Terms of Service

These Terms govern the licensing of the Ydentifi server software, for a fee, to a company or other person acting in the course of a trade, business or profession, for installation and operation upon infrastructure controlled by that person. They constitute an agreement between merchants.

They do not govern the relationship between the Customer and the individuals who use the authentication or other services which the Customer provides by means of the Software. They do not govern a free-tier licence, which is licensed upon the Free Tier Terms. Supply without charge under an Order Form, for trial, evaluation, a pilot, research or academic use, is governed by these Terms and by clause 15.6.

1. Parties, acceptance, and to whom the Software is licensed

1.1 These Terms are entered into between Ydentifi Ltd., a company registered in the Republic of Bulgaria under company number 208962261, having its registered office at Todor Aleksandrov No. 46, floor 2, 2700 Blagoevgrad ("Ydentifi"), and the person which accepts them in accordance with clause 1.2 (the "Customer"). Where an Order Form has been executed, the Customer is the person identified upon it.

1.2 The Customer accepts these Terms by executing an Order Form or by requesting a Licence Key.

1.3 To whom the Software is licensed for a fee. Ydentifi contracts under these Terms only with a person acting in the course of a trade, business or profession, being a company, another legal person, or a natural person registered as a sole trader. Ydentifi does not license the Software for a fee to an individual acting outside a trade, business or profession, and declines such a request.

1.4 A Licence Key is issued under these Terms only against a company registration number, value added tax identification number or equivalent business registration identifier supplied by the Customer at the point of issue. Ydentifi does not undertake to verify that identifier against any register and the Customer undertakes that the identifier it provides is valid and true.

1.5 The Customer represents that it enters into these Terms for purposes relating to its trade, business or profession. Where the Customer is a merchant (*търговец*) within the meaning of Article 1 of the Bulgarian Commercial Act, Articles 297 and 298 of that Act apply to these Terms.

1.6 If, contrary to clauses 1.3 and 1.5, the Customer is held to be a consumer, the mandatory rules of consumer law applicable to it prevail, and any provision of these Terms which cannot bind a consumer does not apply to that Customer. The remainder of these Terms continues in force.

1.7 The individual accepting these Terms represents that they are duly authorised to bind the Customer. Where a person accepts these Terms in the name of a merchant without authority, Article 301 of the Bulgarian Commercial Act applies.

1.8 Documents and precedence. These Terms, the Order Form, the Security and Vulnerability Disclosure Policy, the Documentation and, where executed, the Data Processing Addendum together constitute the entire agreement between the parties in respect of the Software. In the event of conflict they take precedence in the following order: the Order Form; these Terms; the Data Processing Addendum; the Security and Vulnerability Disclosure Policy; the Documentation. No term contained in any purchase order, supplier registration, procurement portal, questionnaire or other document issued by the Customer forms part of the agreement, even where Ydentifi signs, accepts or performs against that document, unless both parties sign a document which expressly varies these Terms by reference to this clause.

2. Definitions and interpretation

2.1 In these Terms the following expressions bear the following meanings:

"Business Day" means a day other than a Saturday, Sunday or public holiday in the Republic of Bulgaria.

"Client SDKs" means the server-side integration libraries published by Ydentifi, by which the systems of a Relying Party communicate with a Deployment. They are licensed under the Apache License, Version 2.0, and not under these Terms.

"Control" means the holding of more than one half of the votes in the general meeting of a company, or the power to direct its management and policy, whether through shareholding, agreement or otherwise; and "Group", in relation to a party, means that party together with every company which Controls it, which it Controls, or which is under common Control with it.

"Device SDKs" means the libraries published by Ydentifi by which an authenticator client application for a mobile operating system may be constructed. The Device SDKs are distinct from the Client SDKs, serve a different function and are addressed to a different audience. They are licensed under the Apache License, Version 2.0, and not under these Terms.

"Deployment" means an installation of the Software operated by the Customer upon infrastructure controlled by the Customer, together with the configuration, integration code, infrastructure and operational procedures by which the Customer operates it. A "Production Deployment" is a Deployment placed into Production Use.

"Documentation" means the technical documentation published by Ydentifi in respect of the version of the Software which the Customer is licensed to operate.

"End User" means an individual in respect of whom an end user account exists within a Deployment.

"Licence Key" means the file issued by Ydentifi which authorises one or more Deployments and records the Seat allowance, the particulars described in clause 3.8, and the date of its expiry.

"Mobile Application" means the Ydentifi Authenticator application distributed through public application stores. The Mobile Application is licensed directly to the individual who installs it upon separate terms and is not licensed to the Customer under these Terms.

"Order Form" means the document recording the matters identified in clause 8.1, executed between the parties.

"Production Use" means the use of a Deployment to authenticate End Users other than for the purposes of development, staging, testing or evaluation.

"Relying Party" means an organisation on whose behalf a Deployment authenticates End Users. The Customer is a Relying Party in respect of its own service. The expression bears the same meaning as in the licence upon which the Mobile Application is licensed to individuals, where the Customer is the Relying Party as seen from that licence.

"Renewal" means the grant of a further Term following the expiry of a Term, and does not include the issue of a Licence Key upon a change of tier under clause 7.3, or of a Licence Key under clause 10.7.

"Seat" bears the meaning given in clause 7.2.

"Software" means the Ydentifi server software and the tooling distributed with it, licensed to the Customer under these Terms, together with all Updates and Upgrades supplied under clause 18. The Software does not include the Client SDKs, the Device SDKs, the Mobile Application or the Third-Party Components.

"Term" means the period for which a Licence Key is issued, determined in accordance with clause 10.

"Third-Party Components" means the third-party components, including open-source components, incorporated into or distributed with the Software and identified in the acknowledgements file distributed with it and in the software bill of materials referred to in clause 18.6.

"Data Processing Addendum" means the addendum published at https://ydentifi.io/legal/dpa; "Security and Vulnerability Disclosure Policy" means the policy published at https://ydentifi.io/legal/security; and the "customer privacy notice" means the notice published at https://ydentifi.io/legal/customer-privacy.

"published prices" means the prices published by Ydentifi from time to time for each tier, and a "tier" means a category of licence so offered.

