SBAM Website and Software Service Terms

Version 1.1 | 18 October 2026

1 Provider, scope and eligibility

SBAM is provided by KUBA S.R.L. (“KUBA”, “we”, “us”), registered office Via di Sottomonte 355, 55100 Lucca (LU), Italy; Italian tax and VAT number 02763370463; REA LU-274112. Contact for contractual and privacy matters: [email protected].

These Terms cover the public website at https://sbam.ai (“Website”) and contracts for the hosted software at https://app.sbam.ai (“Service”). Merely viewing the Website does not establish acceptance of a Service contract or purchase the Service. A Website interaction requiring a contract must use the relevant acceptance process in Section 2. Proposed features and roadmap statements are not agreed deliverables unless incorporated into an accepted order.

Website materials belong to KUBA or their respective rights holders. You may view them and retain reasonable copies for evaluating or using SBAM, subject to applicable law and existing rights. Third-party links do not by themselves form part of an order or endorse the destination's content. Requests submitted through Website forms are enquiries unless expressly accepted as orders through the agreed process.

The Service is offered for business and professional use in Italy, excluding consumers acting outside their trade or profession. “Customer” means the contracting business or professional. A “Representative” is an individual with legal capacity and authority to enter a contract or approve purchases for that Customer. An “Authorised User” is an individual the Customer permits to use its workspace. Operational users must be at least 18 years old. Authorised User status alone does not establish authority to conclude purchases or accept contractual changes. Each person must act within their actual authority.

2 Contract formation and document priority

The Service contract is formed by the Customer's Representative expressly accepting the applicable documents within the app. Before acceptance, KUBA must proactively provide access to reproducible copies of the exact version of these Terms, including Annex 1 on switching and retrieval, the applicable in-app commercial terms, and the separate SBAM Data Processing Agreement, Version 1.1 dated 18 October 2026, including Schedules A to D and its Subprocessor Register. That DPA forms part of the Service contract by this express incorporation. The DPA and its register may be delivered through an access-controlled pre-contractual area or equivalent secure delivery, but must be available without first purchasing the Service or accepting the Service contract; a reference saying they are available only on request is insufficient. They must remain available to the Customer after acceptance, with the accepted version retained. The acceptance process must distinguish authority to bind the Customer from ordinary user access and record the documents and versions accepted.

An individually negotiated binding agreement governs the matters it specifically regulates. Subject to that agreement, the functions, prices, credit metering and other commercial particulars presented and accepted in the app govern the relevant purchase; these Terms govern the remaining matters. A change to these Terms must be identified and validly accepted or introduced under Section 12. Separate LOI or pilot arrangements govern their own agreed subject matter and are not the standard onboarding process. Unexecuted proposals, pilot templates and a future public pricing page are not incorporated automatically.

For personal-data processing, mandatory law and binding transfer clauses retain priority; the applicable data-processing agreement (“DPA”) controls over conflicting commercial provisions within its processing subject matter. Later Website text or pricing does not replace an accepted document/version without a valid contractual amendment. An agreed pilot remains subject to its own transition provisions.

3 Accounts, authorised users and security

The Customer must provide accurate business and contact information, protect credentials, control which people it authorises to use its workspace and promptly request access changes or report suspected unauthorised access to [email protected]. Available actions may change catalogues, connect stores, publish content or incur charges. Application membership permits billing actions, including credit purchases, refill settings and spending-cap changes; these actions are not restricted to owners by the standard application permissions. Technical permissions must not be confused with actual purchasing authority. Following a credible compromise report, each party must take appropriate steps within its control to limit further unauthorised activity. This does not transfer KUBA's own security obligations to the Customer or make every account action automatically authorised.

KUBA's administration and support functions can involve access to Customer workspaces. Access is limited to assigned duties, subject to confidentiality, and governed by the applicable measures in Schedule B of the separate DPA incorporated under Section 2.

4 Service functions and integrations

Depending on the functions made available and ordered, the Service imports supplier documents or spreadsheets, organises product information, uses automated and AI-assisted processes for extraction, research and enrichment, generates or edits product media, and exports or publishes catalogue information through supported connections.

The Customer must select suitable source documents and reference materials and maintain rights to connect each store or external system. A connection grants the technical permissions disclosed in the connection process. Features, fields and permissions differ by integration. We do not commit to every marketplace or to unrestricted order, stock or customer-data synchronisation.

