General Terms of Service

ORDER OF PRECEDENCE & CONTRACT STRUCTURE

These General Terms of Service ("Terms of Service" or "Terms") govern all access to and use of the software-as-a-service platforms, applications, APIs, and related services provided by Venta Internet Services B.V. (trading as VentaVid, “VentaVid”).

The contractual relationship between VentaVid and the Customer consists of the following documents. In the event of any conflict or inconsistency between the provisions of these documents, the following strict order of precedence shall apply:

1. Enterprise Agreement or Order Confirmation (D6): A bespoke, mutually executed written agreement or order confirmation, only to the extent it expressly identifies and amends specific provisions of these Terms;

2. Enterprise Service Level Agreement (D5): An executed SLA, governing service levels, uptime targets, and service credits exclusively;

3. Product Schedules (D2 / D3): Specific terms applicable to designated product modules (Product Schedule A: Venta Video or Product Schedule B: Venta Capture);

4. Data Processing Agreement (Chapter 8 / DPA): The provisions of Chapter 8 of these Terms, governing the processing of personal data under Article 28 GDPR exclusively;

5. General Terms of Service (Chapters 1 to 7): The main body of these Terms.

Express Exclusion of Customer Terms: The applicability of any general, purchasing, procurement, or other terms and conditions of the Customer is hereby expressly excluded and rejected, even where the Customer refers to such terms in a purchase order, tender document, payment confirmation, or other communication, and even where VentaVid delivers the Service without explicit further protest.

CHAPTER 1. GENERAL PROVISIONS

Article 1. Definitions

In these Terms of Service, capitalized terms have the meanings set forth below:

• "Account" means the technical and administrative access profile created by or on behalf of the Customer to configure, manage, and use the Service.

• "Agreement" means the binding legal relationship between VentaVid and the Customer, comprising these Terms of Service, the applicable Product Schedule(s), the DPA, and any applicable Order Confirmation or Enterprise Agreement.

• "API" means the application programming interface(s) provided by VentaVid that allow programmatic interaction with the Service.

• "Customer" means the legal entity or natural person acting in the course of a business or profession that enters into an Agreement with VentaVid.

• "Customer Content" means all video files, audio recordings, photographs, images, documents, form entries, text inputs, customer-provided metadata, and reports submitted to, recorded via, or generated by the Service by or on behalf of the Customer or its End Users.

• "Documentation" means the authoritative functional, technical, and operational descriptions, user manuals, and API specifications made available by VentaVid at its official documentation portal or Trust Center.

• "End User" means any natural person who, without holding an administrative Account, accesses a capture link, interactive workflow, video message, or communication interface provided, generated, or initiated by the Customer (including respondents, claim applicants, and consumers).

• "Enterprise Customer" means a Customer that accesses the Service under a negotiated, custom Order Confirmation or Enterprise Agreement rather than a standard self-service subscription.

• "Order Confirmation" means a written, digital, or countersigned order document issued by VentaVid confirming the commercial terms, subscription tiers, pricing, and specific modules ordered by the Customer.

• "Product Schedule" means an addendum to these Terms governing specific functional modules of the Service, specifically Product Schedule A (Venta Video) or Product Schedule B (Venta Capture).

• "Seal" means the cryptographic integrity mechanism applied by Venta Capture to uploaded and recorded media, consisting of a SHA-256 cryptographic hash anchored in a signed metadata manifest utilizing an asymmetric hardware-backed key management system (AWS KMS ES256).

• "Self-service Customer" means a Customer that registers for and purchases a subscription online via a self-service checkout flow without a bespoke bilateral contract.

• "Service" means the hosted software-as-a-service solutions, web environments, mobile-accessible web links, APIs, and associated technical infrastructure provided by VentaVid.

• "Trust Center" means the online environment maintained by VentaVid (accessible via VentaVid's domain) containing compliance documents, sub-processor registers, security certifications, and technical audit summaries.

• "User" means an individual employee, contractor, agent, or representative authorized by the Customer to access the Service under the Customer's Account and responsibility.

• "VentaVid" means Venta Internet Services B.V., a private limited liability company organized under the laws of the Netherlands, having its statutory seat in Leiden, the Netherlands, with its principal place of business at Bargelaan 200, 2333 CW Leiden, registered in the Dutch Commercial Register under Chamber of Commerce number 58998276.

Article 2. Applicability, Precedence and Governing Language

1. Scope: These Terms apply to all offers, quotations, trials, orders, subscriptions, and agreements concerning the provision of the Service by VentaVid to the Customer worldwide.

2. Mandatory Law: To the extent that any provision of these Terms conflicts with mandatory provisions of applicable consumer or national law that cannot be lawfully varied by contract between commercial parties, such mandatory law shall prevail solely to the extent of such conflict, while all remaining provisions shall remain in full force and effect.

3. Governing Language: These Terms are drafted and executed in the English language. Any translation provided by VentaVid is provided solely for convenience and administrative reference. In the event of any dispute, inconsistency, or discrepancy between the English version and any translated version, the English language text shall strictly prevail and be conclusive.

4. Dutch Legal Concepts: Where these Terms or any related contractual document utilize English terms to describe concepts of the laws of the Netherlands, such terms shall be construed and interpreted exclusively in accordance with Dutch law.

Article 3. Formation of Agreement and Sales Channels

1. Formation:

• Self-service: For Self-service Customers, the Agreement is formed upon completion of the online registration process, the express electronic acceptance of these Terms (click-to-accept), and the successful authorization of the initial payment method.

• Enterprise: For Enterprise Customers, the Agreement is formed upon (i) mutual signature (digital or wet-ink) of an Enterprise Agreement, or (ii) the Customer's acceptance of an Order Confirmation issued by VentaVid. Such acceptance may be provided in writing, electronically (including confirmation transmitted via electronic mail), or through any other method or conduct that clearly demonstrates the Customer's agreement. The applicable Terms of Service shall be made available to the Customer prior to acceptance and form an integral part of the Agreement, and by accepting the Order Confirmation through any such method, the Customer confirms having received, reviewed, and accepted these Terms of Service prior to contract formation.

2. Business Capacity Warranty: The Service is offered exclusively to commercial entities and professionals (B2B). The Customer warrants that it enters into the Agreement strictly for business, commercial, or professional purposes and not as a consumer.

3. Trials and Free Plans: Any trial period, evaluation tier, or free plan granted by VentaVid is provided on a temporary, non-binding basis and creates no right to ongoing renewal, performance, or availability. VentaVid reserves the right to modify or terminate trial access at any time in accordance with these Terms.

4. Sales Channels:

• Direct: The Agreement is entered into directly between VentaVid and the Customer, with direct invoicing and performance.

• Commercial Agent: Where an intermediary acts as a commercial agent on behalf of VentaVid, the Agreement remains strictly bilateral between VentaVid and the Customer; VentaVid issues invoices directly to the Customer.

• Reseller: Where the Customer purchases access through an authorized independent reseller, the reseller is the Customer's sole contracting party. VentaVid has no direct contractual privity with the reseller's end customer. All commercial terms - specifically including contract duration, subscription term (such as 12, 24, or 36 months), pricing, invoicing, and termination rights - are governed strictly and exclusively by the bilateral agreement between the reseller and the end customer. The end customer cannot invoke VentaVid's default commercial provisions (including the 12-month default term in Article 9 or payment terms in Article 11) against the reseller or VentaVid. Vis-à-vis the end customer, these Terms apply exclusively as software license, acceptable use (AUP), intellectual property, and product schedule limitations, and the reseller remains obligated to bind its end customer to terms no less protective of VentaVid than these Terms of Service.

CHAPTER 2. ACCEPTABLE USE POLICY (AUP)

Article 4. Account Management and Access Security

1. Customer Administration: The Customer is responsible for managing its Account, including provisioning and revoking User credentials, setting role-based access permissions, and maintaining the confidentiality of administrative credentials and API keys.

2. Attribution: All actions, orders, transmissions, and submissions occurring under the Customer's Account or utilizing its API keys are deemed to have been executed by and under the full responsibility of the Customer.

3. Authentication: VentaVid strongly encourages and provides two-factor authentication (2FA). The Customer is responsible for enforcing appropriate authentication hygiene among its Users. VentaVid is not liable for unauthorized access resulting from compromised, stolen, or shared credentials, phishing, or social engineering directed at the Customer's personnel.

4. Subscription Scope: Subscriptions are strictly non-transferable and tied to the specific legal entity of the Customer. A single subscription may not be shared across multiple independent corporate entities or unaffiliated third parties under any circumstances.

5. Security, Webhooks and Enterprise Integration:

• (a) Customer Integration Responsibility: The Customer is exclusively responsible for the configuration, security, and maintenance of all software code, scripts, webhooks, and third-party systems (such as Dealer Management Systems (DMS), CRM platforms, or marketing automation tools) connected to Venta Video via the VentaVid API.

• (b) Credential Protection: The Customer shall implement strict security measures to safeguard its API keys, client secrets, and access tokens. Any API call or transaction executed utilizing valid Customer credentials shall be irrevocably attributed to the Customer.

• (c) Technical Rate Limits: VentaVid enforces automated API rate limits, payload size restrictions, and concurrent connection caps to protect platform stability and infrastructure resilience. VentaVid reserves the right to throttle or temporarily suspend API access in the event of abnormal, abusive, or runaway integration patterns.

