Terms of Service

1. Introduction

These Terms of Service govern the provision of the Kverio Flows service (the "Service") operated by [Operator name], Company ID [Company ID], registered office [registered office], e-mail [e-mail] (the "Operator"), to business customers and legal entities (the "Customer").

The Service is intended for businesses only. By registering, the Customer confirms that it acts in the course of its business and is not a consumer.

The contract between the Operator and the Customer is concluded when registration is completed and the Customer accepts these Terms. The Data Processing Agreement in the appendix forms an integral part of these Terms.

2. Subject of the Service

The Service is a customer journey layer on top of the Customer's booking system. For every booking it creates a private web page reachable through a unique link, on which the Customer's end customer (the "Traveller") sees current information and instructions according to the state of the booking and can respond to them.

The Service includes an administration for configuring journeys, an API and webhooks for connecting a booking system, e-mail notifications and passes for Apple Wallet and Google Wallet.

Bookings, their content and state remain in the Customer's system. The Operator does not provide a booking system and is not responsible for the accuracy of data sent to the Service by the Customer or its system.

3. Registration and account

The account is created by a person authorised to act on behalf of the Customer. The Customer is responsible for the registration details being true and up to date.

Login credentials and API keys are confidential. The Customer is responsible for protecting them and for all activity under its account. If the Customer discovers misuse, it notifies the Operator without undue delay.

One account corresponds to one company. Data of individual accounts is separated and a user of one account has no access to the data of another.

4. Trial period and subscription

A new account receives a 14-day free trial with no payment card required. After the trial ends, new journeys cannot be created until the Customer pays for a subscription. Journeys already created keep working.

The subscription is monthly and is paid in advance through the Stripe payment gateway. Current prices, the scope of the plan and add-ons are published on the Service website and form part of the contract in the wording valid at the time of ordering.

The founding price is an offer for a limited number of the first paying customers. Whoever obtains it keeps it for as long as the subscription continues without interruption. Once the offer is exhausted, the regular price applies to new customers.

Prices are stated without VAT unless expressly stated otherwise. VAT is added in accordance with applicable law.

5. Payment terms and invoices

Payments are processed by Stripe. The Customer enters payment card details directly with Stripe and the Operator has no access to them.

The subscription renews automatically for the next month until the Customer cancels it. Invoices and payment receipts are available in the billing portal linked from the administration.

If a payment fails, the Operator notifies the Customer and the account enters a restricted state: new journeys cannot be created, journeys in progress run to completion. Once payment is made, the account is restored in full.

The Customer is responsible for the accuracy of the billing details entered in Stripe.

6. Termination and cancellation

The Customer may cancel the subscription at any time in the billing portal. Cancellation takes effect at the end of the paid period; until then the Service runs in full. Paid subscription fees are not refunded.

The Customer may delete its account in the administration settings. Deletion irreversibly removes all account data, including journeys and the links given to Travellers. If the account has an active subscription, it must be cancelled first.

The Operator may terminate the contract with one month's notice. In case of a material breach of these Terms, in particular misuse of the Service, the Operator may restrict or terminate the account with immediate effect.

Neither termination of the subscription nor a failed payment ever breaks journeys in progress: links already given to Travellers keep working until the journey is completed. Only deleting the account removes them.

7. Availability and support

The Operator provides the Service with professional care and strives for uninterrupted availability. It does not, however, guarantee any specific level of availability or response time and provides no contractual service level agreement (SLA).

The Operator may briefly restrict the Service for maintenance, updates or security reasons. Planned outages are announced in advance where possible.

Support is provided by e-mail at [e-mail] and through the chat on the Service website on business days. The Operator responds within a reasonable time; no specific response time is guaranteed.

8. Liability

The Service is provided as is. The Operator is not liable for damage caused by incorrect or incomplete data entered into the Service by the Customer or its system, nor for the conduct of Travellers or third parties.

The Operator is not liable for unavailability of the Service caused by circumstances beyond its control, in particular outages of sub-processors or internet connectivity, or force majeure.

The Operator's total liability for damage arising from or in connection with the contract is limited to the amount the Customer paid for the Service in the 12 months preceding the event giving rise to the damage. The Operator is not liable for lost profit or indirect damage.

