1.1. These GTC constitute the basis for LINK’s provision of services to the Customer by electronic means, as required in art. 8 item 1 point 1 of the Act of 18th July 2002 on the provision of services by electronic means (consolidated text: Dz.U.2024.1513 with later amendments). Moreover, these GTC constitute the template of the agreement within the meaning of art. 384 et seq. of the Polish Civil Code, and they are made available free of charge to the Customer before entering into an agreement under URL address www.smsapi.com.

1.2. The GTC specify the principles and technical conditions for entering into and executing the Agreement (the “Agreement”), whose subject matter is the Customer’s access to and use of the services provided by electronic means, named “SMSAPI System”, especially through the website available on the Internet under URL address www.smsapi.com (the “Website”).

1.3. The Customer is obliged to get acquainted with the content of theses GTC and adhere to the GTC and the addendums thereto-an integral part to the GTC. Customer’s acknowledgement and acceptance of the aforementioned provisions shall be indicated through the declaration submitted during the registration of the Account in the SMSAPI System. The Customer shall be obliged to ensure that all Users get acquainted with the content of these GTC and adhere to the GTC and the addendums thereto.

1.4. For the purposes of the GTC, the following definitions are established:

a. SMSAPI System – an automated system for sending and/or receiving Messages by the Customer to/from End Users of Customer’s choice, that is made available by electronic means, especially through the Website.

b. Website – in accordance with point 1.2.

c. Account – the profile of the Customer created in the SMSAPI System that includes the identification data provided by the Customer. The Account has a unique login (user name) and password.

d. Services – SMSAPI service/s provided by LINK to the Customer under these GTC.

e. LINK (or “Service Provider”) – LINK Mobility Poland Sp. z o.o., with its registered office in 44-117 Gliwice, Poland, ul. Toszecka 101. Link Mobility Poland sp. z o.o., considering its partner and linked enterprises, having regard to the definition included in the Attachment no. 1 to the Commission Regulation (EU) No 651/2014 of 17th June 2014 declaring certain categories of aid compatible with the internal market in application of Articles 107 and 108 of the Treaty, shall be considered as a large enterprise in the meaning of the Act of 8th March 2013 on counteracting undue delays in commercial transactions.

f. Customer (or “Service Recipient”) – a natural or legal entity that is a party to the Agreement with LINK and qualifies as an entrepreneur (przedsiębiorca) within the meaning of Article 43¹ of the Polish Civil Code, who acquires and uses the Services solely in the direct course of its business or professional activity, and for whom the conclusion of the Agreement is of a professional nature. The SMSAPI Service is made available exclusively to business customers (B2B). Accordingly, natural persons conducting business activity as sole proprietors who intend to acquire the Services for purposes not directly related to their business or professional activity, or for whom the conclusion of the Agreement is not of a professional nature within the meaning of Article 385⁰ of the Polish Civil Code, shall not be entitled to register an Account or use the SMSAPI Service. The Customer represents and warrants that it acquires and uses the Services solely for the purposes of its own business or professional activity and not in the capacity of a consumer or a consumer enjoying statutory protection equivalent to that afforded to consumers under applicable law.

g. User – a natural person who has been authorized by Customer to log in and use the Services on Customer’s behalf (including the Customer that is a natural person).

h. Operator – any telecommunication operator, aggregator, Internet Service Provider (ISP) etc., which LINK cooperates with through SMSAPI System.

i. End-User – any subject that uses or requests a publicly available electronic communications service for their own purposes (as a rule a recipient of a message);

j. Agreement – in accordance with point 1.2. as well as point 3.1. and 3.2.

k. Postpaid Agreement – in accordance with point 4.4.1.

l. Pricing Appendix – in accordance with point 4.4.1.

m. Settlement Period – in accordance with point 4.4.1.

n. Remuneration – in accordance with point 4.4.3.

o. Monthly Minimum Fee – in accordance with point 4.4.3.b.

p¹. Subscription Fee – in accordance with point 4.4.3.d

p. Initial Limit – in accordance with point 4.4.6.

q. Point – Prepaid Point, Postpaid Generated Point, or Postpaid Settlement Point

r. Prepaid Point – in accordance with point 4.3.2.

s. Prepaid Package – in accordance with point 4.3.3.

t. Postpaid Generated Point – in accordance with point 4.4.2.

u. Postpaid Settlement Point – in accordance with point 4.4.2. and 4.4.6.

v. Message – an electronic communication comprising numerals and/or text and/or audio and/or videos and/or other medias as applicable, which is composed by the Customer and conveyed to be sent through SMSAPI System to an End-User, or composed by an End-User and conveyed to be sent through Operators’ networks by SMSAPI System to the Customer.

w. Content – an information contained in a text message or any binary message, including any executable code, or any multimedia message comprising text, audio or video, numerals, symbols, animation, graphics, photographs and other materials in digital electronic form, provided to LINK by the Customer, as well as any information contained in a Message conveyed by the Customer to be sent by the use of the Services, or any other information that Customer conveys to be sent by LINK.

x. Sender Name – identifier (if applicable) of the Customer as the sender of the Messages at the beginning of Message’s Content (e.g. company/brand name), representing a combination of letters and/or numbers. Sender Name can be up to 11 characters long. Acceptable characters are: a-z A-Z 0-9 . & @ - + _ ! % # [space] *, (valid phone number is not acceptable). Each Sender Name chosen by the Customer may require to be verified by LINK’s customer support team, as well as the Customer may be required to provide any additional statements or documents, in particular in the case of usage of a company/brand name, trademarks etc. Approval of the Sender Name chosen by the Customer depends entirely on LINK’s own discretion. LINK is entitled to reject the chosen Sender Name as well as to make approval of the Sender Name conditional on meeting additional requirements. Adding a Sender Name may also be subject to further limitations and may result in additional fees, of which LINK will inform the Customer before they are charged.

y. Special Characters – the characters NOT included on the following list: @£$¥èéùìòÇØøÅå_^{}\[~]|ÆæÉ!"#¤%&'()*+,-./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZÄÖÑܧ¿äöñüà and "space" and "enter".

z. Individual Message – a single SMS Message or one part of a related SMS Message. In case of an Individual Message sent in FAST Option, a multiplier 1.5 shall be applied (1 Individual Message FAST = 1.5 Individual Messages).

aa. SMS Message – a text or binary Message as defined in GSM 03.38 Specification. LINK applies the customary commercial usage of universal standards for GSM networks, including in particular the usage of the 7-bit alphabet – GSM 03.38, i.e., 3GPP TS 23.038 (originally GSM recommendation 03.38), and the 16-bit alphabet – UCS-2, i.e. Universal Coded Character Set defined within the standard ISO/IEC 10646, depicting the standard “Unicode”. Whenever any dispute regarding the usage of one or the other of the aforementioned alphabets rises, the 16-bit alphabet – UCS-2 shall be applicable and any and all calculations for initiated by the Customer number of SMS Messages for sending shall be based on the latter.

For the purposes of calculating the number of SMS Messages and their length (single (stand-alone) Message or related (connected) SMS Messages), the following rules shall apply:

Length of a single (stand-alone) SMS Message: 1) without Special Characters: contains maximum 160 characters;* 2) with Special Characters: contains maximum 70 characters.* *The characters ^ { } [ ] ~ \ | € as well as “enter” are counted as two characters.

Length of a related (connected) SMS Message: 1) without Special Characters: contains maximum 153 characters;* 2) with Special Characters: contains maximum 67 characters.* *The characters ^ { } [ ] ~ \ | € as well as “enter” are counted as two characters.