"Update" means a new version of the Software released to correct defects or security vulnerabilities in it; "Upgrade" means any other new version of the Software.

2.2 Nothing in these Terms restricts, varies or supplements the rights granted under the Apache License, Version 2.0, in respect of the Client SDKs or the Device SDKs. Those rights are conferred by that licence alone and are available to any person, whether or not a party to these Terms.

2.3 Third-Party Components. The Software incorporates Third-Party Components which are licensed to the Customer under their own respective licences, and those licences govern in respect of them to the extent their terms require. Clause 17.1 does not apply to a Third-Party Component in the form in which it is publicly available. Clause 16.2 does not extend to a claim arising from a Third-Party Component otherwise than as incorporated by Ydentifi into the Software.

2.4 Interpretation. Headings are for convenience and do not affect construction. "Including" and "in particular" are without limitation. The singular includes the plural and the reverse. A reference to a statute or directive includes the national law implementing it and any provision replacing it.

3. Licence grant, delivery and the Licence Key

3.1 Subject to payment of the fees recorded upon the Order Form and to the restrictions in clause 4, Ydentifi grants to the Customer, for the Term, a non-exclusive, non-transferable and non-sublicensable licence to install and operate the Software upon infrastructure owned or controlled by the Customer, for the Customer's own internal business purposes, within the Seat allowance recorded in the Licence Key.

3.2 The Customer may make copies of the Software for backup, archival, development, staging and testing purposes. All such copies are subject to these Terms.

3.3 The Customer may permit companies within its Group, and its contractors and processors, to operate a Deployment upon the Customer's behalf, provided that each is bound by obligations no less protective than these Terms and that the Customer remains responsible for their acts and omissions.

3.4 Ydentifi and its licensors retain all intellectual property rights in the Software, the Documentation and all Updates and Upgrades. No ownership right is transferred by these Terms.

3.5 The rights conferred upon the Customer by Articles 5(2), 5(3) and 6 of Directive 2009/24/EC, to make a back-up copy, to observe and study the functioning of the Software, and to decompile it so far as necessary to achieve interoperability, are not affected by these Terms.

3.6 Delivery. Upon acceptance of these Terms and, where fees are payable, upon receipt of the first payment in cleared funds, Ydentifi shall make the Software available to the Customer for download and shall issue the Licence Key to the Customer's address for service within five Business Days.

3.7 Re-issue. During the Term, Ydentifi shall re-issue the Licence Key, with unchanged allowances and expiry, within five Business Days of a request by the Customer, at no additional charge.

3.8 Particulars recorded in the Licence Key. The Licence Key carries the particulars the Customer supplies when requesting it: the kind of person the Customer is, the name it declares, the correspondence address it gives, the business registration identifier referred to in clause 1.4, and the country. Those particulars are readable by any person who obtains the Licence Key file, and clause 4.5 restricts to whom it may be given.

Ydentifi does not undertake to verify those particulars against any register, save as clause 8.4 provides. They are what the Customer declared, and clauses 1.4 and 1.5 contain the Customer's representation and undertaking about them.

4. Restrictions upon use

4.1 Except as permitted by clause 4.2, the Customer shall not sell, rent, lease, lend, sublicense or distribute the Software, make it available as a hosted or remote service, or act as a service bureau or application service provider by which a third party obtains the benefit of the Software.

4.2 The Customer may authenticate End Users on behalf of any number of Relying Parties, each of which shall be the Customer or a company within its Group. Authentication on behalf of any other person requires a separate written agreement with Ydentifi.

4.3 The Customer shall not remove, obscure or alter any copyright, trademark or proprietary notice contained within or affixed to the Software.

4.4 The Customer shall not circumvent, disable or otherwise interfere with the licensing controls contained within the Software, nor operate the Software otherwise than under a valid Licence Key.

4.5 The Customer shall not disclose, share or redistribute a Licence Key to any person outside its own Group.

4.6 The Customer shall not unbundle any component of the Software for separate use, nor incorporate any component of the Software into another product for distribution.

4.7 The Customer shall not reverse engineer, decompile or disassemble the Software, modify, adapt or translate it or create derivative works of it, or use the Software, or any information obtained from it, to develop a product which competes with it. This clause does not restrict testing of the Customer's own Deployment under clause 6.

4.8 Clauses 4.1 to 4.7 apply only to the extent permitted by applicable law and do not restrict any act permitted by Articles 5(2), 5(3) and 6 of Directive 2009/24/EC.

5. The Customer's Deployment

5.1 The Software is installed and operated upon infrastructure controlled by the Customer. Ydentifi has no access to any Deployment, to the Customer's database, logs or records, or to any data processed by a Deployment, and is not able to obtain such access. Ydentifi does not operate, monitor, back up or restore any Deployment.

5.2 The Customer is responsible for the infrastructure upon which a Deployment operates, including its provisioning, network configuration, certificate and key material, backup arrangements, availability and security.

5.3 For the avoidance of doubt, the following are not included within these Terms and shall be the subject of separate agreement if required: hosting; installation, configuration and administration; migration; custom development; integration; training; and the managed operation of a Deployment. Support, Updates and Upgrades are governed by clause 18 and by any support plan recorded upon the Order Form.

5.4 Ydentifi shall have no liability in respect of any loss arising from an authentication performed upon a device operating unauthentic software, or upon a device the security of which has been diminished, from whatever cause. This clause imposes no obligation upon the Customer to detect or prevent such use.

5.5 Reliance upon an authentication. An authentication performed by means of a Deployment establishes that a request was approved upon a device enrolled in that Deployment. It does not establish who was holding the device, nor the identity of the person for whom the device was enrolled beyond what the Customer verified before that enrolment.

5.6 Before relying upon an authentication, the Customer shall exercise, and shall procure that each Relying Party exercises, due care, which includes at least:

verifying the identity of each person, to the standard its own risk assessment requires, before inviting

that person to enrol a device;

obtaining the outcome of each authentication from its Deployment, through the interfaces described in the

Documentation, and not from the End User's device or from any other source;

confirming that the outcome relates to the request which it issued, and that the request has not expired;
relying upon an authentication only for the action for which it was requested, and applying additional

measures where the value or risk of that action requires them; and

acting without undue delay upon a report from an End User that a device has been lost or stolen or used

by another person, including by revoking the enrolment of that device.