Article 5. Permitted and Prohibited Use

1. Permitted Purpose: The Customer and its Users may use the Service solely for legitimate business purposes in accordance with the Documentation, the applicable Product Schedule, and all applicable statutory laws and regulations.

2. Prohibited Conduct: The Customer shall not, and shall ensure that Users and End Users do not:

• (a) Engage in, facilitate, or promote illegal activities, deceptive practices, or violations of third-party rights;

• (b) Conduct covert, clandestine, or non-consensual audio or video recordings where forbidden by applicable criminal or civil law;

• (c) Create, transmit, or manipulate recordings to commit fraud, manufacture deceptive evidence, or intentionally misrepresent physical objects or events;

• (d) Transmit unsolicited commercial communications, spam, or abusive automated messaging via VentaVid's delivery mechanisms (including SMS and email);

• (e) Interfere with, disrupt, or place an unreasonable or disproportionately large load on the infrastructure, networks, or servers of VentaVid or its cloud providers;

• (f) Introduce viruses, worms, trojans, ransomware, or other malicious or technologically harmful code;

• (g) Reverse engineer, decompile, disassemble, or attempt to derive the source code, underlying algorithms, or data models of the Service;

• (h) Access or probe the Service, APIs, or systems for benchmark testing, competitive intelligence, or to build a directly competing commercial service;

• (i) Scrape, harvest, or crawl data or content from the Service through automated tools without VentaVid's prior written authorization;

• (j) Alter, tamper with, forge, or obscure any cryptographic Seal, timestamp, metadata manifest, or inspection report generated by the Service.

3. Technical Nature of Recording and Integrity (Venta Capture): Where the Customer utilizes Venta Capture, the Customer expressly acknowledges that the Service constitutes an objective technical recording, timestamping, and hashing tool. VentaVid does not adjudicate claims, does not verify physical reality or identity, does not evaluate substantive truth, and promises no fraud detection or prevention. All assessments, valuations, and commercial determinations remain exclusively with the Customer.

4. Safety-Critical Disclaimer: The Service is not fail-safe and is not designed or intended for use in high-risk, hazardous, or safety-critical environments requiring fail-safe performance (such as emergency rescue services, direct clinical triage, or critical infrastructure operations).

5. Hosting Status and Content Moderation (EU Digital Services Act):

• Hosting Exemption: With respect to media, text, and materials uploaded or submitted by End Users, VentaVid acts strictly as an intermediary hosting provider within the meaning of Article 6 of Regulation (EU) 2022/2065 (Digital Services Act, "DSA"). VentaVid does not pre-screen, monitor, or ascertain the substantive veracity, lawfulness, or appropriateness of Customer Content.

• Notice and Action Mechanism: In accordance with Article 16 DSA, any party may report alleged illegal content hosted on VentaVid's infrastructure to VentaVid's designated contact point at legal@ventavid.com. Notices must contain a sufficiently substantiated explanation of why the content is alleged to be illegal, the precise URL or identifier, and the contact details of the notifier.

• Moderation and Statement of Reasons: If VentaVid removes, disables, or restricts access to Customer Content pursuant to a substantiated notice or detected AUP violation, VentaVid shall provide the affected Customer with a clear and specific statement of reasons in accordance with Article 17 DSA, outlining the legal or contractual grounds, the factual basis, and the redress mechanisms available.

Article 6. End Users and Flow Administration

1. Workflow Governance: The Customer exclusively configures its capture flows, invitation links, form fields, and recording requests. The Customer is solely responsible for ensuring that its workflows comply with all applicable legal requirements, including sector-specific regulations and mandatory privacy disclosures.

2. Notice to End Users: The Customer must inform End Users prior to capture regarding the purpose, scope, recording nature, and processing of their data. While VentaVid provides default legal notices and consent screens within the capture flow, such defaults are provided as technical aids only; the Customer remains legally responsible for verifying and tailoring these notices to its specific legal obligations.

3. End User Responsibility: End Users remain responsible for their own actions and submissions. However, the Customer is liable to VentaVid for any systemic, intentional, or negligent misuse of the Service originating from links or workflows distributed under the Customer's Account.

4. Individual Restrictions: VentaVid reserves the right to suspend or block specific individual End Users, IP addresses, or workflow links that generate abusive or unlawful submissions, without terminating the Customer's overarching Account.

5. Data Subject Inquiries: Any inquiries, requests for access, rectification, or erasure submitted by End Users shall be directed to the Customer as the responsible controller. VentaVid will not independently respond to or alter End User submissions except upon validated instruction from the Customer or as required by mandatory law.

Article 7. Suspension, Blocking and Termination for Breach

1. Immediate Suspension (Security Grounds): VentaVid is entitled to immediately suspend, restrict, or block access to the Service, Account, API keys, or specific workflows, without prior notice, where reasonably necessary to protect the platform or third parties upon:

• (a) Detection or reasonable suspicion of active cyberattacks, unauthorized penetration, or infrastructure disruption;

• (b) Suspicious authentication patterns, compromised credentials, or credential stuffing attacks;

• (c) Exposure or unauthorized dissemination of API keys;

• (d) Dissemination of malware, ransomware, or malicious scripts;

• (e) Extreme or abusive API call volume threatening platform stability;

• (f) Material breach of Article 5 (Prohibited Use);

• (g) Legal or regulatory orders requiring immediate blocking.

2. Notice and Cure for Minor Breaches: For non-critical breaches (including unintentional fair use overages, minor account sharing, or technical misconfigurations), VentaVid will provide the Customer with written notice and a reasonable cure period:

• 7 calendar days: for excessive usage, workflow misconfigurations, or minor operational non-compliance;

• 48 hours: for unaddressed credential leaks or minor unsolicited communication incidents.

3. Consequences: Suspension shall be restricted to the minimum extent and duration necessary. If the Customer fails to remedy the breach within the applicable cure period, or in the case of repeated or irremediable abuse, VentaVid may dissolve the Agreement with immediate effect, without any obligation to refund prepaid fees.

4. Customer Data Breach Liability: Any security incident, data breach, or regulatory exposure resulting from a misconfiguration, unlawful workflow design, or credential compromise on the part of the Customer or its Users remains the sole responsibility of the Customer.

5. Investigation Cooperation: In the event of suspected security incidents, abuse, or unauthorized access involving the Customer's Account, the Customer shall provide all reasonable cooperation to VentaVid's technical investigators at its own expense.

Article 8. Customer Security Testing and Audits

1. Prior Consent Required: The Customer shall not execute any penetration tests, vulnerability scans, stress tests, or automated security assessments against VentaVid's infrastructure, applications, or APIs without VentaVid's prior express written authorization.

2. Testing Conditions: Where VentaVid authorizes a security test, the parties must execute a formal Rules of Engagement agreement governing scope, timing, IP source whitelisting, non-destructive methodologies, and strict confidentiality. All testing costs are borne exclusively by the Customer.

3. Regulatory Audits: Statutory audit rights granted to competent supervisory authorities under mandatory law remain unaffected.

CHAPTER 3. TERM, PRICING AND PAYMENT

Article 9. Term, Renewal and Termination

1. Self-service Subscriptions: Self-service subscriptions are entered into on a monthly recurring basis. The Customer may cancel the subscription at any time via the Account billing interface, taking effect at the expiration of the then-current monthly billing period. VentaVid may only terminate a Self-service subscription in the event of Customer breach or misuse pursuant to Article 7, or upon formal product discontinuation pursuant to paragraph 4 of this Article.

2. Enterprise Subscriptions:

• Initial Term: Unless specified otherwise in an Order Confirmation, Enterprise Agreements have an initial binding term of twelve (12) calendar months.

• Tacit Renewal: Upon expiration of the initial term or any renewal term, the Agreement shall automatically renew for successive renewal terms of twelve (12) calendar months each, unless either party serves formal written notice of non-renewal at least sixty (60) calendar days prior to the end of the then-current term.

3. No Convenience Termination: Neither party is entitled to terminate an Enterprise Agreement for convenience during an ongoing initial or renewal term. Closing a Customer office, discontinuing a business line, or terminating an internal project shall not relieve the Customer of its obligation to pay all agreed fees for the entire unexpired term.

4. Product Discontinuation: VentaVid reserves the right to retire or sunset a specific Service or Product Schedule upon at least ninety (90) calendar days' prior written notice to the Customer. In such an event, the Agreement for that specific Service shall terminate at the end of such notice period, and VentaVid shall issue a pro-rata refund of any unearned prepaid fees for the discontinued Service.

Article 10. Prices, Indexation and Usage Tiers

1. Currency and Taxes: All prices stated by VentaVid are in Euros (EUR) and are strictly exclusive of Value Added Tax (VAT), sales taxes, customs duties, and any other governmental levies, which shall be borne by the Customer.

2. Annual Price Indexation: VentaVid is entitled to adjust its recurring subscription fees annually, with effect from January 1st, in accordance with the Dutch Consumer Price Index published by Statistics Netherlands (CBS). Such indexation adjustments do not constitute a contractual amendment and do not entitle the Customer to terminate the Agreement.

3. Price Adjustments Exceeding Indexation: VentaVid may adjust prices beyond the indexation threshold upon written notice provided at least thirty (30) calendar days prior to the renewal date. If the Customer objects to such price increase, the Customer is entitled to terminate the Agreement with effect from the renewal date by providing written notice prior to such date.