Calculating the number of related SMS Messages: N = n / 153 (without Special Characters) or M = m / 67 (with Special Characters), rounded up to the nearest integer. *The characters ^ { } [ ] ~ \ | € as well as “enter” are counted as two characters.

bb. SMS PRO Message – SMS Message, initiated from a Sender Name approved by LINK, as long as LINK’s connection to a given destination operates an alphanumeric Sender Name (otherwise the message may be sent with a numeric Sender Name, universal Sender Name, or not be sent). The correct sending of SMS PRO Message is dependent on the Customer meeting the requirements of the Operator. The verification of such requirements is each time the responsibility of the Customer (such verification shall include, in particular, sending of test messages, and the Customer’s confirmation of their proper delivery; the Customer shall inform LINK about the planned sending of test messages).

cc. FAST Option – Messages with “FAST Option” chosen, treated as priority and settled with multiplier 1.5 in relation to the base rate.

dd. HLR Number Check – service that allows to verify the home GSM network of a given number.

ee. Confidential Information – any provision of the Agreement or information disclosed by either party in any form, before, during and/or after execution of the Agreement, relating in particular to the provision of Services or any details to either party’s business, whether marked as confidential or identified as confidential in any other way, including, but not limited to information on: network access codes, trade secrets, processes, techniques, software (including source codes and object codes), computer records, hardware configuration, designs, plans, developments, inventions, drawings, product information, business or marketing plans and projections, details of agreements or arrangements with third parties and customers, and customers’ lists.

ff. Provision of the Services by Electronic Means – provision of the Services without simultaneous presence of both parties (from the distance), through the transfer of data on the recipient’s request, sent and received by means of electronic equipment for processing (including digital compression) and storage of data, which is entirely sent, received or transmitted by the means of a telecommunication network, within the meaning of the ECL.

gg. Means of Electronic Communication – technical solutions, including the teleinformation devices and the software tools cooperating with them, allowing individual communication at distance by using data transmission between the teleinformation systems, especially the electronic mail.

hh. Teleinformation System – a set of computer devices cooperating with each other and the software, which makes it possible to process and store, as well as send and receive the data through the telecommunication networks, by means of a terminal appropriate for the given type of network, within the meaning of the ECL.

ii. Technical Specification – the collection of specifications and/or technical information and requirements with regard to LINK’s Teleinformation System, necessary for the use of this system for the purposes of the provision of Services. The Technical Specification constitutes an appendix to the GTC and is available at smsapi.com/docs.

jj. Electronic Communications Legislation – Directive (EU) 2018/1972 of the European Parliament and of the Council (European Electronic Communications Code), and any local implementations in national law, as well as any other applicable EU or national legislation regulating the electronic communications/telecommunications sector, including in particular the Act of 12th July 2024 Law on Electronic Communication (Dz.U.2024.1221 with later amendments, “ECL”) and the Law on combating abuse in electronic communications (Dz.U.2023.1703 with later amendments).

kk. Data Protection Legislation – EU General Data Protection Regulation 2016/679 (“GDPR”) and the EU Directive on privacy and electronic communications (“ePrivacy Directive”), and national provisions on the protection of privacy in the country in which the controller or processor is established, as amended, replaced or superseded from time to time, including laws implementing or supplementing the GDPR and ePrivacy Directive. Terms defined in the GDPR article 4 shall be understood in accordance with the GDPR definition.

ll. KSeF – (i.e. the National e-Invoicing System) a government system of the Ministry of Finance enabling the issuance, receipt and archiving of structured invoices in XML format; it applies to Clients who, in accordance with applicable law, are required to receive structured electronic invoices; excluded from KSeF are, inter alia, pro forma invoices, interest notes, simplified invoices up to PLN 450 (until the end of 2026), and invoices issued to natural persons not conducting business activity (B2C).

mm. KSeF-Covered Client – means an entity conducting business activity that has the status of an active value added tax (VAT) taxpayer or benefits from VAT exemption, having its registered office or a fixed place of business in the territory of Poland, which – in accordance with applicable law – is obliged to receive structured invoices via the National e-Invoicing System (KSeF).

nn. Non-KSeF-Covered Client – means an entity that does not meet the conditions specified for a KSeF-Covered Client and which, under applicable law, is not obliged to receive structured invoices via KSeF; this includes, in particular, entities without a registered office or a fixed place of business in Poland, natural persons not conducting business activity, and other entities legally excluded from the obligation to receive invoices in KSeF.

2.1. The GTC cover LINK’s provision of the Services by electronic means to the Customer and Customer’s access and the use of SMSAPI System, especially through the Website.

2.2. The access defined in point 2.1 above is provided with the use of an Account assigned to the Customer (operating via its Users).

2.3. The Customer is obliged to take all appropriate measures to secure that no unauthorized access to the Account, Services and Content is exercised. The Customer is not entitled to make the Account access data in the form of login (user name) and password, or any other authorization data (ie. API credentials, OAuth tokens) available to third parties, unless otherwise agreed. If Account information is made available to third parties, or the Customer becomes aware of anything else that may jeopardize the security and integrity of the Services, the Customer shall immediately change such Account information, and immediately notify LINK. If any Account access data is made available to third parties, the Customer holds strict liability for all consequences of making such data available to third parties.

2.4. Unless otherwise agreed, the Customer is required to actively use the Account at least once during a period of 12 (twelve) consecutive months. In the case LINK identifies a lack of activity on the Account based on prepaid settlement, for a period longer than 12 consecutive months, the Account, and all related data, may be removed or suspended by LINK without prior notification.

2.5. The Customer is not allowed to transfer Account or share its usage to/with another entity without LINK’s prior express consent.

3.1. Access to and use of SMSAPI System requires an agreement to be in place between the parties. The Agreement is entered into by the Customer’s registration of the Account in the SMSAPI System.

3.2. Within 7 days from the date of registration of the Account In the SMSAPI System, LINK is entitled to reject such a registration, which is tantamount to the withdrawal from the Agreement specified in point 3.1, and results in the return of the equivalent of the Prepaid Points as specified in point 4.3.2, which have been purchased and not utilized by the Customer until such withdrawal. For the purposes of Account registration and/or Services control, the Customer is obliged, upon each request from LINK, to provide the necessary information and documents enabling the verification of the Customer’s identity (in particular confirmation of a bank transfer made for verification purposes) and confirmation of their authorization to enter into the Agreement. LINK is entitled to verify Customer’s data provided at the Account. For avoidance of any doubt, successful registration of the Customer’s Account and conclusion of the Agreement depends entirely on LINK’s own discretion and corporate policies. LINK is not obliged to provide any statement or reason for Account’s non-registration or Agreement’s rejection.

3.3. By the registration of the Account, the Customer provides certain contact information. LINK is entitled to send to the Customer’s address, e-mail address or via telephone number, given at the registration, all information (incl. notifications) connected with the Agreement or the performance thereof, as well as the functioning of the SMSAPI System and/or the Services, including also information on educational activities (e.g. training, webinars related to SMSAPI System). Until provision of new contact information in a proper manner, the contact information given at the registration shall be regarded as applicable for contact / notification / exchange of information with the Customer.

4.1. For the provision of services, LINK is entitled to a remuneration as stipulated hereunder.

4.2. Payment shall be made based on either prepaid or postpaid settlement, as specified in point 4.3-4.4, whereas the default form shall be prepaid. If, due to the specific nature of the Customer’s business, the Customer requests the configuration, integration or customization of functionalities or preparation of additional documentation, LINK may, subject to its technical and organizational capabilities, perform such customization or provide such support. Such activities may be subject to additional fees, separate from the fees for the Services, the amount of which shall be presented to the Customer in each case before the commencement of their performance.

4.3. 4.4. Prepaid settlement.

4.3.1. Prepaid settlement shall be deemed as a default form of payment.

4.3.2. Settlement of the remuneration shall be based on the points purchased by the Customer (“Prepaid Point(s)”). Within SMSAPI System one Prepaid Point has the nominal value equivalent to EUR 1.00 (one Euro), VAT excluded, unless clearly stated otherwise. This value can be utilized only for the acquisition of the Services within the functionalities of SMSAPI System, i.e. in particular for sending and/or receiving of Messages.

4.3.3. In order to pay for the Services the Customer shall purchase Prepaid Points within the functionalities of SMSAPI System-either as separate Prepaid Points, or as a package of Prepaid Points (“Prepaid Package”).

