Enlivy

Legal

Terms and Conditions

Last updated:

1. Parties

1.1. Enlivy SRL Company headquartered in Dej, 28 Avram Iancu Street, Cluj county, with VAT ID RO44824071, VIES code RO44824071, registered at the Trade Registry Office under no. J12/4142/2021, bank account RO75RZBR0000060022929164, BIC RZBRROBUXXX, opened at Raiffeisen Bank, Dej branch, legally represented by Mr. Andrei-Robert Rusu, email address office@enlivy.com.

1.2. The User of the web application and all services offered through it, made available to you through the enlivy.com website.

Hereinafter individually referred to as “Party” and collectively as “Parties,” have agreed to conclude this service contract.

2. Definitions

2.1. The Terms and Conditions stated hereinafter constitute the contract that you, as a user of the services, enter into with us, Enlivy SRL, and regulate the conditions of collaboration between the parties, namely the manner in which we provide the services through the enlivy.com website.

2.2 The operator of the enlivy.com website is us, Enlivy SRL.

2.3 The purchaser of the services provided through the enlivy.com website is you, whether a natural person, authorized natural person, individual or family enterprise represented by its representatives, as well as a legal entity represented by its legal representative, who creates an account on our website and uses the services subject to this contract, either free of charge or for a fee, by placing an order, as the case may be. The User shall also be considered the one who creates an account but does not use the services subject to this contract, with the clauses regarding the use of the account being applicable to them.

2.3. The visitor is a person who, although accesses the enlivy.com website, does not create an account on it and does not use, free of charge or for a fee, the services subject to this contract.

2.5 The entirety of the services and service subscriptions made available through the enlivy.com website, provided in the form of annual or, as the case may be, monthly subscriptions. Each subscription is individual, and each user can access at any time the list of services offered as well as the limit in which they can use the services on the subscription details page.

2.6. The uptime period of the services that the Provider can actually ensure, in accordance with section 7.3.

2.7. The account is an interface of the app.enlivy.com website that can only be accessed by users who create an account. The dedicated interface of the user account can also be accessed through the Application Programming Interface (API) by accessing api.enlivy.com. Creating an account involves the voluntary input by a natural person or by the representative of a legal person, as the case may be, of personal data, followed by the acceptance of this contract.

2.8. The Order is the purchase by a user who has created an account on the enlivy.com website or through app.enlivy.com/api.enlivy.com of the services that are the subject of this contract.

3. Object and Acceptance of the Contract

3.1. The clauses of this contract proposed by the Supplier shall apply to all Users who have created an account through the app.enlivy.com or api.enlivy.com website. These clauses also apply to all Orders placed by Users through the app.enlivy.com or api.enlivy.com website. Users are required to be aware of these contractual clauses before accepting them.

3.2 User acceptance: Under the conditions set forth in this contract and in compliance with Article 9 of Law no. 365/2002 on electronic commerce, the User who creates an account and clicks the “I have read the ‘Terms and Conditions of Service’ and agree with their content” button accepts the contractual clauses proposed by the Supplier and becomes part of this contract. The User is bound to adhere to the Terms and Conditions of Service regarding the use of the account, as well as the rights and obligations of the parties, even if they do not place an order.

3.3. In the same manner as described in section 3.2., the User who places an Order and clicks the “I have read the ‘Terms and Conditions of Service’ and agree with their content” button accepts the contractual clauses proposed by the Supplier and becomes part of this contract. The User benefits from the selected services or service package and has the corresponding obligation to pay the subscription fee.

3.4. Description of Services - The services provided by us through the app.enlivy.com or api.enlivy.com website, which you can purchase in the form of subscriptions, are intended to support your or your company’s activities as a User of the services provided. These services include generating invoices, receipts, and other supporting documents, as well as electronic management of these documents, and electronic management of human and financial resources, among others. For a complete list of services and service packages available to you, please visit enlivy.com/pricing.

3.5. The services covered by this contract can be accessed through a web browser, API, or by accessing the app.enlivy.com or api.enlivy.com website.

3.6. The Supplier reserves the right to unilaterally change the content of this contract, with the version displayed on the app.enlivy.com or api.enlivy.com website being applicable to the relationship between the Supplier and Users, as well as to Orders placed by the latter. The Supplier will notify Users of any changes to these contractual clauses via email.

