2. Description and nature of the Service

2.1. The Widget is software that, through a control panel displayed on the Licensee Website, provides display and navigation aids that the Visitor can switch on and off themselves. Depending on the Plan, the functions include in particular: read-aloud (using the speech synthesis built into the Visitor’s browser), reader mode, page structure, contrast and colour saturation, link highlighting, text size, cursor and reading guide, keyboard navigation support, font replacement (including a dyslexia-friendly font), display of alternative texts, line and letter spacing, hiding images, reducing animations, predefined combinations of functions (“profiles”), customisation of the Widget’s appearance, and the Statement Template.

2.3. For each Plan, the content of the contract is determined by the Plan description published on the Website at the time of the Order, by these GTC and – if any – by an individual written agreement of the Parties. Other content on the Website (presentation pages, blog, FAQ, advertisements) is for information only and must be interpreted in line with this Clause 2.

2.8. Custom Tuning. For Plans marked accordingly on the Website, after installation of the Widget the Provider makes reasonable efforts to adjust the Widget’s behaviour to the Licensee Website (for example excluding certain elements from contrast changes, site-specific styles). Custom Tuning aims to improve display; its scope is determined by the Provider, and it does not extend to developing the Licensee Website or making it accessible. As part of Custom Tuning, the Provider may load a site-specific stylesheet and script for the Licensee Website from the CDN; the User consents to this by placing the Order and may request its removal at any time.

2.9. Reporting errors. If the User reports in writing, with sufficient detail (affected URL, function, browser, reproducible steps), a malfunction of the Widget or a deviation of the Widget’s own functions from WCAG, the Provider investigates it and remedies it within the technical limits of the Widget and within a reasonable time. Troubleshooting does not cover the Licensee Website’s own code, content, content management system or third-party plugins. The statutory rights of Consumers are set out in Clause 13.2.

3. Registration and conclusion of the contract

3.1. Registration is required to use the Service (name, e-mail address, password). The User must provide true data and keep it up to date. The User must keep the Account access data confidential and is responsible for activity carried out through the Account if the unauthorised access arose within the User’s sphere.

3.2. The Service may only be used by persons aged 18 or over with legal capacity, or by persons authorised to represent an organisation. Anyone acting on behalf of an organisation warrants that they are authorised to do so.

3.3. When placing the Order, the User declares whether they are acting as a Consumer or as a Business. If the User enters a company name, tax number or EU VAT number in the billing details, the User thereby declares that they are acting as a Business. The person making an untrue declaration bears its consequences.

3.4. Technical steps of concluding the contract:

a) registration on the Website;

b) entering billing details in the Account (name or company name, address, country and, for Businesses, tax number or EU VAT number);

c) entering the domain of the Licensee Website;

d) selecting a Plan (the Provider may suggest a Plan based on the number of subpages of the domain);

e) selecting the Billing Period (monthly or annual);

f) the summary page, which shows the domain, the Plan, the Billing Period, the gross fee payable and the fact of automatic renewal. Here the User accepts the GTC and, separately, the highlighted provisions, confirms having read the Privacy Policy and, if a Consumer, may request that performance of the service begin immediately;

g) payment with the “Pay now” button, which entails an obligation to pay, on the Stripe payment page.

For the Free Plan, steps e)–g) do not apply; the GTC are accepted at registration and when the domain is activated.

3.5. Correcting input errors. Before payment, the User may go back at any step and correct the data entered; all data can be checked on the summary page. Billing details can also be changed later in the Account. Errors noticed after payment should be reported to support@guidebot.org.

3.6. For a paid Plan, the contract is concluded upon successful payment of the fee (approval of the charge); for the Free Plan, upon activation of the domain. It is concluded for an indefinite term with the chosen Billing Periods. The Provider confirms the Order by e-mail within 48 hours at the latest. The confirmation contains the domain, the Plan, the Billing Period, the fee, information on automatic renewal and cancellation, and, on a durable medium (as an e-mail attachment), the GTC in force at the time of the Order. If the confirmation does not arrive within 48 hours, the User is released from their offer.

