Terms and Conditions

1. About these Terms

1.1 These Terms and Conditions (the "Terms") form a binding agreement between Formentic, a service provided by DYS Global, a sole trader (enskild firma) registered for VAT in Sweden ("Formentic", "we", "us") and the business entity that registers for or uses the Service (the "Client", "you").

1.2 The Service is provided to businesses only. It is not intended for consumers. By creating an account, clicking "I agree", or using the Service, you confirm that you act on behalf of a business and have authority to bind that business to these Terms.

1.3 These Terms incorporate by reference: the Privacy Policy, the Data Processing Agreement ("DPA"), the Acceptable Use Policy, the Billing Plans document (also published as the Billing & Subscription Policy), the Subprocessor List, and any order form or plan selection you make (together, the "Agreement"). If documents conflict, the order of priority is: (a) a signed order form, (b) the DPA (for personal data matters), (c) these Terms, (d) the Billing Plans document, (e) the Privacy Policy, (f) the Acceptable Use Policy and Subprocessor List.

2. Definitions

• "Service" means the Formentic software-as-a-service platform, its web application, APIs, documentation, and related support.
• "SFMC" means the Client's Salesforce Marketing Cloud (Marketing Cloud Engagement) account, including any business units.
• "Installed Package" means the API integration package the Client creates in its SFMC account and whose credentials (Client ID, Client Secret and related endpoints) it provides to Formentic.
• "Provisioned Assets" means the assets that Formentic creates in the Client's SFMC account through the Installed Package to operate the Service, namely: (a) the dedicated folder(s) and Data Extensions; (b) the Content Builder folder "Formentic" with its sub-folders, holding the images Formentic uploads at the Client's request (such as the screenshots of tests, in its "01 Forms › Test screenshots" folder) and, where the Client lets Formentic update its Cloud Pages, the content blocks that hold the Cloud Page code; (c) where the Client uses Formentic's emails, the emails, content blocks and images that Formentic saves in that folder at the Client's request ("Formentic Emails"); and (d) where the Client uses double opt-in, the confirmation email and the triggered send that Formentic creates for it.
• "Linked Client Assets" means assets in the Client's SFMC account that Formentic did not create but that the Client connects to a Formentic Email, namely: (a) the content blocks the Client chooses to include in a Formentic Email; and (b) the triggered sends, including those that Journey Builder creates for journey email activities, that use a Formentic Email.
• "Client Data" means all data, including personal data, that the Client or its Users submit to the Service or that the Service reads from or writes to Provisioned Assets.
• "Account Data" means information about the Client and its Users used to administer the account (for example name, business email, company details, platform details, billing details).
• "User" means an individual authorised by the Client to access the Service under the Client's account.
• "Plan" means the Free, Standard or Pro subscription tier described in the Billing Plans document.
• "Support Session" means a live remote session scheduled at the Client's request under Section 6.4.
• "Applicable Data Protection Law" means all privacy and data protection laws that apply to the processing of personal data under the Agreement, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and US federal and state privacy laws such as the California Consumer Privacy Act as amended by the CPRA ("CCPA").

3. The Service and account

3.1 Account. To use the Service you must register an account and provide accurate, complete and current information. You are responsible for all activity under your account and for your Users' compliance with these Terms.

3.2 Eligibility. You must be a legally constituted business and your Users must be at least 18 years old.

3.3 Changes to the Service. We may improve or modify the Service. We will not materially reduce the core functionality of a paid Plan during a paid subscription term without at least 30 days' notice.

