Terms of Service and End User Licence Agreement

Corporate information

The BlackfishID platform and the software made available through it are provided by BLACKFISHID, S.L. ("BlackfishID", "we", "us" or "our"), a Spanish company with registered office at Paseo de la Castellana 280, first floor, 28046 Madrid, Spain, holding Tax Identification Number B44770394, registered in the Mercantile Register of Madrid under Volume 48693, Folio 21, Sheet B 592761, Entry 1, dated 15 March 2023.

These Terms of Service and End User Licence Agreement (the "EULA") are entered into between BlackfishID and the customer that acquires access to the Service (the "Customer", "User" or "you").

By accepting this EULA, by placing an order directly or through an authorised partner, distributor or reseller, or by accessing or using the Service, the Customer agrees to be bound by it, and by our Privacy Policy.

1. Binding conditions of use

1.1 Acceptance. Please read this document carefully. It constitutes a legally binding agreement from which legal obligations arise for you.

1.2 Contractual precedence. In the event of any discrepancy between this EULA and any specific contract executed between BlackfishID and the Customer, or between BlackfishID and the authorised partner through which the Customer acquires the Service, the terms of the executed contract shall prevail.

1.3 Changes to this EULA. BlackfishID may amend this EULA from time to time. The version in force at the start of a subscription term applies for that term. Any amended version will be published at this address with the date of the update, and BlackfishID will give at least thirty (30) days' notice of any material amendment before it takes effect for a renewed term.

2. Definitions

"Service": the BlackfishID unified cybersecurity platform provided as a managed software-as-a-service offering, including its monitoring, detection, response, reporting and related managed components, together with any agents, software, updates and documentation made available by BlackfishID.

"Authorised User": an employee, agent or contractor of the Customer authorised to use the Service.

"Device": any workstation, laptop or server (physical or virtual) that runs a BlackfishID managed agent or consumes a BlackfishID endpoint or server licence.

"Customer Data": any data, including personal data, submitted to or collected by the Service from the Customer's environment.

"Order": the order for the Service placed directly or through an authorised partner, distributor or reseller, specifying the subscription term and the number of Devices or Authorised Users.

"DPA": the BlackfishID Data Processing Agreement applicable to the Service.

"Documentation": the technical and user documentation for the Service made available by BlackfishID.

3. Licence grant and scope

Subject to this EULA and to payment of the applicable fees, BlackfishID grants the Customer a limited, non-exclusive, non-transferable, non-sublicensable right, during the subscription term, to access and use the Service and Documentation solely for the Customer's own internal business purposes and only for the number of Devices or Authorised Users set out in the Order.

The Service is a managed subscription. The Customer acquires no copy of, and no title to, the underlying software. All rights not expressly granted are reserved to BlackfishID.

4. Authorised Users and registration

The Customer must provide accurate and complete information during registration. The Customer is responsible for its Authorised Users and their compliance with this EULA, shall keep access credentials confidential and unshared, shall promptly notify BlackfishID of any unauthorised access, and is responsible for all activity under its accounts.

5. Restrictions and acceptable use

The Customer shall not, and shall not permit any third party to:

• (a) copy, modify, translate, or create derivative works of the Service;
• (b) reverse engineer, decompile, disassemble, or attempt to derive the source code, structure or algorithms of the Service, except to the extent this restriction is prohibited by law;
• (c) sublicense, rent, lease, sell, resell, or make the Service available to any third party, except as expressly permitted;
• (d) remove, alter, or obscure any proprietary notice or brand mark;
• (e) use the Service to build or support a competing product or service;
• (f) use the Service unlawfully, or to store or transmit unlawful or infringing material, or to disrupt the Service;
• (g) exceed the number of Devices or Authorised Users contracted without placing an additional order.

6. Deployment and Customer responsibilities

The Customer shall deploy the BlackfishID agents on the Devices to be protected and provide the access, telemetry sources and cooperation reasonably required.

The Customer is responsible for the accuracy and legality of the Customer Data, for obtaining any consents required to deploy and monitor, for the correct installation, configuration and updating of the agents provided, for maintaining appropriate backups, and for the security of its own networks and endpoints beyond the scope of the Service.

Where the Service identifies a vulnerability in the Customer's systems, remediation is the responsibility of the Customer unless otherwise agreed in the Order.

