I. The Provider, purpose and scope of these Terms

1) These General Terms and Conditions are issued by Mgr. Martin Ševčík, Identification No. 06860583, with his registered office at Hlinky 277/29, 603 00 Brno, Czech Republic, carrying on business as a sole trader under the Czech Trade Licensing Act (the “Provider”).

2) These Terms govern the provision of marketing management, advisory, audits, marketing due diligence, research, preparation of briefs, supplier management, digital and content services, and other related work.

3) The “Client” is any person ordering a service in connection with its business, profession or public‑sector activities. The Provider does not contract with consumers under these Terms.

4) These Terms form part of an agreement only where the agreement, proposal or order expressly refers to them and the Client received them, or was given durable access to them, before entering into the agreement.

II. Contract documents and order of precedence

1) “Agreement” means a written agreement, an accepted proposal or another agreement between the Provider and the Client that identifies at least the service and the Fee. “Order” means an individual assignment agreed under the Agreement.

2) If the contract documents conflict, they apply in the following order: the individually signed Agreement; an accepted Order or statement of work; the data processing schedule; these Terms; and any other schedules or supporting documents.

3) A different provision takes precedence only to the extent of the specific conflict. The remaining provisions of these Terms continue unchanged.

4) The Client’s terms and conditions do not apply unless the Provider expressly accepts them in writing. This does not affect any mandatory rule of law governing references by both parties to conflicting standard terms.

III. Entering into the Agreement and express acceptance of important provisions

1) The Agreement is entered into when both parties sign it, when the Client accepts the Provider’s proposal in writing, or in another unambiguous manner specified in the proposal. Starting the work or paying an Advance Payment enters the parties into the Agreement only where the proposal expressly states that it will have that effect.

2) By entering into the Agreement, the Client confirms that, before doing so, it received the version of these Terms identified in the Agreement and had an opportunity to review it.

3) In the short‑form Agreement, the Client must expressly accept at least the provisions on capacity reservation and any reservation fee, acceptance of Deliverables, the licence being conditional on payment, the limitation of liability, and the restriction on targeted solicitation of the Provider’s personnel. A general statement accepting all of these Terms does not replace that express acceptance.

4) The person entering into the Agreement for the Client must be authorised to do so. If an employee or contractor of the Client accepts a proposal, the Client is responsible for ensuring that the person had the necessary authority or that the Client ratifies the person’s action without undue delay.

IV. Scope of services and changes to the brief

1) The Provider will provide only the services expressly stated in the Agreement or an Order. Any activity, deliverable, deadline or responsibility not expressly agreed is outside the Provider’s obligations.

2) The Client may request a change to the brief. The Provider will explain its effect on the price, timetable, capacity and other parts of the work. A change becomes binding only when both parties confirm it in writing.

3) If the Client asks for work outside the agreed scope and the Provider performs it before the price is confirmed, the Client will pay for the work actually performed at the hourly rate stated in the Agreement. If no rate is stated, the rate in the Provider’s most recent proposal for comparable work will apply.

4) An estimate of work, budget or timing is non‑binding unless the Agreement expressly identifies it as fixed. The Provider will notify the Client of a material overrun as soon as the Provider can reasonably foresee it.

V. Roles and decision‑making authority

1) The Provider prepares recommendations, coordinates the agreed work and takes operational steps within the approved brief. Commercial, investment, employment and legal decisions remain with the Client.

2) The Provider is not the Client’s employee, director, statutory representative, commercial agent or attorney. Without a separate written power of attorney, the Provider may not enter into contracts, assume debts, make legal declarations or commit the Client beyond an approved budget on the Client’s behalf.

3) The Client will identify in the Agreement the persons authorised to give instructions and approve Deliverables, budgets and publication. The Provider may rely on their instructions until the Client gives written notice of a change.

4) The Provider may refuse an instruction that falls outside the agreed scope, conflicts with law, third‑party rules or professional standards, or may create a disproportionate security or reputational risk.

VI. Client cooperation, materials and approvals

1) The Client will provide complete and accurate materials, access, decisions, budgets and other cooperation needed for the work in good time. Unless another period is agreed, the Client will provide them within five business days after a request.

2) The Client is responsible for the accuracy of its materials and approvals. Unless verification is expressly included in the brief, the Provider is not required to verify facts, prices, legal claims, technical product features or a person’s authority.

