Terms and Conditions

1. Provider

1.1The provider of the qzila service and the operator of the website qzila.com, the sign-in service identity.qzila.com and the tools interface tools.qzila.com is:

Business name: adcore s.r.o.
Registered office: Svätojurská ulica 6153/2, 902 01 Pezinok
Office: Dunajská 12, 811 08 Bratislava
Company ID (IČO): 51285495
Tax ID (DIČ): 2120671608
VAT ID (IČ DPH): SK2120671608 (registered under Section 7 of the VAT Act, not a VAT payer)
Registration: Commercial Register of the Bratislava III Municipal Court, Section: Sro, Insert No. 125650/B
Managing director: Miroslav Demovič
E-mail: hello@qzila.com
E-mail for reporting security incidents: incident@adcore.sk

hereinafter the “provider”.

1.2The supervisory authority is the Slovak Trade Inspection (SOI), SOI Inspectorate for the Bratislava Region, Bajkalská 21/A, P. O. BOX No. 5, 820 07 Bratislava, www.soi.sk.

2. Introductory Provisions

2.1These General Terms and Conditions (hereinafter the “Terms”) govern the rights and obligations of the provider and the customer in the use of the qzila.com website, the qzila account and the tools of the qzila service.

2.2The qzila service is a set of stand-alone software tools provided as SaaS for security, compliance, monitoring, marketing, productivity, and sales and finance. All tools share one account, one notification centre and one invoice. The current list of tools is available at qzila.com/tools.

2.3The qzila service is intended exclusively for businesses, organisations and sole traders, i.e. commercial companies and other legal entities, self-employed persons, public administration bodies, and non-profit and professional organisations. It is not intended for consumers. A person who creates a qzila account or an organisation confirms upon registration that they are acting as a sole trader or other entrepreneur in the course of their business activity, or on behalf of and with the authority of a business or organisation. The provider may require proof of this fact, in particular the business name and Company ID (IČO) in the billing profile, and may cancel the account if the declaration is untrue.

2.4Should a contract nevertheless be concluded with a consumer, mandatory consumer protection legislation shall prevail.

2.5Pursuant to Section 273 of the Commercial Code, the Terms form part of the contract between the provider and the customer. The customer expresses consent to them upon creating a qzila account by ticking the relevant box in the registration form. The Terms are available to the customer on the website prior to registration and the customer may save or print them. The provider keeps a record of the consent given, including the date, time and wording of the Terms.

2.6Deviating provisions of an individual contract, price quotation or SLA concluded with the provider take precedence over the Terms. Where the customer obtained the service through an authorised reseller of the provider, the price, invoicing, implementation and support may be governed by the contract with the reseller; these Terms nevertheless apply to the use of the tools.

2.7The Asign platform (asign.sk) is governed by separate terms and conditions. Where qzila tools are connected with the Asign service, each of the services is subject to its own terms.

3. Definitions

Tool means an individual stand-alone tool of the qzila service, usually available on its own subdomain within tools.qzila.com.

qzila account means a user account in the identity.qzila.com sign-in service which provides access to all tools with a single sign-in.

Organisation means a workspace to which the members, customer content, tool usage and billing belong. Data and usage belong to the organisation, not to the person who added them. The owner and the administrator manage members, settings and billing; a member does not have these permissions.

Customer means a person under clause 2.3 on whose behalf an organisation was created. User means a natural person with a qzila account who is a member of the customer’s organisation.

Customer content means all data that the customer or users enter into the tools or that is generated in them, in particular domains, URLs and hosts, files, screenshots, check results, data on persons and roles, time entries, form responses, notification recipients and configurations.

Billing unit means the unit for which a tool charges a price, for example a monitored domain, page, vault, person, check, scan or volume of stored data.

Beta tool means a tool labelled as Beta.

SLA means a separately agreed level of availability and support. DPA means a data processing agreement pursuant to Art. 28 GDPR.

4. Conclusion of the Contract and Subject of the Service

4.1The contract is concluded by creating a qzila account and expressing consent to the Terms; an individual contract is concluded by its signature. The contract is concluded electronically, in the Slovak language and for an indefinite period; prior to registration and prior to adding a payment card, the customer may check and correct the data entered. The English version of the documents on the website is a translation.

4.2Information on the website is for information purposes only. The price of a billing unit displayed in the account at the time the unit is added is binding.