4. Duration of the Contract

4.1. This contract is concluded for an indefinite period from the moment the User creates an account on the app.enlivy.com or api.enlivy.com website or from the moment the User places an order, as applicable.

4.2. Access to Services: The User will have access to the services or service package purchased immediately after payment processing, followed by confirmation by the Supplier via email. Any material errors regarding the data entered in the order can be reported by the User within 24 hours of placing the order by sending an email to contact@enlivy.com.

4.3. Cancellation of an order, in the event of erroneous placement by the User, may also be requested within 24 hours by sending an email to contact@enlivy.com.

4.4. If the User does not notify the intention to terminate the services or service package purchased at least 30 calendar days before the expiration of the subscription term, it will be automatically renewed monthly or annually, as applicable, without any prior formalities. Additionally, the User will be automatically notified by email one week before the subscription renewal.

4.5. Users placing an order for the first time will have the option to request a refund of the subscription fee within 30 days of placing the order, regardless of the type or duration of the subscription purchased, but only with regard to the first order placed.

5. Price of the Contract

5.1. Payment Obligation:for the services provided, the User undertakes to pay the Supplier the subscription fee, the amount of which is determined and displayed at the time of order completion, depending on the service package chosen by the User.

5.2. Payment Notifications The Supplier will regularly send payment notifications to the User, depending on the selected service package and billing period.

5.3. The complete list of service fees and service packages we offer can be consulted at any time by visiting enlivy.com/pricing, and we reserve the right to unilaterally modify these amounts. For ongoing contracts, subscription prices will only be changed after prior notification to the User, with a notice period of 30 days.

6. Use of Services Covered by this Contract

6.1. Licensing: The User who places an order and pays for the services covered by this contract or uses these services for free understands that by accepting the Terms and Conditions of Service, they are entitled to the purchased services for the agreed-upon period at the time of placing the order. In this sense, the User is granted a single, non-transferable, and non-exclusive license by the Supplier for the use of the services covered by this contract. For obtaining a transferable license against payment of additional costs, please contact us via email at contact@enlivy.com.

6.2. Users have the option to benefit from one of the service packages provided by the Supplier for free for a trial period of 30 days. This option must be expressed by the User within 30 days of creating the account by accessing enlivy.com/demo and clicking the “I have read the ‘Terms and Conditions of Service’ and agree with their content” button. At the end of the 30-day trial period, the User will have the option to purchase one of the service packages provided by the Supplier; otherwise, their access to the trial services will be restricted. In such a situation, the User will be required to provide the Supplier with the card details they intend to use for payment after the trial period ends. Additionally, for any commissions/taxes charged during the trial period, these cannot be refunded between parties, even in the event of early termination of the trial period.

6.3 The User understands that the license obtained under clauses 6.1. and 6.2. cannot be transferred, sold, assigned, or sublicensed by any means or made available to another person without the prior written consent of the Supplier.

6.4. Additionally, the User understands that they are obligated to use the purchased services in accordance with the clauses of this contract, under penalty of license revocation as specified in clause 12.

6.5. The updating of service packages or adjustments to their fees represent a unilateral right of the Supplier, the exercise of which will be communicated to Users in real-time. In this regard, changes to the fees of service packages will take effect within a period of 30 days from notification, allowing Users the option to request the cancellation of the subscription under the conditions of clause 4.4.

7. Availability of Services

7.1. The services and service packages we offer to support your activities or those of your company are displayed on the website enlivy.com/pricing and are valid as long as they are displayed at the indicated web address. Other packages than those displayed at the aforementioned web address may also be available in the user account under the Membership section.

7.2. Any changes to the amount of the service fees and service packages, as well as changes regarding the availability of services, will be communicated to Users via email, taking effect only after a period of 30 days from the communication. In this regard, the User assumes full responsibility for the accuracy of the personal data entered when creating the account, especially regarding the email address provided for communication with the Provider, and any damages, regardless of their nature, resulting from changing the email address or phone number (if the User opts to receive SMS alerts) without updating the account details or losing access to the email address provided for communication, will be borne by the User.