3) Before publication, the Client will check in particular prices, terms of sale, product claims, mandatory notices, translations, personal data and claims regulated by law. By approving them, the Client confirms that they are factually accurate and consistent with its business.

4) A delay by the Client extends deadlines by at least the period of the delay and any further time reasonably needed to reschedule the work. The Client’s delay does not change the due date for work already performed or for reserved capacity.

5) If the Client fails to provide cooperation for more than ten business days, the Provider may suspend the work. After twenty business days, the Provider may close an inactive project and invoice the work performed, reserved capacity and non‑cancellable commitments to third parties.

VII. Deadlines, dependencies and availability

1) A deadline is fixed only where the Agreement identifies it as binding and states the cooperation the Client must provide. All other dates are planned dates.

2) The Provider is not responsible for delay caused by the Client, a person appointed by the Client, third‑party approval, a change to the brief, failure of a third‑party system, or another dependency outside the Provider’s reasonable control.

3) As the Provider carries on business as an individual, a short illness, injury or serious personal event may delay the work. The Provider will notify the Client without undue delay and propose how the work can continue, replacement capacity or a new date. If the obstacle lasts more than fifteen business days, either party may end the unfinished part of the work. The Provider will refund the unused part of any Advance Payment after deducting work performed, any reservation fee and non‑refundable costs.

VIII. Fees, expenses and invoicing

1) The Fee and the way it is calculated are stated in the Agreement or an Order. Fees exclude VAT and any similar indirect tax. Any tax that the Provider is legally required to charge will be added at the applicable rate. The Client must provide any valid tax or business identification needed for the correct tax treatment.

2) Unless the Agreement states another period, an invoice is due seven calendar days after delivery and will be delivered electronically. Payment must be made in the invoiced currency to the account stated on the invoice. The Client bears its own bank and transfer charges, and the Provider must receive the invoiced amount in full except for a deduction required by mandatory law.

3) The Client must raise a specific objection to an invoice without undue delay. An objection to part of an invoice does not postpone payment of the undisputed part.

4) Travel, paid media, licences, software, production, research panels, translations, legal services and other third‑party supplies are not included in the Fee unless the Agreement states otherwise. The Client will pay them directly or provide an Advance Payment before the cost is incurred.

5) The Provider is not required to finance the Client’s expenses from the Provider’s own funds. Without a sufficient Advance Payment, the Provider may decline to begin, or may suspend, a purchase or campaign.

6) For work lasting more than twelve months, the Provider may increase rates once a year by the annual increase in the average consumer price index published by the Czech Statistical Office. The Provider will give at least thirty days’ notice. If the increase exceeds that index by more than three percentage points, the Client may reject it and terminate the Agreement with effect from the date the new price would otherwise take effect.

IX. Advance Payments, reservation fees and cancellations

1) The Provider may require an Advance Payment before starting work. The Advance Payment will be credited against the price to the extent stated in the Agreement.

2) Only an amount expressly identified in the Agreement as a reservation fee, and expressly accepted by the Client, is non‑refundable. The reservation fee pays for setting capacity aside, limiting the Provider’s ability to accept other work and preparing to begin. It is not an advance for work that has not yet been performed.

3) If the Client cancels an agreed in‑person meeting, workshop or filming session less than two business days in advance, the Client will pay for the reserved time at the agreed hourly or daily rate and any non‑refundable third‑party costs. This does not apply if the parties agree a replacement date without material cost.

4) When a project ends, the Client will pay for work performed, any expressly agreed reservation fee and any third‑party commitments that can no longer be cancelled. The Provider will refund the remainder of the Advance Payment within fourteen days after the final account.

X. Late payment and suspension of work

1) If the Client pays late, the Provider is entitled to statutory default interest and the statutory fixed compensation for recovery costs.

2) If payment is more than five business days late, the Provider will demand payment in writing and allow at least three additional business days. If payment is still not made, the Provider may suspend work, purchases and the delivery of Deliverables not yet handed over.

3) The Provider is not liable for the consequences of a suspension made under the preceding paragraph. Deadlines will move by at least the period of the Client’s delay and any further time reasonably needed to reschedule the work.

