Terms of Service and DPA – Klisza
TERMS OF SERVICE
Klisza
https://klisza.click/
I. SERVICE PROVIDER AND OWNER OF THE SOFTWARE
Konrad Hopek Development
Świtezianki 2/32
31-563 Kraków, Poland
Tax ID (NIP): 9452234681
II. GENERAL PROVISIONS
1. The Service Provider owns the software, i.e. an Application for Web, Android, and iOS designed for collecting photos from event guests, integrating customers, events (event photo shops/cafés), and event guests. The purpose of the App is to streamline ordering, delivery, and pickup, and to optimize cost and time for all participants in the process.
2. These Terms have been drawn up under the laws applicable in the territory of the Republic of Poland.
3. These Terms govern the rights and obligations between the Service Provider and Customers (commercial Users) and other users (non-commercial Users) of the Klisza App.
4. Customers are entrepreneurs conducting business activity in accordance with generally applicable regulations.
5. Pursuant to Art. 43¹ of the Act of 23 April 1964 — the Civil Code (hereinafter CC), an Entrepreneur is a natural person, legal person, or organizational unit referred to in Art. 33¹ § 1, conducting business or professional activity in its own name. Pursuant to Art. 22¹ CC, a consumer is deemed to be a natural person entering into a legal transaction with an entrepreneur that is not directly related to their business or professional activity.
6. By entering into an agreement with the Service Provider, the Customer represents that they are an entrepreneur entering into the agreement as part of their own business activity and are not a consumer within the meaning of Art. 22¹ CC.
7. These Terms govern relations between the Service Provider and Customers regardless of whether they are paid or free of charge. By using any Klisza services, the Customer agrees and confirms that only these Terms apply to the contractual relationship between the Service Provider and the Customer.
8. Individual arrangements require written form and must be signed by both parties.
9. The Service Provider reserves the right to unilaterally amend these Terms at any time of its choosing. The Customer will be notified of such changes by email at least one month before they take effect. The Customer has the right to object to such a change in writing within two weeks of receiving the email. The change will be deemed accepted and binding if the Customer agrees to it or does not object within two weeks. In the event of an objection, the Service Provider has the right to terminate the agreement concluded under the previous Terms with 14 days' notice.
III. TECHNICAL REQUIREMENTS
1. Proper use of the App requires:
a) a computer or other device with internet access.
b) an active email account.
2. The following web browsers are currently suitable for use with the web application: Chrome, Firefox, Safari, Microsoft Edge, with Cookies, Local Storage, and JavaScript enabled.
3. Proper use of the App requires a device running iOS or Android with internet access, meeting the current requirements available on the App's page in Google Play or the App Store.
4. The mobile app can currently be used on the following devices:
iOS devices: iPad, iPhone — requires iOS 16 or newer
Android devices: smartphone and tablet — requires Android 10, minimum 4 GB RAM
5. The cost of data transmission required to download, install, launch, and use the App is borne by its Users on the basis of agreements concluded with telecommunications operators or another internet provider. The Service Provider is not responsible for the amount of fees charged for the data transmission necessary to use the App.
6. The Service Provider is not liable for any problems arising from failure to meet the requirements specified above, in particular any resulting malfunction of the App.
IV. TERMS OF USE OF THE APP
1. The Service Provider makes the system available to the Customer in the form of software as a service ("SaaS") for use over the internet, client software, and the ability to store data.
2. Use of the App may be free or paid, depending on the User category (customer, spot/event photo shop, guest).
3. Creating an Account is free. Creating an Account requires providing: first and last name, email address, or phone number. Additionally, a declaration of having read and accepted the Terms and Privacy Policy is required.
4. The Customer may make a purchase in the App directly via https://klisza.click/ or in the mobile app through the external payment operator Stripe.
5. The fee is paid for the order or service selected by the Customer.
6. The Service Provider reserves the right to further develop and modify the App and all Software specifications at any time (e.g. by using newer or different technologies, systems). The Customer acknowledges that situations may arise where, in connection with updates and upgrades, temporary maintenance of the Software will take place.
7. The Customer undertakes to use the App in accordance with these Terms as well as any individual arrangements.
8. The Customer is obliged to use the App in accordance with its intended purpose and may not misuse it, in particular may not use it to store or distribute content that is unlawful. Furthermore, the Customer undertakes not to use any technical equipment, software systems, or other data that could harm the operation of the App.