5.7 Ydentifi shall have no liability in respect of any loss arising from reliance upon an authentication by the Customer or a Relying Party which did not exercise the care described in clause 5.6.

6. Security assurance and testing of the Deployment

6.1 The parties acknowledge that each Deployment is unique. The Software constitutes one component within an authentication system which the Customer designs, configures, integrates, hosts and operates. The security characteristics of that system as a whole are determined by the Customer's architecture, configuration, infrastructure, key management, integration code, operational procedures and the further components with which the Software is combined, none of which is within the knowledge or control of Ydentifi.

6.2 The Customer undertakes, at its own cost, before placing a Deployment into Production Use and at appropriate intervals thereafter:

(a) to conduct, or to procure the conduct of, penetration testing and security assessment of the

Deployment as a whole, including those components supplied by Ydentifi as integrated and configured by the Customer;

(b) to carry out its own risk assessment and threat modelling appropriate to its sector, its

regulatory obligations and its risk appetite;

(c) to satisfy itself that the Deployment meets the Customer's own security requirements and any

requirement imposed upon the Customer by law, by regulation or by a supervisory authority; and

(d) to remediate any deficiency so identified.

6.3 By placing a Deployment into Production Use, the Customer represents that it has performed its obligations under clause 6.2 and that the Deployment, including those components supplied by Ydentifi as integrated and configured by the Customer, meets the Customer's security requirements. Ydentifi is entitled to rely upon that representation and gives no assurance as to the suitability of any Deployment for the Customer's purposes.

6.4 The Customer requires no further permission from Ydentifi in order to test its own Deployment.

6.5 Where testing under this clause identifies a vulnerability or security defect in the Software itself, as distinct from the Customer's configuration, integration or infrastructure, clause 11.7 applies and the Security and Vulnerability Disclosure Policy governs its reporting and disclosure.

6.6 This clause allocates responsibility for the assurance of a Deployment. It does not exclude or diminish the warranties given by Ydentifi under clause 14 in respect of the Software as supplied, it does not diminish the standard of care owed by Ydentifi under Article 302 of the Bulgarian Commercial Act, and it does not exclude or limit any liability which cannot lawfully be excluded or limited, including liability under Directive (EU) 2024/2853 on liability for defective products, or under the law implementing Council Directive 85/374/EEC which it replaces.

7. Seats and licence compliance

7.1 The Order Form records the Customer's tier and its Seat allowance.

7.2 A Seat is consumed by each end user account existing at any one time within a Production Deployment, whether or not a device has been enrolled against that account and whether or not the account is in active use. Deletion of an end user account releases the Seat. Accounts within a Deployment which is not a Production Deployment do not consume Seats.

The Seat allowance is a single allowance shared by all Production Deployments operated under the Licence Key, and the Seats consumed are the total of the Seats consumed within each of them.

7.3 The Customer is responsible for monitoring its Seat consumption and for maintaining sufficient headroom within its tier. Where the Customer exceeds, or anticipates exceeding, its Seat allowance, the Customer shall contact Ydentifi in order to arrange transfer to the appropriate tier.

7.4 Once the Seat allowance recorded in the Licence Key has been reached, the Software does not create further end user accounts. End Users already enrolled continue to authenticate, and no existing account is affected. Ydentifi gives no assurance that any tolerance above the Seat allowance is available, and no course of dealing gives rise to an expectation of one. The Software applies the Seat allowance within each Deployment separately; that does not enlarge the Seat allowance, which clause 7.2 applies to all Production Deployments together.

7.5 Overage. Where the number of Seats consumed exceeds the Seat allowance, however arising, the Customer shall pay the fees applicable to the tier appropriate to its actual consumption, for the whole of the period of the excess, at the rates recorded upon the Order Form or, where none apply, at Ydentifi's published prices. Payment of those fees is the sole consequence of an excess where the Customer's statement under clause 7.6 was made in good faith.

7.6 Records and self-certification. The Customer shall keep records sufficient to demonstrate its Seat consumption across all Production Deployments during the Term and for two years afterwards, and shall, not more than once in any Term upon Ydentifi's written request, provide a statement of its peak Seat consumption certified by an officer of the Customer. Ydentifi has no right of access to any Deployment and shall not require one.

7.7 Verification of the Customer's records. Where a statement given under clause 7.6 is materially inconsistent with the Seat allowance recorded in the Licence Key, or where Ydentifi has reasonable grounds to believe that the licensing controls have been circumvented contrary to clause 4.4, Ydentifi may require the records kept under clause 7.6 to be verified by an independent auditor nominated by Ydentifi and reasonably acceptable to the Customer, upon not less than thirty days' notice and not more than once in any Term.

The verification is of those records alone. Clause 7.6 continues to apply, and nothing in this clause confers upon Ydentifi or upon the auditor any right of access to a Deployment, to the Customer's systems or to its premises. The auditor shall report to Ydentifi only whether the statement was accurate and, where it was not, the correct figures; the auditor shall report nothing further, and shall be bound by obligations of confidence no less protective than clause 17.

Ydentifi bears the cost of the verification, unless it discloses an understatement of Seats consumed exceeding five per cent, in which case the Customer bears that cost in addition to the fees payable under clause 7.5.

7.8 Clauses 7.5, 7.6 and 7.7 apply during the Term and for so long afterwards as the records under clause 7.6 are required to be kept.

7.9 Unlicensed use. Where the Software is operated by means of the circumvention of its licensing controls contrary to clause 4.4, under a Licence Key disclosed contrary to clause 4.5, or after the revocation of a Licence Key under clause 10.8, the Customer shall pay Ydentifi, as a penalty (*неустойка*), one hundred and twenty-five per cent of the published prices for the Seats so consumed, for the whole of the period of that use. The penalty is without prejudice to Ydentifi's right to recover damages exceeding it under Article 92 of the Bulgarian Obligations and Contracts Act.

