Enterprise and Institutional Terms

These terms automatically supplement the Terms of Service for organisational business and institutional accounts through the same electronic acceptance by an authorised representative. The Provider is MAŃSKI AI s.r.o. and the Terms’ definitions apply. The account, acceptance record and Order identify the Customer, acting representative, workspace, plan, seats, term and price. The DPA and its standard schedules are incorporated at the same time, without an individual signature. Bespoke security, sector or service-level requirements apply only if separately agreed; a standard team plan does not imply such additional commitments.

Standard SaaS processing uses the published default schedules and the Customer’s lawful configuration and instructions. Before restricted-data use, assess the legal regime and whether the available controls meet its risks. An institution’s internal review is not regulatory certification. Individual signature, custom annexes or procurement documentation are optional enterprise mechanisms unless a special legal regime or the institution’s rules require them; they are not a prerequisite for every law firm, university or business.

The Customer designates owners and administrators, assigns roles, approves authorised users and maintains timely access removal. Access is limited to the appropriate workspaces, matters and projects. A leaving user’s personal account request must not erase institutional records without controller authority. The Customer supplies retention and legal-hold instructions, professional reviewer roles and any permitted external-source policy.

The Provider performs its own contractual duties of confidentiality, security, processing limitation and assistance. The Customer remains responsible for its legal basis, professional duties and substantive decisions. Neither party can use this allocation to avoid its mandatory duties. Special categories or offence data may be approved only for the specified lawful purpose and controlled setting; classified information is excluded from the standard Service.

The Terms’ mutual confidentiality obligations cover institutional materials, case files and non-public procurement or security information. The agreed DPA governs instructed personal-data processing; a separate lawful regime must be documented where GDPR does not govern the activity. Customer Data remains stored and processed in the EU, with no silent exemption for support or subcontractors.

The accepted security schedule identifies actual measures, evidence, responsibilities and any service levels. There is no implied certification, uptime percentage, insurance limit, recovery objective or guaranteed support time. The Provider shall not materially reduce agreed protection without the required change process. A supplier change follows the DPA notice and objection mechanism and cannot defeat a procurement condition.

The parties keep current incident and privacy contacts. The Provider reports Personal Data Breaches without undue delay and provides available information and updates under the DPA. Material service-security issues affecting the contracted institutional use are communicated without undue delay with reasonable information on impact and mitigation, subject to lawful security restrictions.

The Provider shall provide proportionate compliance information and cooperate with agreed customer audits and legally competent regulators. Confidentiality or a preference for desk review shall not prevent an audit or access required by law. Appropriate safeguards protect other customers and unrelated trade secrets. The DPA audit provisions apply to personal-data processing; additional sector access rights must be set out in the Order where required.

The Customer identifies whether the deployment concerns a public administration information system, a public procurement, mandatory contract publication, regulated cyber-security obligations or a sector-specific secrecy regime. Where applicable, the Order must address the necessary catalogue entry, security level, approvals, procurement terms and commencement conditions. This document does not assert that Veritas Ask is entered in a public-sector cloud catalogue or approved for classified use.

Processing for criminal-law purposes by competent authorities must be assessed under the relevant law-enforcement data regime, rather than automatically under GDPR. Processing for EU institutions must be assessed under their applicable framework. Judicial or law-enforcement decision-support uses require an intended-purpose assessment under the AI Act; the presence of a human reviewer is not a blanket exemption. The agreed scope must exclude an unassessed or unauthorised regulated deployment.

For financial-sector ICT arrangements, a DORA or other required sector addendum must address the relevant service and function, locations, subcontracting, incident assistance, regulator and audit access, continuity, termination and exit. Support of a critical or important function may require detailed service levels and tested resilience that are not implied by these standard terms. Healthcare or diagnostic intended uses similarly require their own assessment; the standard medical profile supports evidence research.

The Customer provides retention periods or objective criteria, legal holds and deletion authority. Current organisation cleanup is initiated by an administrator; a retention setting is not an automatic background task unless a separately supplied capability is expressly agreed. The Provider implements the agreed instructions within the supplied functions and assists with any contracted operational process.

The parties plan export and handover before termination, preserving permitted access, record integrity and confidentiality during transition. The Export and Switching document and mandatory Data Act rights apply where relevant. An exit schedule must specify the formats, original files, associated metadata, assistance, timing and deletion confirmation required for the actual workspace. No proprietary source code, model weights or another customer’s data are included by implication.

The Order may specify invoicing, purchasing references, seats, support, acceptance criteria and service credits. The business liability rules in the Terms apply unless expressly replaced in a signed agreement; mandatory data-subject and regulatory rights remain unaffected. A service credit is not an exclusive remedy for an unrelated breach unless lawfully and expressly agreed.

A negotiated agreement may vary the standard documents only by a clear, lawful provision. Mandatory law prevails; the DPA controls personal-data processing; these terms supplement the general Terms. A required contract-register publication or other statutory condition controls effectiveness where applicable. Neither party may rely on confidentiality to prevent a mandatory publication, but the parties must identify and protect information lawfully exempt from disclosure. Material changes require the agreed notice and amendment process, not only a new webpage.