4.3.4. The Customer shall pay the single net price of EUR 1.00 (one Euro), VAT excluded, for one Prepaid Point (EUR 1 = 1 Point). At the time of purchase of Prepaid Points/ Prepaid Package, the net price paid by Customer-resident of Poland for tax purposes, shall be increased by the relevant VAT rate (example: a Prepaid Package containing 100 Prepaid Points is offered on SMSAPI System for the price of EUR 100 and upon its purchase by Customer-resident of Poland for tax purposes, they shall pay EUR 123 for it (when VAT rate amounts to 23%)).

4.3.5. The Prepaid Points shall be automatically settled upon initiation by the Customer of Messages’ sending via the SMSAPI System and/or usage of additional services available on SMSAPI System, in accordance with the applicable LINK price list. The Customer hereby agrees that in case the Customer has any overdue payments resulting from the Postpaid Agreement, any payment resulting from the purchase of Prepaid Points may firstly be set off by LINK against the settlement of Postpaid Agreement.

4.3.6. The settlement rate of points required for initiation of Messages’ sending/ usage of additional services, as referred to in point 4.3.5 above, depends primarily on the type of Message and the Operator to which network it is directed. The Customer is obliged to check the current applicable settlement rate before initiating the sending process of the Message/ the usage of any additional services available within the SMSAPI System.

4.3.7. LINK is entitled to change the settlement rates i.e. number of Prepaid Points required for a given type of Message or for additional services within the SMSAPI System, at any time and without prior notice. The aforementioned changes shall not require the approval by the Customer for their effectiveness/applicability. The applicable rates shall be those of the date when the Customer uses the Services.

4.3.8. The payments for the purchased Prepaid Points/ Prepaid Packages shall be made: a) by the electronic service for on-line electronic payments; b) by bank transfer made from Customer’s bank account to LINK’s bank account, whereas prior to making any payments via bank transfer, the Customer must generate a pro-forma invoice.

4.3.9. The SMSAPI System enables activating the automated re-charge of the Account by the means of the electronic service for on-line electronic payment. The Customer shall be fully and exclusively liable for the consequences of activating the automated re-charge of the Account.

4.3.10. Upon request of LINK, the Customer shall provide proof of: (a) payment (bank document); (b) ownership of the bank account (the bank account must be owned by and opened in the name of the Customer).

4.3.11. The sale and subsequent activation/settlement of the purchased Prepaid Points/ Prepaid Package depends on the receipt and confirmation by LINK of the entire price as per the applicable price list. Each purchase shall be confirmed by a VAT invoice. The rules for issuing and delivering invoices: a. Delivery via KSeF: VAT invoice deemed delivered at the moment it is assigned an identification number in the KSeF system. For Clients not covered by KSeF, deemed delivered upon being made available in the Account. b. KSeF failure or unavailability (offline mode): LINK shall issue invoices in offline mode marked with QR codes; date of receipt is the date it is actually received by the Client. c. Total KSeF failure: LINK shall issue invoices in electronic form outside KSeF system without QR codes.

4.5. Postpaid settlement.

4.4.1. Postpaid settlement shall be available only after conclusion of a separate agreement between the Parties (“Postpaid Agreement”) and shall be effected in monthly settlement periods corresponding to calendar months (each, a “Settlement Period”). The Postpaid Agreement shall be accompanied by a pricing appendix (the “Pricing Appendix”), setting out the commercial terms applicable to the provision of the Services. To the extent that any matter is not expressly regulated in the Pricing Appendix, the price list made available through the Account and/or on the Website shall apply on a supplementary basis.

4.4.2. Unless specified otherwise, the settlement of the remuneration shall be based on the rates for one Message, depending on the number of Postpaid Generated Points, generated by the Customer in this month (1 Individual Message/ 1 HLR Number Check = 1 “Postpaid Generated Point”). If the Customer maintains more than one Account under a single Agreement, the number of Postpaid Points shall be determined separately for each Account. Volumes generated under individual Accounts shall not be aggregated for the purpose of determining the applicable pricing, rates or settlement thresholds. The ultimate amount of compensation due is settled in conversion to the “Postpaid Settlement Points”.

4.4.3. The Customer is obliged to pay LINK, for each and every Settlement Period, a remuneration (“Remuneration”) comprising of: a) the amount equal to the product of multiplying the number of Messages sent by the Customer in a given Settlement Period, and the rate assigned to one Message in accordance with the Pricing Appendix; b) the Monthly Minimum Fee instead of the amount specified in point a) above-in case the amount calculated in accordance with point a) above is lower than monthly minimum fee specified in the Pricing Appendix; c) the amount constituting a remuneration for additional services (i. from the Pricing Appendix; ii. from the price list for additional services published on the Account and/or on the Website); d) the Subscription Fee for providing access to SMSAPI System, calculated pursuant to principles and in the amount specified in the Pricing Appendix.

4.4.4. LINK is entitled to change the remuneration due for one Message/ other Service, as specified in the Pricing Appendix, upon the one month’s notice, effective at the end of a calendar month. The Customer shall be informed of the remuneration’s change by e-mail notice. Should the Customer not accept the remuneration’s change, they are entitled to terminate the Agreement, effective at the end of a calendar month, whereas to be valid the notice of termination must be delivered to LINK in writing within 14 days from the date when the notice of remuneration’s change is sent by LINK.

4.4.5. The Remuneration shall be paid within 14 days from the date the VAT invoice is issued by LINK, by a bank transfer made to a bank account indicated on the invoice. Unless the Parties expressly agreed otherwise, LINK is entitled to set a shorter payment period, which shall nevertheless be at least 5 days from the date VAT invoice is issued.

4.4.6. The Customer is eligible to utilize, in a given Settlement Period-within the postpaid settlement-such number of Postpaid Settlement Points that does not exceed the Initial Limit specified in the Pricing Appendix. The Customer may request LINK to increase the Initial Limit by sending e-mail to the address: support@smsapi.com. LINK reserves the right to condition the increase in the Initial Limit upon the Customer’s payment of a Deposit in an amount specified by LINK in an e-mail.

4.4.7. In case of any delay in payment, LINK shall be entitled to: a) bringing a claim before the court having jurisdiction over LINK’s registered office and charge statutory interest for late payment in commercial transactions; and b) limit or stop the Provision of Services to the Customer (both settled postpaid and prepaid), including also the decrease in the Initial Period-until the date of total payment of the amount due; and c) charge compensation for debt recovery costs incurred in connection with internal debt collection conducted by LINK; and d) charge of the Customer for debt recovery costs incurred by LINK in connection with the referral of the debt for external debt collection (such costs shall amount to 20% of the value of unpaid or partially paid invoices); and e) request settlement of any further claims LINK may be entitled to under the applicable law (including in particular the supplementary damages).

4.4.8. Following termination of the Postpaid Agreement, the default form of settlement shall be prepaid.

4.6. The Points (prepaid, postpaid generated, postpaid settled) are a digital content that can be used only in a limited way, i.e. in order to acquire only the limited range of the Services and/or settle the Services. The Points cannot be used in any other way than specified in this section. To the extent permitted by law, the Points are subject neither to exchange, nor transfer to another Account, nor return, and moreover, they might have an expiration date assigned to them, which depends on the respective purchased Package/separate Points.

4.7. LINK shall not be liable for any fees, commissions or other additional costs incurred by the Customer or applied by his bank, or by any electronic payment system, in connection with the transaction, including-but not exclusively-costs incurred in relation with any currency exchange rate applied.

4.8. LINK shall not be liable for any interruptions in functioning of bank systems, electronic payment systems or any other external payment service providers’ systems.

4.9. Prices, and any other Remuneration’s components, may be subject to annual adjustment equivalent to the increase in the average monthly gross wage and salary in enterprise sector index (including profit sharing payments), published by Statistics Poland (GUS) for the previous year. No prior notification of this change shall be required for its effectiveness.

4.10. For Customers covered by KSeF, the invoice shall be issued and transmitted/made available/archived in digital form via KSeF together with the identification number assigned to such invoice in the KSeF system, subject to the provisions of clause 4.3.11(c). For Customers not covered by KSeF, the VAT invoice shall be delivered in electronic form by making it available in the Account, and alternatively by sending it to the e-mail address provided by the Customer upon Account registration.