7.3. To ensure that Users have access to the services provided through the website enlivy.com, we, Enlivy SRL, make every effort and due diligence to ensure the availability of services for as long a period as possible. However, it is impossible for us to guarantee the availability of the services provided for the entire contractual period, considering the services’ dependence on internet access, possible technical limitations encountered by us or our partners, and potential force majeure events as defined by law. Consequently, Users understand and accept that service availability is assured by the Provider at a rate of 99%, this obligation being one of diligence, not result. If a User cannot access the purchased service due to reasons attributable to the Provider, they can request a refund proportional to the time period for which access to the service was restricted.

7.4. The availability period mentioned in point 7.3 does not include maintenance periods about which the Provider notifies Users in advance but does include unplanned and unannounced maintenance periods arising from unforeseeable events.

7.5. Users’ access to the purchased services will be ensured for the entire availability period, subject to the suspension of access rights under the conditions of point 11.2.

8. Rights and Obligations of the Parties

8.1. User Rights and Obligations

8.1.1. The User understands that they are obliged to use the services provided by the operator of the website enlivy.com in compliance with all applicable legal provisions in the field in which they operate.

8.1.2. The User assumes full responsibility for the accuracy and truthfulness of the data they provide or register using the services subject to this contract. They are also solely responsible for any legal violations or infringements of third-party rights, including those related to the conclusion, performance, and termination of their service contracts with their partners.

8.1.3. The User understands that they are obliged to comply with legal provisions regarding copyright and/or intellectual property rights, as well as data protection laws concerning the data and information they provide or register using the services subject to this contract. The Provider has no obligation regarding the data entered by the User or the data contained in documents and/or files created/generated, managed, processed, or saved by the User.

8.1.4. The User is obliged to pay the Provider the value of the services provided, within the terms and conditions agreed upon at the time of order placement.

8.1.5. The User assumes full responsibility for the creation, customization, administration, and management of documents and files sent, processed, or saved using the provided services, as well as the accuracy and legality of the data entered in these documents and/or files.

8.1.6. The User fully accepts the contractual clauses found in the Terms and Conditions of service provision, as well as the Annexes referenced therein.

8.1.7. The User has the right to benefit from the purchased services or service package for the entire availability period for which the subscription was acquired.

8.1.8. The User has the right to create and customize multiple user accounts with different access rights in the IT system, depending on the purchased service package. In this case, the primary User who created these accounts holds full responsibility for their creation, management, and closure. However, the User’s withdrawal from the services subject to this contract does not lead to the deletion of secondary user accounts created as mentioned above but does result in the deletion of all data directly related to the User who withdrew from the services.

8.1.9. The User has the right to download any document and/or file created/generated, managed, processed, or saved using the provided services, as well as any table containing data related to the aforementioned, at any time during the availability of the purchased services. During the period when the User does not have access to services, either due to non-payment or access restriction under point 10, they can request any of the previously mentioned items from the Provider via an email sent to office@enlivy.com, and the Provider will respond based on availability.

8.1.10. The User has the right and corresponding obligation to obtain a backup of the documents and/or files created/generated, managed, processed, or saved, and all data entered and processed through the provided services during their availability period. After the User loses access to the provided services, the right to obtain a data backup cannot be exercised. Therefore, the Provider does not assume any obligation to store the User’s data, documents, or files. Exceptionally, the User can obtain a backup of documents and/or files created/generated, managed, processed, or saved, and all data entered and processed through the provided services within a maximum of 10 days from the moment they lose access to services, if they notify the Provider within this period.

8.1.11. The User has the right and corresponding obligation to perform a complete data wipe of the entered data and documents or files created/generated, managed, processed, or saved using the provided services before renouncing them, at any time during the services’ availability period but only after obtaining a backup according to point 8.1.9. The Provider will not be held liable if the User, despite being notified of the existence and conditions for exercising this right, does not exercise it under the terms and deadlines established in this contract, regardless of the nature of the damages incurred.

8.2. Rights and Obligations of the Provider

8.2.1. The Provider ensures the User the following:

  • the possibility to create/generate, customize, manage, and process documents and/or files through the provided services for the entire duration of their availability;
  • written assistance via email, from Monday to Friday between 10:00 AM and 5:00 PM;
  • data backup, under the conditions regulated in point 8.1.10;
  • connection to the system through a secure communication protocol (https);
  • synchronization of data from the user account so that it is available from any type of device, from anywhere, via internet access. In this regard, the Provider states that the services offered do not work or work in a limited manner in offline mode.