4) If payment is more than fourteen calendar days late, the Provider may require advance payment for all further work and terminate the Agreement with immediate effect.

XI. Ongoing work and reserved capacity

1) Ongoing work may be arranged as a monthly retainer or a reservation of capacity. The Agreement states the specific scope, availability, any number of hours and the priorities.

2) Unless the Agreement expressly includes a set number of hours, the monthly Fee is not a price for a particular number of hours. It pays for reserved capacity, ongoing availability and the Provider’s agreed responsibility.

3) Unused capacity does not carry over to the next month. Requests outside the agreed scope are additional work.

4) The monthly Fee is payable in advance. Unless the Agreement states otherwise, the notice period is one full calendar month and begins on the first day of the month after notice is delivered.

5) If the parties agree a minimum term, ordinary notice may end the Agreement no earlier than the end of that term. This does not affect either party’s right to terminate for material breach.

XII. Delivery, review and acceptance of Deliverables

1) A “Deliverable” is the result of work delivered by email, link, project tool or directly in the Client’s system.

2) The Client will review a Deliverable within ten business days after delivery and, within that period, identify any specific failure to meet the agreed brief. General dissatisfaction, a change of preference or a request outside the brief is not a defect.

3) If the Client raises no specific reservation within that period, the Deliverable is accepted. A Deliverable is also accepted when the Client publishes or uses it, hands it to a third party for implementation, or places a follow‑on Order based on it.

4) The preceding paragraph does not apply to a failure that the Client could not identify on an ordinary review. The Client must notify the Provider without undue delay after discovering it and no later than three months after delivery.

5) The Provider will correct a timely notified failure to meet the brief within a reasonable period. While the Provider has an opportunity to correct it and is doing so without undue delay, the Client may not demand a discount, have a third party provide replacement performance at the Provider’s cost, or terminate the Agreement because of that failure, except where mandatory law provides otherwise.

6) The Provider is not responsible for changes to a Deliverable made by the Client or a third party, or for use outside the purpose, environment or context for which it was created.

XIII. Nature of the services and no guarantee of results

1) The Provider will perform the services with the care reasonably expected of a marketing consultant. The Provider undertakes to follow a proper professional process, not to achieve a particular commercial result.

2) Results also depend on the Client’s offer, price, product, sales function, budget, internal team, competitors, economic conditions, data and third‑party decisions. The Provider therefore does not guarantee a number of enquiries, revenue, margin, return on investment, traffic, search ranking, or the success of any market entry, campaign or transaction.

3) A recommendation is based on the information available when it is prepared. Unless the parties agree otherwise, the Provider is not required to update it after the agreed work ends.

4) The Client remains responsible for the final decision and for how a recommendation is implemented. The Provider is not responsible for the result where the Client implements a recommendation only in part, late, in different circumstances or without the conditions identified by the Provider.

XIV. Audits, due diligence, estimates and data

1) A marketing audit or marketing due diligence review is a professional assessment of a defined subject. It is not a legal, tax, accounting, financial, technical or cybersecurity audit and does not provide audit assurance.

2) The Provider relies on materials made available by the Client, interviews, accessible systems and reasonable samples. Unless agreed otherwise, the Provider does not verify the completeness of the accounts, authenticity of documents, ownership of rights, legal compliance or undisclosed facts.

3) A report describes the position as at the date stated in it. Failure to identify a problem is not confirmation that no problem exists.

4) A Deliverable is prepared solely for the Client and the purpose stated in the Agreement. No investor, financing bank, buyer or other third party may rely on it without the Provider’s prior written consent. The Provider may make consent subject to a separate brief, further information and a separate liability cap.

5) Budgets, forecasts and scenarios are estimates based on assumptions. They are not promises of future results.

XV. Platforms, suppliers and subcontractors

1) Unless the parties agree otherwise in writing, the Client contracts directly with advertising platforms, software providers, media owners and other suppliers. Their terms, prices, availability and decisions are outside the Provider’s control.

2) A change to a third‑party service’s algorithm, rules, price, features, measurement or availability, or the suspension of an account, is not by itself a breach of the Agreement by the Provider. The Provider will take reasonable steps within the agreed scope that may reduce the effect.

3) The Provider may involve a specialist or subcontractor in the work. The Provider is responsible for selecting, briefing and coordinating that person to the extent required by law and the Agreement. The Client will be informed in advance if the person is to receive access to confidential information or personal data.