8. Fees, billing and taxes

8.1 The Order Form records the Customer's identity and business registration identifier, the version of these Terms accepted, the tier, the Seat allowance, the Term, the fees and currency, the rates applicable to additional Seats and to a change of tier, the payment terms, any support plan, the Customer's address for service, and any rider agreed between the parties.

8.2 The Customer shall pay the fees recorded upon the Order Form, in the currency stated, for the Term.

8.3 All fees are exclusive of value added tax and of any other tax or duty, which the Customer shall pay in addition where properly due. Where the law requires the Customer to deduct or withhold tax from a payment, the Customer shall pay such additional amount as leaves Ydentifi with the full amount it would have received without the deduction, and shall provide Ydentifi with evidence that the tax withheld has been paid.

8.4 Where the Customer is established outside the Republic of Bulgaria and the reverse-charge mechanism applies, the Customer shall provide a valid VAT identification number and Ydentifi shall invoice without Bulgarian value added tax. Ydentifi may confirm the validity of that number with the competent authority for that purpose, and clause 1.4 does not limit its doing so. Where the supply falls outside the scope of Bulgarian value added tax for any other reason, including because the Customer is established outside the European Union, Ydentifi shall invoice without Bulgarian value added tax.

8.5 Ydentifi may vary its published prices at any time. No such variation affects a Term in respect of which the fees have already been paid, and any variation takes effect in respect of the Customer upon Renewal.

9. Payment terms

9.1 Invoices are payable within 30 days of the date of invoice unless the Order Form provides otherwise. Payment is made when Ydentifi's account is credited. Bank and transfer charges are borne by the Customer.

9.2 Sums remaining unpaid after the due date shall bear statutory interest under Bulgarian law from the due date until payment.

9.3 Where an invoice remains unpaid for more than 60 days after the due date, Ydentifi may decline to grant a Renewal. A Licence Key remains valid to the end of the Term in respect of which it was issued.

9.4 Fees are non-refundable once the Term has commenced, save where a refund is provided for under clauses 10.5, 14.3, 16.5, 19.4 or 23.1.

9.5 The Customer shall pay all sums due under these Terms in full, without set-off, counterclaim, deduction or withholding, save as the law requires and as clause 8.3 provides.

9.6 Where an amount properly due remains unpaid fourteen days after notice, Ydentifi may suspend support and the supply of Upgrades until it is paid. This clause does not apply to Updates and does not affect a Licence Key already issued.

10. Term, Renewal and termination

10.1 Each licence is granted for a fixed term of twelve months from the date of issue of the Licence Key, unless the Order Form provides otherwise. A licence does not renew automatically. Renewal shall be agreed between the parties before expiry of the Term.

10.2 Ydentifi gives no notice of the expiry of the Term. The date of expiry is recorded in the Licence Key, and the Customer is responsible for managing the lifecycle of its licence, including seeking a Renewal in good time. Ydentifi is not obliged to offer a Renewal, nor to state a reason for declining to do so.

10.3 Where either party commits a material breach of these Terms, the other may serve notice specifying the breach. The party in breach shall have thirty days from service of that notice within which to remedy it. If the breach is not remedied within that period, the party not in breach may terminate with effect from the end of that period or from such later date as it may specify.

10.4 Upon expiry or termination the Customer's right to operate the Software ceases, and the Customer shall cease all such operation and destroy or delete all copies of the Software and of the Licence Key within its possession or control. Upon termination, the Customer shall confirm in writing that it has done so within thirty days of a request by Ydentifi. All property of the Customer, including each Deployment, its database, its records and its configuration, remains the Customer's. Ydentifi holds none of that property and neither deletes nor withholds any of it.

10.5 Termination for convenience by Ydentifi. Ydentifi may terminate these Terms for its own convenience upon not less than ninety days' notice, in which case it shall refund the fees attributable to the unexpired portion of the Term.

10.6 Termination does not affect any right or remedy which has accrued to either party before it takes effect.

10.7 Transition upon expiry. Where the Term expires while a Renewal is under discussion, or where the Customer notifies Ydentifi before expiry that it intends to migrate away from the Software, Ydentifi shall upon request issue a Licence Key valid for sixty days from expiry, once in respect of any Term, at no charge. During that period the licence in clause 3 continues for the sole purposes of continuity of authentication for existing End Users and orderly migration. The thirty days of warnings described in clause 10.10 follow the expiry of any Licence Key issued under this clause, and are additional to it.

10.8 Revocation of a Licence Key. Ydentifi may revoke a Licence Key by notice in writing given in accordance with clause 22, where the Customer is in material breach which it has failed to remedy within the period given by clause 10.3, where an amount properly due remains unpaid following notice, where the Customer operates the Software outside the scope of clause 3, where the Software is used unlawfully, where a payment for the Licence Key is reversed, charged back or recalled, or in the circumstances described in clause 23.7. In the last two cases the period given by clause 10.3 does not apply. Upon revocation the Customer's right to operate the Software ceases immediately and clause 10.4 applies. Ydentifi shall issue no further Licence Key to a Customer whose Key has been revoked.

10.9 Effect of revocation. The Software verifies the Licence Key without contacting Ydentifi, and Ydentifi operates no facility by which a Key already issued may be withdrawn from a Deployment. Revocation therefore operates as a matter of right and not of mechanism: the Key already held continues to verify until the expiry recorded within it, and Ydentifi's remedy in respect of operation after revocation is the remedy available at law. Nothing in this clause requires Ydentifi to maintain such a facility, and nothing in it prevents Ydentifi from introducing one.

10.10 Cessation upon expiry. When a Licence Key expires and no valid Licence Key replaces it, the Software emits warnings for thirty days and thereafter ceases to authorise authentication operations, from which point End Users cannot authenticate by means of the Deployment. The administrative interface remains available for the installation of a valid Licence Key. The date of expiry is recorded in the Licence Key, and its management is the Customer's responsibility under clause 10.2. The cessation is complete and immediate, and no further period of grace applies.