8.2.2. Regarding the relationship with the User, the Provider acts as a host and provides storage and content management services added by the User, under the conditions of Law no. 365/2002 regarding electronic commerce. A certain component of the provided services involves data storage also on the User’s devices. However, most data is not stored in the web browser or on the User’s devices but on servers available to the Provider, in a secure manner. For these reasons, the Provider does not assume responsibility for losing access passwords to the user account or for activities that may compromise the User’s account. If the Provider receives a notification regarding certain conduct or actions of the User that generate a reasonable suspicion regarding their legality, it reserves the right to suspend access to the services subject to this contract under the conditions of point 10.

8.2.3. The Provider is obliged to provide the User with a unique, non-transferable, and non-exclusive license that allows the latter to use the provided services for the duration agreed upon by the parties at the time of order placement. In exchange for the license, the Provider has the right to the value of the provided services.

8.2.4. The Provider has no obligation or prerogative to monitor or control the data, respectively the User’s documents and/or files.

8.2.5. For the situation described in point 7.3, the Provider is obliged to refund the User the value of the purchased service package proportionally to the period during which the latter did not have access to the service.

8.2.6. The Provider has the right to collect anonymous data about how its services are used and to make them public in an aggregated manner.

8.2.7. The Provider has the right to unilaterally modify the provisions of this contract, also having the correlative obligation to communicate or notify these changes to the Users. The changes will take effect after 30 days from their communication via email and/or through the application, and Users will be bound to accept the new contractual provisions before using the services subject to this contract.

8.2.8. The Provider holds all copyright and intellectual property rights over the web application through which the services subject to this contract are provided. Any infringement of these rights allows the Provider, under the law, to request the User or any other persons responsible for violating them to pay fair compensation.

9. Creating an Account and Accessing the Provided Services

9.1. Creating an account is done by accessing the website https://app.enlivy.com/register, entering data such as name, surname, country of residence, email address, and the account password, followed by pressing the button “I have read the ‘Terms and Conditions of service provision’ and agree with their content.” We recommend using a secure password and not disclosing it to others to avoid compromising the security of your user account.

9.2. Access to the provided services is ensured for Users who have placed an order and paid the subscription value, subsequently confirmed by the Provider. Whatever the reason or cause for which the User cannot access the provided services, they are obliged to immediately notify the Provider by sending an email to contact@enlivy.com. Regarding the proportional reduction mechanism of the subscription value for the situation described in point 7.3, the moment from which it will be considered that the User did not have access to the services subject to this contract is the moment they notified the Provider about the inability to access the services under the previously mentioned conditions.

10. Contractual Liability

10.1. No data transmission over the internet can be guaranteed to be 100% secure. Despite our efforts to protect your data and information using secure information transmission protocols (https), the Provider cannot ensure or guarantee the security of information transmitted by the User to the Provider. Consequently, the User understands and accepts the risk involved in transmitting information to the Provider over the internet.

10.2. We reiterate that you, as the User of the provided services, are solely responsible for the manner, way, or purpose in which you use the services subject to this contract, as well as for any potential legal violations and any potential damages caused to third parties as a result of improper or illegal use of the provided services. Additionally, the User understands and accepts that they are solely responsible for the authenticity and manner of use/management of data and information through the provided services.

10.3. Furthermore, the User is solely responsible for entering real, correct, and complete information during the account creation process and for maintaining the accuracy of this information by updating it in case of any changes.

10.4. The Provider cannot be held responsible for the manner, way, or purpose in which the User uses the services provided, even if the User violates certain legal provisions. The Provider will cooperate with any institution or public authority that legally requests its support in such cases and reserves the right to suspend the User’s access to the provided services, under the conditions of point 11.2.

10.5. The User understands and accepts that they are solely responsible and are obliged to cover any damages suffered by the Provider, regardless of their nature, as a result of actions taken or any illicit conduct adopted during the use of the provided services.

10.6. Despite the efforts made by the Provider to ensure the correctness and accuracy of the information found on the website app.enlivy.com, the User understands and accepts that their updating will be done by the Provider as soon as possible to ensure their correspondence with the functionalities of the provided services.

10.7. The Provider cannot be held responsible, under any circumstances, for direct or indirect damages suffered by the User as a result of improper use of the services, interruption of their use under the conditions of this contract, or the lack of correspondence between the information found on the website app.enlivy.com and the functionalities of the provided services. Furthermore, the Provider cannot be held responsible, under any circumstances, for damages suffered consisting of loss or reduction of profit and/or turnover of the User as a result of using the provided services.