9. The Customer is obliged, at their own cost and risk, to maintain their own IT infrastructure necessary to use the App. Current requirements are specified in Chapter III TECHNICAL REQUIREMENTS.
V. APP FUNCTIONALITY
1. The Service Provider provides software in the form of an App for Web, Android, and iOS designed for ordering event photo, coffee, and other products from local events, with delivery or personal pickup.
2. The Customer (commercial user — spot) may add their employees by providing their first and last names and email addresses.
3. The App allows customers to browse spot menus, place orders, track order status and guest location live, pay online or on pickup, and use the loyalty program (points, quests, rewards).
4. Events (event photo shops/cafés) can manage their menu, orders, staff, and publish news updates.
5. Guests can accept delivery jobs, navigate to the delivery address, and track their earnings.
6. Customers can rate events and event guests after a completed order and communicate via chat within a given order.
VI. PAYMENTS
1. Prices are expressed as gross prices.
2. The Service Provider offers the following payment methods:
a) Stripe
b) Google Pay/Apple Pay
c) payment on pickup (at selected events)
3. The Customer authorizes the Service Provider to issue an electronic invoice without the recipient's signature.
VII. COMPLAINT PROCEDURE
1. Any complaints regarding the App's operation may be submitted by email to: kontakt@klisza.click
2. The complaint should include as much information and circumstances relating to the subject of the complaint as possible, in particular the type and date of the irregularity, and contact details.
3. The Service Provider will handle the complaint promptly, no later than within 14 days.
4. The Service Provider's response to the complaint is sent to the User's email address provided in the complaint.
VIII. WARRANTIES AND LIABILITY
1. The Service Provider delivers the App to the Customer with due diligence and will make every economically reasonable effort to ensure uninterrupted use of the Software and will correct software errors that limit the use of the Software.
2. However, the Service Provider does not provide any warranties or accept liability for the App's continuous availability or for the Software being free of errors. The Customer expressly acknowledges that, given the current state of technology, it is not possible to completely exclude all errors from the Software.
3. Warranty liability is excluded to the fullest extent permitted by applicable law.
4. The Service Provider is not liable for any direct or indirect damages incurred in connection with the use of the Software by the Customer or third parties, in particular those caused by malfunction or damage to the Customer's end devices.
5. The Service Provider is liable only in the event of intentional conduct or gross negligence.
6. The Customer is liable to the Service Provider for any damages resulting from a breach of the Customer's or users' obligations, in particular in the case of unlawful use of the Software.
7. The Service Provider is not liable for damage and malfunctions resulting from improper operation, altered operating system components, interfaces and parameters, changes to necessary system settings, or simple app errors caused by the Customer.
8. To the extent that obligations related to the use of the Software have been breached due to force majeure, including war, terrorism, natural disasters, fire, strikes, lockouts, embargoes, government intervention, epidemics or pandemics, power failures, transport failures, telecommunications network or data line failures, or legislative changes occurring after the conclusion of the agreement, this does not constitute a breach of the agreement and does not entitle the Customer to any claims against the Service Provider.
IX. ASSUMPTION OF LIABILITY BY THE CUSTOMER
1. The Customer should indemnify, defend, and hold the Service Provider harmless from and pay for any awarded claims and/or any third-party penalties based on: (i) the Customer's use of the Services in a manner contrary to these Terms; (ii) the Customer's breach of applicable data protection law; or (iii) Customer Data and any other information or materials submitted or used in connection with the Services.
2. At the Customer's request, the Service Provider will reasonably cooperate in defending against such a claim, provided the Customer reimburses the Service Provider for reasonable costs incurred in connection with such cooperation.
X. TERM AND CONDITIONS FOR TERMINATING AGREEMENTS FOR THE PROVISION OF ELECTRONIC SERVICES
1. This agreement is concluded for an indefinite period, unless the order form provides otherwise.
2. The Customer may stop using the App at any time, with immediate effect and without giving reasons, via their Account administration panel or by sending an appropriate statement by email to: kontakt@klisza.click.
3. The Service Provider may block a User's Account if: a) the User violates the Terms, b) the User fails to pay for an order or has outstanding financial obligations to the Service Provider;
4. Furthermore, either Party may terminate the Agreement for good cause, subject to compliance with applicable statutory requirements.
5. After termination of the Agreement by the Service Provider, the Customer will immediately stop using access to the Service or using it in any other way.