The limitation of liability does not apply where the law does not permit it, in particular for damage caused intentionally or by gross negligence.

9. Acceptable use

The Customer may use the Service only for its intended purpose: informing Travellers about the progress of their booking. In particular, it is prohibited to:

• send Travellers unsolicited commercial communications or contact them through the Service outside the context of their booking,
• collect identity documents, travel document numbers, payment details or special categories of personal data (for example health, religion or biometric data) through forms on the customer page,
• enter content into the Service that violates the law or the rights of third parties,
• interfere with the security or operation of the Service, circumvent account restrictions or access data of other accounts,
• resell the Service to third parties without the Operator's written consent.

The Service deliberately does not allow Travellers to upload files. The Customer therefore cannot request copies of documents or other attachments from Travellers through the Service and must not request them indirectly either.

In case of a breach of this article, the Operator may remove the content concerned and restrict or terminate the account. The Customer is liable for damage caused to the Operator or third parties as a result.

10. Intellectual property

The Service, its software, design, screen templates and documentation are the work of the Operator or its licensors. The Customer obtains a non-exclusive, non-transferable right to use the Service for the duration of the contract within the scope of these Terms.

Content the Customer enters into the Service (logo, texts, photographs, booking data) remains the Customer's. The Customer grants the Operator the right to process this content to the extent necessary to provide the Service.

The Customer is responsible for holding the necessary rights to the content it enters.

11. Changes to the Terms and the Service

The Operator may reasonably amend these Terms, in particular due to changes in law, extension of the Service or a change of sub-processors. Changes are announced by e-mail to the account address at least 30 days before they take effect.

If the Customer does not agree with a change, it may terminate the contract before the change takes effect; termination is effective at the end of the paid period. By continuing to use the Service after the change takes effect, the Customer accepts it.

The Operator may develop the Service continuously and change its features. A material reduction of features the Customer pays for is announced in advance.

12. Governing law and disputes

The contract and these Terms are governed by the law of the Czech Republic, in particular Act No. 89/2012 Coll., the Civil Code. Disputes are decided by the courts of the Czech Republic; the court with local jurisdiction is determined by the Operator's registered office.

The Terms are drawn up in Czech and English. The English version is a translation for the Customer's convenience; in case of a discrepancy, the Czech version prevails.

If any provision is invalid, the remaining provisions remain in force.

13. Final provisions

These Terms are effective from [effective date]. Previous versions are available from the Operator on request.

The processing of Travellers' personal data is governed by the Data Processing Agreement in the appendix. The processing of data of administration users and website visitors is described in the Privacy Policy.

1. Roles of the parties

The Customer is the controller of the personal data of Travellers that it or its booking system enters into the Service. The Operator is the processor, processing this data on behalf of the Customer and according to its instructions. This appendix is a data processing agreement under Article 28 of Regulation (EU) 2016/679 (GDPR).

For the data of administration users (name, e-mail, login credentials) and billing data, the Operator is the controller; this is described in the Privacy Policy.

2. Subject, duration, nature and purpose of processing

The subject of processing is displaying the customer page for a booking, sending notifications to Travellers, issuing wallet passes and keeping a record of the journey (events and responses) for the Customer.

Processing lasts for the duration of the contract and, after its end, until the data is deleted or returned in accordance with Article 10 of this appendix.

The nature of processing is storage, display, sending by e-mail, transfer to the Customer through the API and webhooks, and anonymisation. The purpose is informing the Traveller about the progress of their booking and enabling them to respond.

3. Categories of data subjects and personal data

Data subjects are Travellers, that is the Customer's end customers, and where applicable other persons the Customer attaches to a booking (contact person, driver).

Data processed: name, e-mail address, telephone number, language, pickup time and place and destination, flight number or other booking identifier, driver and vehicle details the Customer assigns to the booking, the Traveller's responses from forms on the customer page, a record of when and through which steps the journey passed, and the time the page was opened.

Special categories of personal data, identity documents and payment details of Travellers are not processed and the Customer must not enter them into the Service (Article 9 of the Terms).

4. Controller's instructions

The Operator processes data only on the Customer's documented instructions. Instructions are given by these Terms, by the account configuration in the administration and by API calls. Other instructions are given by the Customer in writing.