3.7. The contract is concluded electronically and qualifies as a written contract. The Provider files the contract: it electronically records the Account data, the Order, the accepted version of the GTC and the time of acceptance, and keeps them for the period required by law. Orders and invoices remain available in the Account. The Provider has not subscribed to any code of conduct.

3.8. The Provider may refuse a registration or Order for a lawful reason, in particular if the intended use is unlawful or high-risk within the meaning of Clause 2.6(5), the User has provided untrue data, or the User has previously seriously breached these GTC.

3.9. Visitors use the Widget on the Licensee Website as part of the User’s service; the Provider does not enter into a contract with them.

4. Licence

4.1. For the term of the contract, the User receives a limited, revocable, non-exclusive, non-transferable and non-sublicensable right to embed and use the Widget solely on the Licensee Website (“Licence”). The Licence does not transfer ownership of any part of the Service.

4.2. Unless the Order provides otherwise, one Licence applies to one domain. The Widget may only be embedded in another domain, subdomain or additional website with an additional Licence.

4.3. The Provider reserves all rights not expressly granted in these GTC and all related intellectual property rights.

4.4. The User may not, and may not allow any third party to:

a) sublicense, distribute or resell the Service, or provide it as a hosting or white-label service, without the Provider’s prior written consent;

b) copy or modify parts of the Service or the documentation, or create derivative works from them;

c) reverse engineer or decompile the code of the Service or circumvent its technical protection measures (API key, domain binding), except where expressly permitted by mandatory law;

d) rent out, sell or otherwise transfer the Licence;

e) use the Guidebot trademarks, name, logo or domains without the Provider’s prior written consent, except as provided in Clause 16.3;

f) disrupt the operation of the Service, overload the Provider’s systems or interfere with the measurement under Clause 6.3.

4.5. Third-party and open-source components used in the Service are governed by their own licence terms, which the User must observe.

4.6. The Widget interface displays the Provider’s name, logo, a link to the Website and the version number. Hiding the logo is possible in the Plans marked accordingly on the Website; the User may not remove these elements by other technical means.

5. Provision, updates and modification of the Service; support

5.1. The Provider endeavours to keep the Service running continuously but only commits to a service level (SLA) under a separate written agreement. During maintenance, updates or an outage of the hosting or CDN provider, the Widget may temporarily not be displayed.

5.2. Updates to the Widget take effect automatically via the CDN from the day they are released; the User does not need to do anything. During the term of the contract, the Provider provides the updates needed for the Widget to work in conformity with the contract, including security updates.

5.3. The Provider may modify the Service (functions, profiles, appearance) for the following reasons: technical development, security, legal or regulatory requirements, changes in browsers, technology or third-party services, introduction of new functions, or discontinuation of a rarely used function. The modification may not cause the User additional costs. If a modification removes or materially adversely affects an essential function of a paid Plan, the Provider notifies the User at least 30 days in advance, unless an immediate modification is required for security reasons or by law. In that case the User may terminate free of charge within 30 days of the notification or of the modification (whichever is later), and the Provider refunds the part of the prepaid fee attributable to the unused period pro rata.

5.4. The Provider may modify the content and limits of the Free Plan, or discontinue the Free Plan, with 30 days’ prior notice.

5.5. The Provider provides technical support by e-mail (support@guidebot.org) during business hours on Business Days, with a reasonable response time. The scope of support depends on the Plan. Professional Services are charged separately.

5.6. The Provider may check the embedding of the Widget on the Licensee Website and measure the public pages of the Licensee Website as set out in Clause 6.3. This does not mean that the Provider operates or supervises the Licensee Website.

5.7. The Provider does not operate the Licensee Website and is not responsible for its operation, availability or content, or for third-party services used by the User.

6. Plans, limits and measurement

6.1. The functions, limits and fees of the Plans are set out in the Plan description on the Website. Certain functions (for example profiles, Custom Tuning, customisable appearance or hiding the logo) are only available in certain Plans.

6.2. The limits of the Plans are: a) the number of subpages of the Licensee Website and b) the monthly number of Widget loads (“API calls”). The values for each Plan are set out in the Plan description on the Website.