4.11. Any provision of the GTC, including also any fee due under the GTC, shall neither exclude nor limit LINK’s right to pursue in the full amount any claims LINK may be entitled to under the applicable law.

5.1. The Agreement is entered into for an indefinite period of time unless otherwise specified.

5.2. Each party may terminate the indefinite-time Agreement upon one-months’ notice, effective at the end of a calendar month. The notice requires for its effectiveness to be sent by the Customer to the e-mail: support@smsapi.com, or by LINK to the e-mail address indicated by the Customer by Account’s registration, or provided later at the Account. Nevertheless, notice of termination of the Agreement based on postpaid settlement, in order to be valid, must be made in writing. Customer’s instruction to delete the Account based on prepaid settlement, shall be considered as a notice of termination of the Agreement.

5.3. The Agreement based on postpaid settlement, including the Postpaid Agreement, is entered into for a definite period of time, until the last day of the 24th month following the month of the Agreement/ Postpaid Agreement conclusion, unless Parties agreed in writing another term of the Agreement. Unless mandatory rules of the law stipulate otherwise, the Customer is not entitled to terminate the Agreement/ Postpaid Agreement during the fixed-term.

5.3.1. After the date of expiry of the period referred to in point 5.3, the Agreement/ Postpaid Agreement, shall be automatically extended for an indefinite period of time. Each party may give the other party a notice of the intention to not continue the Agreement/ Postpaid Agreement, effective at the end of the period referred to in point 5.3. The notice shall be delivered to the other party not later than 30 days before the expiry of the period referred to in point 5.3. The notice requires for its effectiveness to be made in writing.

5.3.2. After the date of expiry of the 30-days period referred to in point 5.3.1, each party may terminate the Agreement/ Postpaid Agreement upon one-month notice, effective at the end of a calendar month. The notice requires for its effectiveness to be made in writing. The e-mail form, as specified in point 5.2, shall not be valid.

5.3.3. In each case the Agreement/ Postpaid Agreement is terminated before expiration of the fixed-term for which it has been concluded, LINK shall be entitled to charge an additional fee equal to the product of multiplying the number of months for which the Agreement/Postpaid Agreement was to be in force and the sum of all fees incurred by the Customer periodically, including in particular the Monthly Minimum Fee and the Subscription Fee, which does not exclude or limit LINK’s right to claim supplementary compensation.

5.3.4. For avoidance of any doubt, for each and every matter related to the termination of the Agreement based on postpaid settlement, that is not regulated in point 5.3.-5.3.3. above, in the Postpaid Agreement, or, where applicable, in any other relevant agreements, rules relevant to Agreement based on prepaid settlement shall be applied.

5.4. LINK may terminate the Agreement (prepaid or postpaid) without prior notice in the following cases: a) If, at LINK’s own discretion, continuation of the provision of the Services is not commercially justifiable or in the event of an objective impossibility or significant difficulty for LINK to provide completely or partially the Services; b) In case of any identified breach under these GTC or applicable legislation; c) If the Customer is suspected to have provided false or misleading information; d) If there are justified grounds to suspect that the Customer becomes insolvent or is unable to pay its debts as they fall due; e) If the Customer’s Account based on prepaid settlement has been inactive for 12 consecutive months.

5.5. To the extent permitted by law, LINK does not return the equivalent of Points not utilized by the Customer before the termination of the Agreement, nor any payment/ costs related to Points’ purchase, unless clearly stated otherwise.

6.1. The Customer accepts and agrees that all use of Services is subject to the following:

6.1.1. The Customer accepts and agrees that regardless of the relations between the Customer and any third parties the Customer shall be considered a sole sender of the Messages incoming from the Customer’s Account.

6.1.2. Customer shall ensure that before any Message is sent or any Content is made available, all necessary rights, authorizations, licenses, consents, and permissions have been obtained or granted in accordance with applicable law.

6.1.3. The Customer shall use the Services in accordance with any user instructions and other policies and guidelines provided by LINK. Notwithstanding the above, the correct sending of Messages is dependent on the Customer meeting the requirements of the Operator. The verification of such requirements is each time the responsibility of the Customer (such verification shall include, in particular, sending of test messages, and the Customer’s confirmation of their proper delivery; the Customer shall inform LINK about the planned sending of test messages).

6.1.4. The Customer shall ensure that Users comply with this Agreement. In any case, Customer is entirely liable for User’s acts and omissions.

6.2. The Customer is obliged to abstain from abusing/misusing the Services, including but not limited to:

6.2.1. indicating false or misleading denoting of the sender;

6.2.2. sending Messages to End-Users without legal basis according to applicable law or not in compliance with the provisions of the applicable law;

6.2.3. allowing the Services to be used for communication through unregulated channels (such as P2P, grey routes) and/or sending Messages not for Customer’s own commercial purposes;

6.2.4. sending more than 20 messages to the same telephone number within 60 seconds;

6.2.5. using the Services for sending Messages constituting SPAM/ phishing/ smishing etc. under the common standards or guidelines, or under the applicable law, and/or sending Messages as follows: a) that are unsolicited, in particular Messages that contain unsolicited commercial information, within the meaning of the Electronic Services Act of 18 July 2002; b) which Content serves (implicitly or explicitly) any purposes related to charity, advertising services/products of any Operator and/or gambling, within the meaning of the Gambling Game Act of 19 November 2009r; c) which Content may be considered phishing i.e. any and all Messages, which sender claims either to be an entity, which they are not, or to act on behalf of an entity, on which behalf they are not entitled to act.

6.2.6. delivering by or to the Teleinformation Systems, and/or including also SMSAPI System, any data/information/Content that: a) causes interferences in the operation of or overloads the Teleinformation Systems of LINK or any third party that takes direct or indirect part in providing the Services; b) infringes the rights, policies, and/or interests of LINK, third parties, commonly accepted social norms, as well as using the Services not in compliance with the law applicable at the place of sending or at the place to which the Message is sent; c) advertises or promotes service/s that use value-added numbers, which are connected with collecting increased charges for messages or subscription of payable service, in particular Premium SMS.

6.2.7. using the Services for the dissemination of political advertising within the meaning of Regulation (EU) 2024/900 of the European Parliament and of the Council of 13 March 2024 on the transparency and targeting of political advertising. Where the Customer intends to use the Services to transmit content that may constitute political advertising or that is related to political activity, electoral or referendum processes, the Customer shall be required to contact LINK’s Customer Service in advance. Any such transmissions shall be subject to prior approval by LINK, which may be conditional upon the provision of additional information or documents confirming that the intended communications comply with applicable law. LINK shall be entitled to refuse or block any transmission if it considers that it constitutes political advertising or may result in a breach of applicable law.

6.3. Should the Customer be in breach with point 6.1 or 6.2, LINK shall be entitled to refrain from providing the Services to the Customer, without having to terminate the Agreement, regardless of other rights to which LINK is entitled.

6.4. As of the day of the termination of the Agreement between the parties, the Customer is obliged to stop using the SMSAPI System.

6.5. LINK has a right of control over the fulfillment of the Customer’s obligations under the Agreement and at its own discretion may suspend the Account of the Customer.

6.6. The Customer is solely and entirely responsible for the form and the Content of Messages being sent with the use of the SMSAPI System.

6.7. Customer is solely responsible for choice of End-User, and for providing LINK with correct End-User contact information (telephone number, e-mail address, etc.). Any and all cost incurred as a consequence of incorrect choice of End-User, or incorrect End-User contact information, in particular resulting in sending Messages to non-existent or incorrect recipients, shall be covered in whole by Customer.

6.8. Customer accepts and understands that any cost or loss incurred due to Customer’s non-compliance with the requirements in this section shall be carried in whole by Customer.

7.1. LINK reserves the right to conduct Teleinformation System related maintenance works, which may cause difficulties or make it impossible for the Customer to use the Services. The dates for and expected durations of such maintenance works will be published on the Website or sent by e-mail before the beginning of said works. If possible, LINK shall endeavor to conduct maintenance works simultaneously on only one out of two access points. In case of technical integration, the Customer shall ensure in their solution the use of both access points at any time.