4. SFMC Installed Package and scope of access

4.1 Required permissions. To operate the Service, you must create an Installed Package in your SFMC account with API integration (server-to-server) access limited to the following scopes: Data Extensions: Read and Write (which also lets Formentic create the folders that hold its Data Extensions); Assets › Documents and Images: Read and Write (to upload the images you give Formentic, such as the screenshots of your tests and the images in your emails, into its own Content Builder folder); Assets › Saved Content: Read and Write (to keep your Cloud Page code and the content of your Formentic Emails in Formentic's content blocks); and Channels › Email: Read and Write (to save your Formentic Emails in Content Builder and to manage the triggered sends that use them, as described in Section 4.2). You may also grant Journeys: Read; it is optional and only lets Formentic show you the names of the journeys that use your Formentic Emails. We will never ask you to grant broader permissions for the standard Service. These scopes are defined by Salesforce and apply to your whole Business Unit; what limits our use of them to the Provisioned Assets and the Linked Client Assets is Sections 4.2 and 4.3 and the way the Service is built.

4.2 Purpose limitation. We will use the Installed Package credentials solely and exclusively to:

• create a dedicated Formentic folder and the Data Extensions required by the Service (the Provisioned Assets);
• read, insert, update and delete records within the Provisioned Assets as needed to deliver the Service;
• update the structure of Provisioned Assets when the Service requires it, with notice in release notes;
• where you let Formentic update your Cloud Pages, write the Cloud Page code into content blocks in the Formentic folder in Content Builder, and read those blocks back, so you can test a new version on your staging page and go back to the previous one;
• where you use Formentic's emails, save each Formentic Email and its content blocks in the Formentic folder in Content Builder, and read, without modifying them, the content blocks you choose to include in a Formentic Email;
• only on your instruction (for example when you select Update live sends), pause the triggered sends that use a Formentic Email, publish the latest version of that email to them and restart them;
• read, once a day and after you change a Formentic Email, the status and aggregate send totals (such as the numbers of emails sent and failed) of the triggered sends that use it, in order to alert you when they fail, without reading the recipients of any send;
• where you grant Journeys: Read, read the names of the journeys that use a Formentic Email, in order to show them to you;
• where you use double opt-in, create the confirmation email and its triggered send in the Formentic folder, for your Cloud Page to send the confirmation to the person who submitted your form;
• upload the images you give Formentic, such as the screenshots of your tests and the images in your emails, into the Formentic folder in Content Builder (for test screenshots, a folder per form), and read test screenshots back to check that a required test was done; Formentic keeps no copy of them; and
• delete the Provisioned Assets when you ask us to (Delete Formentic folder).

4.3 What we will not do. We will not use the Installed Package to access, read, modify, export or delete any folder, Data Extension, record, content, email, triggered send, journey, automation, subscriber list or other asset in your SFMC account that is not a Provisioned Asset, except the Linked Client Assets and, where you grant Journeys: Read, journey names, in each case only as described in Section 4.2. We will not sell, share or use Client Data from your SFMC account for any purpose other than providing the Service to you.

4.4 Credentials. Your Client Secret and other integration credentials are encrypted at rest using AES-256 (AES-256-GCM) and in transit using TLS 1.2 or higher, and access is restricted to the automated systems that need them to deliver the Service. Formentic personnel do not have routine access to decrypted credentials. User passwords are never stored in readable form; they are stored only as salted cryptographic hashes (SHA-2 family), and Formentic cannot see or recover your password.

4.5 Your control. You may revoke or rotate the Installed Package credentials in SFMC at any time. Revocation will stop the Service from working for your account. You should update the credentials in the Service after any rotation.

4.6 Assisted access. We will access your SFMC account beyond the Installed Package only when you expressly request it, and only (a) to help with a custom setup not supported by the standard Service, or (b) to investigate and fix an issue with our setup. Such access will take place during a scheduled online Support Session, with your personnel present, using access you grant for that session. We will not keep or reuse any access granted for a Support Session afterwards. Any work in a Support Session is limited to what you ask for.

4.7 Salesforce. Salesforce and Marketing Cloud are trademarks of Salesforce, Inc. Formentic is independent and is not affiliated with, endorsed or sponsored by Salesforce. Your use of SFMC remains governed by your agreement with Salesforce, and you are responsible for ensuring that connecting the Service is permitted under that agreement.

