Terms

Mindzeed ApS · CVR No. 38 67 98 64 · Vandtårnsvej 77, 2860 Søborg, Denmark

Version 2.0 · Effective from 1 November 2026 · Replaces the version effective from 1 January 2020

1. Scope

1.1 These terms and conditions (the "Terms") govern the use of the online service provided by Mindzeed ApS ("Mindzeed"). The party subscribing to the service is referred to as the "Customer".

1.2 A partner who resells the service to its own end customers under a Partner Agreement with Mindzeed is deemed a Customer for the purposes of these Terms. Where these Terms and a signed Partner Agreement regulate the same matter differently, the Partner Agreement shall prevail.

1.3 The Terms are accepted when the service is ordered digitally or by other means, and upon renewal of a subscription. The current version is published at mindzeed.com.

1.4 The data protection relationship depends on how the service is provided:

1.5 Order of precedence. In the event of a conflict, the following order of precedence shall apply to matters concerning the processing of personal data: (1) the General Data Protection Regulation (GDPR) and other mandatory data protection legislation; (2) the applicable Data Processing Agreement or Sub-Processing Agreement, including its annexes; (3) the Partner Agreement, where one exists; and (4) these Terms. In all other matters, a signed Partner Agreement or individually negotiated agreement shall prevail over these Terms.

2. Subscription and Right of Use

2.1 Subject to the Customer's compliance with the Terms, Mindzeed grants the Customer a limited, non-exclusive, non-transferable and time-limited right to access and use the service for the agreed number of user licences.

2.2 A direct Customer may use the service for internal purposes only. A partner may make the service available to its end customers in accordance with its Partner Agreement.

2.3 Users are employees of the Customer or, in the case of partners, of the end customer. A licence may not be shared between multiple users.

2.4 All rights not expressly granted remain with Mindzeed.

3. Availability, Upgrades and Maintenance

3.1 Mindzeed provides the service on a best-efforts basis with the aim of ensuring stable operation. Planned maintenance windows for upgrades and maintenance shall be notified to the Customer's system administrator at least 48 hours in advance.

3.2 The Customer is responsible for providing the hardware, software and internet access required by its users.

3.3 Mindzeed continuously develops the service and corrects errors. By subscribing, the Customer accepts future upgrades and bug fixes.

3.4 Mindzeed may modify the technical architecture and individual security measures, provided that the overall level of security is not reduced. Changes that materially affect the processing of personal data or the level of security shall be notified in accordance with the applicable data protection agreement.

4. Support

4.1 Mindzeed provides support to the Customer's system administrator, who also acts as the point of contact for the Customer. Support is not provided directly to end users unless otherwise separately agreed.

4.2 For partners, Mindzeed provides second-line support. The partner is responsible for first-line support to its own end customers.

4.3 Support requests must be submitted in writing to support@mindzeed.com. Mindzeed aims to respond to enquiries within one business day and, in the case of fault reports, to commence troubleshooting within 24 hours on business days.

4.4 Mindzeed may use subcontractors to provide support and consulting services. Where such a subcontractor processes personal data, it shall be engaged as a sub-processor in accordance with clause 12.

5. Prices and Payment

5.1 The agreed subscription period is invoiced in accordance with the individual agreement entered into. Payment is due eight days after the invoice date.

5.2 Mindzeed may change its prices and terms. Changes shall be notified in writing at least three months in advance and shall take effect no earlier than the subsequent subscription period. Changes are deemed accepted unless the Customer terminates the subscription in accordance with the applicable notice period, with effect from the end of the current subscription period.

5.3 Mindzeed may also adjust prices in line with general price developments and exchange rates. Annual licence fees may be index-adjusted without further notice in accordance with the net price index published by Statistics Denmark, subject to a minimum adjustment of 2.5 per cent.

5.4 If the Customer creates users in excess of the number covered by the subscription, the additional licences shall be invoiced from the beginning of the month in which they are created. Reducing the number of licences requires a written agreement and shall take effect from a new subscription period.

5.5 Prepaid licence fees for a subscription period are non-refundable.

5.6 In the event of late payment, interest shall accrue in accordance with the Danish Interest Act.

5.7 If an invoice remains unpaid after three payment reminders, Mindzeed may suspend the Customer's access to the service following at least 14 days' written notice. Suspension does not release the Customer from its payment obligations.

5.8 Suspension under clause 5.7 does not affect the Customer's ability to obtain a copy of the personal data processed in the service, and Mindzeed shall not withhold personal data as a means of securing payment. Personal data shall be deleted only in accordance with clause 7.

5.9 Danish VAT shall be charged to Customers with an address in Denmark and Customers in other EU countries without a valid VAT number. Customers outside the EU and EU Customers with a valid VAT number shall be invoiced without Danish VAT.

6. Trial Period

6.1 Mindzeed may offer a free trial subscription. If the Customer does not subscribe before the end of the trial period, access shall cease when the trial period expires, and the trial account and its associated data shall be deleted.

