General Terms and Conditions Conturalis BV

• “Operator” / “Conturalis”: Conturalis BV, the provider of the Smart Web Platform, CTS Cloud, and associated SaaS infrastructure, operating under Belgian law.
• “Tenant” / “Client”: The legal entity, business, or certified integration partner entering into an agreement with Conturalis for the use of the platform.
• “Compute Credits”: The proprietary, prepaid digital utility unit used to meter and consume all platform execution, including LLM inference tokens, cloud storage, API routing, and background tasks.
• “Smart Data”: The proprietary text, documents, and media synchronized by the Tenant into the Conturalis system to ground the AI Agents.
• “Web Agents”: The autonomous conversational (Chat), publishing (Content), and outreach (Sales) modules powered by the CTS Cloud.

2.1. These general conditions apply to all offers, agreements, and active relationships between Conturalis and the Tenant.

2.2. By creating an account, synchronizing a WordPress environment via the Conturalis Plugin, generating a License Key (JWT), or utilizing the CTS Cloud API, the Tenant acknowledges having fully read, understood, and accepted these terms.

2.3. The applicability of any general or specific terms and conditions of the Tenant is expressly rejected, unless agreed otherwise in writing and signed by an authorized representative of Conturalis.

2.4. Data Processing Agreement (DPA): To the extent that Conturalis processes Personal Data on behalf of the Tenant in the provision of the platform, the parties acknowledge that the Tenant is the Data Controller and Conturalis is the Data Processor under Regulation (EU) 2016/679 (GDPR). The Data Processing Agreement set forth in Annex A attached hereto forms an integral, legally binding part of these Terms.

3.1. Conturalis reserves the right to amend or supplement these terms to reflect technical developments, security enhancements, changes in upstream infrastructure or AI model API pricing, or legislative updates.

3.2. Material changes will be communicated to the Tenant electronically (via email or the Control Panel) at least thirty (30) days prior to taking effect.

3.3. If the Tenant does not agree with the proposed material modifications, the Tenant has the right to terminate the agreement and cease platform usage prior to the effective date. Continued use of the platform and API services after the effective date of the modifications constitutes acceptance of the revised terms.

4.1. Prepaid Ecosystem: Conturalis operates strictly on a pay-as-you-go, prepaid Credit Economy framework (structured via “Horizon Tiers”). All AI consumption, vector database queries, and background tasks automatically deduct a fractional amount of Compute Credits from the Tenant’s centralized Wallet.

4.2. Automated Service Suspension: The delivery of services is entirely dependent on a positive Wallet balance. If a Tenant’s Wallet balance reaches zero (0), the Automated Service Suspension protocol is instantly triggered, degrading all AI processing and API access to an inactive state.

4.3. Out-of-Scope Services: Standard Credit consumption covers automated cloud execution. Manual engineering interventions or strategic consulting are excluded and billed at standard hourly rates.

5.1. Vector Embedding & RAG: By utilizing the platform, the Tenant acknowledges that data synchronized to the CTS Cloud is processed into mathematical vector embeddings to enable Retrieval-Augmented Generation (RAG).

5.2. Data Curation & Responsibility: Conturalis acts as an automated processing conduit and does not actively pre-screen or manually moderate ingested Smart Data. The Tenant bears sole legal responsibility for the legality, accuracy, and curation of all data ingested into the CTS Cloud.

5.3. Sub-processor Authorization & Global AI Infrastructure:
(a) The Tenant grants Conturalis general written authorization pursuant to GDPR Article 28(2) to engage third-party infrastructure and model sub-processors, specifically including Google LLC / Google Cloud Platform (GCP).
(b) The Tenant expressly acknowledges and agrees that generative AI inference, prompt token calculation, embedding generation, and autonomous grounding search operations may be processed dynamically via Google Cloud Vertex AI global infrastructure clusters (including data transmission to and processing within the United States).
(c) International data transfers to Google LLC in the United States are legally grounded in the European Commission’s Adequacy Decision for the EU-U.S. Data Privacy Framework (DPF) pursuant to GDPR Article 45, with Google Cloud’s Standard Contractual Clauses (SCCs) under GDPR Article 46 serving as a contractual fallback.