4. Overages and Automated Tiers:

• Self-service: When a Self-service Customer systematically exceeds the volume, storage, seat, or submission allowances of its current plan, the Account may automatically be transitioned to the applicable higher tier at the then-current standard rates, provided that threshold warnings were issued via the dashboard or email.

• Enterprise: Additional submissions, storage, API volume, or add-on modules exceeding contractually agreed commitments are billed monthly in arrears at the agreed overage rates set forth in the Order Confirmation.

5. Fair Use Policy: VentaVid monitors aggregate infrastructure, bandwidth, and AI processing consumption. Where Customer usage significantly exceeds reasonable business patterns, VentaVid will notify the Customer to discuss remediation, technical rate limiting, or appropriate commercial tier adjustments.

Article 11. Invoicing and Payment Terms

1. Payment Methods:

• Self-service: Payment is made in advance via credit card, direct debit, or integrated online payment service providers authorized by VentaVid.

• Enterprise: Invoicing is conducted annually or quarterly in advance as specified in the Order Confirmation. Variable overage charges are invoiced monthly in arrears.

2. Payment Period: Invoices must be paid in full within twenty-one (21) calendar days from the invoice date, without any deduction, discount, or withholding, other than covered by paragraph 6 of this Article.

3. Prohibition of Set-off and Suspension: The Customer is not entitled to set off any disputed claim against VentaVid's invoices, nor to suspend its payment obligations.

4. Invoice Disputes: If the Customer disputes any portion of an invoice in good faith, it must notify VentaVid in writing within fourteen (14) calendar days of the invoice date, stating the detailed grounds of the dispute. Undisputed amounts must be paid within the original payment period.

5. Default Interest and Collection Costs:

• If an invoice is not settled in a timely manner, the Customer is automatically in default by operation of law, without requiring any further notice of default.

• From the date of default, the Customer owes statutory commercial interest pursuant to Article 6:119a of the Dutch Civil Code.

• All reasonable judicial and extrajudicial collection costs incurred by VentaVid to recover overdue amounts shall be reimbursed by the Customer in accordance with the Dutch Extrajudicial Collection Costs Act.

6. Withholding Taxes: Prices are stated exclusive of foreign withholding taxes. If the Customer is required by mandatory local law to deduct withholding tax from its payment to VentaVid, the Customer shall not be required to gross up the invoiced amount, provided that the Customer immediately delivers to VentaVid an official withholding tax certificate or valid receipt issued by the competent tax authority within thirty (30) calendar days of payment, enabling VentaVid to claim foreign tax relief or credit.

Article 12. Consequences of Non-Payment and Escalation

In the event of non-payment by the Customer, VentaVid shall apply the following phased operational escalation protocol:

1. Day 7 after Due Date: An informal automated payment reminder is issued by email to the Customer's designated billing contact.

2. Day 14 after Due Date: A formal demand for payment is served, demanding settlement within seven (7) calendar days.

3. Day 21 after Due Date: A formal notice of impending suspension is issued, notifying the Customer that access will be restricted.

4. Day 30 after Due Date (Read-Only Mode): The Account is transitioned to Read-Only Mode. During Read-Only Mode:

• The generation of new video links, capture workflows, and the receipt of new End User submissions are blocked;

• Previously recorded videos, historical submissions, cryptographic Seals, and audit logs remain accessible for viewing and manual export by the Customer.

5. Day 60 after Due Date: Without prejudice to any other rights or remedies available to VentaVid under the Agreement or applicable law, VentaVid shall be entitled to immediately suspend Customer’s and its End Users’ access to the Services (including any read-only access) if Customer fails to pay any undisputed invoice within seven (7) natural days following written notice of non-payment. Such suspension shall not constitute a termination or dissolution of the Agreement, nor shall it release Customer from its ongoing payment obligations. Access will be restored promptly following full payment of all outstanding amounts.

6. Permanent Purge (Post-Termination Deletion): Within ninety (90) calendar days following the effective termination date of the Agreement, all stored Customer Content, media, and records shall be permanently purged from active systems in accordance with Article 20 and the DPA, following formal pre-erasure notification.

CHAPTER 4. DELIVERY, QUALITY AND CHANGES

Article 13. Delivery, Availability and Support

1. Care and Delivery: VentaVid shall provide the Service with reasonable skill and care as a reasonable efforts obligation. Unless an Enterprise SLA has been executed between the parties, VentaVid does not guarantee uninterrupted, error-free, or specific percentage availability, and no guarantee of result is provided.

2. Scheduled Maintenance:

• Standard scheduled maintenance windows take place on Fridays between 20:00 and 23:00 Central European Time (CET/CEST) and Sundays between 02:00 and 06:00 Central European Time (CET/CEST).

• VentaVid will give at least seven (7) calendar days' prior notice for any scheduled maintenance that may cause service disruption.

3. Emergency Maintenance: VentaVid may perform emergency maintenance without prior notice where strictly required to remediate critical security vulnerabilities, infrastructure faults, or active threats.

4. Customer Support:

• Support tickets may be submitted 24/7 via email or the support portal.

• Standard support inquiries are processed on Dutch business days between 08:00 and 18:00 CET/CEST.

• Critical system-wide outages are monitored 24/7, with an operational target response time of two (2) hours on a best-efforts basis.

5. Delivery Timelines: All implementation, onboarding, or custom delivery dates communicated by VentaVid are indicative and non-fatal target timelines.

Article 14. Warranties, Defects and Exclusive Remedies

1. Conformity: VentaVid warrants that the Service will function substantially in conformity with the published Documentation. VentaVid makes no warranty regarding specific functionalities, compatibility, or merchantability not explicitly set forth in the Documentation or Order Confirmation.

2. Browser and Device Compatibility: VentaVid applies reasonable commercial efforts to ensure compatibility with modern, officially supported web browsers and mobile operating systems (iOS and Android). VentaVid does not warrant identical performance across outdated, modified, or customized third-party browsers.

3. Notification of Defects: The Customer must report any reproducible material defect in the Service in writing within thirty (30) calendar days of discovery, providing comprehensive diagnostic information.

4. Exclusive Remedies: In the event of a verified non-conformity, VentaVid shall use reasonable commercial efforts to repair or circumvent the defect within a reasonable timeframe. If VentaVid determines that repair is commercially or technically unfeasible, either party may terminate the affected service component, and VentaVid shall issue a pro-rata refund of any prepaid, unearned subscription fees paid for the non-conforming component. This refund constitutes the Customer's sole and exclusive remedy for breach of warranty.

Article 15. Changes to the Service and Terms

1. Evolution of the Service: VentaVid continuously updates and develops the Service. VentaVid reserves the right to modify, add, or deprecate specific features, provided that such modifications do not result in a material degradation of the core functionalities contracted by the Customer under an active paid subscription, except where necessitated by legal obligations, third-party technology deprecation, or critical security requirements.

2. Amendments to Terms:

• VentaVid may amend these Terms of Service upon at least thirty (30) calendar days' advance notice via email or administrative dashboard notification.

• If a proposed amendment materially and adversely affects the Customer's legal position or core rights, VentaVid shall provide at least sixty (60) calendar days' advance notice, and the Customer shall be entitled to terminate the Agreement prior to the effective date without penalty.

• Minor typographical corrections, statutory compliance updates, or newly introduced non-mandatory features may be implemented immediately without triggering a termination right.

• Amendments shall never apply retroactively.

Article 16. Beta and Artificial Intelligence Features

1. Beta Releases: Features designated as "Beta", "Preview", or "Experimental" are provided strictly "as is" and "as available", without warranty, SLA coverage, or performance commitments. VentaVid may modify or discontinue Beta features at any time.

2. AI Functionalities (Transcription and Signal Detection):

• Certain optional modules of the Service leverage automated machine learning technologies for speech-to-text transcription, automated textual summarization, and capture signal detection.

• The Customer acknowledges that automated models may occasionally generate inaccurate, incomplete, or biased output. The Customer is solely responsible for independently verifying all AI-generated outputs, transcripts, and signals before relying upon them for operational, underwriting, or claims decisions.

• Where the Customer deploys AI functionalities that generate synthetic content or automated transcripts, the Customer remains responsible for ensuring that its workflows comply with statutory transparency requirements (including Article 50 of Regulation (EU) 2024/1689 (EU AI Act)), and VentaVid shall make available standard interface indicators to the extent supported by the then-current Documentation.

CHAPTER 5. CONTENT, INTELLECTUAL PROPERTY AND CONFIDENTIALITY

Article 17. Customer Content and Licences

1. Customer Ownership: All rights, title, and interest in and to Customer Content (including all recorded video files, photographs, metadata, audio tracks, and inspection entries) remain exclusively with the Customer or its licensors.

2. Limited Operating Licence: The Customer hereby grants VentaVid a non-exclusive, worldwide, royalty-free, revocable licence to store, transmit, reformat, process, and display Customer Content strictly to the extent necessary to deliver, maintain, protect, and support the Service in accordance with the Agreement and Customer instructions.

3. No Model Training on Customer Content: VentaVid shall not use Customer Data (including video recordings, audio, transcripts, and metadata) to train, fine-tune, or improve any proprietary or general-purpose machine learning or artificial intelligence models without Customer’s prior written consent. Where the Customer opts for an optional module that utilizes third-party AI or transcription service providers (such as speech-to-text engines), VentaVid warrants that it engages such providers under commercial enterprise terms that prohibit the third party from using Customer Data to train their own AI models. Provided VentaVid has procured such contractual restrictions, VentaVid shall not be liable for any unauthorized use or breach by such third-party provider, but shall reasonably assist Customer in asserting any remedies available under the applicable vendor agreement.