6.2 During a trial period, Mindzeed assumes no obligations regarding the availability or use of the service.

7. Term, Termination and Data Deletion

7.1 The subscription period is specified in the agreement or order confirmation.

7.2 Notice of termination must be submitted in writing to support@mindzeed.com and is valid upon written confirmation from Mindzeed. If the subscription is not terminated within the applicable notice period, it shall renew automatically.

7.3 Mindzeed may terminate the subscription with immediate effect in the event of a material breach by the Customer. General termination is governed by the order confirmation.

7.4 Upon expiry or termination, the Customer's access to the service shall cease. Prepaid subscription fees are non-refundable.

7.5 Before deletion, the Customer may export its data using the service's reporting and export features. Mindzeed shall provide reasonable assistance with exporting data upon request. Unless otherwise agreed, the export window shall be 30 days from the date on which access ceases.

7.6 After the export window has expired, Mindzeed shall delete the personal data processed on behalf of the Customer and shall confirm the deletion in writing upon request. Personal data in backups shall be removed as part of the normal backup rotation and shall not be restored unless necessary to restore the production environment.

7.7 Where the Customer is the data controller, the Customer may instead instruct Mindzeed to return the personal data. Deletion and return of data shall otherwise be governed by the applicable Data Processing Agreement or Sub-Processing Agreement.

8. Customer Warranties and Undertakings

8.1 The Customer warrants that its use of the service is lawful and that its users comply with the Terms, and shall indemnify Mindzeed against third-party claims arising from the Customer's use of the service.

8.2 The Customer warrants that it is entitled to use the content it uploads to the service and shall indemnify Mindzeed against claims and losses in this connection.

8.3 Mindzeed may remove content that, in Mindzeed's reasonable opinion, breaches the Terms, infringes third-party rights or violates applicable law. Wherever possible, Mindzeed shall notify the Customer in advance.

9. Third-Party Content and Links

9.1 The service may contain links to third-party websites or services that Mindzeed does not own or control. Mindzeed is not responsible for the content, privacy practices or availability of such third parties.

9.2 This provision does not limit Mindzeed's liability for its own sub-processors under clauses 12 and 17.3.

10. Data Protection

10.1 The Customer, or in the case of partners under Model A the end customer, is the data controller and retains the rights to its data, including personal data. Mindzeed processes personal data solely for the purpose of providing the service and on documented instructions.

10.2 Processing is governed by a separate written data protection agreement, cf. clause 1.4. The agreement is signed by the parties and is not accepted merely by reference to a website.

10.3 Where the Customer is a partner operating under Model B, the partner is the data processor for its end customers, and Mindzeed is a sub-processor pursuant to a signed Sub-Processing Agreement.

10.4 The Customer is responsible for ensuring that personal data processed in the service has been collected and is processed lawfully, and that it does not infringe third-party rights.

10.5 The Customer shall keep user information confidential and is responsible for access rights granted within its own organisation.

10.6 Mindzeed hosts and processes personal data within the EU. Transfers to third countries shall take place only on a valid transfer basis under Chapter V of the GDPR, as documented in the applicable data protection agreement and in Mindzeed's Transfer Impact Assessment.

11. Security

11.1 Mindzeed implements and maintains appropriate technical and organisational measures pursuant to Article 32 of the GDPR, including encryption in transit and at rest, role-based access controls with multi-factor authentication for administrative access, logging and monitoring, automated backups with recovery testing, vulnerability and patch management, and a documented security incident management procedure.

11.2 The applicable measures are documented in Mindzeed's self-assessment and security and compliance package, as well as in the annexes to the applicable data protection agreement. The same measures apply to all customers, whether they subscribe directly or are served through a partner.

11.3 Mindzeed's primary hosting provider is subject to an annual ISAE 3402 Type II assurance report or equivalent. The report shall be made available to the Customer once a year and otherwise upon request.

11.4 Mindzeed shall notify the Customer of a personal data breach without undue delay and no later than 24 hours after becoming aware of the breach, in accordance with the applicable data protection agreement.

12. Sub-Processors

12.1 Mindzeed uses sub-processors to provide the service. An up-to-date list specifying each supplier's location, function and transfer mechanism forms part of the applicable data protection agreement and shall be made available to the Customer upon request.

12.2 Mindzeed shall notify the Customer in writing at least 60 days before adding or replacing a sub-processor. The Customer may object in writing before the notice period expires. If no objection is received, the change shall be deemed accepted.

12.3 If the Customer objects, the parties shall seek a mutually acceptable solution. If no such solution is reached, either party may terminate the subscription on reasonable notice.

12.4 Mindzeed shall impose equivalent data protection obligations on its sub-processors by contract and remains fully liable for their fulfilment of those obligations, pursuant to Article 28(4) of the GDPR.

13. AI Functionality

13.1 AI functionality is optional and is not enabled by default. Mindzeed does not process personal data using AI functionality without the Customer's prior documented instructions, including activation of the relevant feature.

13.2 Personal data processed in the service is not used to train general-purpose AI models, either by Mindzeed or by Mindzeed's AI suppliers.