5.4. Foundation Model Data Protection: Conturalis procures foundation model execution under enterprise commercial terms ensuring that sub-processors (specifically including Google Cloud Vertex AI) do not use Tenant prompts, completions, or synchronized Smart Data to train, fine-tune, or refine their foundational AI models without documented instruction.

5.5. Strict Exclusion of Special Category Personal Data: The Tenant is strictly prohibited from synchronizing, submitting, uploading, or prompting the Web Agents with Special Categories of Personal Data as defined under GDPR Article 9 (including health data, biometric identifiers, political opinions, trade union memberships, or criminal convictions under Article 10). The Tenant agrees to fully indemnify and hold harmless Conturalis from any regulatory sanctions, fines, or third-party liabilities arising from a breach of this prohibition.

5.6. Tenant Transparency & AI Disclosure: The Operator designs and provides the Web Agents with configurable technical capabilities to inform natural persons of artificial intelligence interactions pursuant to Article 50(1) of Regulation (EU) 2024/1689 (EU AI Act). The Tenant (as Deployer) warrants and agrees that it will maintain a clear, timely disclosure to website visitors (whether via the platform’s native interface components, custom initial greeting prompts, or website disclosures) ensuring end-users are informed that they are interacting with an artificial intelligence system. The Tenant assumes sole liability for any failure to inform end-users resulting from the Tenant’s manual suppression or omission of such disclosures. The Tenant warrants that all commercial outreach, cold messaging, telephone calls, or email campaigns initiated using leads, drafts, or data generated by the Sales Agent comply strictly with the ePrivacy Directive (Directive 2002/58/EC), applicable national opt-out registries, and fair direct marketing practices. The Tenant acknowledges that Conturalis merely provides software automation and bears no responsibility for unsolicited commercial communications dispatched by the Tenant.

6.1. Conturalis adheres strictly to structural data minimization and erasure principles.

6.2. When a Tenant explicitly deletes a file, removes a user profile, or disconnects a WordPress environment, the associated data enters a thirty (30) day “Time-To-Live” (TTL) cooling-off period.

6.3. Upon expiration of the TTL, the Conturalis automated infrastructure permanently and irreversibly purges all orphaned vector embeddings, chat transcripts, and associated operational metadata from active production datastores. Routine secondary backup snapshots are overwritten in the ordinary course of business pursuant to standard backup rotation cycles, without prejudice to statutory data retention obligations imposed by applicable tax or commercial laws.

7.1. Wallet top-ups and Horizon Tier subscription upgrades are executed automatically via the Control Panel.

7.2. Non-Refundable: Because Compute Credits grant immediate, irreversible access to reserved cloud computing power and LLM generation limits, all credit purchases are final and strictly non-refundable, regardless of whether they are actively consumed.

7.3. Default of Payment: Failure to fulfill financial obligations for post-paid enterprise agreements will result in immediate suspension of API access, an automatic default interest rate of 10% per annum, and a fixed administrative compensation.

8.1. The Tenant must maintain the absolute confidentiality of their Control Panel credentials, API keys, and WordPress Plugin License Keys (JWT).

8.2. The Tenant explicitly agrees not to reverse-engineer the Conturalis Plugin, perform deliberate DDoS attacks, exploit API rate limits, or utilize the Web Agents to generate illegal, harmful, or explicitly prohibited content.

9.1. Generative AI Limitations: While Conturalis utilizes a stacked AI verification pipeline, generative AI models are inherently probabilistic. The Tenant acknowledges that Web Agents may occasionally produce inaccurate, misleading, or unexpected output (“hallucinations”).

9.2. No Guarantee of Output: Conturalis provides the infrastructure “as-is” and strictly disclaims any warranty regarding the absolute factual accuracy of the AI-generated responses. Conturalis is not liable for financial loss, lost prospects, or reputational damage caused by end-user reliance on Web Agent output.

10.1. Except in cases of proven intentional misconduct, gross negligence, or non-performance of essential contractual obligations, Conturalis shall not be held liable for any direct or indirect damages suffered by the Tenant.

10.2. Liability Cap: Should Conturalis be found liable by a competent court, the maximum cumulative liability for any single event shall never exceed the total amount paid by the Tenant for Compute Credits in the twelve (12) months strictly preceding the incident giving rise to the claim.