If the Operator believes an instruction infringes the law, it informs the Customer.

The Operator does not process Traveller data for its own purposes, does not combine it with data of other customers and does not use it for advertising or for training models.

5. Confidentiality

The Operator ensures that persons authorised to process personal data are bound by confidentiality. Only persons who need access to operate and support the Service have it.

6. Security

The Operator takes technical and organisational measures appropriate to the risk, in particular: encrypted transport (HTTPS), separation of data between accounts, access to the Traveller's page only through a private link with a random token, storage of passwords and API keys as hashes only, login attempt limits, regular server backups and updates, logging of changes to journeys, and exclusion of the customer page from search engine indexing and third-party scripts.

If the Operator becomes aware of a personal data breach, it notifies the Customer without undue delay and no later than 48 hours after becoming aware of it, with the information available, so that the Customer can meet its own notification obligations.

7. Sub-processors

The Customer gives general authorisation to engage sub-processors. As of the effective date they are:

• [VDS hosting provider in the Czech Republic]: operation of the virtual server in the Czech Republic running the application and database (all data),
• [SMTP provider]: sending e-mail notifications to Travellers (e-mail address and notification content),
• Apple Inc.: issuing and updating Apple Wallet passes (pass content: name, pickup time and place, link to the journey page),
• Google LLC: issuing and updating Google Wallet passes (the same content),
• Stripe Payments Europe, Ltd.: processing subscription payments (the Customer's billing data only; no access to Traveller data),
• tawk.to Inc.: chat on the website and in the administration (only the content of conversations with the Customer's users; the chat is not loaded on the Traveller's page).

The Operator informs the Customer by e-mail at least 30 days in advance of any intended addition or replacement of a sub-processor. The Customer may object on data protection grounds; if the parties do not reach agreement, the Customer may terminate the contract at the end of the paid period.

The Operator imposes on sub-processors by contract the same data protection obligations as it has itself and remains responsible for their performance.

8. Transfers outside the EU

Data is stored and processed in the Czech Republic. Apple, Google, Stripe and tawk.to may also process data outside the European Economic Area; transfers are safeguarded by the European Commission's standard contractual clauses or an adequacy decision, together with the supplementary measures of these providers.

9. Assistance to the controller and data subject rights

The Operator assists the Customer with appropriate technical and organisational measures in fulfilling its obligation to respond to Travellers' requests to exercise their rights. In the administration the Customer can view, correct and cancel a journey and export all account data.

If a Traveller contacts the Operator directly, the Operator forwards the request to the Customer without undue delay and does not answer it itself unless the parties agree otherwise.

The Operator assists the Customer in ensuring compliance with Articles 32 to 36 of the GDPR (security, breach notification, impact assessment), taking into account the nature of processing and the information available to it.

10. Retention, deletion and return of data

The Traveller's personal data (name, e-mail, telephone) is anonymised automatically in the Service 30 days after the journey ends, that is after it is completed, cancelled or expires. Anonymisation also removes it from the event log, the journey label and the record of sent notifications. The course of the journey and form responses remain available to the Customer without a link to a person; if responses contain personal data, the Customer is responsible for their scope.

The Customer may at any time download an export of all account data in a machine-readable format (JSON) and may delete the account at any time. Deleting the account irreversibly removes all Traveller data from the Service; it disappears from backups within 30 days at the latest.

After the contract ends, the Operator deletes the data unless the Customer requests its return by export before the end. Data the Operator must retain by law (in particular accounting records) is retained for the statutory period.

11. Audits

The Operator provides the Customer with the information necessary to demonstrate compliance with the obligations under Article 28 of the GDPR. It allows audits conducted by the Customer or an auditor mandated by it, at most once every 12 months, with at least 30 days' prior notice, during normal business hours and in a manner that does not disrupt the operation of the Service or the security of other customers' data. The Customer bears the costs of the audit.

Audits are preferably conducted through written questions and the provision of documentation.

12. Final provisions of the appendix

This appendix applies for the duration of the contract. To the extent that it governs the processing of personal data, it prevails over the other provisions of the Terms.

The liability of the parties under this appendix is governed by Article 8 of the Terms unless the GDPR provides otherwise.