4. Aggregated Telemetry and Fraud Pattern Data: VentaVid retains exclusive ownership of all anonymized, aggregated statistical usage data, operational telemetry, technical anomaly patterns, abstract fraud indicators, and system metrics derived from the operation of the Service, provided that such data is fully anonymized and does not contain personal data or identify the Customer or its End Users. The Customer retains the right to export its raw workflow data and Customer-configured templates upon termination for ongoing internal use, but acquires no ownership rights in VentaVid's underlying base templates, software code, or anomaly detection heuristics.

5. Customer Indemnity: The Customer warrants that Customer Content and the distribution of capture workflows comply with applicable statutory laws and do not infringe third-party intellectual property, portrait, or privacy rights. The Customer shall indemnify, defend, and hold harmless VentaVid against any direct third-party claims, regulatory enforcement actions, or statutory fines arising out of (a) an alleged infringement of third-party intellectual property or portrait rights, (b) claims from recorded individuals regarding consent, privacy, or the use of their recordings, or (c) data protection violations attributable to Customer Content or Customer workflow configurations, provided that VentaVid promptly notifies the Customer in writing, grants the Customer sole control over the defense and settlement, and provides reasonable cooperation at the Customer's expense.

Article 18. VentaVid's Intellectual Property Rights

1. Proprietary Rights: All intellectual property rights, database rights, trade secrets, software code, UI designs, system architectures, documentation, report formats, and cryptographic sealing algorithms utilized within or embodied by the Service remain the exclusive property of VentaVid or its licensors.

2. Restrictions: The Customer shall not license, sublicense, sell, rent, lease, transfer, distribute, or make available the Service to unauthorized third parties, nor create derivative works based on the Service.

3. Feedback: If the Customer or its Users provide suggestions, comments, or improvement ideas ("Feedback") to VentaVid, VentaVid shall be entitled to freely use, incorporate, and commercialize such Feedback without restriction, compensation, or attribution.

Article 19. Confidentiality and Reference Rights

1. Confidential Information: Each party agrees to treat all non-public technical, commercial, financial, and operational information disclosed by the other party as strictly confidential. Confidential Information of VentaVid means all non-public, proprietary, or business-sensitive information disclosed by or on behalf of VentaVid to Customer or its End Users, whether orally, in writing, electronically, or by inspection of tangible objects, that is designated as confidential or that reasonably should be understood to be confidential given the nature of the information and the circumstances of disclosure, including, without limitation:

• (a) the Software, Services, underlying source code, object code, APIs, algorithms, technical architecture, and system performance data;

• (b) product roadmaps, release plans, specifications, prototypes, and security documentation (including vulnerability scans, penetration test reports, and audit certificates);

• (c) business, marketing, financial, and pricing information, customer and partner lists, and terms of any commercial proposals; and

• (d) any trade secrets, know-how, and proprietary methodologies developed by VentaVid.

2. Duration of Duty:

• Trade secrets within the meaning of the Dutch Trade Secrets Act shall remain confidential indefinitely for as long as they qualify as trade secrets under applicable law.

• Other Confidential Information shall remain protected during the term of the Agreement and for a period of five (5) years following its termination.

3. Exclusions: The obligations of confidentiality do not apply to information that is publicly known, already known prior to disclosure without breach, independently developed, or required to be disclosed by statutory law or a binding court order (subject to prior prompt written notice where lawful).

4. Customer References: VentaVid shall not use the Customer's commercial name, logo, or trademark in marketing materials, customer lists, or public press releases without the Customer's prior express written or electronic consent (opt-in).

Article 20. Retention, Data Export and Deletion

1. Customer Pre-Termination Export: Upon termination of the Agreement, the export, retention, and permanent deletion of Customer Content and Personal Data are strictly governed by Article 37 of the Data Processing Agreement (Chapter 8).

2. No Post-Termination Access: Following the formal termination date of the Agreement, the Customer's Account shall be closed and the Customer shall have no further access to the administrative dashboard, media libraries, or storage repositories.

3. Post-Termination Deletion: Within thirty (30) calendar days following the effective termination date, VentaVid shall permanently delete all Customer Content from its active production environments. Data residing in automated, rotating disaster recovery backup systems shall be overwritten and permanently purged in accordance with VentaVid's standard 30-day backup retention cycle (resulting in complete erasure across all systems within a maximum of 60 days following termination).

4. No Archival Guarantee: While VentaVid maintains strict retention integrity during the active contracted retention period set forth in the applicable Product Schedule, the Service is not an indefinite archival repository. The Customer remains responsible for long-term legal preservation beyond the contracted retention period.

CHAPTER 6. SECURITY, LIABILITY AND FORCE MAJEURE

Article 21. Information Security, Incident Response and Audits

1. Technical and Organizational Measures: VentaVid implements and maintains appropriate technical and organizational measures to safeguard the confidentiality, integrity, and availability of Customer Content, as detailed in the DPA (Chapter 8).

2. Security Incident Protocol: In the event of a security incident affecting Customer Content, VentaVid shall:

• (a) Promptly investigate the nature and scope of the incident;

• (b) Implement containment and mitigation measures;

• (c) Notify the Customer without undue delay (and in no event later than 24 hours after becoming aware of a personal data breach, in accordance with Article 35 of the DPA and Section 10 of IC-ISMS-013);

• (d) Provide reasonable cooperation to assist the Customer in fulfilling its statutory notification obligations;

• (e) Conduct a post-incident review to prevent recurrence.

3. No Flawless Security Warranty: The Customer acknowledges that no internet-connected cloud service is completely invulnerable. A security incident or unauthorized cyberattack does not constitute an attributable failure or breach on the part of VentaVid, provided that VentaVid maintained reasonable and appropriate security measures in accordance with industry standards.

4. Audits and Questionnaires: VentaVid provides automated access to compliance documentation, third-party attestations, and architecture overviews in its Trust Center. On-site audits or custom security reviews requested by the Customer require prior mutual agreement on scope, timing, execution, and cost reimbursement, and shall be conducted during normal Dutch business hours without disrupting ongoing operations.

Article 22. Limitation of Liability

1. General Liability Cap: To the maximum extent permitted by applicable law, VentaVid's total aggregate liability arising out of or in connection with the Agreement, whether in contract, tort (including negligence), breach of statutory duty, or otherwise, shall be strictly limited to the total fees actually paid or payable by the Customer to VentaVid under the Agreement for the specific Service giving rise to the claim during the twelve (12) calendar months immediately preceding the event giving rise to liability.

2. Free and Trial Tiers: For free subscriptions, evaluation tiers, or trial usage, VentaVid's aggregate liability shall be capped at a maximum aggregate amount of EUR 250 (two hundred and fifty Euros).

3. Exclusion of Indirect and Consequential Damages: Under no circumstances shall VentaVid be liable for any:

• (a) Indirect, incidental, special, punitive, or consequential damages;

• (b) Loss of profit, revenue, business opportunities, goodwill, or commercial reputation;

• (c) Business interruption, operational downtime, or wasted management time;

• (d) Loss, corruption, or destruction of data, files, or records (without prejudice to VentaVid's incident response and mitigation obligations under Article 21).

4. Exhaustive Definition of Direct Damages: VentaVid's liability for direct damage shall be strictly and exhaustively limited to:

• (a) Reasonable costs incurred by the Customer to determine the cause and extent of the direct damage;

• (b) Reasonable costs incurred by the Customer to have VentaVid's non-conforming performance brought into compliance with the Agreement;

• (c) Reasonable costs incurred by the Customer to prevent or mitigate direct damage, provided the Customer demonstrates that such expenditure resulted in an effective mitigation of direct damage.

5. Exceptions to Limitations: The limitations and exclusions of liability set forth in this Article 22 shall not apply to:

• (a) Damage caused by the intent or deliberate recklessness of VentaVid's management board or executive officers;

• (b) Liabilities that cannot be lawfully excluded or limited under mandatory provisions of applicable Dutch law.

6. API and Key Security: VentaVid is not liable for any damages, unauthorized transactions, or data loss resulting from compromised, leaked, or mishandled Customer API keys, or actions executed via Customer webhooks.

7. Lapse of Claims: All claims, legal actions, and rights of action of the Customer against VentaVid arising out of or in connection with the Agreement shall lapse and be extinguished upon the expiration of one (1) year from the date on which the Customer became aware, or reasonably should have become aware, of the facts giving rise to the claim.

8. Severability and Conversion: If any limitation or exclusion in this Article 22 is deemed unenforceable or invalid by a court or arbitral tribunal, such provision shall be deemed converted into a valid provision that accomplishes the commercial objective of the original limitation as closely as legally permissible pursuant to Article 3:42 of the Dutch Civil Code.

Article 23. Force Majeure

1. Definition: Neither party shall be liable for any failure or delay in performing its obligations under the Agreement (other than monetary payment obligations) if and to the extent such failure or delay is caused by circumstances beyond its reasonable control, constituting force majeure pursuant to Article 6:75 of the Dutch Civil Code.