6.5. If the number of loads increases due to misuse by a third party (for example artificially generated requests), the Provider reviews the measurement at the User’s request. If misuse is likely, the Provider lifts the restriction and disregards the loads affected by the misuse.

6.6. Changing Plans. The User can switch to a higher Plan in the Account at any time, with immediate effect. When the Plan is changed, the Provider settles the fee difference pro rata for the remainder of the Billing Period: by an immediate charge for an upgrade, or by a credit for a lower fee, which it offsets against subsequent fees and, when the contract ends, refunds if the User is entitled to it.

7. Obligations of the User

7.1. The User uses the Service in accordance with these GTC, the Order and the law.

7.2. The User is responsible for the content, code and data processing of the Licensee Website and for its compliance with the laws applicable to it, including accessibility, consumer protection, e-commerce and data protection rules, and for providing an accessibility statement and a feedback mechanism where required by law.

7.3. Testing and mitigation of damage. After embedding the Widget and whenever the Licensee Website is changed, the User must check that the Widget does not interfere with the operation of the Licensee Website, in particular forms, ordering and payment processes and menus. If the User notices a malfunction, they must switch off or remove the Widget without delay and notify the Provider.

7.4. The User may not create the impression that the Licensee Website is accessible, certified or legally compliant because it uses the Widget, or that the Provider has checked or approved it.

7.5. The User informs Visitors about the operation of the Widget as set out in Clause 10.

7.6. It is prohibited to use the Service for unlawful purposes or content, in a way that infringes the rights of others (in particular copyright, trademarks, personality rights or trade secrets), to send unsolicited messages, to damage the Provider’s systems, to disturb other Users, or to modify the code of the Widget.

7.7. The Provider may notify the authorities if a criminal offence is suspected, and may prohibit use that is unlawful or contrary to these GTC.

8. Fees, payment, invoicing, renewal

8.1. The Service is subject to a fee, except for the Free Plan. The Website shows fees in euro (EUR) as gross prices including value added tax. The total amount payable is shown on the summary page before payment.

8.2. The transaction is taxed on the basis of the law and the data provided by the User (country, tax number, EU VAT number). A Business is responsible for the correctness and validity of the tax number and EU VAT number it provides and bears any tax burden and other disadvantage resulting from incorrect data.

8.3. Payment is made by bank card (Visa, Mastercard, American Express, Discover) through the payment service of Stripe Payments Europe, Limited (Ireland). Card data is processed by Stripe; the Provider does not receive or store the full card number and only sees the card type and last four digits.

8.5. If a charge fails, the Provider may retry it. If the fee is still not paid, the Provider may suspend the paid functions and switch the domain to the Free Plan; the contract then continues under the terms of the Free Plan.

8.6. In the event of late payment, a Business must pay default interest under Section 6:155 of the Hungarian Civil Code and a flat-rate recovery cost equal to EUR 40 under Hungarian Act IX of 2016; a Consumer must pay default interest under Section 6:48 of the Hungarian Civil Code.

8.7. Fee changes. The Provider may change its fees due to changes in costs, inflation, taxes or the content of the Service. For existing Subscriptions, a fee increase applies from the first renewal falling at least 30 days after the User has been notified by e-mail. If the User does not accept the fee increase, they may cancel the Subscription before the renewal under Clause 9.1; in that case the fee increase does not apply to them. A fee reduction applies from the next renewal.

8.8. The Provider issues electronic invoices, which can be downloaded in the Account. The User accepts electronic invoicing. The User is responsible for the correctness of the billing details.

8.9. (Business) The Provider may set off its overdue claims against a Business against any refund due to the Business. A Business may not withhold payment of fees by invoking a disputed counterclaim.

9. Cancellation, withdrawal, refunds and termination

9.1. Cancelling the Subscription. The User may cancel the Subscription at any time in the Account (with the “Cancel subscription” button in the domain settings) or by e-mail to support@guidebot.org. The cancellation takes effect at the end of the current Billing Period; until then the paid functions remain available. The domain is then automatically switched to the Free Plan, which is subject to the limits of the Free Plan (Clause 6.4). The cancellation can be revoked in the Account until the end of the current period. Fees paid for the current Billing Period are not refunded, except in the cases set out in Clauses 9.2, 9.3, 5.3 and 17.3 and by law.