7.2. In special cases that may influence safety or stability of the Teleinformation System (in particular malfunctions or other not planned interruptions in the proper functioning of the services), LINK has a right to temporarily stop or limit the provision of the Services, without prior notification, as well as to conduct the maintenance works aiming at recovering the safety or stability of the Teleinformation System.

7.3. Difficulties or lack of possibility to use the Services because of the reasons indicated in point 7.1 or 7.2 shall not justify any claims against LINK.

8.1. LINK ensures the confidentiality of the Content of the Messages initiated for sending through the Services, as well as of the information on the entities by and to which the Messages are sent, unless such information is in the public domain as a matter of principle or its disclosure is necessary for the correct provision of the Services. The Information as referred to above may be revealed only in accordance with the applicable law.

8.2. LINK takes the matters of protection and security of personal data seriously and will process such information in accordance with applicable Data Protection Legislation and the Agreement. In order to provide the Services, LINK may process personal data about Users and others who access the Services. LINK may disclose personal data to third parties as set out in the Agreement.

8.3. The way of dealing with personal data, scope and responsibilities of LINK in the processing of personal data are described in the Data Processing Appendix, which constitutes a written agreement for entrusting the processing of personal data between LINK and the Customer, i.e., a documented instructions in accordance with art. 28, par. 3 (a) of GDPR.

8.4. The security requirements regarding the processing of personal data by the processor are set out in the Security Appendix.

8.5. In order to facilitate the Services, contact details as part of the Account shall be provided for various purposes, e.g. accounting/financial, technical support, marketing, etc. The Customer is obliged to properly inform all individuals/Users who have been or will be listed in the Account about the fact of providing their data within the Services and about their rights as data subjects.

8.6. The Customer, the User/s, and persons who have been listed in the Account, have the right to access and correct their personal data and request discontinuation of the processing.

8.7. The Customer, User/s, and other persons who have been listed by the Customer in the Account may be informed of: a) changes in the GTC, price lists or privacy policy; b) changes directly related to the provision of services within the SMSAPI System; c) payment status for the performed Services; d) activities of the educational nature or related to the operation or improvements of the SMSAPI System.

8.8. Any Information related to the mentioned in the section above may be sent, depending on the need, via one of the available channels, by processing the contact data provided in the Account.

8.9. LINK is not liable for any processing of personal data performed by any of the payment service providers.

8.10. To the extent permitted by law, LINK shall not be liable for damage incurred by the Customer or third parties as a result of the personal data processing when the Customer is in non-compliance with the provisions of this section, other provisions of the GTC, the Agreement, or, where applicable, any other related agreement. In case any such claim arises, the Customer shall be obliged to immediately satisfy such claim. Should LINK be obliged to satisfy such claim-the Customer is obliged to immediately indemnify LINK against it.

8.11. Other relevant information on personal data processing is available in the privacy statement/policy of the SMSAPI System.

9.1. The Customer must not use any Confidential Information, nor disclose it to any person, neither during nor after the term of the Agreement, except for the use or disclosure for the performance of the Customer’s rights or obligations under the Agreement, or if required by applicable law.

9.2. The Customer shall treat as confidential and protect Confidential Information concerning LINK with a degree of care at least equivalent to the protection of its own Confidential Information.

9.3. Confidential Information shall not include information that is: a) already in the possession of the receiving party without an obligation of confidentiality; or b) rightfully provided to the receiving party by a third party without a breach of any separate nondisclosure obligation; or c) already publicly available without breach of the Agreement.

10.1. The Services are provided “as is”. LINK shall endeavor to realize the messaging properly, but it does not guarantee the delivery of each and every message (in particular, but not exclusively, in the case the Message can not be delivered to the End User, or the Message is blocked in relation to the breach of point 6.2).

10.2. To the extent permitted by law, LINK disclaims all warranties, either expressed or implied, statutory or otherwise, including without limitation warranties of functionality, fitness for a particular purpose or non-infringement.

10.3. LINK does not warrant that the Services will be error-free, that the use of the Services will be uninterrupted or error-free. The Customer accepts and agrees that Messages may not reach the intended recipient, and that the Customer carries all risks related to the use of the Services.

11.1. The Customer shall indemnify LINK against all damages, losses, costs, expenses and other claims because of a third party arguing that the use by the Customer of any derivate work, created by using the Content or the Services, constitutes an infringement of any Intellectual Property Rights. The Customer shall bear full responsibility for the type, content, quality and organization of the Customer service, including the Content of the Messages sent. The Customer’s liability for breach of the Agreement shall not be limited in any way, unless it is required by the applicable law.

11.2. LINK, to the extent permitted by the applicable law, shall not be liable for errors and breaks in the provision of the Services that result in particular from failures or incorrect functioning of the Teleinformation Systems, unless they are caused by circumstances attributable entirely and exclusively to a proven case of intentional misconduct or gross negligence.

11.3. LINK shall not be liable for the lack of possibility to access the Services that results from incorrect registration or unsuccessful login attempt by the Customer/User, or for the consequences of the capture of logon data by any third party. Moreover, LINK shall not be liable for the consequences of activating the automated re-charge of the Account by the means of the electronic service for on-line electronic payment.

11.4. LINK shall not be liable for indirect damages, including also lost benefits or profits.

11.5. The above restrictions do not apply to damages caused by fraud, gross negligence or intentional misconduct.

11.6. LINK’s total aggregate liability to the Customer, resulting from the legal relationship covered by the Agreement, or in any other case these GTC apply to, within each twelve (12)-month period, will in no event exceed the fees paid (paid amounts for purchased Points/packages) by the Customer in the period of 12 consecutive months prior to the date of the event giving rise to this liability, excluding Operator fees and taxes relevant to the Customer for the same period of time.

11.7. In the case of damage or loss, LINK has, in particular, a right to claim auxiliary compensation.

11.8. Any provision of the GTC must not be interpreted as either excluding or limiting LINK’s right to pursue in the full amount any claims LINK may be entitled to under the applicable law.

12.1. Complaints may be submitted in the event of non-performance or improper performance of the Services, failure by LINK to meet the agreed Service commencement date due to reasons attributable to LINK, or incorrect calculation of fees for the provision of the Services.

12.2. LINK provides the following channels for submitting complaints: in writing (by postal mail or courier delivery to LINK’s registered office address), by email sent to: bok@smsapi.pl, or by telephone at +48 32 7 201 200. LINK indicates that the preferred forms for submitting complaints are electronic and written forms.

12.3. LINK shall confirm receipt of the complaint via any of the communication channels indicated in section 12.2 within 14 days of its submission.

12.4. If the Client submits a complaint, the preferred method of communication regarding that complaint, including providing a response and any request to remedy formal deficiencies, shall be the method specified by the Client in the complaint. If the Client does not specify such method, LINK may communicate: a) using the contact method previously indicated by the Client during the term of the Agreement, or b) on a durable medium, in particular to the Client’s email address, or c) using the same method by which the complaint was submitted.

12.5. If LINK identifies formal deficiencies in the complaint, LINK shall promptly request the Client to remedy such deficiencies using the appropriate communication method specified above, setting a deadline of no less than 7 days from the date of receipt of the request. A complaint supplemented within the prescribed deadline shall have effect from the date of its original submission.

12.6. The maximum period for submitting a complaint is 12 months from the end of the billing period in which the interruption of the Service occurred, or from the date on which the Service was improperly performed or was to have been performed, or from the date of delivery of the invoice containing an incorrect calculation of the Service fees. Complaints submitted after this period shall be left unexamined.

12.7. A complaint submitted in accordance with Article 378 of the Electronic Communications Law should include in particular: a) the Client’s full name or business name and residential or registered office address; b) specification of the subject matter of the complaint and the relevant period; c) description of the circumstances justifying the complaint; d) the email address assigned to the Client’s Account and the tax identification number (NIP) in the case of business clients; e) the method by which the response to the complaint should be delivered; f) the Client’s signature, in the case of complaints submitted in writing.