2. Included Events: Force majeure shall expressly include:

• (a) Widespread failures of the public internet, telecommunication backbones, or major DNS routing networks;

• (b) Unscheduled, catastrophic outages, physical failures, or power disruptions of underlying third-party hyperscale cloud infrastructure providers (specifically including Amazon Web Services / AWS), provided that such outage lies outside VentaVid's reasonable control and could not be averted by commercially reasonable technical measures;

• (c) Undelivered or delayed SMS or telephony messages caused by intermediary and mobile telecom carrier failures;

• (d) Failures, outages, or unexpected API deprecation by upstream third-party AI model providers;

• (e) Distributed denial-of-service (DDoS) attacks, novel zero-day exploits, state-sponsored cyber warfare, or sophisticated cyberattacks by criminal organizations or advanced threat actors, in each case to the extent such events could not reasonably have been prevented or mitigated by security measures complying with reasonable commercial standards and Article 21;

• (f) Acts of war, terrorism, civil unrest, natural disasters, epidemics, pandemics, strikes, or binding government orders and trade embargoes.

3. Excluded Events: Force majeure shall not include routine internal software bugs, ordinary personnel turnover, avoidable supplier defaults, or financial insolvency.

4. Suspension and Mitigation: The affected party shall notify the other party without undue delay of the force majeure event and shall apply commercially reasonable efforts to mitigate its effects. The affected obligations are suspended for the duration of the condition.

5. Termination after Three Months: If a force majeure event continues uninterrupted for more than three (3) consecutive months, either party is entitled to terminate the affected Agreement with immediate effect by written notice. In such an event, the Customer is entitled to a proportionate refund of any prepaid, unearned subscription fees covering the period during which the Service was completely unavailable.

CHAPTER 7. LEGAL REQUESTS, CONTINUITY AND DISPUTES

Article 24. Authority Demands, Evidence and Legal Holds

1. Government Demands: If VentaVid receives a formal subpoena, search warrant, court order, or binding disclosure demand from a competent law enforcement, judicial, or regulatory authority concerning Customer Content, VentaVid shall:

• (a) Assess the formal validity, jurisdictional competence, and legal basis of the demand;

• (b) Promptly notify the Customer in writing prior to disclosure, unless prohibited by criminal procedural law or judicial confidentiality order.

2. Customer Legal Hold Responsibility: The Customer is solely responsible for implementing its own legal hold, evidence preservation, and data preservation protocols. VentaVid does not provide an automated litigation hold feature unless explicitly agreed in an Order Confirmation.

3. Preservation Requests: If the Customer provides VentaVid with a written preservation request referencing specific identified media files that are demonstrably subject to active litigation, VentaVid shall suspend the automated deletion cycle for those specific records, subject to the Customer paying the standard data storage fees.

4. Witness and Forensic Assistance: If Customer requests technical verification declarations, bespoke affidavits, specialized forensic data extraction, or expert witness testimony from VentaVid’s engineering staff for use in judicial, arbitral, or regulatory proceedings:

• (a) Such assistance is not included in standard subscription fees and shall be provided strictly subject to engineering resource availability and reasonable advance notice;

• (b) Customer shall compensate VentaVid at its then-current standard professional services hourly rates, plus all reasonable travel, legal, and out-of-pocket expenses;

• (c) VentaVid acts strictly as a factual technical witness explaining its platform architecture, cryptographic logs, and system timestamps; VentaVid does not act as an independent (court-appointed) expert and makes no representation regarding physical damage causation, party liability, or the substantive truth of recorded events.

Article 25. Assignment, Restructuring and Insolvency

1. Assignment by VentaVid: VentaVid is entitled to assign, transfer, or subrogate its rights and obligations under the Agreement, together with associated customer data and Accounts, to an affiliate, legal successor, or third party acquiring the business or assets of VentaVid, without requiring the separate consent of the Customer, which consent is hereby granted in advance pursuant to Article 6:159 of the Dutch Civil Code.

2. Assignment and Corporate Restructuring by Customer: The Customer shall not assign or transfer its rights or obligations under the Agreement to any third party without VentaVid's prior written consent. In the event of a merger, acquisition, business sale, or corporate restructuring of the Customer, the original contracting Customer entity shall remain jointly and severally liable for all obligations under the Agreement until the acquiring or surviving entity has formally acceded to the Agreement in writing and VentaVid has confirmed its acceptance thereof.

3. Insolvency and Suspension:

• Either party may terminate or suspend the Agreement with immediate effect if the other party is declared bankrupt, enters into liquidation, or is placed under judicial receivership.

• Pursuant to Article 373(3) of the Dutch Bankruptcy Act, any statutory cooling-off period ordered under the Dutch Scheme of Arrangement (WHOA) shall be respected, during which VentaVid's termination rights related to pre-existing default are suspended.

• If a bankruptcy trustee demands continued performance of the Service pursuant to Article 37 of the Dutch Bankruptcy Act, VentaVid's continued performance is conditional upon the trustee providing immediate advance payment or adequate security for all ongoing fees.

Article 26. Notices and Communications

1. Electronic Notice: All notices, demands, and formal communications under the Agreement shall be given in writing by electronic mail. Notices to the Customer shall be sent to the primary administrative email address registered with the Account. Notices to VentaVid shall be addressed to legal@ventavid.com (with physical copy to VentaVid's registered address at Bargelaan 200, 2333 CW Leiden, the Netherlands).

2. Receipt: Notices sent by email shall be deemed delivered on the next Dutch business day following transmission, provided no delivery failure notification is generated. The Customer is responsible for keeping its administrative contact details accurate and current.

Article 27. Governing Law and Dispute Resolution

1. Governing Law: The Agreement, these Terms, and all contractual or non-contractual legal relationships arising out of or in connection with them, shall be exclusively governed by and construed in accordance with the laws of the Netherlands.

2. Exclusion of CISG: The United Nations Convention on Contracts for the International Sale of Goods of 1980 (Vienna Sales Convention / CISG) is expressly excluded and shall not apply.

3. Mandatory Amicable Negotiations: In the event of any dispute, controversy, or claim arising out of or relating to the Agreement, the parties shall first attempt in good faith to resolve the matter through senior executive negotiations for a period of at least thirty (30) calendar days following written notice of dispute, before initiating any formal legal or arbitral proceedings.

4. Arbitration (Enterprise Disputes):

• Except as provided in paragraph 5 below, any dispute, controversy, or claim arising out of or relating to an Enterprise Agreement, Order Confirmation, or an Enterprise Customer subscription, including its formation, validity, breach, or termination, that cannot be resolved amicably, shall be submitted to and finally resolved by arbitration under the Rules of Arbitration of the International Chamber of Commerce (ICC).

• The number of arbitrators shall be one (1).

• The legal seat of arbitration shall be London, England.

• The language of the arbitral proceedings shall be English.

• The governing substantive law applied by the arbitrator shall be the laws of the Netherlands.

5. Carve-Out for Summary Relief, Debt Collection and Self-service Disputes:

• Notwithstanding the arbitration agreement in paragraph 4:

  • (a) VentaVid reserves the exclusive right to bring any undisputed debt collection action or payment default claim against the Customer before the competent state court of the Customer's domicile or before the District Court of The Hague, the Netherlands;

  • (b) Either party may apply to the competent state courts of the Netherlands (including the preliminary relief judge) for interim, provisional, or conservatory relief;

  • (c) All disputes arising out of or relating to Self-service Subscriptions (regardless of monetary value) shall be submitted exclusively to the jurisdiction of the competent court of the District Court of The Hague, the Netherlands.

Article 28. Final Provisions and Version Control

1. Severability: If any provision of these Terms is held to be invalid, illegal, or unenforceable, the validity and enforceability of the remaining provisions shall not be affected. The parties shall replace the invalid provision with a valid provision that best reflects the economic and legal intent of the invalid provision.

2. No Waiver: No failure or delay by VentaVid in exercising any right, power, or remedy under these Terms shall operate as a waiver thereof.

3. Electronic Proof: Digital logs, system timestamps, and database audit trails maintained by VentaVid shall constitute prima facie evidence of the transactions, user acceptances, and usage to which they relate.

4. Version Control and Archival: VentaVid maintains an immutable digital archive of prior versions of these Terms and Product Schedules in its Trust Center for Customer reference, without prejudice to VentaVid's right to amend these Terms in accordance with Article 15.

CHAPTER 8. DATA PROCESSING AGREEMENT (DPA)

This Data Processing Agreement ("DPA") forms an integral, legally binding part of the Terms of Service and applies to all processing of Personal Data by Venta on behalf of the Customer in the provision of the Service, in accordance with Article 28 of Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR").

Article 29. Scope, Roles and Subject Matter

1. Roles of the Parties: The parties acknowledge that with respect to Personal Data contained in Customer Content, customer workflows, and End User submissions processed through the Service:

• The Customer is the Data Controller; and

• VentaVid is the Data Processor.

2. End User Distinction: Natural persons interacting with the Service - including End Users who receive, view, review, or authorize video messages, repair estimates, or approvals via Venta Video, as well as End Users who capture, record, or submit media and form data via Venta Capture - are data subjects vis-à-vis the Customer. VentaVid processes all such Personal Data strictly on behalf of, upon the automated configuration of, and under the documented instructions of the Customer.

3. Subject Matter and Duration: The subject matter, nature, and purpose of the processing comprise the provision, hosting, cryptographic sealing, transmission, and support of the cloud-based video and capture services. The duration of processing corresponds to the term of the Agreement plus the post-termination retention and deletion period defined in Article 20 and Article 37.

4. Categories of Data and Data Subjects:

• Categories of Data Subjects: Customer personnel, authorized Users, and End Users (including customer clients, respondents, insured parties, asset owners, and claim applicants).