9.2. Money-back guarantee. In addition to the rights of Consumers under the law, and for all Users, the Provider refunds the full fee, without deducting any proportionate fee, if the User cancels

a) the first paid Subscription for a given domain within 14 days of paying the fee, or

b) an annual Subscription within 14 days of its automatic renewal

by a request sent to support@guidebot.org. The request must state the User’s name, the domain and the invoice number. The guarantee does not apply to renewals of monthly Subscriptions. Upon the refund, the paid Subscription ends immediately and the domain is switched to the Free Plan. The guarantee can be used once per domain (except for annual renewals) and does not cover Professional Services already performed.

9.3. Right of withdrawal of Consumers.

(1) A Consumer may withdraw from a distance contract without giving any reason within 14 days of the day the contract was concluded (Hungarian Government Decree 45/2014 (II. 26.)).

(2) The right of withdrawal is exercised by an unequivocal statement sent by the Consumer by e-mail (support@guidebot.org) or by post (Széchenyi Ödön utca 32., 9485 Nagycenk, Hungary). The model form in Annex 1 may also be used. The withdrawal is in time if the Consumer sends the statement before the deadline expires. The burden of proving the exercise of the right of withdrawal lies with the Consumer.

(3) If the Consumer expressly requested that the service begin during the withdrawal period, under the law they would have to pay a proportionate fee for the service provided until withdrawal. In view of Clause 9.2, the Provider does not claim this fee.

(4) The Provider refunds the full fee paid within 14 days of learning of the withdrawal, using the original payment method; this does not cause the Consumer any additional cost.

9.4. Removing the Widget from the Licensee Website does not in itself constitute cancellation or termination and does not end the obligation to pay fees.

9.5. The User may terminate the contract (the Account) at any time by e-mail to support@guidebot.org. For a paid Subscription, termination takes effect – at the User’s choice – at the end of the current Billing Period or immediately; in the case of immediate termination, the fee for the current period is not refunded, except in the cases set out in Clauses 9.2 and 9.3. Deletion of a domain can also be requested in the Account; the Provider fulfils the request within 5 Business Days at the latest.

9.6. The Provider may terminate the contract by e-mail without giving reasons, with 30 days’ notice. In that case it refunds the part of the prepaid fee attributable to the unused period pro rata.

9.7. The Provider may terminate the contract with immediate effect or suspend the Service if the User seriously breaches Clause 4 or 7, is in default of payment (Clause 8.5), uses the Service unlawfully, has provided untrue data, or if required by an official or court decision. In the case of a serious breach no prior notice is required; in other cases the Provider first requests the User to remedy the breach within a reasonable deadline. A Business is not entitled to any refund upon immediate termination due to its breach. The Provider refunds a Consumer the fee attributable to the unused period, after setting off its claims arising from the breach.

9.8. Upon termination of the contract the Licence ends and the User must remove the embed code. The Provider may technically stop the Widget from being displayed on the Licensee Website. The Provider deletes personal data in accordance with the Privacy Policy and Annex 2. Clauses 2.4–2.7, 11, 13.1, 14, 15, 19, 21 and 22 and any payment obligations outstanding upon termination survive termination.

10. Personal data and data processing by the Widget

10.1. The Provider processes the personal data of Users (customers) as controller in accordance with the Privacy Policy available at https://guidebot.org/en/privacy-policy.

10.2. How the Widget works on Visitors’ devices and in the Provider’s systems:

a) the Widget stores the settings chosen by the Visitor (language, functions and profiles switched on) in the local storage (localStorage) of the Visitor’s browser so that they also apply on the next page load;

b) the Widget counts the use of functions on the Visitor’s device and, on the next page load, sends the counts together with the domain of the Licensee Website to the Provider’s statistics server; the Provider only stores aggregated monthly statistics per domain, does not link them to individual Visitors and does not store the Visitor’s IP address in the statistics;

c) when the Widget files are downloaded, the CDN provider technically processes the Visitor’s IP address, browser data and referring page address in order to serve the requests;

d) the Widget does not set cookies and does not transmit the content of the Licensee Website or data entered by the Visitor to the Provider; read-aloud takes place in the Visitor’s browser.