13.3 Any AI supplier used by Mindzeed shall be listed as a sub-processor under clause 12, together with its location and transfer mechanism. AI functionality may be enabled and disabled for each customer at any time.

13.4 An up-to-date description of the active AI functionality shall be provided upon activation and is set out in Mindzeed's AI and Data Processing Description.

14. Intellectual Property Rights

14.1 Mindzeed retains all intellectual property rights in the service and its content, including copyrights, patent rights and trademark rights.

14.2 The Customer may not assign, license, sell, rent, lend or otherwise transfer the right of use to a third party without Mindzeed's written consent. A partner's right to make the service available to its end customers is governed by the Partner Agreement.

14.3 The Customer may not copy or modify the service or its content, including by removing trademarks implemented in the service.

14.4 The Customer retains all rights to content that it uploads to the service.

15. Confidentiality

15.1 Each party shall treat confidential information received from the other party, including the terms of their agreement, as confidential and shall not disclose such information to third parties without written consent.

15.2 The obligation applies during the term of the agreement and for three years after its termination, and does not prevent disclosures required by law or by a competent authority.

16. Disclaimer of Warranties Concerning the Service

16.1 Except as expressly stated in the Terms or in a signed agreement between the parties, the service is provided without warranties, whether express, implied or statutory, including warranties of merchantability or fitness for a particular purpose.

16.2 This provision does not limit Mindzeed's obligations under clauses 10 and 11 or the applicable data protection agreement.

17. Limitation of Liability

17.1 Liability is governed by the general rules of Danish law, subject to the exceptions and limitations set out below.

17.2 The table below sets out how the different types of liability are treated:

17.3 Mindzeed is liable for sub-processors' processing of personal data pursuant to Article 28(4) of the GDPR. These Terms do not exclude such liability, which is subject, as between the parties, to the cap in clause 17.5.

17.4 The parties have agreed on the cap in clause 17.5 in light of the nature of the processing. The service processes only ordinary personal data relating to employees, namely names, email addresses, organisational affiliation, job roles, training status and results, phishing simulation results, and technical log data. No special categories of personal data under Article 9 of the GDPR and no data concerning criminal offences are processed. The processing does not include profiling, behavioural monitoring or automated decision-making. The parties consider the cap proportionate to the risk posed by the processing to data subjects and to the fees payable for the service.

17.5 Subject to clauses 17.2 and 17.6, each party's aggregate liability for any claim arising out of or in connection with the subscription, including claims concerning the processing of personal data and recourse claims under Article 82(5) of the GDPR, is limited to the total fees actually paid by the Customer for the service during the 12 months preceding the act or omission giving rise to the claim and shall in no circumstances exceed EUR 5,000 in aggregate.

17.6 The cap in clause 17.5 applies only as between the parties. It does not limit, and may not be invoked against, a data subject exercising rights under Articles 79 and 82 of the GDPR or a supervisory authority exercising its powers under Articles 58 and 83 of the GDPR. Each party shall bear any administrative fine imposed on that party.

17.7 The Terms do not limit liability that cannot be limited under applicable law, including liability for personal injury and death and liability for intentional or grossly negligent acts or omissions.

17.8 The Customer's liability is subject to the same limitations, except for the Customer's payment obligations and the indemnities under clause 8.

18. Force Majeure

18.1 Neither party shall be liable for failure to perform its obligations, other than the payment of amounts due, where such failure results from circumstances beyond the party's reasonable control that the party could not reasonably have foreseen when accepting the Terms.

18.2 Such circumstances may include telecommunications network outages, government intervention, industrial disputes, infrastructure failures, natural disasters, epidemics and pandemics, acts of terrorism, fire, flooding, storms, sabotage, damage caused by computer viruses or hacking, war, civil war, insurrection and nuclear incidents.

18.3 A party affected by force majeure shall notify the other party without undue delay. If the situation lasts for more than 90 days, either party may terminate the subscription by written notice.

19. Assignment

19.1 Mindzeed may assign its rights and obligations under the subscription to a third party.

19.2 The Customer may not assign its rights and obligations without Mindzeed's written consent, which may not be unreasonably withheld.

20. Amendments to the Terms

20.1 Mindzeed may amend the Terms. Changes shall be notified in writing at least three months in advance and shall take effect no earlier than the subsequent subscription period.

20.2 Changes are deemed accepted unless the Customer terminates the subscription in accordance with the applicable notice period before the changes take effect.

20.3 Changes shall not have retroactive effect and shall not affect liability for acts or omissions occurring before the changes took effect.

20.4 Where a Partner Agreement refers to a specific version of the Terms, an amendment shall take effect in that contractual relationship only if agreed in writing between the parties.

21. Governing Law and Jurisdiction

21.1 The Terms and the subscription are governed by Danish law, excluding its rules of private international law and the United Nations Convention on Contracts for the International Sale of Goods (CISG).

21.2 Disputes shall be brought before the Danish courts, with the Copenhagen City Court agreed as the court of first instance.

21.3 This provision does not affect the jurisdiction of supervisory authorities or the rights of data subjects under Article 79 of the GDPR.