• Types of Personal Data: Video recordings, voice and audio recordings, photographic images, full names, email addresses, mobile telephone numbers, timestamps, IP addresses, browser/device telemetry, GPS coordinates (where explicitly enabled in workflow templates), form input data, speech-to-text transcripts, and asset registration numbers or license plates.

• Special Categories of Data: The Service is not intended for the intentional processing of special categories of personal data (Article 9 GDPR) or criminal data (Article 10 GDPR). To the extent Customer workflows unintentionally capture such data, the Customer remains solely responsible for establishing an appropriate statutory exception under Article 9(2) GDPR.
  Without limiting the generality of the foregoing, the Service does not extract, generate, or process biometric data (within the meaning of Article 4(14) and Article 9 GDPR). VentaVid merely stores and transmits recorded media, photographs, and signature inputs as standard digital files and does not perform any biometric identification, facial recognition, voiceprint analysis, or behavioral analysis on submitted content.

5. VentaVid as Independent Controller: The parties acknowledge that VentaVid acts as an independent Data Controller for the processing of personal data relating to Account administration, User identity and authentication, billing and financial accounting, platform security and fraud prevention, and aggregated, anonymized analytical telemetry.

Article 30. Controller Instructions and Compliance

1. Documented Instructions: VentaVid shall process Personal Data strictly on behalf of and in accordance with the documented, lawful instructions of the Customer, including with respect to transfers of Personal Data to a third country, unless required to do so by European Union or Member State law to which VentaVid is subject. In such a case, VentaVid shall inform the Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

2. Agreement as Instructions: The Customer's execution of the Agreement, its configuration of settings, APIs, and workflows within the Service, and its operational use of features constitute the complete and finalized instructions to VentaVid. Additional bespoke instructions require mutual written agreement and may be subject to additional fees.

3. Duty to Warn: VentaVid shall immediately inform the Customer if, in its reasonable professional opinion, an instruction from the Customer infringes the GDPR, the Dutch GDPR Implementation Act, or other Union or Member State data protection provisions.

Article 31. Confidentiality and Personnel Security

1. Confidentiality Commitment: VentaVid ensures that all personnel, contractors, and agents authorized to process Personal Data have committed themselves to confidentiality under a binding non-disclosure agreement or are under an appropriate statutory obligation of confidentiality.

2. Access Limitation: Access to Customer Personal Data by VentaVid personnel is strictly restricted to employees requiring access for platform maintenance, technical support, troubleshooting, or legal compliance (principle of least privilege).

Article 32. Technical and Organizational Security Measures (TOMs)

1. Security Standards: Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, VentaVid implements and maintains appropriate technical and organizational measures to ensure a level of security appropriate to the risk, pursuant to Article 32 GDPR.

2. Core Safeguards: VentaVid's technical and organizational measures encompass:

• (a) Hosting and Data Location: All primary database storage, video processing, and media hosting are conducted within data centers located in the European Economic Area (specifically AWS Europe Region, Ireland / eu-west-1);

• (b) Encryption in Transit: All external and internal communications are encrypted using modern transport layer security protocols (TLS 1.3 / TLS 1.2 with strong cipher suites);

• (c) Encryption at Rest: All video files, photographic captures, transcripts, and database backups are encrypted at rest using symmetric AES-256 encryption managed via AWS Key Management Service (AWS KMS);

• (d) Cryptographic Integrity: Capture submissions are sealed utilizing separate hardware-backed asymmetric keys (AWS KMS ES256) and SHA-256 cryptographic hashes;

• (e) Logical Segregation: Multi-tenant architecture ensuring strict logical isolation of Customer databases, media buckets, and access tokens;

• (f) Access Controls: Multi-factor authentication (2FA/MFA), role-based access control (RBAC), and automated logging of administrative access;

• (g) Resilience and Backups: Automated daily snapshots and disaster recovery replication across physically separate availability zones;

• (h) Vulnerability Management: Regular automated dependency scanning, static code analysis, and structured internal vulnerability assessments.

3. Modifications to TOMs: VentaVid may update or amend its technical and organizational measures from time to time, provided that such modifications do not materially reduce the overall security level of the Service.

Article 33. Sub-processors

1. General Authorization: The Customer hereby grants VentaVid general written authorization to engage third-party sub-processors to support the delivery of the Service.

2. Current Sub-processors: A comprehensive register of all approved sub-processors, their corporate locations, processing roles, and applicable transfer safeguards is published in VentaVid's online Trust Center.

3. Notification of Changes: VentaVid shall maintain an up-to-date register of all sub-processors in its online Trust Center. VentaVid shall announce any intended addition or replacement of a sub-processor at least fourteen (14) calendar days prior to authorizing such sub-processor to process Personal Data, via an update in the Trust Center or an automated in-app / email notification to Customer's registered administrative contact.

4. Objection Procedure: Customer may object to the appointment of a new sub-processor within ten (10) calendar days following notice, exclusively on reasonable, substantiated data protection grounds (i.e. demonstrating that the sub-processor fails to meet the requirements of Article 28 GDPR or materially compromises the security of Customer Personal Data). If no objection is submitted within such a timeframe, the sub-processor shall be deemed approved.
   In the event of a timely and substantiated objection:

• (a) VentaVid shall consult with Customer in good faith to assess reasonable mitigating measures or technical alternatives;

• (b) If VentaVid, in its reasonable discretion, cannot accommodate the objection or provide an alternative configuration without unreasonable technical or financial burden, VentaVid may either elect not to deploy the sub-processor for Customer, or terminate the specific affected Service module upon thirty (30) days’ written notice, providing a pro-rata refund of any prepaid fees for the unexpired term of the affected module. The Customer shall have no right to terminate the Agreement for convenience or claim damages on the basis of a sub-processor change.

5. Flow-down Obligations: Where VentaVid engages a sub-processor, VentaVid shall impose data protection obligations no less protective than those set out in this DPA by way of a written contract, specifically ensuring that the sub-processor provides sufficient guarantees to implement appropriate technical and organizational measures. VentaVid remains fully liable to the Customer for the performance of its sub-processors' data protection obligations.

Article 34. International Data Transfers

1. EEA Processing Principle: Personal Data is stored and hosted primarily within the European Economic Area (EEA).

2. Third-Country Transfers: Where the performance of the Service involves the transfer of Personal Data to a country outside the EEA or an international organization that does not benefit from an adequacy decision by the European Commission pursuant to Article 45 GDPR, VentaVid ensures that appropriate safeguards are implemented in accordance with Chapter V GDPR, specifically:

• (a) The standard contractual clauses adopted by the European Commission (Implementing Decision (EU) 2021/914, Module Two: Controller-to-Processor, or Module Three: Processor-to-Processor, as applicable), which are hereby incorporated by reference; or

• (b) Participation in and certification under the EU-U.S. Data Privacy Framework (DPF) for certified recipients in the United States; and

• (c) Where necessary, supplementary technical and organizational measures based on a documented Transfer Impact Assessment (TIA).

Article 35. Personal Data Breach Management and Notification

1. Breach Notification: In the event of a personal data breach within the meaning of Article 4(12) GDPR affecting Customer Personal Data, VentaVid shall notify the Customer without undue delay, and in any event within twenty-four (24) hours after becoming aware of the breach.

2. Content of Notification: To the extent information is available, the notification shall contain at least:

• (a) A description of the nature of the breach, including where possible the categories and approximate number of data subjects and records concerned;

• (b) The name and contact details of VentaVid's data protection contact point;

• (c) A description of the likely consequences of the breach;

• (d) A description of the remedial measures taken or proposed to be taken by VentaVid to address and mitigate the breach.

3. No Admission of Fault: Notification of a personal data breach by VentaVid shall not be construed as an admission of fault, liability, or negligence on the part of VentaVid.

4. Customer Reporting Duty: The Customer remains exclusively responsible for determining whether the breach requires formal notification to the Dutch Data Protection Authority or other competent supervisory authorities pursuant to Article 33 GDPR, and to affected data subjects pursuant to Article 34 GDPR.

Article 36. Assistance to Controller and Data Subject Rights

1. Data Subject Requests: Taking into account the nature of the processing, VentaVid shall assist the Customer by appropriate technical and organizational measures, insofar as this is technically possible, for the fulfilment of the Customer's obligation to respond to requests for exercising the data subject's rights laid down in Chapter III GDPR (including access, rectification, erasure, restriction, and portability).

2. Direct Requests: If VentaVid receives a request directly from an End User or data subject, VentaVid shall not respond independently (save to confirm that the request relates to the Customer) and shall promptly forward the request to the Customer.

3. DPIA and Consultation Assistance: Taking into account the nature of processing and the information available to VentaVid, VentaVid shall provide reasonable assistance to the Customer in ensuring compliance with the Customer's obligations pursuant to Articles 32 to 36 GDPR (specifically including Data Protection Impact Assessments / DPIAs and prior consultations with supervisory authorities).

4. Cost Allocation: Where assistance requested under this Article 36 exceeds standard self-service features or requires material custom engineering, forensic, or legal analysis, VentaVid is entitled to charge reasonable remuneration based on its standard hourly professional services rates.

Article 37. Deletion and Return of Personal Data

1. Pre-Termination Export: The Customer shall extract and export all desired Customer Personal Data using the automated export utilities and APIs of the Service prior to the effective date of termination of the Agreement.