4.3The provider may refuse registration or the activation of a tool, in particular if the data are incomplete or untrue, the customer has previously breached the Terms or is in default of payment, the registration is automated or bulk, or the use of the service would be unlawful or would compromise its security.

4.4The subject of the service is access to the tools that the organisation activates, to the extent set out in their description on the website and in the account. The service includes one account for all tools, management of organisations and roles, a notification centre with delivery by e-mail, Slack, webhook, SMS or to Jira, a usage overview with export, and the IAM tool.

4.5The provider may develop, update and change the tools. The provider shall notify customers using a paid tool of its discontinuation at least 30 days in advance, where circumstances permit, and shall enable them to export their data during this period. No charge is made for the period after the tool is discontinued.

4.6Beta tools are available only to invited organisations, are not charged during the beta phase, may have limited availability and functionality, and may be changed or discontinued at any time without notice. If a beta tool becomes a paid tool, its price will be displayed in the account before charging begins.

4.7Tools may have technical limits (for example the number of requests per minute, notifications per day or file size), which are set out in the documentation or in the account.

5. Prices and Payment Terms

5.1The service is charged according to actual usage (pay-as-you-go), with no minimum purchase, annual licence or commitment period. The price per billing unit is stated in the price list at qzila.com/pricing, on the tool’s page and in the account before the customer adds the unit. The IAM tool is included in the account free of charge.

5.2Prices are in euros. The provider is registered for tax under Section 7 of Act No. 222/2004 Coll. on Value Added Tax (hereinafter the “VAT Act”) and is not a VAT payer under Section 4 of the VAT Act; prices are final and no VAT is added to them. For a customer who is a taxable person from another EU Member State, the place of supply of the service is the customer’s state and the tax is paid by the customer (reverse charge); the customer is obliged to state a valid VAT ID in the billing profile. If the provider becomes a VAT payer, VAT at the statutory rate will be added to prices from that date, of which the provider will inform customers in advance.

5.3Each qzila account receives a monthly credit, currently €5, by which the invoice for tool usage is reduced. The credit is neither a trial period nor time-limited; it is renewed every month, is shared across all tools, any unused portion is not carried over, and it cannot be paid out. The credit may also be used without a payment card; without a card nothing is charged, the tools operate with the lower limits stated in the account, and usage beyond the credit is possible only after a card has been added.

5.4Usage is calculated per tool and per calendar month and is charged monthly in arrears. An invoice itemised by tool is issued on the 1st day of the following month and the amount is debited from the payment card via the Stripe service. The monthly fee for a monitored item (for example a domain, page, vault or person) is charged pro rata according to the number of days during which the item was added; charging ends on the day of its removal. An invoice amount lower than €0.50 is carried over to the next invoice, for a maximum of 12 months.

5.5An organisation has a spending limit of €50 per month unless the customer changes it. Upon reaching 80% of the limit, the provider will notify the customer. Once the limit is reached, the scheduled activity of the tools, in particular monitoring and checks, is suspended until the beginning of the following month or until the limit is increased; the customer acknowledges that no notifications are received during the suspension.

5.6Payment is made upon the successful debit of the amount from the card or upon its crediting to the provider’s account. Card details are processed directly by Stripe; the provider sees only the card brand, the last four digits and the expiry date.

5.7The provider shall notify organisation owners of a price change by e-mail and in the account at least 30 days before it takes effect. The new price applies only to usage after the change takes effect. A customer who does not agree with the change may, before it takes effect, remove the affected units or stop using the service.

6. Late Payment and Suspension of the Service

6.1If a payment cannot be debited from the card, the provider shall inform the organisation owners thereof without undue delay by e-mail and in the account and shall repeat the attempt.

6.2If the repeated attempt also fails or the invoice cannot be collected for another reason, the provider shall send the organisation owners, by e-mail, a request for payment or for the addition of a functioning card, setting an additional period of at least 7 days and warning of possible suspension. After the period has expired to no avail, the provider may suspend the organisation.

6.3During suspension, scheduled monitoring and checks are stopped and results are displayed only in summary form. Customer content remains preserved and protected, the customer has access to it for the purpose of export, and the provider may not withhold it as security for payment. Access will be restored without undue delay, no later than 2 working days after payment of the amount due.