Third-party platforms have their own access rules and technical constraints. The Customer remains responsible for its account with those platforms. KUBA remains responsible for its own contractual obligations; an integration's involvement does not automatically exclude that responsibility. Changes affecting agreed functionality remain subject to the applicable contract and mandatory law.

5 Automated changes, AI outputs and publication

AI extraction and enrichment can produce incomplete, inaccurate or inconsistent information. Research results may reflect unreliable or outdated external pages. Images found online are not necessarily licensed for reuse. Generated or edited images may misrepresent product characteristics. Output may resemble content produced for others and may not qualify for exclusive intellectual-property protection.

Enrichment may save changes directly to the working catalogue, without a separate preview or undo step, and may replace manually entered fields. Reference documents and configured rules may cause existing product codes or other values to change. Review and preserve appropriate copies before initiating operations that could overwrite valuable data.

Before publishing or using output commercially, the Customer must check the resulting information and media against reliable product sources, including identity, variants, prices, taxes, measurements, safety statements, mandatory disclosures and third-party rights. The Customer must not treat generated content as a certification of product compliance or legal advice.

KUBA remains responsible for the AI transparency obligations applicable to it, including machine-readable marking and detectability of generated or manipulated content where required by law. The Customer must preserve required origin information and markings supplied with Outputs and provide the disclosures required for its own use or publication, including any applicable deepfake disclosure. These duties do not transfer KUBA's provider obligations to the Customer.

Publishing can make products active on a connected store and can alter its existing records. Depending on the integration, information, images or combinations absent from SBAM may be removed from the destination. Confirm the destination and intended operation before publishing. A review obligation in these Terms does not imply that the Service supplies a technical approval queue, automatic rollback or a backup of every previous version. It also does not remove KUBA's obligations under the contract or mandatory law.

6 Customer content and intellectual property

“Customer Content” includes materials supplied or connected by the Customer: documents, catalogue data, instructions, images and other assets. The Customer and relevant rights holders retain their existing rights. KUBA and its licensors retain their existing rights in the software, connectors, documentation and general methods.

The Customer permits KUBA to receive, host, reproduce, analyse, transform and transmit Customer Content only as reasonably necessary to perform the agreed Service and documented instructions, including through authorised service providers and selected destinations. This intellectual-property permission is separate from a lawful basis for personal-data processing and from the instructions governed by the DPA. It does not authorise unrelated commercial exploitation or public disclosure of confidential source documents.

“Outputs” are results specifically produced for the Customer through the Service. As between the parties, KUBA assigns any transferable rights it acquires specifically in those Outputs, to the extent those rights exist and can lawfully be transferred. This does not transfer KUBA's pre-existing technology or third-party components/materials KUBA cannot transfer. Their applicable rights and licences remain relevant. This allocation does not guarantee uniqueness, copyright protection or non-infringement.

The Customer must hold the permissions needed for its inputs and intended use of output, including photographs and supplier materials. Report a suspected rights violation to [email protected] with sufficient details to identify the material and concern. KUBA will assess the report and respond as required by applicable law. Any restriction must comply with the contract and applicable law.

The Service licence does not itself grant permission to use Customer Content or non-public Outputs for model training, unrelated evaluation or general product development. Any proposed additional use must be separately defined and agreed where required, including its scope, confidentiality and personal-data arrangements, before it is authorised. Provider security and abuse-prevention processing, optional model-improvement sharing and AI-assisted infrastructure administration remain distinct activities governed by their applicable purpose, role, retention and transfer arrangements in the separate DPA incorporated under Section 2. Authorisation of a catalogue task does not authorise an unrelated purpose.

7 Appropriate use and confidentiality

Users must not use the Website or Service unlawfully, infringe others' rights, submit malicious material, obtain unauthorised access or interfere with security or other customers. The Customer must limit personal data in uploads to the categories authorised in the applicable processing schedule and what the agreed operation requires. Additional categories require documented agreement and the necessary safeguards before submission.

Confidential information includes non-public Customer inputs, task instructions, Outputs and reserved business configurations where their nature or disclosure circumstances indicate confidentiality. Each party must protect the other's confidential information with reasonable care, use it only for the agreed relationship and disclose it only to relevant authorised personnel/providers under appropriate confidentiality and processing arrangements. Customer-directed publication or export permits disclosure to the selected destination, not disclosure of unrelated source documents.