11.1. Conturalis provides a “best-effort” Service Level Agreement (SLA).

11.2. The flawless operation of cloud architecture and third-party APIs cannot be guaranteed. Temporary service interruptions may occur due to Google Cloud regional updates, LLM provider downtime, or network latency. Such occurrences do not constitute a breach of contract by Conturalis.

12.1. Operator IP: Conturalis retains all intellectual property rights to the CTS Cloud architecture, WordPress plugin code, Conpacts Framework (JSON logic), prompt routing algorithms, and brand design systems.

12.2. Tenant IP & Data Indemnity: The Tenant retains all intellectual property rights to the raw, unedited Smart Data they synchronize into the platform. The Tenant warrants that it possesses all necessary lawful bases, consents, and rights to process and transmit such data to the CTS Cloud. The Tenant shall fully indemnify, defend, and hold harmless Conturalis BV against any third-party claims, legal actions, administrative fines, or damages imposed by any Data Protection Authority (such as the Belgian Gegevensbeschermingsautoriteit) arising directly or indirectly from data privacy, GDPR, or IP infringements stemming from the Tenant’s ingested Smart Data or failure to properly inform end-users.

13.1. Conturalis reserves the right to unilaterally and immediately terminate or suspend the Tenant’s API access if the Tenant severely violates the Acceptable Use Policy, initiates fraudulent chargebacks, or files for bankruptcy.

13.2. Upon termination, the Tenant’s active connection to the CTS Cloud will be severed, and data will enter the automated erasure protocol.

14.1. Conturalis is not obliged to fulfill any obligation if prevented from doing so by force majeure.

14.2. Force majeure includes prolonged outages of underlying foundation model APIs (such as Google Vertex AI), Google Cloud regional failures, widespread internet disruptions, cyber-attacks, and government actions.

15.1. All agreements and legal relationships between Conturalis and the Tenant are governed exclusively by Belgian law.

15.2. Any disputes arising from or related to these terms shall fall under the exclusive jurisdiction of the competent courts of the district of East Flanders, division Ghent (Oost-Vlaanderen, afdeling Gent).

Pursuant to Article 28 of Regulation (EU) 2016/679 (GDPR), this Data Processing Agreement (“DPA”) governs the processing of Personal Data by Conturalis BV (“Processor”) on behalf of the Tenant (“Controller”) in connection with the Conturalis Smart Web Platform and CTS Cloud services.

1. Subject Matter, Duration, and Nature of Processing

1.1. Subject Matter: The provision of autonomous AI Web Agents (Chat, Content, Sales), Retrieval-Augmented Generation (RAG) vector searches, document ingestion, and cloud management services as described in the General Terms.

1.2. Duration: Co-terminous with the Tenant’s active account subscription or platform usage, plus the thirty (30) day cooling-off deletion lifecycle (TTL).

1.3. Nature and Purpose: Processing Personal Data contained within Tenant Smart Data, website content, and end-user interactions solely to execute AI inference, provide contextual conversational responses, generate marketing content, and log platform telemetry.

2. Categories of Data Subjects & Types of Personal Data

2.1. Categories of Data Subjects:
(a) Tenant personnel, administrators, and authorized integration partners;
(b) Website visitors, customers, and end-users interacting with the Tenant’s WordPress websites and deployed Web Agents.

2.2. Types of Personal Data Processed:
(a) Identification & Contact Data: Names, email addresses, phone numbers, and professional roles submitted via chat forms or extracted from synchronized site content;
(b) Interactive & Behavioral Data: Chat transcript queries, prompt messages, user intent observations, and session metadata;
(c) Technical Telemetry Data: IP addresses, browser user-agents, timestamps, request URLs, and session identifiers.

2.3. Special Categories of Data: The processing of Special Categories of Personal Data (GDPR Article 9) is strictly prohibited as set forth in Article 5.5 of the General Terms.

3. Obligations of the Processor

Conturalis warrants and agrees to:

3.1. Documented Instructions: Process Personal Data strictly on documented instructions from the Tenant (including with respect to international transfers), which include the performance of services under the General Terms, unless required to do so by European Union or Belgian law.