4.8 No changes by hand. You agree not to change Formentic's code or the Provisioned Assets outside the Service (for example the code in your Cloud Pages or in Formentic's content blocks, a column or key of a Formentic table, or a Formentic folder), except as agreed in writing with Formentic support. Formentic keeps every version of its code and changes it only through the Service. We are not responsible for answers lost or forms that stop working because of a change made outside the Service, and work to repair such a change may be charged at our rates for custom work.

5. Plans, trial, fees and downgrades

5.1 Plans. The Service is offered in three Plans: Free, Standard and Pro. The features, limits and fees of each Plan are described in the Billing Plans document, which forms part of these Terms. By registering, you confirm that you have read the Billing Plans document and understand the differences between Plans.

5.2 Trial. Every new account receives a 14-day trial with full access to the features of the highest Plan (the "Trial"), starting on the day the account is created. At sign-up you may select any Plan. At the end of the Trial:

• if you have not confirmed a paid Plan by placing an order, your account will automatically move to the Free Plan and you will not be charged; or
• if you have confirmed a paid Plan, billing for that Plan will begin on the day after the Trial ends.

We will remind you in your account during the last 3 days of the Trial. Each Client is entitled to one Trial.

5.3 Fees and payment. Fees for paid Plans are stated in the Billing Plans document, are invoiced in advance for the billing period you choose (monthly or yearly, or a two-year term where offered), and are payable in EUR. Fees are exclusive of VAT, sales tax and other applicable taxes, which you will pay where required. EU business clients must provide a valid VAT number for reverse-charge treatment where applicable. Paid Plans are invoiced and paid by bank transfer, within the payment terms stated on the invoice. We do not collect or store payment card details.

5.4 Renewal. Paid Plans renew automatically for successive periods of the same length unless cancelled before the end of the current period. You may cancel at any time in your account settings; cancellation takes effect at the end of the current paid period. Except where required by law or stated in the Billing Plans document, fees are non-refundable.

5.5 Price changes. We may change fees with at least 30 days' written notice. The new fees apply from your next renewal. If you do not agree, you may cancel before the change takes effect.

5.6 Late payment. If payment fails or is overdue, we may, after at least 7 days' notice, move your account to the Free Plan or suspend paid features until payment is received. Late amounts may bear interest at the rate permitted by applicable law.

5.7 Upgrades. Upgrades take effect immediately. Any price difference for the current period is charged pro rata, unless the Billing Plans document states otherwise.

5.8 Downgrades and effect on your setup. You may downgrade at any time, and your account will also move to the Free Plan when a Trial ends without a paid Plan or when a paid Plan is cancelled or not paid. You acknowledge that a downgrade may cause the loss or restriction of features, limits, Users, forms, automations, Provisioned Assets or other configuration reserved to higher Plans, as described in the Billing Plans document. You are responsible for reviewing the Billing Plans document and adapting your setup before and after a downgrade. We will not delete data in your SFMC account as a result of a downgrade without prior notice to you. Configuration that exceeds Free Plan limits may be disabled and will be retained for 30 days, after which it may be deleted unless you upgrade again.

6. Security, logging and support

6.1 Our security obligations. We maintain appropriate technical and organisational measures to protect Client Data and Account Data, including encryption in transit and at rest, access controls based on least privilege, logging and monitoring, secure development practices, backups, and staff confidentiality obligations. Our measures are described in more detail in the DPA.

6.2 Audit logging. The Service logs actions taken by Users in the Service (for example logins, configuration changes, asset provisioning and data operations) for transparency, security and accountability. Admin Users can view these logs in the Service. Logs are retained for 12 months unless a longer period is required by law.

6.3 Your security responsibilities. You are responsible for:

• keeping your Users' login credentials confidential and not sharing accounts;
• configuring and maintaining session duration settings for your Users;
• configuring and maintaining IP allowlisting, which we strongly recommend;
• enabling multi-factor authentication where available;
• promptly removing access for Users who leave your organisation;
• the security of your own SFMC account, including who can view or rotate the Installed Package; and
• notifying us without undue delay at security@formentic.com if you suspect unauthorised access to your account.

We are not responsible for losses caused by your failure to meet these responsibilities.