11. Termination of the Contract and Suspension of Access Rights to the Provided Services

11.1. This contract terminates in any of the following situations:

  • if the parties agree to terminate the contract;
  • if one of the parties repeatedly fails to fulfill its contractual obligations or fulfills them improperly;
  • if one party notifies the other party, in writing, of the unilateral decision to terminate the contract; for this situation, the termination notice will only take effect after a period of 30 days from the date of receipt;
  • in case of death, dissolution, liquidation, bankruptcy, or withdrawal of the operating license of one of the parties.

11.2. The right of access of a User to the provided services, namely the right of access to the user account, may be temporarily suspended by the Provider in any of the following situations:

  • if the Provider is notified by institutions or public authorities, under the law, regarding the alleged violation by the User of legal provisions;
  • if the Provider finds that the User accesses or uses the services covered by this contract without complying with the provisions of this contract, or detects irregularities regarding the activity carried out by a certain User;
  • if a period of 30 days has elapsed since the issuance and communication of the invoice made by the Provider to the User under the terms of this contract; in this situation, the User will be granted access rights only after the payment or processing of the remaining payments, followed by confirmation by the Provider;
  • if the User violates the provisions of this contract or legal provisions in a manner likely to prejudice the legitimate interests and rights of the Provider; for this situation, the User is obliged to respond to the Provider’s requests regarding the conduct or harmful/damaging actions, and to immediately cease any such conduct or action; the User’s access right will be ensured only after providing the necessary evidence or clarifications regarding the cessation of harmful/damaging actions or conduct for the Provider;

12. Revocation of the License

12.1. The Provider has the right to unilaterally revoke the license granted to the User, in exceptional situations where the latter, voluntarily, threatens or seeks to cause harm to the Provider, regardless of its nature, by exercising actions or unlawful acts, such as, but not limited to, actions or acts likely to result in the violation of the Provider’s copyright, patrimonial and/or non-patrimonial rights, as well as any related rights. This contractual clause does not in any way restrict the Provider’s right to obtain full compensation for any damages suffered under the aforementioned conditions, nor does it entitle the User to reimbursement of the value of the services purchased but not used as a result of the license revocation.

13. Confidentiality

13.1. The Parties undertake the reciprocal obligation not to disclose any of the following aspects without the prior written consent of the other Party:

  • any confidential information to a third party, outside those individuals involved in the execution and performance of the contract;
  • any confidential information or information learned in the execution of the contract or to which it has access during the term of the contract, for any purpose other than the execution of the contract.

13.2. The provisions of point 13.1. will not apply in situations where:

  • the information was already known to the disclosing party before it became part of this contract;
  • the information was accessible to the public;
  • the party in question was required by law to disclose the information in question.

14. Force Majeure

14.1. Force majeure exempts the parties from liability in case of partial or total non-performance of the obligations assumed under this contract. Force majeure, in accordance with legal provisions, means an event independent of the parties’ will, unforeseeable and insurmountable, occurring after the conclusion of the contract and preventing the parties or the party invoking it from partially or totally performing the obligations it is obliged to fulfill.

14.2. The party invoking force majeure has the obligation to communicate this fact in writing to the other party, as well as to provide evidence attesting to the occurrence of such an event, within a maximum of 5 days from its occurrence.

14.3. The party that has notified the other party in accordance with point 14.2. about the occurrence of any force majeure event has the obligation to communicate the cessation of the cause to the other party within a maximum of 5 days from its cessation.

14.4. If these circumstances and the consequences they generate last for more than 2 months, each party has the option to terminate this contract. In this situation, where the termination is ordered for the occurrence of a force majeure event lasting more than 2 months, neither party can claim from the other party compensation or the bearing of any damages resulting from the non-performance of this contract.

15. Applicable Law in this Contract

15.1. The provisions found in the Terms and Conditions of Service Provision, together with any annexes to which these provisions refer and which are an integral part of the contract, are to be interpreted in accordance with Romanian law.

15.2. Any misunderstanding regarding the provisions of this contract will be resolved by the parties amicably. If this is not possible, any dispute regarding the application, execution, interpretation, and scope of these contractual provisions will remain within the jurisdiction of the courts at the Provider’s headquarters.