10.3. With regard to Visitors’ personal data, the User is the controller and the Provider is the processor. The terms of data processing are set out in Annex 2 (Data Processing Terms), which forms part of these GTC. For measuring Plan limits, invoicing and developing the Service, the Provider uses aggregated statistics that do not qualify as personal data. To the extent it processes personal data for these purposes, it does so as an independent controller in accordance with the Privacy Policy.

10.4. The User must inform Visitors on the Licensee Website about the operation of the Widget and the related data processing and, where required by law, obtain the necessary consent. The Provider may provide a template text for this purpose. The Provider does not take over the User’s own data protection obligations.

10.5. The Provider sends newsletters and advertising messages only on the basis of the User’s separate, express consent, which can be withdrawn at any time. Registration and acceptance of the GTC do not constitute such consent. System messages necessary for performance of the contract (such as confirmations, invoices, limit notifications, security notices) are not advertising.

11. Intellectual property and feedback

11.1. The Service, the Widget, the user interface, the documentation, the trademarks and related content are the intellectual property of the Provider or its licensors. The User may not use them beyond the scope set out in Clause 4.

11.2. The User retains the rights to content they create on their own website.

12. Third-party services

The Service relies on or may refer to third-party services (for example the payment provider, the CDN, browsers’ speech synthesis, internet search engines). The Provider is not responsible for the content, data processing or availability of third-party services used by the User or the Visitor at their own discretion. Annex 2 applies to the processors engaged by the Provider.

13. Conformity with the contract and warranty

13.2. Towards Consumers, the Provider is liable under Hungarian Government Decree 373/2021 (VI. 30.) for the Service being in conformity with the contract throughout the term of the contract. This means that the Service matches the Plan description and the characteristics described in Clause 2, has the qualities that can be expected of such services, and that the Provider provides the necessary updates. The characteristics described in Clause 2.2 are features of the Service that the Consumer was separately informed of and expressly accepted before placing the Order. In the event of defective performance, the Consumer may request that the Service be brought into conformity (repair). If this is not possible, or in other cases specified by law, the Consumer may request a price reduction or – if the defect is not minor – terminate the contract. The Consumer must cooperate to a reasonable extent in establishing whether the cause of the defect lies in the Consumer’s digital environment (for example their website, browser or content management system).

13.3. Defects must be reported as set out in Clause 2.9. The method of reporting does not restrict the statutory rights of Consumers.

14. Liability

14.4. The User must take the measures that can be expected in the given situation to prevent and reduce damage (in particular switching off or removing the Widget under Clause 7.3). The Provider is not liable for damage resulting from failure to do so. If the User contributed to the damage, the Provider’s liability is reduced in proportion to that contribution.

14.5. Clauses 14.2–14.3 do not apply to breaches of contract committed intentionally, with gross negligence or by a criminal offence, to breaches of contract causing damage to human life, physical integrity or health, or to cases in which the limitation of liability is excluded by law.

14.6. Towards Consumers, the Provider is liable in accordance with the Hungarian Civil Code; Clauses 14.2, 14.3 and 14.7 do not apply to Consumers.

14.8. The fees have been set taking into account the allocation of risk set out in Clauses 2, 13 and 14.

15. Indemnification (Business)

15.2. The Provider notifies the Business of any such claim that comes to its knowledge within a reasonable time and allows the Business to participate in the defence. The Provider reserves the right to conduct its own defence. The Business may only enter into a settlement acknowledging the Provider’s liability with the Provider’s consent.

15.3. A Consumer is liable in accordance with the law for damage they cause unlawfully; Clause 15.1 does not apply to Consumers.

16. References and use of trademarks

16.2. The Provider only displays a Consumer’s name as a reference with the Consumer’s separate, express consent.

16.3. The User may use the Guidebot name and logo solely to state the fact that the Licensee Website uses the Widget, and may not create the impression that the Provider has certified, audited or rated the website as accessible.