6.4 Training and support. All Clients receive free onboarding training. Support requests are handled as follows (response time = time to first meaningful human response):

Support is available by email at support@formentic.com and through the Contact support page in your account. Response times are targets, not guaranteed resolution times, and apply on business days (Monday to Friday, CET, excluding Swedish public holidays). Custom setups not supported by the standard Service may be subject to separate agreement and fees.

6.5 Acceptable use. You will not: (a) use the Service in breach of law, including anti-spam, e-privacy and consumer protection laws; (b) upload malicious code or attempt to break the security of the Service; (c) reverse engineer, resell or sublicense the Service except as permitted by law; (d) use the Service to process special categories of personal data or data of children without a lawful basis and our prior written agreement; or (e) interfere with other clients' use of the Service.

6.6 Suspension. We may suspend access, with notice where reasonably possible, if needed to prevent a security threat, comply with law, or stop a material breach of Section 6.5. We will restore access once the issue is resolved.

7. Data protection

7.1 Roles. For Client Data (including personal data of your contacts, leads and customers stored in Provisioned Assets), you are the controller (or "business" under the CCPA) and Formentic is your processor (or "service provider"). For Account Data, Formentic acts as an independent controller, as described in our Privacy Policy.

7.2 DPA. Our processing of personal data on your behalf is governed by the DPA, which meets the requirements of Article 28 GDPR and includes, where needed, the EU Standard Contractual Clauses and the UK Addendum. The DPA is incorporated into these Terms and applies automatically when you accept them.

7.3 Service provider commitments (US). Where the CCPA or similar US state laws apply, we will not: sell or share personal data; retain, use or disclose it for any purpose other than providing the Service; use it outside our direct business relationship with you; or combine it with personal data from other sources, except as permitted by law.

7.4 Your obligations. You are responsible for having a lawful basis and any required consents and notices for the personal data you process through the Service, including under the GDPR, the ePrivacy Directive, CAN-SPAM and TCPA where applicable.

7.5 Personal data breaches. We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting your data, and will provide the information you need to meet your own notification obligations.

7.6 Return and deletion. When the Agreement ends, you may export your data for 30 days. After that we will delete Client Data and your integration credentials from our systems within 60 days, unless the law requires us to keep it. Data in your own SFMC account (including Provisioned Assets) remains yours and under your control; we will not delete it unless you ask us to.

8. Intellectual property

8.1 Our IP. Formentic and its licensors own all rights in the Service, including software, designs, templates and documentation. We grant you a non-exclusive, non-transferable right to use the Service during your subscription for your internal business purposes, subject to these Terms.

8.2 Your IP. You keep all rights in Client Data and in your SFMC account. You grant us a limited licence to host, process and transmit Client Data only as needed to provide the Service.

8.3 Feedback. If you give us suggestions, we may use them freely without obligation to you.

8.4 Aggregated data. We may use anonymised, aggregated usage statistics that do not identify you, your Users or any individual, to operate and improve the Service.

9. Confidentiality

Each party will keep the other's confidential information (including credentials, Client Data, pricing and non-public technical information) confidential, use it only to perform the Agreement, and protect it with at least reasonable care. This does not apply to information that is public, already known, independently developed or lawfully received from a third party. Disclosure required by law is permitted with prompt notice where lawful. This obligation survives for 5 years after the Agreement ends, and indefinitely for credentials and personal data.

10. Warranties and disclaimers

10.1 Our commitments. We warrant that (a) we will provide the Service with reasonable skill and care, (b) we will use the Installed Package only as set out in Section 4, and (c) the Service will materially conform to its documentation for paid Plans.

10.2 Disclaimer. Except as expressly stated in these Terms, and to the maximum extent permitted by law, the Service is provided "as is" and "as available", and we disclaim all other warranties, express or implied, including implied warranties of merchantability, fitness for a particular purpose, title and non-infringement. We do not warrant that the Service will be uninterrupted or error-free. The Free Plan and Trial are provided without any warranty.