6. Return of Customer Data. During the term of the Agreement and for 30 days after its termination, the Customer may extract Customer Data. Subject to the Service Provider's right to use Customer Data in anonymized form, the Service Provider will delete Customer Data or at least block such data after the extraction period has elapsed.
7. All provisions of this Agreement that, according to their terms, are intended to survive, remain in effect after the termination or expiration of this Agreement.
XI. LICENSE TO USE THE APP
1. All rights to the App belong to the Service Provider.
2. The Service Provider is entitled to grant licenses to the Software to the extent specified in this document. The Customer is granted a non-exclusive, non-transferable, non-sublicensable right to use the Software to the agreed extent and within the agreed number of licenses for the duration of the agreement.
3. The Customer may reproduce the Software only to the extent necessary for its intended use (e.g. for installation in devices' main memory). The Customer may not reproduce, sell, rent, or lend the Software or any part of it in any other way, nor transfer it to third parties or grant sublicenses. The Customer has the right to temporarily grant a subcontractor limited-functionality access in accordance with the Software's instructions.
4. Unless otherwise agreed, no further rights to the Software are granted to the Customer. In particular, the Customer does not acquire any rights to the Software, including copyrights, trademarks, patents, or other intellectual property rights.
5. The Customer may, at any time during the term of the agreement, purchase additional licenses, which will be invoiced in accordance with the applicable Price List. In case of activation during a calendar month, the days until the start of the next month will be charged proportionally.
6. The Customer is not entitled to reverse engineer, decompile, or disassemble the Software, except to the extent expressly permitted by applicable law.
XII. CONFIDENTIALITY
1. Confidential Information means (a) the Software's source code; (b) Customer Data; and (c) business or technical information of each Party, including but not limited to any information concerning software plans, projects, costs, prices and names, finances, marketing plans, business opportunities, personnel, research, development, or know-how. A Party will not disclose or use any Confidential Information of the other Party for any purpose beyond the scope of this Agreement, unless it obtains the prior written consent of the other Party or unless required by law, or as permitted under section 2 below. Each Party agrees to protect the other Party's Confidential Information in the same manner it protects its own Confidential Information of a similar kind (and in any case with at least a reasonable degree of care and reasonable technological standards applicable in its industry).
2. If a Party to the Agreement is legally required to disclose the other Party's Confidential Information, it will promptly inform the other Party in advance, to the extent permitted by law, and will provide reasonable assistance, at the other Party's expense, if the other Party wishes to prevent or challenge the disclosure.
3. Confidential Information does not include information that: (i) is or becomes public without breaching any obligations to the other Party; (ii) was known to a Party before its disclosure by the other Party without breaching any obligations to the other Party; (iii) was independently developed by a Party without breaching any obligations to the other Party; or (iv) was received from a third party without breaching any obligations to the other Party (provided that Customer Data containing personal data will be processed in accordance with the standards set out in this Agreement (including its Annexes), even if such information may be generally known, publicly available, or otherwise available to the Service Provider from other sources).
XIII. USER CONTENT/DSA
1. Customers and other users are prohibited from providing unlawful content. The Service Provider's point of contact enabling direct communication for the purposes of Regulation 2022/2065 on a Single Market For Digital Services and amending Directive 2000/31/EC (Digital Services Act) is: kontakt@klisza.click. Communication may take place in Polish.
XIV. PROTECTION OF PERSONAL DATA
1. The Customer, as a commercial user of the software, is the data controller, and the Service Provider is merely a processor. For this purpose, a separate data processing agreement will be concluded, constituting Annex 1. In the absence of an individually agreed contract, the standard data processing agreement by the Service Provider set out in Annex 1 will apply.
XV. SEVERABILITY CLAUSE
1. If any provision of these Terms is found to be unlawful, invalid, or unenforceable, such provision will nevertheless be enforceable to the fullest extent permitted by applicable law, and the unenforceable part will be deemed severable from these Terms, and such determination will not affect the validity and enforceability of the remaining provisions.
XVI. FINAL PROVISIONS
1. Polish law governs these agreements. The United Nations Convention on Contracts for the International Sale of Goods, done at Vienna on 11 April 1980, does not apply.
2. Any disputes arising from the performance of the Agreement will be resolved amicably by the Parties. If no agreement is reached, disputes will be resolved by the court having jurisdiction over the Service Provider's registered office.
3. In matters not regulated by the Agreement, applicable Polish law applies, in particular the provisions of the Civil Code.