16.4. The Provider does not claim that websites displayed as references are accessible or legally compliant.

17. Amendment of the GTC

18. Force majeure

Failure or delay in performance does not constitute a breach of contract if it is caused by an unforeseeable circumstance beyond the Party’s control, in particular natural disasters, epidemics, war, official measures, outages of utilities, hosting or CDN providers, disruption of the internet backbone, or a cyberattack that the Party could not successfully counter despite reasonable defences. After the force majeure ends, the Parties continue performance in good faith. If force majeure lasts longer than 60 days, either Party may terminate the contract; in that case the part of the prepaid fee attributable to the unused period is refunded.

19. Confidentiality

The Parties treat as confidential any non-public technical, business and customer data that come to their knowledge during performance of the contract and do not disclose them to third parties, unless required by legal or official obligation or if disclosure is to a subcontractor necessary for providing the Service. The confidentiality obligation survives for 3 years after termination of the contract.

20. Complaints and enforcement of rights

20.1. The User may submit complaints about the Service by e-mail (support@guidebot.org) or by post (Széchenyi Ödön utca 32., 9485 Nagycenk, Hungary). The Provider responds to the complaint in writing and on the merits within 30 days of receipt, giving reasons for any rejection. The Provider keeps the complaint and the response for the period required by law.

20.2. If the complaint has not been resolved, a Consumer may

a) turn to the conciliation board competent for their place of residence or stay, or to the conciliation board competent for the Provider’s registered office. The latter is the Conciliation Board operating alongside the Győr-Moson-Sopron County Chamber of Commerce and Industry (Szent István út 10/A., 9021 Győr, Hungary); the contact details of Hungarian conciliation boards are available at https://www.bekeltetes.hu. The Provider is obliged to cooperate in conciliation board proceedings;

b) turn to the consumer protection authority (the county government office competent for their place of residence);

c) turn to the courts;

d) as a Consumer resident in another EU Member State, seek the assistance of the European Consumer Centre Hungary (https://www.magyarefk.hu).

21. Governing law and jurisdiction

21.1. These GTC and the legal relationship of the Parties are governed by Hungarian law, excluding the UN Convention on Contracts for the International Sale of Goods (CISG). For Consumers, this choice of law does not deprive the Consumer of the protection afforded by the mandatory provisions of the law of their habitual residence (Article 6 of Regulation (EC) No 593/2008).

21.3. Towards Consumers, the court competent under the law has jurisdiction; proceedings against a Consumer may be brought before the court of the Consumer’s place of residence.

22. Final provisions

22.1. These GTC contain the entire agreement of the Parties on their subject matter and supersede all previous agreements on the same subject, including the Provider’s website terms of 24 August 2023 and the service contract text of 27 May 2025. Individual Orders recorded separately in writing that are yet to be performed are an exception.

22.2. An individual Order may be amended in writing; e-mail qualifies as written form. On the Provider’s part, any commitment deviating from Clauses 2, 13, 14 and 15 of these GTC is valid only if made in writing by the managing director and expressly marked as an “individual agreement deviating from the GTC”. Customer service and sales communications of the Provider’s staff do not qualify as such.

22.3. If any provision of these GTC is invalid or unenforceable, this does not affect the other provisions. Towards Businesses, an invalid provision is replaced by a valid provision that comes closest to the original purpose and economic effect.

22.4. The Provider may transfer the contract to its legal successor or an affiliated company. A Business consents to this in advance by placing the Order. For Consumers, the Provider notifies the Consumer of the transfer at least 30 days in advance, and the Consumer may then terminate the contract free of charge. The User may not transfer the Licence (Clause 4).

22.5. The Provider sends notices to the e-mail address provided by the User in the Account. Unless proven otherwise, a notice is deemed delivered on the Business Day following its sending.

22.6. These GTC apply to contracts concluded after they enter into force. They apply to contracts existing at the time of entry into force in accordance with the procedure in Clause 17; the Provider submits the highlighted provisions for separate acceptance at the User’s next login to the Account.