4) The Provider is not responsible for a supplier selected or contracted directly by the Client. If the Provider coordinates that supplier, the Provider is responsible only for the agreed coordination, not for the supplier’s own professional work.

XVI. Accounts, access, budgets and security

1) Where technically possible, accounts, advertising data, analytics data, domains and working files should be held in the Client’s environment from the outset. The Client will keep at least one administrator account that is independent of the Provider.

2) Each party will protect access using reasonable technical measures. The Client will arrange multi‑factor authentication, secure transfer of credentials, management of permissions and backups of data it needs to retain.

3) The Provider may spend an approved budget within the agreed limits. An ordinary variance caused by platform billing, exchange rates, tax or delayed data is not a budget overrun if it does not exceed five per cent and was not reasonably within the Provider’s control.

4) If the Provider suspects misuse of an account, a legal defect, a measurement error or a risk of disproportionate spend, the Provider may temporarily suspend the activity concerned and will inform the Client without undue delay.

5) When the Agreement ends, the Client will remove access held by the Provider and the Provider’s personnel. Unless law or an agreement requires otherwise, the Provider is not required to retain operational copies of data for more than thirty days after the end of the Agreement.

XVII. Tools, automation and artificial intelligence

1) The Provider may use ordinary software, automation and artificial intelligence tools in the work, provided this does not breach the Agreement, confidentiality obligations or data protection law.

2) The Provider will not enter the Client’s confidential information or personal data into a publicly available tool in a manner that permits the information to be used for general model training, unless the Client has approved that use in writing in advance.

3) The Provider will reasonably review material work produced with automation. The Client acknowledges that automatically generated material may contain errors, resemble third‑party material or fail to qualify for copyright protection.

4) If the Client requires a particular tool to be used, the Client is responsible for the licence, the lawful use of data entered into it and the tool’s limitations. The Provider will point out any obvious risk the Provider identifies when applying professional care.

XVIII. Lawfulness of the Client’s business and third‑party claims

1) The Client is responsible for the lawfulness of its products, services, prices, business model, sales process and instructions. It is also responsible for compliance in regulated sectors and for obtaining all necessary licences, consents and permits.

2) The Client warrants that it may provide the Provider with all materials, databases, trade marks, photographs, copy, software and personal data supplied for the work, and that using them in accordance with the brief will not infringe any third‑party rights.

3) If a third party or public authority brings a claim because of inaccurate material, an unlawful product, a missing consent or an instruction from the Client, the Client will reimburse the Provider for reasonably incurred costs and amounts paid. This does not apply to the extent the claim was caused by the Provider’s breach of duty.

4) The Provider will notify the Client of such a claim without undue delay and allow the Client to participate reasonably in the defence. The Provider will not admit the claim or settle it at the Client’s expense without the Client’s consent, unless immediate action is needed to limit further loss.

XIX. Intellectual property

1) For the term of the Agreement, the Client grants the Provider a non‑exclusive right to use the Client’s materials to the extent needed to perform the Agreement.

2) Methods, templates, processes, libraries, prompts, automations, general know‑how and other materials created before the Agreement or capable of use outside it remain with the Provider or their original rights holder.

3) Once all amounts relating to a Deliverable have been paid in full, the Provider grants the Client a non‑exclusive licence to use any copyright work in that Deliverable for the Client’s own business, by all means needed for the agreed purpose, worldwide and for the duration of the economic rights. The Client may modify the Deliverable, combine it with another work and provide it to members of its corporate group and its suppliers for the same purpose.

4) An exclusive licence, transferability outside the Client’s corporate group, delivery of source or editable files, and a right to resell the Deliverable commercially must be agreed expressly. They are not included in the ordinary price.

5) Third‑party elements are governed by the relevant supplier’s licence. The Provider will tell the Client about known restrictions where they are material to the agreed use.

6) For any part of a Deliverable created using an automated tool, the Provider grants rights only to the extent permitted by law and the tool’s terms. The Provider does not warrant exclusivity or that copyright subsists in that part.

7) Until payment in full, the Client may use a Deliverable only for internal review and approval. The Provider may waive this restriction for a particular Deliverable in writing.

