Terms and Conditions

This is a translation provided for information purposes. The Slovak version is legally binding.

Version 1.2, effective from 3 October 2026.

1. Who provides the service

|UNl0R & Al s. r. o., Company ID (IČO) 45991961, VAT ID (IČ DPH) SK2023164891, with its registered office at Námestie Slobody 2357/33A, 083 01 Sabinov, registered in the Commercial Register of the District Court of Prešov, Section Sro, Insert No. 23885/P. It provides its services under the Datahorses brand (the "Provider").

2. Who the services are intended for

The services are intended exclusively for entrepreneurs and legal entities. The Provider does not provide them to consumers, that is, to natural persons acting outside the scope of their business activity. By placing an order, the Customer confirms that it is acting within the scope of its business activity.

Ordering via the payment button on the website is intended for Customers with their registered office in the Slovak Republic. A Customer with its registered office outside the Slovak Republic should use the contact form; the Provider will prepare a quote with the tax treatment applicable in the Customer's country and according to whether the Customer is registered for value added tax.

3. What the services include

Monitoring is the ongoing monitoring of publicly available sources, in particular published leaks of login credentials and the configuration of the Customer's domain, with an alert within 24 hours of detection. It includes monthly resilience testing of the Customer's infrastructure using the 12 latest artificial intelligence models selected by the Provider; when a new model is released, the Provider adds it to the next test. The Customer receives the result every month as a written report.

Extended Monitoring is Monitoring with a wider scope; it covers more domains, subdomains and IP addresses, monthly testing and a report for the whole scope, monitoring of lookalike and typosquatting domains, and priority response when something is found.

Enterprise includes, in particular, a security audit, penetration testing, remediation of vulnerabilities and advice on NIS2 and GDPR. The scope, price and deadlines are set out in an individual contract.

Infrastructure testing as part of Monitoring takes place only within the scope and under the conditions set out in Article 4. The Provider performs Enterprise services, in particular penetration testing, only on the basis of a signed written authorisation specifying the scope of systems and the time window.

4. Test scope, consent and procedure

Scope. When ordering, the Customer specifies the test scope: domains, subdomains and IP addresses. The Provider tests exclusively the specified scope. The Customer may extend or narrow it in writing at any time; the change applies from the next test.

Consent. By ticking the consent box when ordering, the person placing the order confirms that they are authorised to act on behalf of the Customer, that the Customer owns or manages the specified domains and IP addresses and may authorise their testing, including vis-à-vis the hosting or cloud provider where its consent is required, and gives, on behalf of the Customer, consent to a monthly security test of the specified scope. The Provider keeps a record of the consent (wording, scope, time, IP address and name of the person) for the duration of the contract and for 3 years after it ends.

Verification before the first test. Before the first test, the Provider verifies that the Customer actually manages the specified domains, in particular by means of a TXT record in DNS or a file on the website containing a code that the Provider sends. If, according to the public register, an IP address does not belong to the Customer, if the Customer is a public sector body or if the hosting provider requires it, the Provider sends the Customer a written authorisation for signature. Until verification or signature is completed, the Provider does not test the unverified part of the scope and works with publicly available sources only in respect of it.

First test within 7 days. The Provider carries out the first test within 7 days of payment. If verification under the previous paragraph is delayed for reasons on the Customer's side, the deadline is extended by the length of that delay.

Information. Within 2 working days of payment, the Provider sends the Customer confirmation of the scope and the verification procedure. Before each test, it notifies the Customer's contact person of its date and the addresses from which the test will be run. After each test, it sends a report.

Monthly repetition. The test is repeated every month for the duration of the subscription within the same scope, unless the Customer changes it.

Care. During testing, the Provider does not launch availability (denial of service) attacks, does not alter data in the Customer's systems and does not copy data beyond the extent necessary to demonstrate a vulnerability. If a test causes an unexpected condition, the Provider stops it immediately and contacts the Customer. The Customer is responsible for backing up its data.

Withdrawal of consent. The Customer may withdraw its consent to testing at any time by email or by telephone; the Provider stops the test immediately and does not perform any further test. This does not terminate the subscription unless the Customer cancels it under Article 8; until then, monitoring of publicly available sources continues.

5. What the services do not include

• No intervention outside the scope. The Provider does not test systems that the Customer has not specified in the test scope or that are not covered by the written authorisation, nor outside the notified date.
• This is not a cybersecurity audit within the meaning of Section 29 of Act No. 69/2018 Coll. Such an audit may be performed only by a certified cybersecurity auditor.
• As part of Monitoring, the Provider does not remedy identified deficiencies; remediation can be agreed separately or as part of Enterprise.

6. How the contract is concluded

The Monitoring contract is concluded upon payment of the price via the payment gateway or upon written confirmation of the order. The Enterprise services contract is concluded upon signature of the individual contract. The Provider reserves the right not to accept an order, in particular if the Customer is not an entrepreneur or if the service could result in a breach of legal regulations. In such a case, it refunds the payment received in full.

7. Price and payment

Prices stated in the price list are exclusive of VAT. The Provider is registered for VAT, and 23% is added to the prices. Payment is made via the Stripe payment gateway; the Provider does not store payment card details. The invoice is issued by the Provider, not by the payment gateway. The price of Enterprise services is set out in the individual contract.

8. Subscription, renewal and termination

Monitoring and Extended Monitoring are subscriptions with a monthly billing period. The subscription renews automatically for the next period and payment is collected at the start of each period until either party terminates it.

The Customer may cancel the subscription at any time by notice sent to the address given in the contact details. Cancellation takes effect on the last day of the period already paid for; until then, the service continues. A period already paid for is not refunded and no pro rata amount is paid out. Termination of the subscription also terminates the consent to testing; after the last paid period, the Provider tests nothing.

The Provider may terminate the subscription with a notice period of one month, or with immediate effect if the Customer misuses the services.

9. Confidentiality

The Provider maintains confidentiality regarding all findings and data of the Customer. It does not disclose findings to third parties and does not publish them. It will not use the Customer as a reference without the Customer's consent.

10. Personal data protection

Where the service involves the processing of personal data of the Customer's employees, for example work email addresses in published leaks, the Provider acts as a processor under Article 28 of the GDPR and the parties enter into a data processing agreement. Processing for the purposes of ensuring network and information security constitutes a legitimate interest under Recital 49 and Article 6(1)(f) of the GDPR.

11. Liability

The Provider does not guarantee that Monitoring or the tests will reveal all security risks of the Customer. The service does not replace the Customer's security measures or its legal obligations.

The Provider is liable for damage caused by a breach of its obligations under Section 373 et seq. of the Slovak Commercial Code. The parties have agreed that compensation for damage is limited to the price paid for the service over the last 12 months, except for damage caused intentionally or through gross negligence and except for a breach of confidentiality.

12. Complaints

The Customer sends any objections to the service to the contact address within 30 days of delivery of the report or of the reason arising. The Provider responds within 15 days. If the objection is justified, the Provider supplements the service free of charge or refunds the corresponding part of the price.

13. Changes to the terms and price list

The Provider may change these terms and the price list. For a subscription already running, a new price applies no earlier than from the following period, and the Provider notifies the Customer of it at least 30 days in advance. If the Customer does not agree with the change, it may cancel the subscription with effect from the date the change takes effect. For Enterprise services, the price and scope set out in the individual contract apply.

14. Governing law

The relationship is governed by the laws of the Slovak Republic, in particular the Slovak Commercial Code. Disputes are resolved by the competent court of the Slovak Republic.

The Provider's contact details are on the contact page. These terms, version 1.2, are effective from 3 October 2026.