11. Obligations of the Customer

The Customer shall:

11.1 operate the Software in accordance with the Documentation and with applicable law;

11.2 maintain the Software at a reasonably current version, and apply Updates within a reasonable period following the date upon which they are made available to it under clause 18.3;

11.3 protect its Licence Key, its certificate and key material and its administrative credentials, and notify Ydentifi without undue delay upon becoming aware of the compromise of any of them;

11.4 design, operate and maintain the authentication and authorisation workflows within its own service, including the handling of enrolment, account recovery, loss of device and lockout;

11.5 make no representation that Ydentifi provides any service, warranty, support or assurance to any End User, and not hold Ydentifi out as a party to the Customer's relationship with any End User;

11.6 be liable for any act or omission of a person whom it enrols as an End User, and of any person whom it permits to operate a Deployment, which would constitute a breach of these Terms if it were an act or omission of the Customer, as if it were such a breach. Liability under this clause is subject to the same limits and exceptions as apply to a breach of the corresponding clause by the Customer;

11.7 notify Ydentifi, without undue delay and in any event within seventy-two hours of becoming aware of it, of any vulnerability or security defect in the Software, through the channel identified in the Security and Vulnerability Disclosure Policy;

11.8 not publish, nor permit the publication of, particulars of a vulnerability notified under clause 11.7 until a corrected version has been made available or ninety days have elapsed since notification, whichever is the earlier. Ydentifi shall use reasonable endeavours to correct the defect within that period and shall keep the Customer informed of its progress.

11.9 Clause 11.8 does not restrict the Customer from: making any disclosure required by law or regulation, including incident notification under Directive (EU) 2022/2555 and personal data breach notification under Regulation (EU) 2016/679, or any obligation owed to a sector regulator; complying with an order of a court or other lawful demand; informing its own security personnel, auditors and professional advisers under obligations of confidence; or informing its own affected users so far as necessary for their protection.

11.10 The Customer shall inform the End Users whom it has enrolled, without undue delay, of each notice given under clause 18.9 and of the measures which that notice states End Users should take. Ydentifi holds no means of contacting End Users and relies upon the Customer to do so.

12. End Users and the Customer's own terms

12.1 The Customer warrants that it has, and shall maintain throughout the Term, terms of service or equivalent contractual arrangements with each End User whom it enrols, governing the authentication service which the Customer provides by means of the Software.

12.2 The Customer shall not invite, instruct or permit an End User to enrol a device before such terms are in force between the Customer and that End User.

12.3 Ydentifi does not undertake to present the Customer's terms to End Users, whether by means of the Software, the Mobile Application or otherwise.

12.4 Support, availability, account recovery and all other aspects of the service which the Customer provides are the responsibility of the Customer and not of Ydentifi.

12.5 Ydentifi licenses the Mobile Application directly to each individual who installs it, upon published terms. That licence extends only to the software upon the individual's device and creates no relationship between Ydentifi and any End User beyond it.

13. Data protection roles

13.1 In respect of the personal data of End Users, the Customer is the controller and Ydentifi is neither controller nor processor. The Customer hosts each Deployment; Ydentifi has no access to such data and receives none in the operation of the Software. Clause 13.4 applies to data which the Customer chooses to disclose to Ydentifi in a support request.

13.2 The Customer shall maintain its own privacy notice covering such processing, shall respond to data subject requests relating to it, and shall discharge the obligations of a controller in respect of it.

13.3 Ydentifi is a controller in respect of the business contact data provided to it by the Customer, comprising the names, business electronic mail addresses and billing details of the individuals who transact with Ydentifi upon the Customer's behalf, and the particulars recorded in the Licence Key under clause 3.8. Ydentifi's customer privacy notice governs that processing.

13.4 Where the Customer discloses personal data to Ydentifi in support of a request under clause 18.1, Ydentifi processes it as processor for that request only, and the Data Processing Addendum, where executed, governs that processing.

13.5 The Software is constructed so that the cryptographic keys of an End User are generated upon the End User's device and do not leave it, and so that biometric verification is performed by that device and its result is not transmitted.

14. Warranties and disclaimer

14.1 Ydentifi warrants that, for the Term, the unmodified Software will conform in all material respects to the Documentation published in respect of the version which the Customer is licensed to operate.

14.2 Ydentifi warrants that it has the right to grant the licence in clause 3, that it is not party to any agreement in conflict with that grant, and that it has no actual knowledge that the Software infringes the rights of any third party. Clause 16 states the Customer's sole and exclusive remedy in respect of any claim that the Software infringes the rights of a third party.

14.3 The Customer's sole and exclusive remedy for breach of the warranty in clause 14.1 is, at Ydentifi's election: correction of the non-conformity; provision of a workaround; or termination of the licence and refund of the fees attributable to the unexpired portion of the Term. Where Ydentifi has not effected one of those remedies within sixty days of notice of the non-conformity, the Customer may terminate and receive that refund.

14.4 The warranty in clause 14.1 does not apply to any non-conformity arising from: modification of the Software by any person other than Ydentifi; combination of the Software with anything not supplied or approved by Ydentifi; operation otherwise than in accordance with the Documentation or upon unsupported infrastructure; or failure by the Customer to apply an Update made available by Ydentifi.

14.5 Save as expressly provided in clauses 14.1 and 14.2, and to the fullest extent permitted by applicable law, Ydentifi gives no warranty, express or implied, and in particular gives no warranty of merchantability, fitness for a particular purpose, system integration or non-infringement. Ydentifi does not warrant that the Customer's operation of the Software will be uninterrupted or error-free, or that every non-conformity is capable of correction.

14.6 The Software is neither designed nor intended for use in any environment or application in which failure could lead to death, personal injury, or physical or environmental damage, including the operation of nuclear facilities, aircraft navigation or communication systems, air traffic control systems, life support systems and weapons systems. Any such use is undertaken at the Customer's sole risk and cost.

14.7 Nothing in this clause affects any liability of Ydentifi under Directive (EU) 2024/2853 on liability for defective products, or under the law implementing Council Directive 85/374/EEC which it replaces, which cannot be limited or excluded as against an injured person.