16. Final Provisions

16.1. The Parties declare that they have read in full the contents of the Terms and Conditions of Service Provision and agree to it in its entirety, and by signing this contract, they declare that they consciously assume the obligations and rights arising from it.

16.2. The Provider reserves the right to update or modify periodically the content of the Terms and Conditions of Service Provision. In these situations, Users will be notified by email of the changes made, which will take effect after a period of 30 days from the notification.

16.3. All notifications or communications sent to the Provider must be communicated to the email addresses indicated in the Terms and Conditions of Service Provision; otherwise, they will not be considered as communicated.

16.4. The annexes to which this document refers, such as Annex 1 regarding the processing of personal data, constitute an integral part of the service provision contract and will be applied and interpreted together with it.

This contract is available at the address enlivy.com/terms-and-conditions-of-service-provision, the version displayed at this address being the one from February 22, 2026.

Annex 1

Processing of personal data by the operator of the enlivy.com website in accordance with European Regulation No. 679/2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (GDPR)

This annex, which is an integral part of the service contract, together with the Terms and Conditions of Service provision and any annexes referred to therein, regulates the specific rules regarding the processing of personal data sent by the User, as the operator, to the Provider, as the processor within the meaning of art. 4 GDPR.

1. Meaning of certain terms

In the context of this annex, the meaning and interpretation given to the terms used shall be in accordance with the provisions of art. 4 GDPR.

2. Object of processing

The object of the processing of personal data by the operator is the processing, by the processor, of the data transmitted by the former for the purpose of providing the services covered by the Terms and Conditions of Service provision.

3. Collected data

The data made available by the operator to the processor for the aforementioned purpose are as follows:

3.1. For the app.enlivy.com service - the personal data processed are those entered by the operator that appear on documents and/or files, such as: name, surname, document issuer and its identification data, e-mail, telephone, and in the case where the document is issued to a natural person client: name, surname, full address, and depending on the operator’s option - bank account, personal identification number (CNP). Additionally, the operator may directly add other additional personal data to the invoices issued, which the processor cannot anticipate.

3.2. For the service of creating and accessing the user account without using the enlivy.com service - the personal data processed are the e-mail address and password associated with the user account, as well as the telephone number.

4. Data subjects

The individuals whose personal data may be subject to processing are as follows:

  • the operator’s employees;
  • the operator’s clients;
  • third parties with whom the operator comes into contact in the normal course of economic activity.

5. Instructions and specific duties of the processor

Under this document, the operator provides the following instructions and specific duties to the processor:

  • to collect and process the personal data specified in point 3 and received from the operator directly for the purpose specified in point 7;
  • to send emails on behalf of the operator;
  • to collect and process information from the content of documents sent and/or stored through the provided services, provided that they have been communicated and opened/viewed by the operator’s clients;
  • to collect and process the personal data specified in point 3 and received from the operator directly for the purpose specified in point 7 or processed with the operator’s consent from other databases.

6. Duration of processing

The duration of the processing of personal data under this document is equal to the period for which the operator benefits from the services provided through the enlivy.com website.

7. Nature and purpose of processing

The nature and purpose of the processing are established under the main contract, consisting of providing services through the enlivy.com website, depending on the package of services purchased by the operator.

8. Rights and obligations of the operator

8.1. The right to receive information from the Processor or to verify through a mandated auditor if the Processor has and implements adequate technical and organizational measures so that the processing complies with the requirements provided by the GDPR; the verification shall take place based on prior written notice, transmitted at least 14 working days before the verification;

8.2. The right to receive assistance from the Processor, especially in fulfilling its obligation to respond to requests from data subjects regarding the exercise of their rights under the GDPR;

8.3. The right to object to other subprocessors under art. 8.2;

8.4. To comply with its obligations under the GDPR as the Controller regarding personal data collected or processed by the Processor on its behalf;

8.5. The obligation to inform data subjects in accordance with the GDPR, including regarding the processing of data by the Processor under this contract;

8.6. The obligation to solely determine the legal basis for the processing of personal data subject to this contract;

8.7. The obligation to implement adequate technical and organizational measures in accordance with the GDPR, including securing the transfer of data from data subjects to the Processor;

8.8. The Operator understands that once the data is deleted after the completion of the services by the Processor in accordance with the GDPR obligations and art. 10 of this contract, the data cannot be recovered, and it is the entire responsibility of the Operator.