The receiving party must demonstrate any exception for information already lawfully known, public without breach, lawfully received without restriction or independently developed. Legally required disclosure must be limited, with prior notice where lawful.

Confidentiality duties continue after the contract ends for information that remains confidential; legally qualifying trade secrets retain their protection under applicable law. This does not set a personal-data retention period. Public use of a Customer name, logo, testimonial, case study or performance metric requires the Customer's separate written permission or an existing binding authorisation covering that use. An unsigned earlier template supplies no permission.

8 Prices, credits and payment

The current commercial model is pay-per-use credits. Before the Customer authorises a credit purchase or refill, the app must disclose the applicable euro price, quantity, metering, taxes, payment timing and relevant spending limit. A future public /pricing page is not assumed to be available or incorporated. KUBA S.R.L. is the contracting Service provider; Stripe or Shopify may process the corresponding billing and provider-issued statements. Shopify platform billing follows the Customer's applicable Shopify merchant agreement, generally involving Shopify International Limited for a European merchant; Shopify Inc. may act as billing agent. Those platform arrangements do not replace the SBAM Service contract.

The Service consumes credits for specified saved operations. The current metering is 24 credits for a new imported product or an event adding genuinely new variants to an existing product, and 4 credits per billed saved enrichment change, capped at 24 credits per enriched product. An unchanged enrichment or an operation that fails before a chargeable result is committed does not consume the corresponding credits. A product successfully saved without pictures after an image-step failure may still consume its product credits. The app must disclose what the chosen operation can consume before it starts. Purchased credits do not expire, and cancellation does not by itself forfeit the unused balance.

Eligible billing activation provides 100 complimentary credits. This allowance is based on credits, without a specified trial duration or implemented credit-expiry period. On the Stripe route, the grant requires a previously unused eligible card fingerprint; prepaid cards do not earn it. On the Shopify route, the grant is available once per eligible live shop and excludes development stores. Activation requires a connected channel and the applicable provider approval/payment-method process. Eligibility is assessed through those card or shop checks; there is no additional complimentary allowance independently granted per company.

Except as expressly provided in these Terms or required by applicable law, purchased credits are non-refundable and cannot be redeemed for cash. Merely stopping use, voluntarily cancelling, or being dissatisfied with an output's style, usefulness, perceived quality or commercial results does not create a satisfaction-based refund entitlement. The free allowance enables evaluation; it does not waive remedies for breach of the agreed Service obligations.

Report suspected billing errors or technical failures to [email protected] with enough information to identify the affected operation. KUBA will investigate and correct verified erroneous deductions or charges, including duplicate or excessive deductions and charges for an operation not performed because of a technical failure. An appropriate correction may restore credits or correct the corresponding bill, without displacing any monetary restitution or other remedy due by law. Failure of an intermediate step does not by itself reverse a properly charged saved result.

Automatic refill is optional and initially off in the normal activation flow. It adds 400 credits for €20 when available credits, after reservations for admitted work, fall below 100; enabling it while already below that threshold may immediately authorise a refill. The amount, threshold, billing method and spending cap must be shown when enabling it. The app allows company members to enable or disable refill and change the cap; it does not enforce an owner-only permission. Disabling refill in the app stops further normal automatic-refill requests while leaving active billing and existing credits usable.

The default spending limit is €2,000 per provider billing cycle, with a €20 minimum, and applies to top-ups and packs as well as automatic refills. The Customer can change the displayed limit in the app, with provider approval where required. Authorised purchases and requests already in flight must be reconciled against that limit; it is not represented as an absolute technical guarantee against every concurrent-request overshoot. KUBA must investigate and correct any amount charged without a valid contractual basis.

Insufficient available credits can leave previously requested work waiting. When billing is active and credits become sufficient, waiting work resumes automatically in queue order and consumes credits under the applicable metering, without a fresh confirmation for each product. Restoring active payment status or reactivating billing can also resume previously waiting work using the retained balance. A billing restriction such as a failed payment can keep that work waiting even if credits remain. Where the app provides a separate stop control for an enrichment run, using it prevents the unsaved remainder from resuming; it does not reverse already saved and billed results. No general import-cancellation control is represented as available.

The in-app cancellation control leads to the relevant Stripe or Shopify billing-management page. Once cancellation takes effect in the billing provider and is reflected in SBAM, new submissions for credit-consuming work and normal refill requests stop, and initial waiting work remains paused. Previously admitted pipelines, including tasks already queued or running, may continue, save results and consume reserved credits after cancellation. Cancellation is not an instruction that aborts every pending stage. Reactivation retains the unused balance and may automatically resume waiting work; the normal new activation starts with automatic refill off. Disabling refill, cancelling billing and requesting workspace/account closure are distinct actions.