Annex 1
AGREEMENT
for the entrustment of personal data processing (DPA)
between
the Data Controller/Customer (a company or private individual using the App)
and
the Processor
Konrad Hopek Development
Świtezianki 2/32
31-563 Kraków, Poland
Tax ID (NIP): 9452234681
§ 1 Definitions
1. Personal Data or Data — personal data within the meaning of Art. 4(1) GDPR, i.e. any information about an identified or identifiable natural person, entrusted to the Service Provider by the Customer for the purpose of performing the Service Agreement;
2. Processor — the Service Provider. Konrad Hopek Development, Świtezianki 2/32, 31-563 Kraków, Poland, Tax ID (NIP): 9452234681.
3. Customer — the entity that has entered into an agreement for the provision of electronic services with the Service Provider under the Klisza App.
4. Data processing — any operations performed on personal data, such as collecting, recording, storing, organizing, altering, disclosing, and erasing, especially those performed in IT systems.
5. GDPR — Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
6. Service Agreement or Agreement — an agreement for the provision of electronic services concluded between the Customer and the Service Provider on the terms set out in the Terms of Service.
§ 2 Subject of the Agreement
1. The Customer, acting pursuant to Art. 28(3) GDPR, entrusts the Service Provider with Personal Data for processing, on the terms and for the purposes set out in these Terms.
2. The Customer represents that they are authorized to process Personal Data to the extent and for the purposes for which they entrust it to the Service Provider under the Terms.
3. The Service Provider undertakes to process the entrusted Personal Data in accordance with this agreement, the GDPR, and generally applicable law protecting the rights of data subjects.
§ 3 Scope and Purpose of Processing
1. The scope of Personal Data entrusted for processing covers Personal Data entered by the Customer into the Klisza App, the processing of which by the Service Provider takes place for the purposes and needs of performing the Services commissioned by the Customer, as referred to in the Terms.
2. The entrustment of Personal Data processing may in particular cover Personal Data of customers and their representatives, as well as employees and collaborators, members of the Customer's team who are Users of the App, to the extent disclosed to the Service Provider via the Klisza App.
3. The scope of Personal Data entrusted for processing results, in each case, from the scope of Services provided by the Service Provider to the Customer.
4. The purpose of entrusting Personal Data processing by the Customer is to enable the Parties to perform the subject of the Service Agreement.
5. The Service Provider is authorized to process Personal Data within the scope of all processing activities referred to in Art. 4(2) GDPR that are necessary for the proper performance of the Service Agreement.
6. The Service Provider's processing of Personal Data takes place exclusively through IT systems and does not involve the use of paper files.
§ 4 Obligations and Rights
1. The Service Provider processes Personal Data only on the Customer's documented instructions, with this Agreement being deemed such a documented instruction.
2. The Service Provider may also process Personal Data to the extent required by European Union or Polish law.
3. The Service Provider will promptly inform the Customer if, in its opinion, an instruction given to it constitutes a breach of the GDPR or other data protection regulations.
4. The Customer is required to have a legal basis for the processing operations of Personal Data that it entrusts to the Service Provider for processing under this agreement.
5. The Service Provider will process Personal Data for the period necessary to perform the commissioned Services and to fulfil all obligations imposed by the Customer under the Agreement.
6. After the termination of the Service Agreement, the Service Provider will, depending on the Customer's decision and the Service Provider's technical capabilities, delete or return to the Customer the Personal Data and any existing copies thereof, unless European Union or Polish law requires the retention of the Data.
7. The Service Provider is obliged to exercise due diligence when processing the entrusted Personal Data.
8. The Service Provider is obliged to implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk.
9. The Service Provider is obliged to grant authorization to process Personal Data to all persons who will process the entrusted Personal Data for the purpose of performing the Agreement.
10. The Service Provider is obliged to ensure that the confidentiality of the entrusted Personal Data, as referred to in Art. 28(3)(b) GDPR, is maintained by persons authorized to process Personal Data.
11. The Service Provider, taking into account the nature of the processing, assists the Customer as far as possible, through appropriate technical and organizational measures, in fulfilling its obligation to respond to requests from data subjects exercising their rights under Chapter III GDPR, as well as the obligations set out in Art. 32–36 GDPR.
12. Upon discovering a Personal Data breach, the Service Provider is obliged to report it to the Customer without undue delay.
13. The Service Provider provides the Customer with all information necessary to demonstrate compliance with the obligations set out in Art. 28 GDPR.