3.2. Confidentiality: Ensure that all personnel authorized to process Personal Data are committed to confidentiality through written non-disclosure agreements or statutory obligations.

3.3. Technical and Organizational Measures (TOMs): Implement and maintain appropriate technical and organizational measures pursuant to GDPR Article 32 to guarantee a level of security appropriate to the risk, as detailed in Section 4 below.

3.4. Assistance with Data Subject Rights & Regulatory Compliance: Provide reasonable assistance to enable the Tenant to fulfill its statutory obligations to respond to requests from Data Subjects exercising their rights under GDPR Chapter III (such as access, rectification, erasure, and data portability), and assist the Tenant in ensuring compliance with its obligations pursuant to GDPR Articles 32 to 36 (including Data Protection Impact Assessments and prior consultations), taking into account the nature of processing and information available to the Processor.

3.5. Data Breach Notification: Notify the Tenant without undue delay upon becoming aware of a confirmed Personal Data Breach affecting Tenant data, providing sufficient information to enable the Tenant to meet its reporting obligations under GDPR Article 33.

3.6. Deletion or Return: At the choice of the Tenant, permanently delete or return all Personal Data upon termination of services, adhering to the 30-day automated erasure protocol for active production datastores, unless European Union or Belgian law mandates retention. Routine secondary system backups are overwritten pursuant to standard rotation lifecycles.

3.7. Audit Rights & Statutory Warnings: Make available to the Tenant all information reasonably necessary to demonstrate compliance with GDPR Article 28, and allow for and contribute to audits or inspections conducted by the Tenant or an independent auditor mandated by the Tenant, no more than once per calendar year upon thirty (30) days’ prior written notice. The Processor shall immediately inform the Tenant if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions.

4. Technical and Organizational Security Measures (TOMs)

Pursuant to GDPR Article 32, Conturalis enforces the following baseline security controls:

4.1. Encryption at Rest: All tenant records, database items, RAG vector embeddings, analytical ledgers, and storage objects are encrypted at rest using industry-standard AES-256 encryption within Google Cloud SQL (Managed PostgreSQL), Google Cloud Firestore, Google BigQuery, and Google Cloud Storage.

4.2. Encryption in Transit: All external and inter-service network traffic is strictly encrypted in transit using Transport Layer Security (TLS 1.3 / HTTPS).

4.3. Tenant & Context Isolation: Multi-tenant boundaries are programmatically enforced across runtime execution contexts, ensuring complete isolation of tenant state and preventing cross-tenant data leakage across concurrent asynchronous serverless executions.

4.4. Access Control & Least Privilege: Administrative access to production infrastructure is restricted via multi-factor authentication (MFA), role-based access control (RBAC), and rotating service account credentials.

5. Sub-processors & International Transfers

5.1. Authorized Sub-processor: The Tenant grants specific written authorization for the appointment of:

• Google LLC / Google Cloud Platform (USA & EU): Cloud infrastructure hosting, container execution (Cloud Run), persistent databases (Cloud SQL / PostgreSQL and Firestore), analytical ledgers (BigQuery), and generative AI model inference (Vertex AI).

5.2. International Data Transfers:
(a) The Tenant expressly acknowledges that AI model inference, prompt token calculation, and search grounding are processed dynamically on Google Cloud Vertex AI global processing clusters, involving transient data transmission to the United States.
(b) Transfers to Google LLC in the United States are formally governed by Google LLC’s certification under the EU-U.S. Data Privacy Framework (DPF) pursuant to European Commission Adequacy Decision 2023/1795 (GDPR Article 45), with Google Cloud’s standard contractual clauses (SCCs) under GDPR Article 46 serving as a contractual fallback.
(c) Enterprise model inference is governed by commercial terms ensuring sub-processors do not utilize Tenant prompts or data to train or improve foundational models without documented instruction.

5.3. Sub-processor Changes: Conturalis shall inform the Tenant of any intended appointment of a new sub-processor at least fourteen (14) days prior to authorization, granting the Tenant the opportunity to object on legitimate data protection grounds. If the Tenant objects on reasonable grounds and Conturalis cannot reasonably accommodate such objection without modifying its cloud architecture or service delivery, either party may terminate the affected services without penalty upon written notice.