15. Limitation of liability

15.1 Subject to clauses 15.3 and 15.4, neither party shall be liable to the other in respect of indirect or consequential loss, loss of profit, loss of revenue, loss of anticipated savings, loss of business or business opportunity, loss of goodwill, loss of use, loss or corruption of data, interruption of business, wasted expenditure, or the cost of procuring substitute goods or services, howsoever arising and whether direct or indirect.

15.2 Subject to clauses 15.3 to 15.6, the total aggregate liability of Ydentifi to the Customer in respect of all claims arising out of or in connection with these Terms shall not exceed an amount equal to one half of the fees payable by the Customer for the Term in which the event giving rise to the claim occurs.

15.3 Nothing in these Terms excludes or limits the liability of either party in respect of:

death or personal injury caused by negligence;
intent (*умисъл*) or gross negligence (*груба небрежност*), the exclusion or limitation of which is void

under Article 94 of the Bulgarian Obligations and Contracts Act;

fraud or fraudulent misrepresentation;
liability under Directive (EU) 2024/2853 on liability for defective products, or under the law implementing Council Directive 85/374/EEC which it replaces; or
any other liability which cannot lawfully be limited or excluded.

15.4 Neither the exclusion in clause 15.1 nor the limit in clause 15.2 applies to the Customer's obligation to pay fees, to the Customer's indemnity under clause 16.1, or to any breach by the Customer of clause 3, clause 4 or clause 17.

15.5 The liability of Ydentifi under clause 16.2 is limited to the fees payable by the Customer for the Term in which the event giving rise to the claim occurs, and is not cumulative with the limit in clause 15.2. Claims under clause 16.2 are excluded from the aggregate in clause 15.2, and the combined liability of Ydentifi under clauses 15.2 and 15.5 shall not exceed the fees payable for that Term.

15.6 Subject to clause 15.3, where the Software is supplied to the Customer without charge, whether for the purposes of trial, evaluation, pilot, research or academic use, it is supplied as is and without warranty of any kind, and the sole liability of Ydentifi in respect of it is for damage caused by intent or gross negligence within the meaning of Article 94 of the Bulgarian Obligations and Contracts Act. Clauses 14.1, 14.3 and 16.2 do not apply to such supply.

15.7 Ydentifi is not liable for any loss to the extent that it arises from: the Customer's breach of these Terms; the Customer's failure to apply, within a reasonable period, an Update made available under clause 18; the Customer's infrastructure, configuration, integration code or operational procedures; or events within a Deployment, which Ydentifi cannot observe and does not control.

15.8 The parties acknowledge that Ydentifi has set its fees in reliance upon the limits in this clause, and that those limits represent a reasonable allocation of risk between merchants.

15.9 Claims under these Terms are subject to the statutory limitation periods under Bulgarian law. Article 113 of the Bulgarian Obligations and Contracts Act provides that an agreement shortening or extending a statutory limitation period is of no effect, and no provision of these Terms purports to do so.

15.10 The limits in this clause are the aggregate liability of Ydentifi to the Customer and to every company within its Group together. The Customer shall procure that no company within its Group brings a claim against Ydentifi in respect of the Software otherwise than through the Customer, and shall indemnify Ydentifi against any such claim to the extent that it exceeds those limits.

16. Indemnities

16.1 The Customer shall indemnify Ydentifi against claims brought against Ydentifi by any third party, and against losses suffered by Ydentifi, to the extent arising from the Customer's operation of a Deployment, from the service which the Customer provides by means of it, or from the Customer's breach of clauses 4, 6.2, 11.5, 11.10, 12.1, 12.2, 13.2 or 23.7. This indemnity extends only to that which results from the Customer's own acts and omissions and does not apply to the extent that the loss was caused by Ydentifi.

16.2 Subject to clause 15.5, Ydentifi shall indemnify the Customer against any claim by a third party that the Software, used within the scope of the licence in clause 3, infringes that party's patent, trademark, trade secret or copyright within the European Union, the United Kingdom or the United States of America. Ydentifi shall defend such claim at its own expense and shall satisfy any final award or agreed settlement.

16.3 The obligation in clause 16.2 is conditional upon the Customer: notifying Ydentifi promptly in writing upon becoming aware of the claim; affording Ydentifi reasonable cooperation in its defence, including such steps as may be available under Bulgarian procedural law to join Ydentifi to the proceedings; not admitting liability in respect of the claim; and not settling or compromising it without Ydentifi's consent, such consent not to be unreasonably withheld.

16.4 Clause 16.2 does not apply to any claim arising from: combination of the Software with anything not supplied or approved by Ydentifi; modification of the Software by any person other than Ydentifi; use of the Software in combination with a modified Client SDK or Device SDK, where the claim arises from the modification; continued use of a version after a non-infringing version has been made available; or use outside the scope of the licence in clause 3.

16.5 Where the Software becomes, or in Ydentifi's reasonable opinion is likely to become, the subject of a claim under clause 16.2, Ydentifi may at its election procure for the Customer the right to continue using it, modify it so that it ceases to infringe, or terminate the licence and refund the fees attributable to the unexpired portion of the Term.

17. Confidentiality

17.1 Each party may receive from the other information which is marked as confidential, or which a reasonable person would understand to be confidential from its nature or from the circumstances of its disclosure. The structure, organisation and source code of the Software constitute the confidential information of Ydentifi whether or not so marked. The commercial terms recorded upon an Order Form constitute the confidential information of both parties.

17.2 Each party shall use the confidential information of the other solely for the purposes of these Terms, shall protect it with no less care than it applies to its own confidential information of like kind, and shall disclose it only to those persons who require it and who are bound by obligations of confidence.

17.3 This clause does not apply to information which is or becomes public otherwise than by breach, which was already known free of any duty of confidence, which is independently developed without reference to the other party's information, or which is received from a third party free to disclose it.

17.4 Either party may disclose the confidential information of the other where required by law, regulation or order of a court, having first given the other such notice as is lawful and reasonably practicable.

17.5 The obligations in this clause continue for five years following expiry or termination, and in respect of the source code of the Software for so long as it remains a trade secret.

17.6 Neither party shall use the name, logo or trademarks of the other publicly without prior written consent. Consent given in respect of a particular reference or case study may be withdrawn upon reasonable notice.