Retaining a balance does not commit KUBA to operate the Service indefinitely. Reactivation must not forfeit that balance merely because billing was cancelled. Subject to the following legal safeguards, KUBA offers no voluntary commercial cash-refund guarantee on permanent discontinuation. Nothing in this Section excludes restitution of unearned prepaid sums or any other remedy due under applicable law, including in the event of non-performance or impossibility. A closure notice cannot retrospectively remove those rights. KUBA must also respect the applicable notice, switching, retrieval and deletion obligations in Section 10.

9 Personal data, tracking and data processing

Privacy roles follow actual purposes, instructions and decisions, rather than labels such as administration or security. The Privacy Policy identifies processing for which KUBA determines separate purposes and means and the applicable controller arrangements. Tracking information and controls address optional tracking; accepting these Terms is not consent to optional analytics or advertising. Newsletters, offers and other commercial updates require a separate optional opt-in with a simple withdrawal mechanism; refusal or withdrawal must not prevent ordinary Service use. Necessary service and billing notices are distinct from marketing.

Where KUBA processes personal data on the Customer's behalf, the separate Article 28 DPA incorporated under Section 2 applies. Its schedules identify the agreed processing, measures, authorised processing chain, countries and transfer safeguards. KUBA must proactively supply the complete chain information needed before contracting and maintain access, change notices and a genuine opportunity to object as specified in that DPA. Controlled delivery protects non-public operational details; it does not limit legally required transparency, data subjects' access to recipient identities where required, competent authorities' powers or the Customer's information and audit rights. The Customer must have a lawful basis for its instructions and provide required information to affected people. KUBA's own duties as processor are not transferred to the Customer by this clause.

10 Availability, suspension and termination

Email support is available through [email protected] on working days. No response time, numerical uptime or result guarantee is included unless expressly agreed individually. Any such individual commitment remains binding.

KUBA may restrict the affected functions immediately where reasonably necessary to address an urgent security threat or unlawful use. The restriction must be proportionate to the issue, and KUBA will give notice as soon as reasonably possible unless doing so would increase the risk or be prohibited by law. For other remediable issues, including payment problems, KUBA will give notice and a reasonable opportunity to remedy before a non-urgent suspension. Restrictions must be reviewed and lifted when their grounds cease. Termination rights remain subject to the contract and applicable law; this clause introduces no penalty or automatic forfeiture of credits.

The standard commercial arrangement remains pay-per-use credits, with billing cancellation and reactivation as described in Section 8. Billing cancellation alone does not close or delete the workspace. The Customer may request switching to another provider or its own infrastructure, or request erasure on termination, by contacting [email protected] through an authorised Representative. KUBA will support the exit strategy with the information, assistance, continuity and security required by Chapter VI of Regulation (EU) 2023/2854. Any notice period before switching begins must not exceed two months. Switching must proceed without undue delay and ordinarily within 30 calendar days after that notice period. Where that transition is technically unfeasible, KUBA must give the justification and alternative period required by law within 14 working days of the request; that alternative may not exceed seven months. The Customer retains the statutory right to extend the transition once.

The relevant Service contract is considered terminated on successful completion of switching, and KUBA will notify the Customer of that termination. If the Customer instead requests erasure on termination without switching, the contract is considered terminated at the end of the applicable notice period, which may not exceed two months; KUBA will notify the Customer without making its confirmation a further condition of termination. Mandatory personal-data rights remain unaffected. Exportable data must remain available for retrieval for at least 30 calendar days after the applicable transition ends, or for a longer agreed or legally required period. This retrieval window is additional to the transition; it is not a general instruction to erase all data 30 days after billing cancellation.

Exportable Customer Assets comprise the Customer's source documents and uploads, product and catalogue records, generated outputs, media and associated Customer-use metadata falling within the statutory exportable-data and digital-asset scope. KUBA will provide the legally required machine-readable export, interfaces and assistance, using an operational assisted route where appropriate. Legitimate exclusions for protected internal software, trade secrets or security information must be specified and must not obstruct lawful switching or retrieval.