10.3 Third-party platforms. We are not responsible for the availability, changes or failures of SFMC, Salesforce APIs, or other third-party services outside our control.

11. Liability

11.1 Our responsibility for data security. We accept responsibility for any unauthorised access to, or disclosure of, Client Data, Account Data or integration credentials that is caused by our breach of our security obligations under these Terms or the DPA (a "Formentic Security Breach"). In that case we will, at our own cost: (a) investigate and contain the breach; (b) notify you as set out in Section 7.5; (c) cooperate with you and any competent authority; and (d) compensate you for your resulting direct losses, subject to Section 11.3.

11.2 Excluded losses. Neither party is liable for indirect, incidental, special or consequential losses, or for loss of profits, revenue, goodwill or business opportunity, even if foreseeable.

11.3 Caps. Each party's total aggregate liability arising out of or relating to the Agreement in any 12-month period is limited to the fees paid or payable by you in the 12 months before the event giving rise to the claim (or EUR 0 if you are on the Free Plan, to the extent permitted by law). For a Formentic Security Breach, our total aggregate liability is instead limited to the greater of 2 times those fees or EUR 10,000.

11.4 No limit. Nothing in these Terms limits liability for death or personal injury caused by negligence, fraud, gross negligence or wilful misconduct, your payment obligations, or any liability that cannot be limited under applicable law.

12. Indemnities

12.1 By us. We will defend you against third-party claims alleging that the Service infringes their intellectual property rights, and pay resulting damages finally awarded or agreed in settlement, provided you notify us promptly and let us control the defence.

12.2 By you. You will defend us against third-party claims arising from Client Data, your breach of Section 6.5, or your failure to have a lawful basis for processing personal data through the Service.

13. Term and termination

13.1 The Agreement starts when you accept these Terms and continues until terminated.

13.2 You may terminate at any time by closing your account; paid fees are not refunded except as required by law.

13.3 Either party may terminate with immediate effect by written notice if the other materially breaches the Agreement and fails to cure the breach within 30 days of notice, or becomes insolvent.

13.4 We may terminate a Free Plan account on 30 days' notice, or if it has been inactive for 12 months.

13.5 On termination, your right to use the Service ends, Section 7.6 applies, and you should revoke the Installed Package credentials in SFMC. Sections that by their nature should survive (including 7, 8, 9, 11, 12 and 14) survive termination.

14. General

14.1 Changes to these Terms. We may update these Terms. We will notify you of material changes at least 30 days before they take effect. If you do not agree, you may terminate before the change takes effect; continued use after that date means acceptance.

14.2 Governing law and disputes. These Terms are governed by the laws of Sweden, excluding its conflict-of-law rules and the UN Convention on Contracts for the International Sale of Goods. Disputes will be resolved by the courts of Stockholm, Sweden, unless the parties agree on arbitration. This does not limit either party's right to seek urgent interim relief in any competent court.

14.3 Export and sanctions. Each party will comply with applicable EU, UN and US export control and sanctions laws. You confirm you are not located in, or controlled by persons in, a sanctioned country or listed on a sanctions list.

14.4 Subcontractors. We may use subcontractors and sub-processors, as listed in the DPA and the Subprocessor List, and remain responsible for their performance.

14.5 Force majeure. Neither party is liable for delay or failure caused by events beyond its reasonable control, excluding payment obligations.

14.6 Assignment. You may not assign the Agreement without our consent, which will not be unreasonably withheld. We may assign it to an affiliate or a successor in a merger or acquisition with notice to you.

14.7 Notices. Notices to us go to support@formentic.com; notices to you go to the account owner's email address.

14.8 Entire agreement. The Agreement is the entire agreement between the parties on its subject matter. If any provision is unenforceable, the rest remains in effect. A failure to enforce a right is not a waiver. The parties are independent contractors. Only the parties have rights under the Agreement.

14.9 Language. These Terms are drafted in English. Any translation is for convenience only.

15. Contact

DYS Global · Sole trader (enskild firma), VAT-registered · Sweden · Postal address on request · support@formentic.com