18. Support, Updates, Upgrades and continuity

18.1 Support is provided at the level recorded upon the Order Form. Where no support plan is recorded, Ydentifi gives no committed response times.

18.2 Ydentifi shall correct defects in the Software and remedy security vulnerabilities in it for a period of not less than five years from the date of release of a version, and for such further period as it continues to support the Software. Ydentifi does so only by releasing a new version of the Software, made available under clause 18.3, and does not correct or patch earlier versions. This obligation relates to the Software as licensed and not to any Deployment or to the infrastructure upon which it operates.

18.3 Subject to clause 9.6, during the Term the Customer is entitled to obtain and deploy all Updates and Upgrades to the Software which Ydentifi makes generally available, and Ydentifi shall make them available to the Customer. Updates and Upgrades are supplied subject to these Terms; a separately licensed component retains its own licence.

18.4 Ydentifi may alter, improve or discontinue features between versions. Where a feature is discontinued, Ydentifi shall record that fact in the release notes for the version concerned.

18.5 Vulnerability notification by Ydentifi. Ydentifi shall notify the Customer, in accordance with clause 22.4 and within seventy-two hours of becoming aware of it, of any vulnerability or security defect in a version of the Software which is within the period stated in clause 18.2. Notification and disclosure are otherwise governed by the Security and Vulnerability Disclosure Policy.

18.6 Ydentifi produces a software bill of materials in respect of each released artefact and shall make it available to the Customer upon request. Ydentifi operates the coordinated disclosure process described in the Security and Vulnerability Disclosure Policy.

18.7 Cessation of the licensing activity. Ydentifi shall notify the Customer not less than three months before it ceases to license the Software, and shall issue Licence Keys covering the period of that notice.

18.8 Escrow. Where the Order Form so provides, Ydentifi shall deposit the latest version of the Software in executable form, as compiled binaries or container images, with an escrow agent identified upon the Order Form, under an escrow agreement providing for release to the Customer solely upon the opening of insolvency or liquidation proceedings in respect of Ydentifi, or Ydentifi's cessation of the licensing activity, in either case without a transfer under clause 23.1. Material so released may be used solely to continue operating the Customer's own Deployments within the scope of clause 3. Ydentifi is not obliged, in any circumstances, to deliver or disclose the source code of the Software.

18.9 Vulnerabilities in the Mobile Application. Ydentifi shall notify the Customer, in accordance with clause 22.4 and within seventy-two hours of becoming aware of it, of any actively exploited vulnerability in the Mobile Application, of any severe incident affecting its security, and of any other vulnerability or security defect in it which calls for action by End Users, stating the measures End Users should take. Ydentifi corrects defects in the Mobile Application only in its latest version, which is available to End Users free of charge.

19. Force majeure

19.1 Neither party shall be liable for any failure or delay in the performance of an obligation under these Terms to the extent caused by circumstances beyond its reasonable control, including natural disaster, war, armed conflict, act of terrorism, civil unrest, epidemic, act of government, embargo, industrial action affecting a third party, and failure of a power, telecommunications, hosting or transport provider. A party already in default may not rely upon this clause, in accordance with Article 306(1) of the Bulgarian Commercial Act.

19.2 A party unable to perform by reason of such an event shall notify the other in writing within a suitable period, in accordance with clause 22.4 and with Article 306(3) of the Bulgarian Commercial Act, stating the nature of the event and its likely consequences for performance. A party which fails to give that notice is liable for the loss caused by the failure to notify.

19.3 The affected party shall use reasonable endeavours to mitigate the effect of the event and shall notify the other upon its cessation.

19.4 Where such an event prevents performance for a continuous period exceeding sixty days, either party may terminate upon fourteen days' notice, and Ydentifi shall refund the fees attributable to the unexpired portion of the Term.

19.5 This clause does not excuse any failure to make payment.

20. Changes to these Terms

20.1 Ydentifi may amend these Terms in respect of any later Term. No amendment applies to a Term already in progress; the version accepted by the Customer under clause 1.2 in respect of a Term governs that Term until its expiry.

20.2 An amendment takes effect thirty days after publication in accordance with clause 22.1, and applies to the Customer upon its next Renewal.

20.3 Where an amendment is materially adverse to the Customer, the Customer may decline the Renewal, in which case clause 10.4 applies upon expiry of the current Term.

20.4 A Licence Key issued upon a change of tier during a Term is issued for the unexpired remainder of that Term. Neither such a Licence Key nor one issued under clause 10.7 or 18.7 alters the version of these Terms which governs the Customer.

20.5 Clauses 20.1 to 20.4 do not apply where an amendment is required by law, by a regulator or by order of a competent authority, in which case it takes effect as that law or order requires.

20.6 Ydentifi may at any time make corrections which do not alter any right or obligation.

21. Governing law and dispute resolution

21.1 These Terms are governed by the law of the Republic of Bulgaria, excluding its rules of private international law. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

21.2 The parties shall each use good faith endeavours to resolve any dispute by discussion between representatives having authority to settle it, within thirty days of notice of the dispute given by one party to the other.

21.3 Any dispute not so resolved shall be subject to the exclusive jurisdiction of the competent courts of the Republic of Bulgaria, to which each party irrevocably submits.

21.4 Notwithstanding clause 21.3, either party may apply to any court of competent jurisdiction for interim or protective relief, including injunctive relief to restrain a breach of clause 4 or clause 17, where the acts complained of occur or take effect outside the Republic of Bulgaria. An application for such relief does not constitute a waiver of clause 21.3 in respect of the substantive dispute.

21.5 Failure by the parties to hold the discussion contemplated by clause 21.2 does not prevent either party from commencing proceedings, and clause 21.2 is not a condition precedent to the jurisdiction conferred by clause 21.3.

22. Notices

22.1 Notices of general application. Ydentifi gives notice of any matter of general application under these Terms by publication at https://ydentifi.io/legal, including any amendment to these Terms, any variation of published prices and any change to a published policy. A notice so published takes effect upon the date of publication or upon such later date as it may state. The Customer undertakes to consult that address at reasonable intervals.