7. Service management, availability and support

BlackfishID will provide the Service using reasonable skill and care and in accordance with recognised industry standards, and will use commercially reasonable efforts to make the Service available on a continuous basis, subject to scheduled maintenance and events beyond its reasonable control. BlackfishID will give notice of planned maintenance whenever possible.

The service levels applicable to the Service, including availability targets, service hours and incident response targets, are those set out in the Order or in the service level terms referenced in it.

The Service is a security tool that reduces but does not eliminate cyber risk. BlackfishID does not warrant that it will detect, prevent or remediate every threat, vulnerability or incident.

8. Third-party components

BlackfishID may integrate third-party tools, software or services in order to deliver the Service. BlackfishID is responsible for ensuring that such components meet its security standards, but is not liable for failures or disruptions attributable to those third parties or to services the Customer contracts directly, such as domain registrars or hosting providers.

9. Fees

Fees are set out in the applicable Order and are billed in accordance with it. Where the Service is acquired through an authorised partner, distributor or reseller, fees are payable to that partner, distributor or reseller.

Non-payment may result in suspension or termination of the Service in accordance with clause 14.

10. Intellectual property

All intellectual property rights in the Service, the Documentation, and any improvements, updates or derivative works are and remain the sole and exclusive property of BlackfishID.

The Customer retains all rights in the Customer Data and grants BlackfishID a limited right to process it solely to provide, secure, maintain and improve the Service, subject to the DPA.

11. Customer Data and data protection

To the extent BlackfishID processes personal data on behalf of the Customer, BlackfishID acts as processor and the Customer as controller, governed by the DPA.

BlackfishID collects and stores only the data necessary to provide the Service. Customer Data is hosted within data centres located in the European Union, except where otherwise agreed with the Customer in writing, in accordance with the DPA and applicable law.

Certain ancillary components, such as threat-intelligence enrichment or specific data-processing functions, may be processed in another region where necessary to provide or improve the Service, subject to appropriate safeguards under Chapter V of Regulation (EU) 2016/679.

The Customer may request information about data retention and processing practices at any time by writing to support@blackfishid.com.

12. Security and confidentiality

BlackfishID will implement appropriate technical and organisational measures to protect the Service and Customer Data, as described in the DPA.

Each party shall keep the other's non-public information confidential and use it only for the purposes of this EULA. This obligation survives termination for five (5) years, and indefinitely for trade secrets.

13. Warranties, disclaimer and limitation of liability

BlackfishID warrants that the Service will materially conform to the Documentation during the subscription term.

EXCEPT AS EXPRESSLY SET OUT HERE, THE SERVICE IS PROVIDED "AS IS" AND BLACKFISHID DISCLAIMS ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, OR THAT THE SERVICE WILL BE UNINTERRUPTED OR ERROR-FREE.

Subject to the following paragraph, neither party shall be liable for indirect, special, consequential or exemplary damages or loss of profits, revenue, goodwill or data, and BlackfishID's total aggregate liability shall not exceed the fees paid or payable for the Service in the twelve (12) months preceding the claim.

Nothing in this EULA limits liability for death or personal injury caused by negligence, for fraud, or for any liability that cannot be limited under applicable law.

14. Term, suspension and termination

This EULA is effective for the subscription term set out in the Order and renews accordingly.

BlackfishID may suspend the Service where required for security or legal reasons, or for non-payment. Where payment is not received within the stipulated period, BlackfishID may suspend or terminate access after prior notice.

Either party may terminate for material breach not cured within thirty (30) days, or immediately on insolvency.

On termination, the Customer's right to use the Service ceases, Customer Data is treated in accordance with the DPA, and fees already invoiced for the current term are non-refundable.

15. Compliance, sanctions and export

The Customer shall comply with all applicable laws in its use of the Service, including data protection, export control, sanctions and anti-bribery laws, and represents that it will not use the Service in violation of applicable United Nations, European Union, United States, United Kingdom, Spanish or local sanctions or export controls.

16. Governing law and jurisdiction

This EULA is governed by the laws of the Kingdom of Spain.

Any dispute shall be finally resolved by arbitration administered by the Corte de Arbitraje de Madrid, seated in Madrid, conducted in English, enforceable under the 1958 New York Convention, without prejudice to interim relief before any competent court, and subject to any mandatory local-law requirement applicable to public-sector Customers.