imprion POS system as well as substantive or technical support, in which insight or other processing of personal data is also required to solve individual tasks. The provider will carry out the processing exclusively for the purpose of ensuring the operation of the Imprion POS system and support, as stated in these General Terms and Conditions. Data processing as part of support is carried out from time to time, when the Subscriber requests technical or substantive support, and lasts at most until the completion of the specific task.

20.4 Types of personal data and categories of individuals

20.5 Technical and organizational measures to ensure data security

(a) The provider implements appropriate technical and organizational measures to ensure processing security in accordance with Article 32 of Regulation (EU) 2016/679.

(b) Data is stored on the Provider's own or managed infrastructure, to which only authorized persons of the Provider and authorized subprocessors from Annex I have access.

(c) Data transmission between the User's devices and the Imprion POS system is protected by encryption.

(d) Access to data is protected by passwords and limited rights of employees according to the principle of the minimum necessary scope.

(e) The provider ensures the traceability of processing through processing logs and regularly performs data backups.

(f) The provider regularly checks, evaluates and evaluates the effectiveness of technical and organizational measures to ensure processing security.

20.6 Obligations of the Parties

Instructions

(a) The processor processes personal data only according to the documented instructions of the controller, provided through User Support, unless it is required to do so by the law of the Union or the law of the Member State applicable to the processor. In the latter case, the processor informs the controller about this legal requirement before processing the data, unless the law in question prohibits this for important reasons of public interest. During the entire duration of the processing, the controller can give further instructions, which are documented.

(b) The processor immediately informs the controller if, in his opinion, the controller's instructions violate Regulation (EU) 2016/679 or other applicable regulations of the Union or the Republic of Slovenia on data protection.

Purpose limitation

The processor processes personal data only for specific processing purposes, as specified in article 14 and point 20.4, unless it receives further instructions from the controller.

Duration of processing

The processor only processes personal data for as long as is necessary for the execution of the task.

Security of processing

(a) The processor implements at least the technical and organizational measures referred to in point 20.5 to ensure the security of personal data, including protection against security breaches that result in accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access to data.

(b) The processor grants access to personal data to members of its staff only to the extent that is strictly necessary for the implementation, management and monitoring of the contract, and ensures that authorized persons are bound by confidentiality.

A special type of data

If the processing includes special types of personal data (sensitive data) in the sense of Regulation (EU) 2016/679, the processor applies special restrictions and/or additional protective measures.

Documentation and compliance

(a) Both parties are able to demonstrate compliance with these provisions.

(b) The processor promptly and appropriately handles the controller's inquiries regarding data processing.

(c) The processor makes available to the controller all the information necessary to prove the fulfillment of the obligations from these provisions, and at the request of the controller, enables audits and contributes to them. The administrator informs the processor about the announced audit at least 10 working days before the announced date.

Use of Subprocessors

(a) The processor has the general permission of the controller to hire sub-processors from the agreed list in Annex I. The processor shall notify the controller in writing at least 30 days in advance of any intended changes to this list by adding or replacing sub-processors, thus providing him with sufficient time to object before hiring the sub-processor in question. If the operator does not object within this period, it is considered that he agrees to the lease.

(b) The processor hires the subprocessor with a contract that imposes on the subprocessor the same obligations regarding data protection as the processor has under these provisions.

(c) The processor remains fully responsible to the controller for fulfilling the obligations of the subprocessor.

International data transfers

The provider does not transfer personal data to third countries or international organizations; processing takes place within the European Economic Area. Any transfer to a third country or international organization is carried out only on the basis of the documented instructions of the controller and in accordance with Chapter V of Regulation (EU) 2016/679.

20.7 Assistance to the Administrator

(a) The processor shall immediately notify the controller of any request received from the data subject. It does not respond to this request itself, unless authorized to do so by the controller.

(b) The processor assists the controller in fulfilling its obligations to respond to the requests of individuals to exercise their rights, taking into account the nature of the processing and acting in accordance with the instructions of the controller.

(c) The processor also assists the controller in ensuring compliance with the obligations from Articles 32 to 36 of Regulation (EU) 2016/679 (processing security, breach notification, data protection impact assessment and prior consultation), taking into account the nature of the processing and the information available to it.

20.8 Notice of personal data breach

(a) In the event of a breach of personal data security, the processor cooperates with the controller and assists him in fulfilling his obligations under Articles 33 and 34 of Regulation (EU) 2016/679, taking into account the nature of the processing and the information available to him.

(b) In the event of a breach of the security of personal data in relation to the data processed by the processor, the processor shall immediately notify the controller after becoming aware of the breach. The notice shall include at least: a description of the nature of the breach, details of the point of contact, the likely consequences of the breach and the measures that have been or will be taken to deal with it.

20.9 Non-compliance with the provisions and termination of the contract

(a) In the event that the processor violates its obligations under these provisions, the controller may order the processor to temporarily suspend the processing of personal data until compliance is ensured, otherwise the contract may be terminated. The processor immediately informs the controller if, for any reason, it cannot ensure compliance.

(b) The controller has the right to terminate the contract, insofar as it concerns the processing of personal data, if the processor significantly or persistently violates these provisions or its obligations from Regulation (EU) 2016/679, or does not act in accordance with a binding decision of a competent court or supervisory authority.

(c) Upon termination of the contract, the Processor deletes or returns all personal data that it processed on behalf of the Controller as part of the support, and deletes existing copies, unless the law of the Union or the law of a Member State requires retention, or insofar as the Subscriber maintains access to the data in accordance with point 15.4.

IV. PART - VALIDITY AND FINAL PROVISIONS

21 Validity and modification of the General Terms and Conditions

21.1 The Provider publishes the applicable General Terms and/or amendments to the General Terms and Conditions on the website https://imprion.io. Each User may request the Provider to view the General Terms and Conditions that were in effect during a certain period of time.

21.2 The General Terms and Conditions enter into force on the date specified by the Provider. The General Terms and Conditions and amendments to the General Terms and Conditions must be published at least 30 days before their entry into force.

21.3 The Provider has the right to unilaterally change the General Terms and Conditions and to publish changes to the General Terms and Conditions in the manner referred to in point 21.1 and to notify the Subscribers or Users within the period referred to in point 21.2.

22 Final provisions

22.1 The law of the Republic of Slovenia applies to the interpretation of the General Terms and Conditions and in the event that a specific issue is not regulated by the General Terms and Conditions.

22.2 The court in Maribor is competent to resolve any disputes arising from the use of the Imprion POS system or in connection with its use.

22.3 These General Terms and Conditions apply from 1 July 2026.

APPENDIX I

List of parties to the processing of personal data

Managers

By concluding the Subscription Agreement, of which these General Terms and Conditions are an integral part, the Subscriber in relation to the Provider becomes the controller of personal data in accordance with the provisions of the General Regulation (EU) 2016/679 and these General Terms and Conditions.

Processor

According to these General Terms and Conditions, the provider is the processor of personal data.

Subprocessors

The provider cooperates with the following sub-processors for the purposes of performing tasks from these General Terms and Conditions:

The Provider shall notify the Client of any changes to the list of sub-processors in accordance with point 20.6 of these General Terms and Conditions.

Authorized person for data protection

The provider has not appointed an authorized person for data protection, as the conditions for this from Article 37 of the General Regulation (EU) 2016/679 have not been met. For questions regarding the protection of personal data, the email address [email protected] is available.