2. Post-Termination Deletion: Within ninety (90) calendar days following the effective termination date of the Agreement, VentaVid shall permanently erase and purge all Customer Personal Data from active database environments and storage repositories, unless Union or Member State law requires continued retention of the Personal Data.

3. Disaster Recovery Backups: Personal Data residing on automated disaster recovery backup snapshots shall be securely overwritten and permanently destroyed in accordance with VentaVid's regular rotating backup lifecycle (not exceeding thirty (30) calendar days).

4. Written Certification: Upon written request submitted by the Customer within thirty (30) days following the completion of the deletion period, VentaVid shall provide written confirmation that all Customer Personal Data has been permanently purged in accordance with this Article.

Article 38. Audits and Inspections

1. Information Demonstrating Compliance: VentaVid shall make available to the Customer all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR and this DPA, primarily through third-party security certifications, SOC/ISO reports, and architecture summaries available in the Trust Center.

2. Audit Procedures: If the Customer reasonably demonstrates that the documentation in the Trust Center is insufficient to confirm compliance, or if an audit is formally mandated by a competent supervisory authority:

• (a) The Customer or an independent certified auditor bound by strict confidentiality (who is not a direct competitor of VentaVid) may conduct an audit or inspection of VentaVid's data processing operations;

• (b) The Customer shall give VentaVid at least thirty (30) calendar days' prior written notice of any requested inspection;

• (c) Any inspection shall take place during regular Dutch business hours without disrupting ongoing platform operations, and shall not grant access to systems or data of other VentaVid customers or VentaVid proprietary trade secrets;

• (d) All costs of the audit shall be borne exclusively by the Customer.

Article 39. Governing Law and Priority

1. Priority: In the event of any conflict or inconsistency between the provisions of this DPA and the provisions of Chapters 1 to 7 of the Terms of Service, the provisions of this DPA shall strictly prevail with respect to data protection and personal data processing obligations.

2. Governing Law: This DPA is governed by and construed in accordance with the laws of the Netherlands.

PRODUCT SCHEDULE A: VENTA VIDEO (D2)

Version: 2.0
Effective Date: November 9th, 2026
Document Reference: D2 / VIS-PSA-2026-V2

This Product Schedule A ("Schedule A" or "Venta Video Terms") forms an integral part of the General Terms of Service ("Terms of Service" or "D1") entered into between Venta Internet Services B.V. ("VentaVid") and the Customer. This Schedule A governs the specific provision and use of VentaVid's outbound video messaging, interactive video conferencing, and transaction confirmation modules (collectively, "Venta Video").

Article A.1. Scope and Service Description

1. Venta Video Modules: Venta Video comprises the following software modules and functionalities, as further detailed in the Documentation:

• Venta Video Core: Web and mobile-based tools enabling the recording, templated production, personalization, and outbound distribution of asynchronous video messages to designated recipients via unique, restricted URLs.

• Approval Code Module: An integrated authorization utility enabling Customer clients or asset owners to electronically review, approve or decline commercial estimates, proposed repair works, or service specifications via a secure verification code mechanism.

• Delivery and Presentation Utilities: Automated dispatch capabilities for SMS notifications, email invitations, and hosted, branded customer viewing landing pages ("Share Pages").

2. One Integrated Service: Venta Video is provided as a unified software-as-a-service product tier. Features available to the Customer depend on the specific commercial plan and modules activated in the applicable Order Confirmation or self-service dashboard.

Article A.2. Content, Dispatch and Delivery Disclaimers

1. Customer Production: The Customer and its Users are exclusively responsible for creating, recording, selecting, and uploading all audio, video, text, images, pricing breakdowns, and estimates transmitted via Venta Video.

2. Templates and Non-Interference: Venta provides software templates, graphic overlays, and transmission mechanisms. Venta does not monitor, review, edit, or censor Customer Content prior to or following dispatch.

3. Unique Recipient URLs: Video messages are made available via unique, unguessable, obfuscated URLs intended exclusively for the designated recipient. The Customer is responsible for ensuring that recipient contact details (mobile telephone numbers and email addresses) are accurately entered. VentaVid is not liable for misdirected messages resulting from Customer clerical errors.

4. Third-Party Telecommunication Networks: SMS notifications and email messages are routed through third-party telecommunications carriers, aggregators, and public internet networks. VentaVid does not warrant uninterrupted, error-free, route-specificity, or immediate delivery of SMS or email messages, and shall not be liable for non-delivery or delivery delays resulting from carrier filtering, spam detection, network congestion, or invalid recipient handsets.

Article A.3. Approval Code Module and Commercial Decisions

1. Operational Mechanism: Where the Customer utilizes the Approval Code Module:

• Proposed works, cost estimates, or repair line-items entered by the Customer are submitted to the vehicle owner or customer via a secure link;

• The recipient receives a randomized, multi-digit verification code (e.g., a six-digit code) via SMS or email;

• By entering the verification code into the web interface, the recipient digitally marks, selects, and authorizes the proposal (or specific sub-items thereof), or formally declines the proposal.

2. Technical Enabler Only: The Approval Code Module functions strictly as an electronic signature and verification conduit between the Customer and its client. VentaVid is not a party to the underlying commercial contract, repair agreement, or service transaction.

3. Disclaimer of Liability for Approvals: VentaVid is not responsible or liable for:

• Any unintended, mistaken, unauthorized, or disputed approvals or rejections executed through the interface;

• Discrepancies between the work authorized and the work physically executed;

• Unpaid invoices, consumer disputes, or warranty claims arising between the Customer and its end clients.

4. Indemnity: The Customer shall indemnify, defend, and hold harmless VentaVid against any third-party claims, customer complaints, or financial disputes resulting from the operation, outcome, or enforcement of authorizations executed via the Approval Code Module.

Article A.4. Non-Emergency and Safety-Critical Exclusion

1. No Life-Safety or Emergency Use: Venta Video is not certified, designed, or intended for use in high-risk, emergency rescue, medical triage, or life-safety critical operations.

2. No Substitute for Emergency Services: The Service must never be utilized as a substitute for official national emergency response channels (such as 112, 911, or official roadside rescue services).

Article A.5. Trials and Free Usage

1. Evaluation Accounts: If the Customer accesses Venta Video under a trial period or non-paid tier and fails to register a valid payment method or upgrade to a paid commercial subscription prior to the expiration of the trial term, VentaVid reserves the right to immediately deactivate the Account.

2. Automated Trial Data Purge: Following expiration or termination of an evaluation, trial, or non-paid period without conversion to an active paid subscription, all stored video messages, contact logs, recipient interactions, and Customer Content created during the trial shall be permanently and automatically purged from active systems without further notice. VentaVid shall have no obligation to maintain, export, or retrieve any data created under a trial account following expiration.

Article A.6. Media Retention and Storage

1. Standard Retention: Unless otherwise agreed in an Order Confirmation, video recordings and associated message pages created within Venta Video are retained on active cloud storage systems for the duration of the Customer's active, paid subscription, subject to standard fair use storage allowances.

2. Post-Termination Purge: Upon the effective termination of the Agreement, data retention is strictly governed by Article 20 of the Terms of Service and Article 37 of the DPA (no post-termination access; complete erasure within ninety (90) calendar days).

Article A.7. Pricing Basis and Plan Allowances

1. Commercial Model: Venta Video is billed based on subscription tiers, user seats, messaging volumes (including included monthly video messages and SMS allowances), as published on VentaVid's official pricing schedule or agreed in an Order Confirmation.

2. Transition from Legacy Pricing: Legacy pricing structures (including historic per-location licensing models and retired packages such as Venta50) are discontinued for all new subscriptions. Existing customers with active contracts referencing legacy models shall remain subject to their existing pricing terms until the expiration or renewal of their current term, or until transitioned by mutual agreement to the subscription tiers specified in an Order Confirmation.

3. Overage Charges: Dispatches of SMS notifications, or video messages exceeding the included allowances of the Customer's active tier are billed monthly in arrears at VentaVid's then-current standard variable rates.

PRODUCT SCHEDULE B: VENTA CAPTURE (D3)

Version: 2.0
Effective Date: November 9th, 2026
Document Reference: D3 / VIS-PSB-2026-V2

This Product Schedule B ("Schedule B" or "Venta Capture Terms") forms an integral part of the General Terms of Service ("Terms of Service" or "D1") entered into between Venta Internet Services B.V. ("VentaVid") and the Customer. This Schedule B governs the specific provision and use of VentaVid's inbound workflow, guided media capture, cryptographic sealing, and inspection reporting platform (collectively, "Venta Capture").

Article B.1. Scope and Technical Nature of the Service

1. Venta Capture Modules: Venta Capture comprises the following modular software components and functionalities, as further detailed in the Documentation:

• (a) Venta Capture Core (Guided Inbound Flows): Dynamic, link-based mobile web interfaces enabling End Users to record guided video sequences, capture photographic evidence, and submit structured form responses without requiring native application downloads or user account registration.

• (b) Cryptographic Sealing & Integrity Module: An integrated security mechanism that generates cryptographic SHA-256 hashes anchored in digital signature manifests utilizing hardware-backed key management systems (AWS KMS ES256), creating immutable, server-side timestamped verification records for submitted media.

• (c) Capture Provenance & Anomaly Signal Utilities: Technical inspection tools that record capture-time environment telemetry (including operating system, browser characteristics, sensor metrics, and network time signals) and report objective technical anomaly indicators.

