Terms of Service

Article 1 — Definitions

• "Bramm": the SaaS platform for information security and compliance, offered by Bramm B.V. (i.o.).
• "Customer": the legal entity or natural person that enters into a subscription agreement with Bramm.
• "User": an employee or representative of the Customer with access to Bramm.
• "Agreement": the subscription agreement concluded between Bramm and the Customer.
• "Services": all functionalities offered by Bramm via the application and website.
• "Privacy Shield": the technical layer through which Bramm pseudonymises personal data before it reaches any AI model.
• "DPA": Data Processing Agreement, governing the processing of personal data by Bramm on behalf of the Customer.
• "Billing Period": the monthly subscription period starting on the date of first subscription and recurring on the same date each month.

Article 2 — Applicability

These terms and conditions apply to all offers, agreements and services of Bramm. By using Bramm's services, the Customer accepts these terms. Deviations are only valid if agreed in writing.

Article 3 — The service

Bramm offers a SaaS platform enabling organisations to manage their information security and compliance. Bramm provides the service on an "as is" basis and aims for a minimum availability of 99.5% per calendar month, excluding planned maintenance.

Bramm reserves the right to improve the service, add or modify features. In the event of material changes that may adversely affect the Customer, Bramm will notify the Customer at least 30 days in advance.

Bramm is a tool to support information security management. The Customer remains solely responsible for compliance with applicable laws and regulations, including ISO 27001, DORA, NIS2, and the GDPR. Bramm does not provide legal or compliance advice.

Article 4 — Subscription and payment

The Customer selects a subscription plan (Ask, Operate or Govern) and associated usage volume upon entering into the Agreement. Current pricing is available at bramm.it/pricing.

4.1 — Billing in advance. Subscriptions are billed in advance on a monthly basis. The Billing Period starts on the date the Customer first subscribes and runs for one calendar month. For example: a subscription starting on 14 May is billed for the period 14 May to 14 June. The next invoice is issued on 14 June for the period 14 June to 14 July, and so on. Payment is due immediately upon invoicing.

4.2 — Upgrading to a higher plan. If the Customer upgrades to a higher subscription plan during an active Billing Period, the pro-rata price difference for the remainder of that Billing Period is charged immediately upon upgrade. For example: if the Billing Period runs from 14 May to 14 June and the Customer upgrades on 28 May, the Customer is charged immediately for the pro-rata difference between the old and new plan for the period 28 May to 14 June. From the next invoice date (14 June onwards), the Customer is charged the full price of the new plan for the entire Billing Period.

4.3 — Downgrading to a lower plan. If the Customer downgrades to a lower subscription plan, the downgrade takes effect from the next invoice date. The Customer continues to have access to the features of the current plan until the end of the active Billing Period. No refund is issued for the remainder of the already paid Billing Period.

4.4 — General payment terms.

• In the event of non-payment, Bramm is entitled to suspend access to the service after written notice.
• Price changes will be communicated at least 30 days in advance.
• All prices are exclusive of VAT unless stated otherwise.
• Bramm reserves the right to charge statutory commercial interest on overdue amounts.

Article 5 — Use of the service

The Customer is responsible for use of Bramm by its Users. The Customer warrants that:

• Users use the service exclusively for legitimate business purposes.
• No information is entered that violates applicable law or infringes the rights of third parties.
• Login credentials are kept confidential and not shared.
• Suspected misuse or data breaches are reported to Bramm without delay.

The Customer is responsible for ensuring that the content entered into Bramm (policies, procedures, supplier data, etc.) is accurate and up to date. Bramm answers based on the information provided by the Customer and cannot be held liable for answers based on incorrect or incomplete input.

Article 6 — Intellectual property

All intellectual property rights in Bramm, including the software, design, algorithms, and Privacy Shield technology, are vested in Bramm B.V. (i.o.). The Customer receives only a non-exclusive, non-transferable right to use the service for the duration of the Agreement.

Content entered by the Customer into Bramm (policies, procedures, supplier data, etc.) remains the property of the Customer. Bramm will not use this content for any purpose other than delivering the service to the Customer.

Article 7 — Data protection

Bramm processes personal data of Users and third parties on behalf of the Customer. The Customer is the data controller; Bramm acts as the data processor.