6.4In the event of default, the provider may claim default interest under Section 369 of the Commercial Code and Government Regulation No. 21/2013 Coll. and a lump-sum compensation of costs of €40 under Section 369c of the Commercial Code, and may refuse the activation of further tools. Default of more than 30 days constitutes a material breach of the contract for which the provider may withdraw from the contract; withdrawal takes effect upon delivery and clause 20.8 applies to data export. Neither suspension nor withdrawal affects the obligation to pay amounts due.

7. Account, Organisations and Customer Obligations

7.1Signing in to a qzila account is possible with a password or via Google, Microsoft or GitHub. When signing in from a new browser, the service may require a verification code sent by e-mail or SMS, and the user may enable two-step verification. One person may be the owner of no more than 10 organisations.

7.2The customer is obliged to:

a)provide true and up-to-date data, including billing and contact data,

b)manage members, roles and permissions in its organisation and remove without delay the access of persons who should no longer have it,

c)ensure that users protect passwords and verification codes, do not share accounts, and use strong passwords and two-step verification,

d)report without delay any suspected misuse of an account or security incident to incident@adcore.sk,

e)hold the necessary rights and authorisations to the data entered into the service and ensure that the use of the service in its organisation complies with employment law, data protection and cybersecurity legislation, in particular for tools involving employee data (for example Time Tracking, IAM, People Lifecycle),

f)pay the price of the service duly and on time and protect webhook addresses and access credentials to integrations.

7.3The customer is responsible for all activity carried out through the accounts of members of its organisation, unless it proves that such activity occurred solely as a result of a breach of the provider’s obligations.

8. Acceptable Use

8.1The customer may monitor, check and scan only domains, hosts, pages and files that it owns or is authorised to test.

8.2The customer may not use the service, in particular:

a)to scan or monitor third-party systems without their authorisation,

b)to develop or test methods of evading the detection of malicious code,

c)as a general-purpose tool for downloading web content, a proxy or a scraper,

d)in a manner that overloads the service or third-party systems, or circumvents published limits,

e)to send spam, distribute malicious code or store unlawful content or content infringing the rights of third parties; files containing malicious code may be uploaded only to a tool intended for checking them,

f)to process special categories of personal data (Art. 9 GDPR), data relating to criminal convictions and offences (Art. 10 GDPR) or birth numbers, unless specifically agreed with the provider in writing and the customer has a legal basis for doing so; an exception is the recording of sick leave under clause 10.4.

8.3By adding an item to a tool, the customer declares that it owns the item or is authorised to monitor and check it. The provider may at any time, in particular before activating a tool or where there is reasonable suspicion of a breach of clause 8.1, require proof of authorisation, for example by a verification record in DNS, a file on the web server or the written consent of the owner. Until the customer proves authorisation, the provider may refuse or suspend the checking of the item or remove the item. Verification is not required for checks that only ascertain publicly available information, for example public DNS records or data from public certificate registries.

8.4The customer is liable for third-party claims arising from use of the service in breach of this Article and shall compensate the provider for any damage incurred as a result.

9. Customer Content and Notification of Illegal Content

9.1The customer remains the owner or authorised holder of the rights to the customer content and is responsible for its lawfulness and accuracy. The provider may use it only to the extent necessary for the provision, operation, security and backup of the service, for support, for the transfer of necessary data to external sources used by the tool for checking (to the extent set out in the Privacy Policy), and for the fulfilment of legal obligations. The provider will not use it for its own marketing purposes, sell it or publish it.

9.2The provider may use anonymised or aggregated technical and statistical data on the use of the service which do not allow the identification of the customer or any person.

9.3The tools retain customer content for the period stated in the Privacy Policy or in the tool description. The provider is not obliged to check customer content in advance; if it becomes aware of its unlawfulness or of a breach of the Terms, it may block or remove it.

9.4Anyone may report content stored in the service that they consider to be illegal, pursuant to Art. 16 of Regulation (EU) 2022/2065 on digital services (hereinafter the “DSA”), by e-mail to hello@qzila.com. The notice must contain a substantiation, the exact location of the content (for example a URL), the name and e-mail address of the notifier and a statement of good faith. The provider shall confirm receipt, assess the notice in a timely, diligent and objective manner, and inform the notifier of its decision.

9.5If the provider removes customer content or disables access to it, or suspends or terminates an account on the grounds of illegal content or a breach of the Terms, it shall provide the customer with a statement of reasons under Art. 17 DSA, including the grounds, information on the use of automated means and the available means of redress. The customer may lodge an objection at hello@qzila.com; this is without prejudice to the customer’s right to bring the matter before a court.