XX. Confidentiality, references and conflicts of interest

1) Each party will protect the other party’s non‑public information where it is marked confidential or its confidential nature reasonably follows from its character and the circumstances. A party will use that information only for the Agreement and disclose it only to people who need it and are bound by confidentiality obligations.

2) The duty of confidentiality does not apply to information that the receiving party can show it knew before disclosure, developed independently, lawfully received from a third party, or that became public without breach of an obligation.

3) If law or an order of a public authority requires disclosure, the disclosing party will notify the other party in advance where legally permitted and disclose only what is required.

4) The duty continues for five years after the Agreement ends. For trade secrets and personal data, it continues for as long as the information is protected by law.

5) The Provider may publish the Client’s name, logo, a description of the work, an example of a Deliverable or a result only with the Client’s prior written consent. Consent may be given separately for each item and may be withdrawn for future use.

6) The Provider may work for other clients, including clients in the same sector, provided confidentiality is maintained and no specific conflict of interest arises. If the Provider identifies a material conflict, the Provider will disclose it and propose information barriers, a narrower scope or an end to the affected work.

XXI. Personal data

1) Each party is independently responsible for personal data it processes for its own purposes, including contact, contract and billing data.

2) If the Provider processes personal data on behalf of the Client, Schedule 1 to these Terms applies automatically. The Agreement or Order will state the particular purpose, categories of data and processing period where they differ from the default description in Schedule 1.

3) The Client is responsible for the legal basis, transparency information, instructions and lawful disclosure of personal data. The Provider is responsible for complying with processor obligations within the activities it performs.

XXII. Liability and its limitation

1) A party that breaches the Agreement will compensate the other party for loss to the extent required by law and this Article. The affected party must take reasonable steps to mitigate its loss.

2) The Provider’s total aggregate liability for all loss arising from or in connection with one Agreement will not exceed: for a one‑off project, the net Fee paid or payable for the Order giving rise to the claim; or for ongoing work, the net Fee paid for the three calendar months immediately preceding the event giving rise to the claim. Related events are treated as one event.

3) The Provider is not liable for loss of profit, revenue, anticipated savings, business opportunity or goodwill, or for indirect or consequential loss. The Provider is also not liable for data restoration costs where the Client was responsible for backups.

4) The Provider is not liable for loss caused by inaccurate or incomplete materials, instructions or approvals from the Client, the acts of a supplier selected by the Client, use of a Deliverable outside its agreed purpose, or modification of a Deliverable without the Provider’s consent.

5) These limitations do not apply to loss caused intentionally or by gross negligence, injury to a person’s natural rights, or to any other extent to which limitation is prohibited by law. They do not limit the powers of a public authority or the direct rights of a data subject. They govern only the allocation of liability between the Provider and the Client to the extent permitted by law.

6) The Fee reflects the allocation of risk in this Article. If the Client requires a higher limit or specific insurance, it must be agreed before work starts and may increase the price.

XXIII. Protection of relationships with the Provider’s personnel

1) During the Agreement and for six months after it ends, the Client will not directly target for recruitment or engagement a particular contractor whom the Provider selected for the work, demonstrably involved in it and personally introduced to the Client, where the purpose is to establish a direct employment, supplier or similar relationship without the Provider.

2) This restriction does not apply to a person with whom the Client worked before the Provider involved them, a generally advertised recruitment process without targeted contact, or a person who approaches the Client on their own initiative without a prior targeted prompt from the Client. Direct work may also be agreed with the Provider’s prior written consent.

3) For each breach, the Client will pay a contractual penalty equal to twice the Provider’s average monthly Fee for the final three complete months of the work, subject to a minimum of CZK 50,000 and a maximum of CZK 150,000 for each person. If the work lasted for a shorter period, the average will be calculated over its actual duration. For an invoice in another currency, the amount will be converted at the Czech National Bank exchange rate published for the invoice date.

4) Payment of the contractual penalty settles the Provider’s claim for loss caused by the same breach to the extent provided by the Czech Civil Code.

XXIV. Term, termination and handover

1) The Agreement continues for the term stated in it. A project ends when the final Deliverable is accepted and all amounts are paid. Ongoing work ends by notice, agreement of the parties or termination for cause.