By entering into this Agreement, the Customer automatically accepts the Bramm Data Processing Agreement ("DPA"), which is available at bramm.it/dpa and is incorporated into and forms an integral part of this Agreement. No separate signature is required. In the event of any conflict between this Agreement and the DPA, the DPA shall prevail with respect to the processing of personal data.

Bramm will notify the Customer of any material changes to the DPA at least 30 days in advance via email.

7.1 — Privacy Shield. Bramm includes a Privacy Shield feature that pseudonymises personal data before it is transmitted to an AI model. The Privacy Shield is provided on a best-efforts basis. Bramm does not guarantee that the Privacy Shield will function correctly or completely at all times. In exceptional circumstances, including but not limited to technical failures, misconfigurations, or edge cases not covered by the pseudonymisation logic, personal data may reach an AI model provider without full pseudonymisation.

The Privacy Shield is a configurable feature. The Customer is solely responsible for enabling, configuring and maintaining the Privacy Shield settings correctly within their Bramm environment. Bramm is not liable for any consequences arising from the Customer disabling, misconfiguring or failing to use the Privacy Shield.

The Customer acknowledges and accepts that: (i) any data entered into Bramm may, in exceptional cases, be transmitted to a third-party AI model provider; (ii) the Customer is and remains the data controller and is solely responsible for ensuring that personal data entered into Bramm is processed in accordance with applicable data protection law, including the GDPR; (iii) the use of Bramm does not transfer or reduce the Customer's responsibilities as data controller.

Article 8 — Confidentiality

Both parties undertake to keep confidential all information they receive from each other in the context of the Agreement that is designated as confidential or that can reasonably be understood to be confidential. This obligation continues after termination of the Agreement.

Article 9 — Liability

To the maximum extent permitted by applicable law, Bramm's total aggregate liability to the Customer under or in connection with this Agreement, whether arising in contract, tort (including negligence), breach of statutory duty or otherwise, shall not exceed the amount paid by the Customer in the one (1) month immediately preceding the event giving rise to the claim.

To the maximum extent permitted by applicable law, Bramm is not liable for:

• Any indirect, incidental, special, consequential or punitive damage.
• Loss of profit, revenue, business, data, goodwill or anticipated savings.
• Damage resulting from the Customer's use of or reliance on the platform or its outputs.
• Damage resulting from incorrect, incomplete or outdated information entered by the Customer.
• Damage resulting from the Customer's failure to correctly configure the Privacy Shield or any other feature.
• Damage resulting from a failure or partial failure of the Privacy Shield, including personal data reaching an AI model provider.
• Damage resulting from force majeure or failures at third-party providers including hosting providers and AI model providers.
• Damage resulting from security incidents outside Bramm's reasonable control.
• Any damage arising from the Customer's non-compliance with applicable law, including GDPR.

Bramm is a software tool. It does not provide legal, compliance, security or professional advice. All outputs generated by Bramm, including AI-generated answers, policy suggestions and compliance summaries, are provided for informational purposes only. The Customer is solely responsible for verifying the accuracy of any output and for all decisions made on the basis of such output. Ultimate responsibility for information security and regulatory compliance always remains with the Customer.

The limitations in this Article apply even if Bramm has been advised of the possibility of such damage and even if a remedy fails of its essential purpose. Bramm's Services are intended for use within the European Economic Area. Nothing in this Article excludes or limits liability that cannot be excluded or limited under mandatory Dutch or European law.

Article 10 — Duration and termination

• The Agreement is entered into for an indefinite period, unless otherwise agreed.
• Either party may terminate the Agreement with one month's written notice, effective from the next invoice date.
• Following termination, the Customer has 30 days to export their data.
• After the export period, Bramm will delete the Customer's data, subject to statutory retention obligations.
• Bramm may terminate the Agreement with immediate effect in the event of material breach by the Customer, including non-payment after notice, or violation of these terms.
• No refund is issued for the remainder of a paid Billing Period upon termination.

Article 11 — Governing law and disputes

These terms and all agreements are governed by Dutch law. Disputes will be submitted exclusively to the competent court in the district of Rotterdam, unless the parties agree otherwise in writing.

If any provision of these terms is found to be invalid or unenforceable, the remaining provisions will continue in full force and effect.