9.6The single point of contact for authorities and recipients of the service under Art. 11 and 12 DSA is hello@qzila.com; communication may be in Slovak or English.

10. Personal Data Protection and DPA

10.1The processing of personal data of website visitors, account holders, organisation members and billing contacts is governed by the Privacy Policy at qzila.com/privacy.

10.2The provider is the producer and owner of the qzila service. With respect to personal data in customer content, the customer is the controller and the provider is the processor within the meaning of Art. 4(8) GDPR, i.e. it processes such data on behalf of the customer. This processing is subject to clauses 10.3 to 10.12, which, together with the other provisions of the Terms, constitute the DPA under Art. 28(3) GDPR; the customer concludes it by consenting to the Terms. A separately concluded DPA takes precedence.

10.3Subject matter and duration. The provider processes personal data solely for the purpose of providing the service, namely by storing, organising, displaying, evaluating, performing checks, sending notifications, exporting, backing up and erasing them, for the duration of the contract and the periods under Article 20.

10.4Data subjects and data. These are in particular the customer’s employees, collaborators and contact persons and notification recipients, and their identification and contact data, job position and roles, time entries and absences, data in personnel cases, form responses, files and other content entered by the customer, and operational logs (time of access, IP address). A detailed overview is provided in clause 3.7 of the Privacy Policy. The data referred to in clause 8.2(f) are excluded; if the customer nevertheless enters them, it is responsible for the appropriateness of such processing. An exception is the data on an employee’s sick leave (PN) in the Time Tracking tool, which the customer as employer records under Art. 9(2)(b) GDPR; only the fact and period of the incapacity for work may be recorded, not the diagnosis or any other data concerning health.

10.5Customer obligations. The customer is responsible for having a legal basis for the processing, having fulfilled its information obligations towards data subjects, and being entitled to engage the provider to carry out the processing.

10.6Instructions, confidentiality and security. The provider processes personal data only on documented instructions from the customer, including with regard to transfers to a third country, except for processing required by Union or Slovak law (of which it shall inform the customer in advance, unless that law prohibits it). Instructions consist of the Terms, the tool settings and written instructions of the organisation owner sent to hello@qzila.com. The provider shall without delay notify the customer of any instruction which, in its opinion, infringes data protection legislation and may postpone it until clarified. The provider shall bind authorised persons to confidentiality, adopt the measures under Article 12, and shall not use the data for its own purposes, marketing or the training of artificial intelligence models.

10.7Sub-processors and transfers. The customer grants general written authorisation to engage the sub-processors listed in Article 7 of the Privacy Policy. The provider shall notify organisation owners by e-mail at least 30 days in advance of any intended engagement or replacement of a sub-processor; the customer may raise a reasoned objection within 15 days and, if it is not resolved, may terminate the service without penalty. The provider imposes the same obligations on sub-processors and is liable for them under Art. 28(4) GDPR. Customer content, including backups, is stored in the EU; transfer to a third country is possible only in accordance with Chapter V GDPR (Article 8 of the Privacy Policy).

10.8Assistance. The provider shall provide the customer with reasonable assistance with data subject requests and with obligations under Art. 32 to 36 GDPR. Data subject requests that the provider receives directly shall be forwarded to the customer.

10.9Personal data breach. The provider shall notify the customer of a personal data breach affecting customer content without undue delay, as a rule within 48 hours of becoming aware of it, by e-mail to the organisation owners, with the information under Art. 33(3) GDPR, which it shall supplement on an ongoing basis. Notification to the supervisory authority and to data subjects is carried out by the customer.

10.10Audit. The provider shall make available the information necessary to demonstrate compliance with Art. 28 GDPR and shall allow an audit by the customer or by an auditor mandated by it and bound by confidentiality, notified at least 30 days in advance, no more than once every 12 months, preferably in the form of documentation, at the customer’s expense and without compromising the data of other customers. The notice period and frequency do not apply in the event of a personal data breach, reasonable suspicion or an inspection by a supervisory authority.

10.11Return and erasure. Upon termination of the contract, the provider shall enable export under Article 20 and shall erase the data, including copies, from active systems within 30 days and from backups within 35 days, unless the law requires further retention; upon request, it shall confirm the erasure.