2) The Provider may terminate the Agreement with immediate effect if, after written demand, the Client fails to pay within fourteen days after the due date; materially or repeatedly fails to provide cooperation; requires unlawful conduct; seriously breaches confidentiality; or damages the relationship of trust to the point that the work cannot reasonably continue.

3) The Client may terminate the Agreement with immediate effect for a material breach by the Provider if the Provider fails to remedy it within a reasonable period of at least ten business days stated in the notice. No cure period is required where a remedy is impossible or would no longer serve a purpose.

4) For ongoing work and divisible services already provided, termination for cause has prospective effect. The parties will settle work performed, payments received, any reservation fee and non‑refundable costs.

5) When the Agreement ends, the Provider will deliver completed and paid Deliverables and provide reasonable assistance with removing the Provider’s access. Substantial migration work, training a replacement or preparing additional documentation is a chargeable service.

6) The provisions on payments, intellectual property, confidentiality, personal data, targeted solicitation, liability and dispute resolution continue after the Agreement ends.

XXV. Events outside the parties’ control

1) A party is not liable for delay where an extraordinary, unforeseeable and unavoidable obstacle beyond its control temporarily or permanently prevents performance. Payment obligations arising before the obstacle are not postponed.

2) The affected party will give notice without undue delay, describe the expected effect and take reasonable steps to limit the consequences.

3) If the obstacle lasts more than thirty days and materially frustrates the purpose of the Agreement, either party may end the affected part of the work. The parties will settle work already performed and non‑refundable costs.

XXVI. Communications and notices

1) Operational instructions, approvals, Orders and changes to scope may be made by email or in an agreed project tool. Termination of the Agreement, changes to these Terms, a notice before suspension and the assertion of a claim must be sent by email to the address stated in the Agreement, through a Czech data box, or by registered post.

2) An email is delivered when it reaches the recipient’s information system and the recipient can access it in the ordinary course. If it is not returned as undeliverable, it is presumed, between businesses, to have arrived on the next business day after sending. The recipient may prove otherwise.

3) Each party will notify the other of changes to its contact details. Until notice is given, the other party may use the most recently notified details.

4) Where the Agreement requires writing, an electronic document satisfies that requirement if it records the content and identifies the person acting, unless mandatory law requires a stricter form.

XXVII. Governing law and courts

1) The Agreement and these Terms are governed by the laws of the Czech Republic, excluding its conflict‑of‑laws rules. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

2) Before starting proceedings, the parties will try to resolve the dispute through discussions between persons authorised to agree a settlement. This does not prevent an application for interim relief or a step needed to stop a limitation period expiring.

3) Where a written choice of territorial jurisdiction is permitted by law, the parties choose the Municipal Court in Brno. If a Czech regional court has subject‑matter jurisdiction at first instance, the parties choose the Regional Court in Brno.

4) If the Client is established outside the Czech Republic, the parties agree that the courts of the Czech Republic have exclusive jurisdiction. This choice must be recorded in writing or in an equivalent electronic form.

XXVIII. Changes to these Terms and final provisions

1) A project is governed throughout by the version of these Terms identified in the Agreement, unless the parties agree otherwise in writing.

2) For ongoing work, the Provider may make reasonable changes to these Terms because of a change in law, services used, the method of delivery or a reasonable need to adjust risk. The Provider will give at least thirty days’ notice of the new text and a summary of the changes.

3) The Client may reject the change and terminate the Agreement for that reason no later than the day before the change takes effect. Termination takes effect on the day before the change and carries no separate charge or penalty.

4) If part of these Terms is invalid or ineffective, the remaining provisions are unaffected. The invalid provision will be replaced by the applicable rule of law. The parties may agree a valid provision that most closely reflects the original commercial purpose.

5) The Client may not transfer the Agreement without the Provider’s consent. The Client may assign a receivable only if doing so does not worsen the Provider’s legal or procedural position. The Client may not set off a disputed or unmatured claim unilaterally.

6) The Czech version governs unless the Agreement expressly identifies this English version as governing. Where this English version governs, it is binding and is not merely a translation for convenience.

7) These Terms are version 2026-09 and take effect on 8 September 2026.

Schedule 1 – Processing personal data on behalf of the Client

Automatic application

This Schedule applies only where the Provider actually processes personal data on behalf of the Client. For the Provider’s own billing and communications, the Provider acts as an independent Controller.