14. The Service Provider undertakes to enable the Customer or an auditor authorized by the Customer to conduct audits, including inspections.
§ 5 Incident Reporting
1. Upon discovering a personal data breach, the Service Provider undertakes to report it to the Customer without undue delay.
2. Information provided to the Customer should include at least:
a) a description of the nature of the breach and, where possible, the categories and approximate number of persons affected and the amount/type of data concerned
b) a description of the likely consequences of the breach,
c) a description of the measures taken or proposed by the Service Provider to address the breach, including measures to mitigate its adverse effects.
3. The Service Provider enables the Customer or a person authorized by the Customer to conduct audits and contributes to them. Audits may be conducted no more than once per calendar year and last no longer than one business day each.
4. Each Party is obliged to bear its own costs associated with conducting an audit.
§ 6 Sub-processing Rules
1. The Customer hereby consents to the further entrustment of Personal Data processing to the Service Provider's subcontractors.
2. Where Personal Data is sub-entrusted to a subcontractor, the subcontractor is subject to the same data protection obligations as set out in the Agreement. If a subcontractor to whom the Service Provider has sub-entrusted the processing of Personal Data fails to fulfil its data protection obligations, the Service Provider bears full liability to the Customer for the fulfilment of the subcontractor's obligations.
3. The Service Provider may transfer Personal Data to a third country outside the European Economic Area, provided the requirements set out in Chapter V GDPR (Art. 44–50) are met.
§ 7 Declared Technical and Organizational Measures
1. The Service Provider guarantees that every person performing the Agreement is obliged to ensure, indefinitely, the confidentiality of personal data processed in connection with the performance of the Agreement.
2. The Service Provider declares the application of technical and organizational measures set out in Art. 32 GDPR, in particular:
a) pseudonymization and encryption of personal data;
b) the ability to continuously ensure the confidentiality, integrity, availability, and resilience of processing systems and services;
c) the ability to quickly restore the availability of and access to personal data in the event of a physical or technical incident;
d) regular testing, measuring, and evaluating the effectiveness of technical and organizational measures for ensuring the security of processing.
§ 8 Final Provisions
1. The Service Provider is liable for non-performance or improper performance of the Agreement's provisions on the terms set out in the Terms of Service. The Service Provider's liability for carrying out the Customer's instructions and post-audit recommendations that are inconsistent with the GDPR or other generally applicable law is excluded.
2. The provisions of the Agreement constitute the entirety of the obligations and conditions for entrusting Personal Data processing in connection with the performance of the Service Agreement.
3. The Agreement replaces all other arrangements made between the Service Provider and the Customer regarding the processing of personal data, regardless of whether they were governed by an agreement or another legal instrument.
4. Any amendments to the Agreement require written form, otherwise they are void.
PHOTOGRAPHS OF THIRD PARTIES AND LIKENESS
1. The application is used to take and share photographs which capture the likeness of third parties — the guests of an event. The Service Provider is not the organiser of the event and does not decide who is photographed.
2. The controller of the personal data contained in photographs added by guests is the event organiser (the Client), who determines the purpose and scope of processing. The Service Provider processes that data as a processor, on the organiser's instruction, on the terms set out in the DPA forming part of these Terms.
3. The event organiser undertakes to inform guests that photographs are being collected and how they will be shared, and to secure a lawful basis for disseminating participants' likeness.
4. A guest who adds a photograph declares that they are entitled to share it and that they hold the consent of the people captured in it, to the extent needed to place the photograph in the event gallery.
5. Copyright in a photograph remains with its author. The author grants the event organiser a non-exclusive licence to use the photograph within the event gallery and in printed materials ordered by the organiser, and grants the Service Provider a licence strictly limited to what is technically necessary to provide the service (storage, display, preparation for print).
6. A person whose likeness has been captured may request its removal. The request should be directed to the event organiser, who has the tools to hide and permanently delete a photograph. A request addressed to the Service Provider will be passed to the organiser without delay and, in justified cases — in particular where the organiser does not respond and the content is unlawful — the Service Provider may remove the photograph itself.
7. Photographs are stored for the period stated in the order (by default 6 months from the event date, extendable). After that period they are permanently deleted. The organiser is reminded 30 and 7 days before deletion.
8. The event gallery is available at an address containing a unique event identifier. The organiser may additionally protect it with a password or PIN. Photo files are stored so that they cannot be accessed without going through the gallery.