These Terms introduce no separate switching charge or early-termination penalty. Any charge lawfully proposed before 12 January 2027 requires prior transparent agreement and may not exceed permitted directly linked costs; no switching charge may be imposed from that date. Ordinary Service charges remain limited to the validly agreed charging basis. No payment clause, suspension or liability cap may be used to defeat mandatory switching or retrieval obligations.

Following successful switching and expiry of the retrieval window or an agreed later period, KUBA will erase the relevant Customer Assets and copies as required by the Data Act and applicable DPA. A valid earlier personal-data instruction must be handled under applicable data-protection law. Only the minimum records required by law or independently and lawfully processed for a defined separate purpose may remain, subject to the applicable role, necessity, restricted access and documented retention period. Examples may include statutory accounting records and the minimum record needed to preserve a residual purchased-credit balance; this is not a general entitlement to retain Customer Assets or processor copies for possible future claims. Backup and provider-copy erasure must also follow defined, verified deadlines or criteria consistent with the applicable law and DPA, rather than an indefinite exception. Restoring a backup must not reactivate an erased workspace or resume its jobs for ordinary use. Preserving a residual balance does not justify retaining the entire workspace. Disconnecting a store does not establish erasure of every copy, and ending Service access does not remove content already published to third-party stores.

11 Liability and disputes

Each party remains responsible under applicable law for breach of its obligations. Nothing in these Terms excludes or limits liability for intentional misconduct, gross negligence or obligations whose exclusion or limitation is prohibited by mandatory law.

Subject to the exceptions below, KUBA's aggregate liability arising out of or in connection with these Terms, the Website or the Service is limited to the fees paid or properly payable by the Customer to KUBA for the affected Service in the 12 months preceding the event giving rise to the claim, whether collected directly or through a payment or platform-billing provider for KUBA's account. Complimentary credits are not fees. Claims arising from the same event or substantially the same cause are considered together, without artificial grouping that would defeat remedies protected by applicable law.

The cap does not apply to fraud, wilful misconduct, gross negligence or any liability which applicable law prohibits limiting. It does not restrict data subjects' rights, authorities' powers, mandatory data-protection or transfer duties, or mandatory statutory switching, access, export and retrieval obligations and remedies. It does not reduce billing corrections or restitution due under applicable law, nor limit the Customer's valid payment obligations. No provision makes credit restoration the exclusive remedy for every breach.

These Terms are governed by Italian law. Subject to valid specific approval where required, the courts of Lucca, Italy, have exclusive jurisdiction over disputes arising from these Terms; mandatory jurisdiction rules remain unaffected. Send contractual complaints and notices to [email protected] from an authorised business contact. KUBA sends individual notices to the Customer's designated contractual contact and keeps relevant delivery evidence. A party must use any mandatory formal channel required by applicable law; KUBA's PEC is [email protected]. A sender should seek confirmation if a time-sensitive ordinary email is not acknowledged.

12 Changes and specific approval

KUBA will notify the Customer of proposed material changes to these Terms or applicable commercial conditions at least 30 days before they are to take effect, identifying the change and effective date. The Customer may stop using and cancel the Service before that date while retaining the unused purchased-credit balance under Section 8. Changes do not retroactively alter completed purchases or override a binding individually negotiated agreement. Changes must be accepted where legally required; silence or continued use is not treated by these Terms as automatic acceptance of every proposed change. Posting a revised page alone does not establish a valid amendment or fresh marketing/tracking consent. Where the Customer objects and no amendment is agreed, the parties shall address continuation or lawful termination under the existing contract without retroactive changes or forfeiture of the unused purchased balance.

Where Articles 1341 and 1342 of the Italian Civil Code require specific written approval, the Customer's Representative must separately approve the following identified provisions, including their stated qualifications and exceptions:

• Section 8: the restrictions on voluntary refunds and cash redemption of purchased credits, including the absence of a satisfaction-based refund or voluntary cash-refund guarantee on discontinuation, without limiting billing corrections, restitution or other remedies required by law; and the pause of waiting work during a billing restriction even where credits remain, subject to Section 10.
• Section 10 and Section 5 of the separate DPA incorporated under Section 2: KUBA's right to restrict affected functions immediately for urgent security threats or unlawful use, and to suspend for other remediable issues following notice and a reasonable opportunity to remedy; and any necessary restriction limited to affected processing during an unresolved subprocessor objection, subject to the stated proportionality, notice, review, lawful-alternative and exit safeguards.
• Section 11: the aggregate liability cap based on fees paid or properly payable for the affected Service during the preceding twelve months, including the treatment of claims arising from the same event or substantially the same cause, subject to all stated exclusions from the cap.
• Section 11: the exclusive jurisdiction of the courts of Lucca, Italy, subject to mandatory jurisdiction rules.