10.12Liability. Liability for breach of clauses 10.3 to 10.11 is governed by Article 17 and Art. 82 GDPR.

11. Operation, Availability and Support

11.1The provider operates the service with professional care. It may carry out maintenance and updates, temporarily restrict availability for maintenance or security reasons, use subcontractors and monitor the technical use of the service to the extent necessary for security, operation, billing and support. It will endeavour to give advance notice of scheduled maintenance.

11.2The provider does not promise uninterrupted availability; without an SLA, the service is provided without a guarantee of any specific percentage availability. Availability may be affected in particular by maintenance, security incidents, outages of the internet, cloud infrastructure, payment services and external data sources, force majeure and configuration on the customer’s side.

11.3Delivery of notifications also depends on third-party services and on the customer’s configuration; the provider does not guarantee the delivery of every notification within a particular time. qzila tools are not intended to be the sole means by which the customer protects its systems.

11.4Support is provided by e-mail at hello@qzila.com or through an authorised reseller. The provider may sign in to a user’s account to resolve a request only with the express consent of the owner or administrator of the organisation, to the extent strictly necessary and with each sign-in being logged. Implementation, consultancy, audits, integrations or training are provided on the basis of a separate agreement and may be subject to a charge.

12. Security

12.1The service is operated in the EU on Amazon Web Services infrastructure: the tools in the Frankfurt region and the qzila.com website in the Ireland region. The provider applies in particular the following measures:

a)encryption of communications (TLS 1.2 and higher, HSTS) and encryption of databases, backups and files (AES-256), with key management in AWS KMS and a separate key for each vault in the Secure Storage tool,

b)storage of passwords exclusively as a one-way hash, and verification codes when signing in from a new browser,

c)role-based access control, least privilege and logical separation of organisations’ data,

d)a strict Content Security Policy and a web application firewall,

e)logging and monitoring,

f)continuous database backup with point-in-time recovery to any moment within the last 35 days, with backups stored in the EU,

g)change and vulnerability management, incident response procedures, regular risk assessment and testing of measures,

h)confidentiality and security training of authorised persons.

12.2Where there is reasonable suspicion of unauthorised access, a security incident, misuse of the service against third parties or a threat to its security, the provider may temporarily restrict an account or organisation. It shall inform the customer thereof without delay, unless doing so would compromise security or the investigation of the incident.

13. Intellectual Property

13.1All rights to the qzila service, the tools, software, design, databases, documentation, assessment methodologies, names, trademarks and logos (hereinafter the “service content”) belong to the provider or its licensors.

13.2The customer obtains a non-exclusive, non-transferable and non-sublicensable right to use the service for the duration of the contract for its internal purposes to the extent of the activated tools. The customer may submit tool outputs (reports, assessments, exports) to auditors, authorities and business partners.

13.3Without the provider’s written consent, the customer may not copy, modify, rent, sell, sublicense or make the service available to third parties other than authorised users (with the exception of authorised resellers), reverse engineer or decompile it beyond the mandatory provisions of the Copyright Act, use it to develop a competing product, or remove rights notices. The customer may use the qzila and adcore names and logos only for the customary identification of the provider as a supplier.

13.4The provider may use the customer’s feedback and suggestions free of charge to develop the service. The provider may cite the customer’s business name or logo as a reference only with the customer’s consent.

14. Tool Results and Regulatory Compliance

14.1The tools perform automated checks and express the results by means of assessments and recommendations. The results are for information purposes only and do not constitute legal, audit or security advice. The provider does not guarantee their completeness or accuracy, in particular where they are based on external sources.

14.2The customer is obliged to verify the results before changing the configuration of its systems, DNS or e-mail, making a decision or submitting them to a third party on their basis; the customer makes changes at its own responsibility. Use of the service does not in itself guarantee compliance with legislation and standards, for example NIS2, DORA or ISO 27001.

14.3The provider does not use customer content to train artificial intelligence models.

15. Third-Party Services

15.1The service uses or enables connection with, in particular, sign-in via Google, Microsoft and GitHub, the Stripe payment service, delivery of notifications to Slack, Jira and webhooks, external data sources (threat databases, DNS resolvers, certificate registries, Have I Been Pwned) and the Asign platform. These services may be governed by their own terms.