12.8. LINK shall examine complaints within 30 days from the date of their submission. If LINK’s response to the complaint was not delivered to the Client, LINK shall, at the Client’s request and no later than within 3 business days from receipt of such request, resend the response using the method specified by the Client in that request.

12.9. The response to the complaint shall include in particular: LINK’s name and contact details, information on whether the complaint has been accepted or rejected, and, if the complaint is accepted, the amount of compensation, other payable amount, or refund granted, along with the payment date, which shall be no later than 30 days from the date the complaint is accepted, or information that the amount will be credited towards future payments.

13.1. Pursuant to recital 259 of EECC’s preamble, art. 102, para 1, 2, 3 and 5 of EECC, if the Customer is a microenterprise, small enterprise, or not for profit organisation, it hereby explicitly waives the right to: (a) have the Agreement made available to the Customer in a durable medium; (b) have a summary of the Agreement provided to the Customer; and (c) be notified when the usage of the Services based on volume or time limits reaches the limits of the Customer’s tariff plan, if applicable.

13.2. In addition, pursuant to art. 105, para 1 and 2 of EECC, the Services purchased by the Customer may set out a commitment period. In the event this period is longer than the maximum statutory period, the Customer hereby explicitly waives the right to a shorter commitment period.

13.3. If the Customer does not wish to waive the foregoing rights, it shall contact LINK’s customer support team.

14.1. LINK reserves the right to conduct a compliance review (remote audit) regarding the Customer’s use of the Services to verify the Customer’s compliance with the Terms and Conditions. This review may involve requesting documentation or information from the Customer. If an audit reveals non-compliance by the Customer, the Customer shall remedy such breach immediately after receipt of notice from LINK. Such remedy shall be without prejudice to any other rights or remedies applicable under the Agreement.

14.2. The Customer agrees to place its name, trade mark and/or logo on the LINK’s website. The Customer authorizes LINK to place its name, trade mark and/or logo in internal materials used for the needs of LINK, as well as in other information, promotional and marketing materials.

14.3. These GTC do not authorize LINK to use, in any other manner than the one resulting from the GTC, the Agreement or any other related agreement, trademarks, advertising slogans, trade names or other intellectual property rights to which the Customer is entitled.

14.4. All declarations of the parties which are related to the Agreement shall be sent to the addresses of the Customer or other persons listed in the Account, or to e-mail addresses as indicated by the Account’s registration, or provided later at the Account. The Customer is however also obliged to immediately inform LINK about any changes of the contact data, by sending e-mail to the address: support@smsapi.com. By the time LINK expressly confirms the update of the Customer’s data, all notices served at the contact data set out in the Account shall be considered validly served regardless if they are received.

14.5. LINK reserves the right to monitor, store and archive Messages sent via the Services, as well as the IP addresses of devices from which Messages are sent, in accordance with applicable law, which the Customer acknowledges and accepts. Data shall be retained solely on the basis of applicable legal provisions and may be used, in particular, for the purpose of documenting the sending of Messages in the event of a dispute or a finding of a breach of these Terms and Conditions.

14.6. If any provision of these GTC, appendices thereto, the Agreement, or any other related agreement, is deemed invalid or ineffective, in whole or in part, this shall not prejudice the validity of other provisions. The provision deemed invalid or ineffective shall be replaced by such a provision that to the fullest possible extent allowed by the law achieves the purpose of the replaced provision.

14.7. These GTC, in a version of 21.07.2026, shall become effective from 21.08.2026. These GTC replaces in whole the “General Terms and Conditions for electronic services available at www.smsapi.com [version of 14.03.2026]”, and any of their previous or changed versions, together with any and all attachments thereto. Postpaid Agreements concluded on the basis of the prior versions of the GTC shall remain valid and effective, whereby they shall be interpreted in accordance with the provisions of these GTC. Should the Customer not accept the GTC’s change, they are entitled to terminate the Agreement, effective on 21.08.2026, whereas the notice of termination, in order to be valid, must be delivered to LINK in writing or in an electronic form /qualified electronic signature/ no later than the effective date of such amendments, and not earlier than 30 days from the date when the notice of GTC’s change is sent by LINK, and must be additionally delivered to LINK by e-mail within the same timeframe.

14.8. LINK reserves the right to introduce changes to the GTC. Should the Customer not accept the material GTC’s change, they are entitled to terminate the Agreement, effective on the date when the GTC’s change becomes effective, whereas the notice of termination, in order to be valid, must be delivered to LINK in writing or in an electronic form /qualified electronic signature/ no later than the effective date of such amendments, and not earlier than 30 days from the date when the notice of GTC’s change is sent by LINK, and must be additionally delivered to LINK by e-mail within the same timeframe.

14.9. The appendices to these GTC are its integral part and an integral part the Agreement between the parties, hereunder in particular: a) Appendix no. 1 – Data Processing Appendix; b) Appendix no. 2 – Security Appendix; c) Appendix no. 3 – Scope Appendix; d) Appendix no. 4 – Standard Contractual Clauses Appendix; e) Appendix no. 5 – the Technical Specification available at smsapi.com/docs

14.10. The GTC and the Agreement shall be governed and interpreted under the laws of Poland.

14.11. In the absence of an amicable solution any dispute arising out of or in connection with these GTC or the Agreement must be brought to the court competent for LINK’s registered address.

1. Introduction

This Data Processing Agreement (“DPA”) is entered into by LINK and the Customer, and constitutes an integral part of an Agreement (“Agreement”) between the parties, concluded within the framework of “LINK General Terms and Conditions for electronic services available at www.smsapi.com(“GTC”), together with the Scope Appendix, the Security Appendix; the Standard contractual clauses (“SCC”) Appendix and any other agreed appendices.

When the data exporter, as defined in the SCC appendix, is based in Switzerland, the references to the GDPR in the SCC should be understood as references to the Federal Act on Data Protection of 19 June 1992 and its revised version of 25 September 2020 (FADP) insofar as the data transfers are subject to the FADP.

“Data Protection Legislation” shall mean the EU General Data Protection Regulation 2016/679 (“GDPR”) and the EU Directive on privacy and electronic communications (ePrivacy Directive), and national provisions on protection of privacy in the country in which the Controller or Processor is established, as amended, replaced or superseded from time to time, including laws implementing or supplementing the GDPR and ePrivacy Directive. Terms defined in the GDPR article 4 shall be understood in accordance with the GDPR definition.

2. Scope and commitment

The Parties agree and acknowledge that, in LINK’s performance of services under the Agreement, processing or personal data on customer’s behalf will take place. Customer therefore appoints LINK as data processor. The terms and conditions of data processing are set forth in this DPA. LINK guarantees that it will implement appropriate technical and organizational measures in such a manner that LINK’s processing will meet the requirements of the Data Protection Legislation and ensure the protection of the rights of the Data Subject.

This DPA covers processing of personal data when LINK processes on the Customer’s behalf as processor (GDPR Article 28.3) or, if the Customer is itself a processor, as a sub-processor (GDPR Article 28.4).

For the purpose of this DPA, Customer shall hold the obligations of Controller, and is fully responsible towards a controller on whose behalf it processes Personal Data by use of LINK’s services. Reference to the “Controller” herein will therefore in all cases be a refer to the Customer.

Subject to the Customer being based in Third Country located outside the European Union (EU) or the European Economic Area (EEA) and without an adequacy decision by the European Commission, the SCC Appendix, Module four shall apply to the processing activities requiring personal data transfers from LINK as processor to the Customer.

LINK as processor, its Sub-processors, and other persons acting under the authority of LINK who have access to the Personal Data shall process the Personal Data only on behalf of the Controller and in compliance with the Agreement and the Controller’s documented instructions, and in accordance with the DPA, unless otherwise stipulated in the Data Protection Legislation. LINK shall inform the Controller if, in LINK’s opinion, an instruction infringes the Data Protection Legislation.