22.2 The Customer's address for service. The electronic mail address recorded upon the Order Form, or otherwise provided by the Customer in connection with the issue of a Licence Key, is the Customer's address for service of any notice, demand or other communication under these Terms, including any communication of a legal nature. The Customer shall keep that address current, monitored, and capable of receiving communications from Ydentifi. A communication sent to that address is deemed to have been received upon the next Business Day following its despatch, whether or not it is opened, and the Customer may not rely upon its own failure to maintain or to monitor that address. The Customer may substitute an alternative address by notice given under clause 22.3.

22.3 Notices given by the Customer. The Customer gives notice to Ydentifi at legal@ydentifi.io or at Ydentifi's registered office.

22.4 Notices served individually. The following are given to the recipient's address for service (the Customer's under clause 22.2, Ydentifi's under clause 22.3) and not by publication: a notice of breach under clause 10.3; a notice of termination; a notice under clause 10.8 revoking a Licence Key; a notice under clause 18.5 of a vulnerability in the Software; a notice under clause 18.9 of a vulnerability in the Mobile Application; a notice under clause 18.7 of cessation of the licensing activity; a notice under clause 19.2 of an event of force majeure; a communication of the assignment of a receivable; and a notice under clause 23.1 of a transfer.

22.5 Where the party giving notice knows that delivery to the other's address for service has failed, it shall use such other means of contact as are reasonably available to it.

22.6 Records. Any record kept by Ydentifi of a Licence Key issued, a notice given or received under this clause 22, or a report received under clause 11.7 or given under clause 18.5 or 18.9 is evidence between the parties of the matters it records.

23. General provisions

23.1 Assignment and transfer. The Customer shall not assign, novate, subcontract or otherwise transfer these Terms or any right or obligation under them without Ydentifi's prior written consent, such consent not to be unreasonably withheld, save that the Customer may assign these Terms in their entirety to a successor to substantially all of its business or assets upon notice to Ydentifi.

Ydentifi may assign, novate or transfer these Terms, in whole or in part, together with its rights and obligations under them, to:

a company within its Group;
a company which acquires the business or the assets to which these Terms relate; or
a successor arising from a merger, division, change of legal form, transfer of the enterprise,

redomiciliation or other reorganisation of its business.

Where the transfer occurs by universal succession, including upon a merger, division or change of legal form, these Terms pass to the successor by operation of law and no consent is required.

In any other case, the Customer hereby gives its express consent, for the purposes of Article 102 of the Bulgarian Obligations and Contracts Act, to the substitution of a transferee notified to it under this clause as the party owing the obligations under these Terms. Ydentifi shall give the Customer notice under clause 22.4 identifying the transferee. The Customer may withdraw its consent in respect of the named transferee by objecting within fourteen days of that notice, upon reasonable grounds relating to the transferee's ability to perform these Terms. Where the transfer is of Ydentifi's enterprise as a whole, that notice also constitutes notification for the purposes of Article 15(1) of the Bulgarian Commercial Act; and where a receivable is assigned, it constitutes communication for the purposes of Article 99(4) of the Bulgarian Obligations and Contracts Act.

Where the substitution does not take effect, the transferee accedes to these Terms alongside Ydentifi, and the two are jointly and severally liable to the Customer in accordance with Article 101 of the Bulgarian Obligations and Contracts Act.

The transferee shall take these Terms unaltered for the remainder of the Term, and rights already accrued to the Customer are unaffected. Where a transfer would diminish the rights of the Customer under these Terms, the Customer may terminate upon thirty days' notice, and Ydentifi shall refund the fees attributable to the unexpired portion of the Term.

23.2 Survival. Clauses 2, 3.4, 3.8, 4, 5.1, 5.4 to 5.7, 6.3, 6.6, 7.5, 7.6, 7.7, 7.8, 7.9, 9.5, 10.4, 10.9, 11.6, 11.7, 11.8, 11.9, 13, 14.5, 14.6, 14.7, 15, 16, 17, 21, 22 and 23 survive expiry or termination, together with any other provision which by its nature is intended to do so.

23.3 No third-party rights. These Terms are made for the benefit of the parties alone. No other person may enforce them, save that clause 16.2 may be relied upon by a company within the Customer's Group operating a Deployment under clause 3.3.

23.4 Entire agreement. These Terms and the documents identified in clause 1.8 constitute the entire agreement between the parties in respect of the Software and supersede all prior statements and agreements. Each party confirms that it has not relied upon any statement, description or assurance not set out in them. This clause does not limit liability for fraudulent misstatement.

23.5 Severability. If any provision is held invalid or unenforceable, the remainder continues in force, and the invalid provision shall be replaced by the mandatory rule of law which it offends or, where there is none, by the closest valid provision achieving the same commercial purpose.

23.6 No waiver. No failure or delay in enforcing any provision operates as a waiver of it, nor prevents its subsequent enforcement. A waiver is effective only in respect of the instance and purpose for which it is given.

23.7 Export control and sanctions. Each party shall comply with applicable export control and sanctions law. The Software contains cryptography. The Customer represents that it is not located within, and shall not make the Software available within, any country or territory subject to comprehensive sanctions, and that it is not a person upon any list of prohibited or restricted parties. The Customer shall not use the Software for any end use which export control or sanctions law prohibits. Ydentifi may suspend its performance, or terminate these Terms with immediate effect and without liability, where it reasonably determines that continued performance would breach export control or sanctions law.

23.8 No partnership. Nothing in these Terms constitutes either party the agent or partner of the other.

23.9 Language. These Terms are made in the English language, which is the authoritative version. Any translation is provided for convenience only, and in the event of inconsistency the English text prevails.

23.10 Counterparts and electronic execution. An Order Form may be executed electronically and in counterparts, each of which constitutes an original. Written form is satisfied where a statement is recorded technically in a manner permitting its reproduction, in accordance with Article 293(4) of the Bulgarian Commercial Act.

24. Contact

Ydentifi Ltd., Todor Aleksandrov No. 46, floor 2, 2700 Blagoevgrad, Republic of Bulgaria. Company number 208962261. legal@ydentifi.io