• (d) Inspection Reporting & Verification Portal: Automated generation of structured inspection dossiers, signed metadata manifests, and access to public key verification utilities for independent technical verification.

• (e) Long-Term Archival Module: An extended retention service enabling multi-year storage and evidentiary preservation of sealed media dossiers beyond the standard one-year retention period, as set forth in Article B.5.

• (f) Forensic Assistance & Expert Services (Professional Services): On-demand technical assistance, forensic data extraction, bespoke technical affidavits, and expert witness testimony provided by VentaVid engineering personnel in connection with administrative, judicial, or arbitral proceedings, subject to separate engagement and time-and-materials compensation as set forth in Article B.8.

2. Modular Service Delivery: Features and modules available to the Customer depend on the specific commercial plan, subscription tier, and add-on modules activated in the applicable Order Confirmation or self-service dashboard. All modules remain subject to the technical boundaries and disclaimers set forth in Article B.2.

3. Tool for Recording and Integrity, Not a Decision-Making Engine:

• Crucial Definition: Venta Capture is strictly an objective technical recording, timestamping, and integrity-verification software tool.

• No Automated Adjudication: Venta Capture is not a decision-making system, does not perform automated claims adjudication, does not execute underwriting determinations, and does not replace human professional judgement.

• Customer Decision Monopoly: The Customer retains exclusive authority, discretion, and responsibility for reviewing, interpreting, verifying, and deciding upon any submission, inspection, insurance claim, financing request, or asset hand-over.

Article B.2. Specific Limitations of Recording, Sealing and Technical Warranties

To ensure unambiguous legal clarity between the parties, VentaVid expressly establishes, and the Customer explicitly acknowledges and agrees to, the following technical boundaries:

1. Cryptographic Seal: The cryptographic Seal and SHA-256 hash generated by the Service warrant strictly and exclusively that the digital file stored within the platform has remained bit-for-bit identical, unaltered, and uncorrupted since the moment of its receipt and sealing on VentaVid's servers. The Seal makes no warranty, representation, or certification whatsoever regarding the authenticity, genuineness, accuracy, or real-world truthfulness of the physical scene, vehicle, property, or event depicted in the recording.

2. Server-Side Timestamp: The timestamp embedded within the inspection manifest certifies exclusively the precise moment (UTC) at which the recording was received and processed by VentaVid's cloud infrastructure. It does not constitute legal proof of the exact physical time or date of the underlying physical incident, accident, or damage occurrence.

3. Provenance Telemetry: Provenance data captured by the platform (such as device model, operating system version, browser environment, and approximate geolocation) reflects technical signals transmitted by the capturing device. It does not verify or guarantee the legal identity, biometric identity, or legal authority of the natural person holding or operating the device, nor does it prove legal ownership of the object, asset, or property photographed, video-recorded, or captured.

4. Substantive Misleadingness of Untampered Media: The Customer acknowledges that a digital file that is technically intact, untampered with, and cryptographically verified may nonetheless be staged, deceptive, misleading, or fraudulent in substance. VentaVid does not inspect, verify, or warrant that a filmed scene, asset, VIN plate, odometer, or property damage actually corresponds to the specific contract, insurance policy, service area, or transaction under review.

5. Technical Signals vs. Fraud Detection:

• Without prejudice to VentaVid's obligation to provide the technical anomaly signals in accordance with the Documentation and Article 14, Venta Capture reports objective technical indicators (e.g., virtual camera software hooks, file uploads substituting for live streams, device or network recycling, and desktop browsers simulating mobile devices) as technical assistance only.

• VentaVid promises no fraud detection, no fraud prevention, and no fraud guarantee.

• The Customer acknowledges that technical signals do not constitute conclusive evidence of fraud and that VentaVid shall not be liable for any failure to detect, identify, or report any sophisticated fraud, deception, or bad-faith submission by an End User or third party.

6. No Biometric Identification: Venta Capture performs no biometric identification, no facial recognition, no voiceprint analysis, and no biometric verification of End Users within the meaning of Article 9 GDPR or the EU AI Act.

7. No Determination of Evidential Value: VentaVid makes no representation or warranty regarding the legal admissibility, evidential weight, or conclusive probative value of Venta Capture files or certificates before courts, arbitral tribunals, or administrative bodies in any jurisdiction. Evidential admissibility remains subject to the discretionary evaluation of the competent judicial or regulatory authority.

8. Immutability of Sealed Records: Once a submission is completed and cryptographically sealed, VentaVid does not modify, redact, alter, or backdate the underlying media, hash manifest, or audit trail. Any subsequent modification of the binary file or manifest will irrevocably invalidate the cryptographic SHA-256 hash and digital signature.

Article B.3. End Users, Workflow Governance and Notices

1. Workflow Administration: The Customer exclusively determines the configuration of its capture flows, including required capture steps, questionnaire prompts, mandatory angles, and invitation distribution.

2. Notice and Consent Obligations: The Customer is strictly responsible for providing appropriate, legally compliant notices to End Users prior to initiating capture, specifically explaining the purpose, scope, recording nature, and processing of their personal data.

3. Default Legal Notices as Technical Aid: Any default informational text, consent toggles, or camera authorization dialogues provided by VentaVid within the capture interface are supplied as customizable technical aids only. The Customer remains solely responsible for evaluating and customizing these notices to comply with applicable data protection and consumer laws.

4. End User Inquiries and Disputes: All communications, access requests, or disputes raised by End Users regarding capture flows, recordings, asset re-inspections, or claims repudiations must be handled directly by the Customer. The Customer shall indemnify, defend, and hold harmless VentaVid against any claims brought by End Users against VentaVid arising from their participation in Customer workflows.

Article B.4. Granular Moderation and Submission Blocking

1. Targeted Enforcement: In the event that an End User submits content that violates the Acceptable Use Policy (Article 5 of D1) or applicable criminal law (such as child sexual abuse material, severe violence, or active malware), VentaVid is entitled to immediately block, quarantine, or remove that specific individual End User, workflow URL, or media submission, without suspending the Customer's overarching Account.

2. Customer Notification: VentaVid shall notify the Customer without undue delay of any granular quarantine or blocking action taken pursuant to paragraph 1, stating the objective technical or legal reasons therefore, unless prohibited by law enforcement order.

Article B.5. Media Retention, Extended Archival and Purging

1. Standard Retention: Unless an alternative retention period is specified in an Order Confirmation or configured within Customer account settings, all media files (video recordings, high-resolution photographs), sensor metadata, and cryptographic manifests submitted via Venta Capture are stored and maintained for a standard retention period of one (1) calendar year commencing on the capture date.

2. Paid Extended Retention: The Customer may contract extended multi-year retention (e.g., three, five, or seven years) for specific workflows or overall storage by subscribing to VentaVid's Long-Term Archival Module at the agreed tariff.

3. Automated Purging: Upon the expiration of the applicable retention period (whether the standard one-year period or the contracted extended period), all media files and associated data shall be permanently erased and purged from active storage without further notice.

4. Customer Export Responsibility: The Customer is solely responsible for exporting and archiving all files, reports, and manifests required for long-term evidentiary preservation, operational needs, unresolved insurance claims, tax records, or ongoing litigation prior to the expiration of the applicable retention period. VentaVid accepts no liability for data purged upon expiration of the contracted retention timeframe.

Article B.6. Free and Evaluation Tiers

1. Free Account Inactivity Policy: If an Account utilizing a free or evaluation tier of Venta Capture records no active capture activity (no workflow dispatches and no completed submissions) for a continuous period of six (6) consecutive months, VentaVid may close the Account and permanently purge all stored data, provided that VentaVid has issued at least three (3) automated warning notices to the Customer's registered email address over a 30-day period.

2. Trial Conversion: Upon expiration of a time-limited evaluation trial without conversion to a paid subscription, the Account shall automatically revert to the standard Free plan (with its associated volume, feature, and retention limitations), unless terminated by the Customer.

Article B.7. Payment Arrears and Evidence Continuity (Read-Only Mode)

1. Protection of Critical Evidence: In recognition of the evidentiary reliance placed upon historical captures by institutional customers (such as insurance carriers, banks, and vehicle leasing enterprises), VentaVid shall apply the Read-Only Mode set forth in Article 12(4) of the Terms of Service upon thirty (30) days of payment arrears.

2. Read-Only Scope in Capture: During Read-Only Mode:

• The generation of new capture links, the execution of new capture workflows, and the ingestion of new End User submissions are blocked;

• All historical media files, sealed manifests, and audit trails recorded prior to suspension remain fully accessible for online viewing and manual export by the Customer.

3. Preservation until Formal Dissolution: Existing evidence shall remain preserved and exportable throughout Read-Only Mode until the Agreement is formally dissolved pursuant to Article 12(5) of D1.

Article B.8. Verification Utilities and Optional Forensic Services

1. Independent Cryptographic Verification: Where Customer subscribes to the Cryptographic Sealing & Integrity Module, each sealed capture includes a cryptographically signed metadata manifest. VentaVid publishes its public verification keys in its Trust Center, enabling Customer, technical experts, or third parties to mathematically and independently verify the SHA-256 hash and digital signature without manual intervention from VentaVid.

2. Forensic Assistance and Testimony: Any request by Customer for bespoke technical affidavits, specialized forensic data extraction, or technical witness testimony by VentaVid personnel relating to sealed captures shall be governed strictly by Article 24, paragraph 4 of the Terms of Service (Witness and Forensic Assistance).