3. Obligations of the controller

The Controller warrants that the Personal Data is processed lawfully, for specified, explicit and legitimate purposes. The Controller will not instruct LINK to process more Personal Data than required for fulfilling such purposes. The Controller is responsible for ensuring that a valid legal basis for processing as defined in the Data Protection Legislation (ref. GDPR Article 6.1) exists at the time of transferring the Personal Data to LINK. If such legal basis is consent (ref. GDPR Article 6.1 (a)) the Controller warrants that any consent is given explicitly, voluntarily, unambiguously and on an informed basis.

In addition, the Controller warrants that the Data Subjects to which the personal data pertains have been provided with information required under the Data Protection Legislation (ref. GDPR article 13 and 14) on the processing of their Personal Data.

4. Confidentiality

LINK ensures that its employees, its Sub-processors, and other persons who process the personal data under the authority of LINK have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. The Controller is subject to a duty of confidentiality regarding any documentation and information, received by LINK, related to LINK or LINK’s Sub-processors’ implemented technical and organizational security measures.

5. Security

The security requirements applying to LINK’s processing of Personal Data is governed by the Security Appendix.

6. Access to Personal Data and fulfilment of Data Subjects’ rights

Unless otherwise agreed or dictated by applicable law, the Controller is entitled to request access to personal data being processed by LINK on behalf of the Controller. If LINK, or a sub-processor, receives a request from a Data Subject relating to processing of Personal Data processed on behalf of the Controller, LINK shall send such request to the Controller, for the Controller’s further handling thereof, unless otherwise stipulated in statutory law. Taking into account the nature of the processing, LINK shall assist the Controller by appropriate technical and organizational measures to fulfil the Controller’s obligation to respond to requests for exercising the Data Subject’s rights stipulated in Data Protection Legislation.

7. Other assistance to the Controller

If LINK, or a Sub-processor, receives a request for access or information from the relevant supervisory authority relating to the registered Personal Data or processing activities subject to this DPA, LINK shall notify the Controller, for the Controller’s further processing thereof, unless LINK is entitled to handle such request itself. If the Controller is obliged to perform a Data Protection Impact Assessment and/or Prior consultation with the supervisory authority in connection with the processing of Personal Data under this DPA, LINK shall provide assistance to the Controller, taking into account the nature of the processing and the information available to LINK. LINK shall provide reasonable assistance and documentation to be used in Controller’s independent risk assessment in relation to use of Sub-processors or Transfer of Personal Data to a Third Country.

8. Notification of Personal Data Breach

LINK shall notify the Controller without undue delay after becoming aware of a Personal Data Breach. The Controller is responsible for notifying the Personal Data Breach to the relevant supervisory authority in accordance with GDPR article 33. The notification to the Controller shall be sent to the e-mail indicated by the Account’s registration, or provided later at the Account, in accordance with the Agreement concluded under GTC, and as a minimum describe (i) the nature of the Personal Data Breach including where possible, the categories and approximate number of Data Subjects concerned; (ii) the likely consequences of the Personal Data Breach; (iii) the measures taken or proposed to be taken by LINK to address the Personal Data Breach.

9. Transfer to Third Countries

Transfer of Personal Data to countries located outside the European Union (EU) or the European Economic Area (EEA) and without an adequacy decision by the European Commission, hereunder by disclosure or provision of access, may only occur in case of documented instructions from the Controller. For transfer to sub-processors in Third Countries, the documented instructions are described in section 10 below, and is subject to EUs standard contractual clauses as provided in the SCC Appendix, Module three - transfers from LINK as processor to a sub-processor in a Third Country.

10. Use of sub-processors

The Controller agrees that LINK may appoint another processor, hereinafter referred to as sub-processor, to assist in providing the services and processing Personal Data under the Agreement, provided that LINK ensures that the data protection obligations as set out in this DPA and in Data Protection Legislation are imposed upon any Sub-processor by a written agreement; and that any Sub-processor provides sufficient guarantees that they will implement appropriate technical and organizational measures to comply with Data Protection Legislation. LINK shall remain fully liable to the Controller for the performance of any Sub-processor.

Applicable sub-processors are listed in Scope Appendix. LINK may update the list to reflect any addition or replacement of Sub-processors by notification to the Customer at least 3 months prior to the date on which such Sub-processor shall commence processing of Personal Data. Any objection to such changes must be provided to LINK within 3 weeks of receipt of such notification or publication on the website. By entering into this DPA, the Customer grants LINK authority to secure any legal basis for Transfer to Third Countries for any Sub-processor approved in accordance with the procedure stipulated above.

11. Audits

LINK shall, upon request, provide the Customer with documentation of implemented technical and organizational measures to ensure an appropriate level of security, and other information necessary to demonstrate LINK’s compliance with its obligations under the DPA and relevant Data Protection Legislation. Controller and the supervisory authority under the relevant Data Protection Legislation shall be entitled to conduct audits, including on-premises inspections and evaluations of Personal Data being processed. Controller shall not be given access to information concerning LINK’s other customers and information subject to confidentiality obligations. Controller is entitled to conduct such audits one (1) day per year, upon no less than two weeks’ notice.

12. Term and termination

The DPA is valid for as long as LINK processes Personal Data on behalf of the Controller. In the event of LINK’s breach of the DPA or non-compliance of the Data Protection Legislation, the Controller may (i) instruct LINK to stop further processing of Personal Data with immediate effect; and/or (ii) terminate the DPA with immediate effect.

13. Effects of termination

LINK shall, upon the termination of the DPA delete all the Personal Data to the Controller unless otherwise stipulated in applicable law. Customer accepts and understands that Personal Data is accessible by it until termination, should Customer require copies of such data before deletion. Upon Customer’s request, LINK shall document in writing to the Controller that deletion has taken place in accordance with the DPA.

14. Breach of the DPA and Limitation of liability

Each party’s non-conformity with requirements set out in this DPA shall be regarded as a breach of the Agreement by that party, and the party shall ensure that breach is remedied without delay. The party in breach shall update the other party on measures adopted to remedy the non-conformity. Neither party shall be liable to the other party for errors caused by the other party’s systems or actions, negligence or omissions, or by general internet or line delays, power failure or other error outside the parties’ reasonable control. Liability limitations in the Agreement apply to liability under this DPA and the SCC Appendix.

15. Notices and amendments

All notices relating to the DPA shall be submitted in writing to the email address indicated by the Account’s registration, or provided later at the Account, in accordance with the Agreement concluded under GTC. In case changes in Data Protection Legislation, a judgement or opinion from another authoritative source causes another interpretation of Data Protection Legislation, or changes to the services under the Agreement require changes to this DPA, LINK will propose implementation of such changes into the DPA.

16. Governing law and legal venue

The Agreement’s terms regarding governing law, dispute resolution method and legal venue agreement shall apply if the location is within the EU or EEA. In other cases, the governing law shall be Polish, and the legal venue shall be the courts of LINK’s registered address.

Requirement for information security

LINK, who according to the Agreement and DPA processes Personal Data on behalf of the Controller, shall implement appropriate technical and organizational measures as stipulated in Data Protection Legislation and/or measures imposed by relevant supervisory authority pursuant to Data Protection Legislation or other applicable statutory law to ensure an appropriate level of security. LINK shall assess the appropriate level of security and take into account the risks related to the processing in relation to the services under the Agreement, including risk for accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Person Data transmitted, stored or otherwise processed.

This Appendix contains a general description of technical and organizational measures that shall be implemented by LINK to ensure an appropriate level of security. To the extent LINK has access to such information, LINK shall provide the Controller with general descriptions of its Sub-processors’ technical and organizational measures implemented to ensure an appropriate level of security.

Technical and organizational measures

Physical access control

LINK will take proportionate measures to prevent unauthorized physical access to LINK’s premises and facilities holding Personal Data. Measures shall include: Procedural and/or physical access control systems; Door locking or other electronic access control measures; Alarm system, video/CCTV monitor or other surveillance facilities; Logging of facility entries/exits; ID, key or other access requirements.