The approval process must identify those provisions and preserve their exact text and version with the Representative's identity, authority declaration and approval record. General acceptance, account access and optional marketing or tracking choices do not replace that approval. A provision requiring specific approval takes effect only if the legally required approval is validly obtained.

ANNEX 1 — SWITCHING AND RETRIEVAL INFORMATION

1 Scope and request route

An authorised Customer Representative may request switching, retrieval or erasure through [email protected]. KUBA shall verify authority proportionately and agree the practical destination/delivery steps without making those arrangements an additional notice period. The timing and mandatory protections in Section 10 apply. The ordinary catalogue download is not the whole switching service; assisted delivery must cover the exportable assets used by that Customer.

2 Exportable assets and formats

The exportable scope comprises the Customer-provided source documents and uploads in their held original formats; reference documents and merchant instructions in their held original files and an accompanying machine-readable index; product, variant and catalogue records in CSV/XLSX where suitable, with machine-readable JSON for associated non-tabular data; generated images/media in their held file formats; and task/source/result metadata necessary to understand and reuse those assets in machine-readable form. The accompanying index shall relate files and records through available stable identifiers and names. KUBA shall maintain and make available through https://sbam.ai/terms and https://app.sbam.ai/terms an up-to-date online register with details of the available data structures and formats, relevant standards and open interoperability specifications for exportable data, as required by Article 26 of Regulation (EU) 2023/2854. Relevant credit/purchase statements can be supplied separately to explain the remaining entitlement, subject to the lawful treatment of KUBA's own accounting records.

Customer-selected destination configurations and reusable instructions are included to the extent they are exportable data or digital assets under applicable law. Credentials and third-party tokens are not delivered through public export files; connections must be securely revoked or re-established under the destination's authorisation process. KUBA shall explain any unavailable item and provide a lawful alternative where required, rather than omit an asset merely because the catalogue download does not cover it. Delivery involving personal/confidential data must use appropriate access protection.

3 Exclusions and limitations

Exclusions are limited to KUBA's or third parties' internal software/source code, model weights, protected internal implementation logic, confidential security and anti-abuse materials, third-party secrets and information outside the statutory exportable scope. They do not exclude the Customer's own source materials, instructions, working results or necessary reuse metadata merely because those items are held in an internal format. Restrictions must protect legitimate rights without obstructing lawful switching or retrieval. Rights in source-page material and other third-party content remain applicable.

Self-service catalogue exports can require resolution of missing or unresolved fields and do not deliver every source file or item above. KUBA shall provide the legally required interfaces, information and assisted route for the remaining scope. Public product/export links are not a representation of authenticated full-workspace delivery. The parties shall cooperate on destination requirements, connection revocation, continuity and secure completion, without imposing a new switching fee through this Annex.

4 Infrastructure jurisdictions and access safeguards

KUBA is established in Italy. The identified primary database is in Ireland and core application services use Western Europe. The initial infrastructure and processing arrangements involve provider entities in Italy, Ireland, Singapore and the United States, with international operational, support and onward processing or access. Provider incorporation, physical hosting and remote access are different facts; these locations do not represent an exclusively European processing commitment. KUBA shall publish and keep current at https://sbam.ai/terms and https://app.sbam.ai/terms, without requiring an account, contracting or a request for the DPA, information identifying, for each relevant Service, the jurisdiction to which the ICT infrastructure deployed for data processing is subject, and a general description of the technical, organisational and contractual measures adopted to prevent international governmental access to or transfer of non-personal data held in the Union where such access or transfer would conflict with Union or applicable national law, as required by Article 28 of Regulation (EU) 2023/2854. These are the websites designated for that information under the Service contract. The DPA supplied under Section 2 contains the named processing chain and applicable personal-data transfer arrangements. GDPR Chapter V continues to govern personal-data transfers.

KUBA shall assess legal demands for access, verify authority and scope, use available objections and challenges as required by applicable law, minimise disclosures and give notice where lawful. It shall maintain contractual, access, security and escalation measures appropriate to the actual chain. This is an obligation to maintain effective safeguards, not a certification that European hosting prevents every foreign access request.