15.2The provider is not responsible for the availability, accuracy of data or changes of third-party services beyond its control. The customer is responsible for the configuration of the integrations it chooses. The provider may restrict an integration if it compromises the security or operation of the service.

16. Confidentiality

16.1The parties shall keep confidential the non-public business, technical and security information of the other party, including customer content, check results and individual contractual terms, and shall use it only for the performance of the contract.

16.2Confidentiality does not apply to information that is publicly known without breach of the contract, demonstrably known in advance, lawfully obtained from a third party or disclosed on the basis of law or a decision of an authority; the party shall inform the other party of such disclosure unless prohibited by law. Confidentiality lasts for 5 years after termination of the contract, and in the case of trade secrets and personal data for the period of their statutory protection.

17. Liability for Damage

17.1The provider is liable for damage caused by a breach of its obligations. It is not liable for damage caused, in particular, by:

a)incorrect customer content or incorrect use of the service,

b)changes or decisions made by the customer on the basis of tool results without reasonable verification,

c)failure to deliver a notification as a result of third-party services or the customer’s configuration,

d)suspension of tool activity after reaching the spending limit or in the event of late payment,

e)acts of third parties, incorrect data from external sources or outages beyond the provider’s control,

f)circumstances excluding liability under Section 374 of the Commercial Code (force majeure),

g)breach of the customer’s obligations under the Terms.

17.2Having regard to Section 379 of the Commercial Code, the parties jointly declare that the damage which the provider foresaw or could have foreseen at the time of conclusion of the contract does not exceed the amount paid by the customer for the service during the 12 months preceding the event giving rise to the damage, but no less than €500. Unless otherwise agreed in an individual contract, compensation for damage is limited to this amount.

17.3The parties consider damage which the provider could not have foreseen to include, in particular, indirect and consequential damage, loss of business opportunities and reputation, penalties imposed on the customer, loss of data which the customer could have prevented by export, and the costs of substitute services. This provision shall not be deemed a waiver of a claim under Section 386(1) of the Commercial Code.

17.4Clauses 17.2 and 17.3 do not apply in the case of intent, gross negligence, harm to life or health, and where mandatory legislation does not permit it; they do not affect the rights of data subjects under Art. 82 GDPR.

18. Complaints

18.1The customer shall report defects of the service or incorrect billing without undue delay to hello@qzila.com, stating the organisation, the tool, a description and the time of occurrence of the problem and, in the case of billing, the invoice number and the disputed items.

18.2The provider shall assess the defect and take appropriate action within a reasonable period, in particular a fix, a workaround or a correction of the invoice. The following do not constitute a defect: unavailability during maintenance, an error caused by the customer, a third party or an external data source, limitations of beta tools, suspension under clause 5.5 or Article 6, or failure to meet expectations that were not agreed.

18.3For the time during which a paid tool did not function due to a defect on the provider’s side, the provider shall, at the customer’s request, reasonably reduce the billing. Further compensation is provided only under an SLA.

19. Duration and Termination of the Contract

19.1The customer may at any time remove billing units, deactivate tools or stop using the service; usage up to that moment will be billed in the next invoice. Cancellation of an account or organisation is carried out by the provider at the request of the owner sent to hello@qzila.com.

19.2The provider may terminate the contract without stating a reason with a notice period of 1 month, which begins on the first day of the month following delivery of the notice.

19.3The provider may terminate the contract with immediate effect if the customer or a user materially breaches the Terms, in particular Article 8, compromises the security of the service or of third-party systems, infringes the rights of third parties, provides untrue data or is in default of payment for more than 30 days.

19.4After the export period has expired, the provider shall erase the data of a cancelled account or organisation from active systems within 30 days and from backups within 35 days, unless legislation requires their further retention, for example for accounting and tax purposes or for the protection of legal claims.

19.5Provisions which by their nature are intended to survive termination of the contract, in particular those on confidentiality, intellectual property, liability, data protection and payments, shall continue to apply.

20. Switching Providers and Data Export

20.1The customer may at any time request to switch to another provider of data processing services, to port exportable data to its own infrastructure or to have them erased (hereinafter “switching”) pursuant to Chapter VI of Regulation (EU) 2023/2854 (hereinafter the “Data Act”). The customer shall send the request to hello@qzila.com; switching shall commence no later than 2 months after its receipt.