Annex 1 – Model withdrawal form

(complete and return this form only if you wish to withdraw from the contract)

To: Codemium Kft., Széchenyi Ödön utca 32., 9485 Nagycenk, Hungary, support@guidebot.org

I/We hereby give notice that I/We withdraw from my/our contract for the provision of the following service:

Service (domain and Plan): ………………………………………………

Date the contract was concluded: ………………………………………………

Name of consumer(s): ………………………………………………

Address of consumer(s): ………………………………………………

E-mail address of the Account: ………………………………………………

Signature of consumer(s) (only if this form is submitted on paper): ………………………………

Date: ………………………………

Annex 2 – Data Processing Terms (Article 28 GDPR)

1. Parties and roles. This Annex constitutes the contract under Article 28 of Regulation (EU) 2016/679 (GDPR) between the User as controller (“Controller”) and the Provider as processor (“Processor”) for the processing of Visitors’ personal data during operation of the Widget on the Licensee Website.

2. Subject matter and duration. The subject matter of the processing is the provision of the Widget on the Licensee Website. Its duration equals the term of the contract, plus the time needed for deletion under point 13.

3. Nature and purpose of the processing: serving the Widget files from the CDN; enabling Visitor settings to be stored on the Visitor’s device; measuring Widget loads and use of functions, aggregated per domain (under Clause 6.3 of the GTC); troubleshooting.

4. Categories of data subjects: Visitors to the Licensee Website.

5. Types of personal data: IP address, browser and device data (user agent), address of the referring page, time of the request, Widget settings and counters of function use. The Parties acknowledge that the use of certain profiles may allow conclusions to be drawn about a Visitor’s health. The Processor therefore stores these counters only aggregated per domain, in a way that cannot be linked to individual Visitors and without IP addresses, and does not draw any conclusions about health from them.

6. Instructions. The Processor processes personal data only on documented instructions from the Controller; these GTC and the settings made in the Account constitute such instructions. If the Processor considers that an instruction infringes the law, it informs the Controller without delay.

7. Confidentiality. The Processor ensures that persons with access to personal data have committed themselves to confidentiality or are under a statutory obligation of confidentiality.

8. Security. The Processor applies appropriate technical and organisational measures under Article 32 GDPR, in particular: encrypted transmission (HTTPS), access to systems restricted by authorisation, storing statistics in aggregated form without IP addresses, and regular updating of systems.

9. Sub-processors. The Controller gives general authorisation to engage sub-processors. Current sub-processors: BunnyWay d.o.o. (Slovenia) – CDN and receipt of statistics on edge servers; Tárhely.Eu Szolgáltató Kft. (Hungary) – hosting of the Website and certain Widget resources. The Processor notifies the Controller of any change at least 15 days in advance, on the Website and by e-mail, and the Controller may object to the change. If the objection cannot be resolved, the Controller’s sole remedy is to terminate the contract free of charge. The Processor imposes on each sub-processor the same data protection obligations as set out in this Annex and remains liable to the Controller for their performance.

10. Transfers to third countries. The Processor currently does not transfer Visitors’ personal data outside the European Economic Area. Any such transfer may only take place under the conditions of Chapter V GDPR.

11. Data subject rights. Visitor settings are stored on the Visitor’s device, and the Visitor can delete them in the browser settings or with the Widget’s “Reset” function. The Processor assists the Controller to a reasonable extent in responding to data subject requests.

12. Assistance and incidents. The Processor assists the Controller to a reasonable extent in meeting the obligations under Articles 32–36 GDPR. It notifies the Controller of any personal data breach without undue delay, with the information available to it.

13. Deletion. Upon termination of the contract, the Processor deletes personal data relating to Visitors. Statistics aggregated per domain that do not qualify as personal data may be retained. Technical logs of the CDN provider are subject to that provider’s own retention period.

14. Audit. The Processor makes available to the Controller the information necessary to demonstrate compliance with this Annex. Audits initiated by the Controller are primarily document-based, at most once a year, with 30 days’ prior notice, subject to confidentiality and at the Controller’s expense.

15. Liability. The Parties’ liability towards each other is governed – to the extent permitted by the GDPR – by Clause 14 of the GTC.