Schedule 1 · 1. Application and roles of the parties

1) This Schedule applies where the Provider processes personal data on behalf of the Client in performing the Agreement. The Client is the Controller and the Provider is the Processor unless a particular activity requires a different allocation of roles.

2) This Schedule is a data processing agreement under Article 28 of the GDPR. For processing on the Client’s behalf, it takes precedence over the general provisions of these Terms.

Schedule 1 · 2. Description of the processing

1) The processing covers data made available in marketing, analytics, CRM, email, research and similar systems for the agreed purposes of analysis, segmentation, administration, transfer, configuration, reporting or marketing support.

2) Processing continues for the term of the Agreement and for no more than thirty days afterwards, unless law, the Client’s instruction or the technical backup cycle requires otherwise.

3) The default categories of Data Subjects are the Client’s customers and prospective customers, employees, applicants, suppliers, business contacts, website visitors and research participants. The default categories of Personal Data are identification and contact data, professional information, transaction history, responses to communications, technical identifiers, service usage data and the content of communications.

4) Special Categories of Personal Data, criminal‑offence data and large‑scale systematic monitoring are not permitted without an express written specification and a prior assessment of security and lawfulness.

5) The Agreement or Order must supplement this description where the actual processing differs materially from the default description.

Schedule 1 · 3. Instructions and the Client’s obligations

1) The Provider will process Personal Data only on the Client’s documented instructions, including instructions on transfers to a third country, unless processing is required by European Union or Czech law.

2) The Client is responsible for the lawfulness of its instructions, the legal basis, transparency information, retention periods, the handling of Data Subject rights and the accuracy of the data.

3) If the Provider considers an instruction to breach the GDPR or another law, the Provider will inform the Client and may suspend the instruction until the issue is resolved.

Schedule 1 · 4. The Provider’s obligations

1) The Provider will ensure that authorised persons are bound by confidentiality and will limit their access to what is necessary.

2) The Provider will adopt technical and organisational measures appropriate to the risk, including access controls, multi‑factor authentication where available, device updates, encrypted transmission and separation of client credentials.

3) Taking into account the nature of the processing and the information available, the Provider will reasonably assist the Client with Data Subject requests, security, breach notifications, data protection impact assessments and consultation with a Supervisory Authority. Work outside the ordinary scope is charged at the agreed hourly rate unless the need for assistance was caused by the Provider’s breach of this Schedule.

4) The Provider will keep the information needed to demonstrate compliance and permit a reasonable audit under clause 7 of this Schedule.

Schedule 1 · 5. Sub‑processors and transfers

1) The Client grants general authorisation for the Provider to appoint the Sub‑processors needed for the agreed tools and services. The Provider will provide a current list on request.

2) The Provider will notify the Client of an intended new Sub‑processor who will receive continuing or material access to Personal Data. The Client may object within ten business days on reasonable data protection grounds. If the parties cannot find a reasonable solution, either party may end the affected service without penalty.

3) The Provider will impose on each Sub‑processor obligations that are materially equivalent to those in this Schedule.

4) A transfer outside the European Economic Area may take place only where the conditions of Chapter V of the GDPR are met, including through an adequacy decision or the European Commission’s Standard Contractual Clauses. Where the Client is subject to another applicable data protection regime, the parties will sign any additional transfer mechanism reasonably required under that regime.

Schedule 1 · 6. Personal Data Breaches, return and deletion

1) The Provider will notify the Client of a Personal Data Breach it becomes aware of without undue delay and provide the information then known and reasonably needed for assessment and notification obligations.

2) When processing ends, the Provider will, at the Client’s choice, return or delete the Personal Data unless retention is required by law. Data in ordinary backups may remain until overwritten. Until then, it will not be used further and will remain protected.

Schedule 1 · 7. Audit

1) The Client will first use documentation, a questionnaire and other remote verification. An on‑site audit may take place no more than once a year, on at least fifteen business days’ notice, during business hours and without access to other clients’ data.

2) The Client will bear the reasonable cost of an audit unless it shows a material breach of this Schedule by the Provider.

Schedule 1 · 8. Liability

1) This Schedule does not limit Data Subject rights or the powers of a Supervisory Authority. As between the parties, liability is allocated under Article XXII of these Terms to the extent permitted by law.