20.2Switching shall take place within a transitional period of no more than 30 calendar days. If this is technically unfeasible, the provider shall, within 14 working days of the request, give reasons and set an alternative period of no more than 7 months. During the transitional period, the provider shall provide reasonable assistance, continue to provide the service and maintain its security.

20.3Exportable data consist of customer content and data on the organisation’s use of the service, in particular:

a)account and organisation: members, roles and invitations, settings, billing profile, usage overview and invoices,

b)notifications: rules, recipients and history of notifications sent,

c)security checks (for example Email Security, TLS Scanner, Security Headers, Safe Check, Breach Monitor): checked items, results, assessments, recommendations, check history and audit log,

d)monitoring (for example Uptime Monitor, DNS Monitor, Snapshots, Typosquat Monitor): monitored items and their settings, history of checks and changes, screenshots and captured page text,

e)Secure Storage: stored files and their metadata,

f)Time Tracking: clients, projects, tasks, rates, time entries, absences and timesheets, including their approval,

g)IAM and People Lifecycle: persons, roles, access rights, contacts and personnel cases, including attached documents,

h)Formulator: forms and responses,

i)compliance tools (for example Auditor, Incident Responder, Continuity, Frameworks, Exceptions): records, documents, evidence and their history.

20.4Exportable data do not include the service content, data protected by the rights of the provider or third parties, or the provider’s internal operational and security data. Data are exported in a structured, commonly used and machine-readable format: tabular data in CSV or XLSX format, other data, including the metadata necessary for their interpretation, in JSON format, and files in their original format, as a rule in a single ZIP archive. If a tool does not offer self-service export, the provider shall prepare the export at the customer’s request. Export respects the permissions within the organisation. The provider publishes and keeps up to date a description of the switching procedure and of the data structures and formats under Art. 26 of the Data Act in the service documentation on the qzila.com website.

20.5After the end of the transitional period, the customer has at least 30 calendar days to retrieve the data. Thereafter, the provider shall erase them completely, unless legislation requires their further retention. The contract terminates upon completion of switching or, in the case of a request for erasure only, upon expiry of the period under clause 20.1.

20.6The provider does not charge any fees for switching or data export.

20.7Clauses 20.1 to 20.6 do not apply to beta tools provided for testing purposes, to the extent permitted by Art. 31 of the Data Act.

20.8If the customer stops using the service without a request under clause 20.1, the provider shall, upon request, enable it to export the data for at least 30 days from termination of the contract and shall then proceed in accordance with clause 19.4. Data may not be withheld as security for payment.

21. Amendments to the Terms

21.1The provider may reasonably amend the Terms, in particular in the event of changes to legislation, the service, the pricing model or subcontractors, or for security reasons.

21.2The provider shall give notice of an amendment to the Terms at least 30 days before it takes effect by e-mail to organisation owners and by publication on the website.

21.3If the customer does not agree with the amendment, it may stop using the service and request cancellation of the account as of the date the amendment takes effect. Continued use of the service after the amendment takes effect shall be deemed consent to the new wording. Amendments do not apply retroactively to claims that arose before they took effect.

22. Communication

22.1The parties communicate electronically. Notices to the provider shall be sent to hello@qzila.com, and security incidents to incident@adcore.sk. Notices to the customer shall be sent to the e-mail address of the organisation owner or the billing e-mail address, or displayed in the account.

22.2An e-mail is deemed delivered on the working day following its dispatch, unless the sender receives a non-delivery notification. The customer is obliged to keep its contact and billing data up to date.

23. Governing Law and Disputes

23.1The contract and the Terms are governed by the law of the Slovak Republic. The parties shall primarily resolve disputes amicably.

23.2Pursuant to Act No. 160/2015 Coll., the Civil Dispute Procedure Code, the parties have agreed that the court with territorial jurisdiction shall be the court of the provider’s registered office, unless mandatory legislation provides otherwise.

24. Final Provisions

24.1The Terms become valid upon publication on the website and take effect on the date stated in the header.

24.2The invalidity of any provision does not affect the remaining provisions; the parties shall replace it with a valid provision that comes as close as possible to its purpose.

24.3The Terms are drawn up in the Slovak language; in the event of any conflict with a translation, the Slovak version prevails.

24.4The contractual documentation includes, in particular, the Privacy Policy, the price list in the qzila account and, where applicable, an individual contract, an SLA, a separate DPA or a contract with an authorised reseller.

In Pezinok, 20 October 2026
adcore s.r.o.