8.9. In all situations where the Operator is required to perform an obligation, such as informing the data subject about the breach of personal data security, the Processor cannot be held liable for the Operator’s inactions within the scope of that obligation.

9. Processor’s Rights and Obligations:

9.1. The obligation to inform the Operator within a maximum of 10 days if, in the Processor’s opinion, an instruction violates the GDPR and/or other legal provisions regarding the processing of personal data;

9.2. The obligation to ensure the security of personal data processed on behalf of the Operator in accordance with art. 32 of the GDPR and art. 11 of this Annex;

9.3. The obligation to promptly inform the Operator of any unauthorized breach of the personal data security during processing by the Processor;

9.4. The obligation to assist the Operator with all necessary information for notification, if applicable, to the competent authority for data security breaches, without substituting the Operator in its notification obligation;

9.5. The obligation to assist the Operator in ensuring compliance with the obligations set out in Articles 32-36 of the GDPR;

9.6. The obligation to assist the Operator in resolving requests from data subjects or to forward to the Operator any requests received from data subjects regarding personal data collected and processed by the Processor, within a maximum of 5 calendar days from receiving it. This assistance does not apply if the Operator already has the technical means provided by the Processor to directly address the data subject’s request (e.g., Right of access - where the Operator already has all the information about the data it collects);

9.7. The obligation not to transmit personal data and/or confidential information, which may be personal data, learned during the execution of the contract;

9.8. The obligation to ensure training for authorized personnel processing personal data regarding the confidentiality of this data;

9.9. The obligation to include confidentiality obligations to employees and subprocessors;

9.10. The right to disclose certain personal data under a legal obligation or other condition provided by legislation at the request of an authority, public institution, or court.

9.11. The right to recruit subprocessors under art. 8 or in cases where approval has been obtained from the Operator;

9.12. The right to cover the costs of providing assistance to the Operator, borne by the Operator, in situations provided by the GDPR under art. 9, if they exceed the monthly cost of the services provided by the Processor.

9.13. The right to use anonymized statistical information resulting from the activities performed under this contract or its entire activities.

9.14. The Processor cannot determine the purposes or means of processing personal data, as these are solely determined by the Operator.

10. Processing Security

10.1. The Processor must implement appropriate technical and organizational measures to ensure adequate security measures relative to the risk, in line with industry best practices. When determining the appropriate level of security, the Processor must take into account the current state of development, implementation costs, and the nature, scope, context, and purposes of the processing, as well as the risks of varying likelihood and severity for the rights and freedoms of individuals, and the risks posed by the processing, particularly with regard to those that could lead to, accidentally or unlawfully, the destruction, loss, alteration, or unauthorized disclosure of personal data transmitted, stored, or otherwise processed, or unauthorized access to them.

10.2. In this context, the Processor has internally established the application of the following organizational and technical security measures for personal data security, taking into account the type of activity performed:

  • periodic security audits conducted by cybersecurity experts;
  • limited access to the database for a very small number of Processor employees;
  • continuous monitoring of database access;
  • encryption of the connection used by the Operator to access the service using SSL;
  • encrypted customer passwords stored;
  • regular backups.

10.3. Voluntarily, the Processor may send summaries of security auditors’ conclusions (after deleting commercial or confidential information) conducted periodically to Operators to demonstrate its ongoing activities on this subject.

11. Limitation of Liability

The Operator understands and agrees that the Processor cannot be held liable for damages or losses that may arise from the following:

  • non-compliance with the contract due to events beyond the liability or will of the Processor;
  • compliance with the instructions of the Operator or non-compliance with the instructions of the Operator justified in advance by a notification regarding their illegal or immoral nature;
  • absence or invalidity of consent from data subjects or the use of an incorrect legal basis by the operator;
  • non-compliance with the contract due to actions of the Operator.

12. Limitation of Responsibility

The Operator and the Processor delimit their responsibilities regarding ensuring the protection of personal data (for example, ensuring confidentiality or processing security), depending on the access and effective control exercised over the data, both contractually and technically.

13. Entry into Force, Effectiveness, and Amendment of this Annex

The provisions contained in this Annex shall enter into force upon its publication on the enlivy.com/GDPR page and shall be valid in the form displayed, applicable where the Terms and Conditions of Service apply. The content of the annex was updated on 22 February, 2026.