Access control to systems

LINK will take proportionate measures to prevent unauthorized access to systems holding Personal Data. Measures shall include: Password procedures (including e.g. requirements to length or special characters, forced change of password on frequent basis etc.); Access to systems subject to approval from HR management or IT system administrators; No access to systems for guest users or anonymous accounts; Central management of system access; Routines of manual lock when workstations are left unattended, and automatic lock within maximum 5 minutes; Restrictions on use of removable media, such as memory sticks, CD/DVD disks or portable hard drives, and requirements of encryption.

Access control to data

LINK will take proportionate measures to prevent unauthorized users from accessing data beyond their authorized access rights, and to prevent the unauthorized access to or removal, modification, or disclosure of Personal Data. Measures shall include: Differentiated access rights, defined according to duties; Automated log of user access via IT systems.

Data entry control

LINK will take proportionate measures to check and establish whether and by whom Personal Data has been supplied in the systems, modified or removed. Measures shall include: Differentiated access rights based on duties; Log of user access, and frequent review of security logs to uncover and follow-up on any potential incidents; Ensure that it is possible to verify and establish to which bodies Personal Data have been or may be transmitted or made available using data communication equipment; Ensure that it is possible to verify and establish which Personal Data have been entered into data-processing systems, altered or deleted, and when and by whom the Personal Data have been input, altered or deleted.

Disclosure control

LINK will take proportionate measures to prevent unauthorized access, alteration or removal of Personal Data during transfer of the Personal Data. Measures shall include: Use of state-of-the-art encryption on all electronic transfer of Personal Data; Encryption using a VPN or HTTPS for remote access, transport, and communication of Personal Data; Audit trail of all data transfers.

Availability control

LINK will take proportionate measures to ensure that Personal Data are protected from accidental destruction or loss. Measures shall include: Frequent back-up of Personal Data; Remote storage; Use of anti-virus/firewall protection; Monitoring of systems in order to detect virus etc.; Ensure stored Personal Data cannot be corrupted by means of malfunctioning of the system; Ensure that installed systems may, in the case of interruption, be restored; Uninterruptible power supply (UPS); Business Continuity procedures.

Separation control

LINK will take proportionate measures to ensure that Personal Data collected for different purposes are processed separately. Measures shall include: Restrictions on access to Personal Data stored for different purposes based on duties; Segregation of business IT systems.

Job/subcontractor control

LINK shall implement measures to ensure that, in the case of commissioned processing of Personal Data, the Personal Data is processed strictly in accordance with the Controller’s instructions. Measures shall include: Unambiguous wording of contractual instructions; Monitoring of contract performance.

Training and awareness

LINK shall ensure that all employees are aware of routines on security and confidentiality, through: Unambiguous regulations in employment contracts on confidentiality, security and compliance with internal routines; Internal routines and courses on requirements of processing of Personal Data to create awareness.

Scope of the processing

The DPA concerns LINK’s processing of Personal Data on behalf of the customer in connection with provision of messaging services. The Messaging Services include Controller’s access to LINK’s solutions for managing messaging to message recipients chosen by Controller for purposes and frequency as chosen by Controller by use of the service. The Agreement will provide further insight into the specific type of messaging services provided to Controller under the Agreement.

Categories of Data Subjects

The categories of Data Subjects whose personal data may be processed under the DPA are defined by controller. The processing involves processing of Personal Data related to Controller’s end-users (recipients and/or senders of messages depending on the Controller’s use of the services under the Agreement).

Types of Personal Data

The Processing relates to the following categories types of Personal Data, subject to the Controller’s concrete use of the services: Basic Personal Data, such as name, contact details such as email, phone number etc.; Location data, such as GPS, Wi-Fi location data and location data derived from LINK’s network (that is not traffic data as defined below); Traffic data: personal data processed in relation to the conveyance of communication on an electronic communications network or billing thereof; Data related to content of communication, such as e-mails, voice mails, SMS/MMS, browsing data etc.

Special categories of Personal Data, such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership or health data, will be processed under the DPA if the services are used by customer to process such data.

Subject-matter of the processing

The subject-matter of LINK’s processing of personal data on the customer’s behalf is the provision of services to the Customer that require processing of personal data. Personal data will be subject to processing activities as specified in the Agreement.

Duration of the processing

The processing will continue for the duration of Customer’s contract with LINK. LINK will retain Personal Data for as long as it is necessary to fulfil the purposes for processing.

Nature of the processing

Personal data will be processed by Customer entering the data into LINK’s platform, either through its access to LINK’s platform, or by providing data to LINK employees in order for them to enter data to the customer’s area of the platform. The data will further be processed in order for messages to be set up as required by customer, and the list of recipients to be correct, before the process for sending the defined messages to the defined recipients is initiated.

Purpose of the processing

The purpose of engaging LINK to process personal data on customer’s behalf is for customer to fulfil its requirements for communication towards recipients.

Sub-processors

The Sub-processors approved under the DPA are listed in the LINK Mobility sub-processors list – LINK Mobility International (https://linkmobility.com/list/). The DPA is regarded as an instruction from Customer to transfer Personal Data to the listed sub-processors.

(as per COMMISSION IMPLEMENTING DECISION (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council)

between: LINK, and its affiliates established within EEA, hereinafter “data exporter”, and The Customer (MODULE FOUR) or the respective Sub-processor in Third Country (MODULE THREE), hereinafter “data importer”.

The SCC text is found at: Publications Office (europa.eu) (https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32021D0914&from=EN)

The Data exporter and Data importer enter into SCC with the following modules:

MODULE ONE: Transfer controller to controller: No. MODULE TWO: Transfer controller to processor: No. MODULE THREE: Transfer processor to processor (if and to the extent applicable): Yes (in case of a sub-processor in Third Country) / No (in case of Customer in Third Country). MODULE FOUR: Transfer processor to controller (if and to the extent applicable): Yes (in case of Customer in Third Country) / No (in case of a sub-processor in Third Country).

Specifications relevant to MODULE THREE: Transfer processor to processor

Clause 7 – The Parties agree that this clause shall be included: Docking clause (a) An entity that is not a Party to these Clauses may, with the agreement of the Parties, accede to these Clauses at any time. (b) Once it has completed the Appendix and signed Annex I.A, the acceding entity shall become a Party to these Clauses. (c) The acceding entity shall have no rights or obligations arising under these Clauses from the period prior to becoming a Party.

Clause 9 – Option 2 GENERAL WRITTEN AUTHORISATION shall apply: The data importer has the controller’s general authorisation for the engagement of sub-processor(s) from an agreed list. The data importer shall specifically inform the controller in writing of any intended changes to that list by the addition or replacement of sub-processors at least 3 months in advance.

Clause 11 – The optional part of the clause shall not be included.

Clause 17 – Option 1 shall apply: These Clauses shall be governed by the law of one of the EU Member States, provided such law allows for third-party beneficiary rights. When the data exporter is based in Switzerland: Switzerland (if subject to FADP only) or Norway (if subject to both FADP and GDPR).

Clause 18: Any dispute arising from these Clauses shall be resolved by the courts of an EU Member State. When the data exporter is based in Switzerland: Switzerland or Norway as above.

Specifications relevant to MODULE FOUR: Transfer processor to controller

Clause 7 – Docking clause shall be included. Clause 11 – The optional part of the clause shall not be included. Clause 17 – Option 1 shall apply. Clause 18: As above.

A. LIST OF PARTIES

MODULE THREE and MODULE FOUR: Transfer processor to processor / Transfer processor to controller

Data exporter(s): 1. Name: Link Mobility Poland Sp. z o.o. and its affiliates as listed in the “Subsidiary companies” section on LINK Mobility sub-processors list (https://linkmobility.com/list/). Address: ul. Toszecka 101, 44-117 Gliwice, Poland and Link Mobility Poland Sp. z o.o.’s affiliates’ addresses as listed in the “Subsidiary companies” section on LINK Mobility sub-processors list. Contact person’s name, position and contact details: DPO: Jan Wieczorkiewicz, dpo@linkmobility.com. Activities relevant to the data transferred under these Clauses: provision/use of communication services towards recipients. Role: processor(s).

Data importer(s) relevant to MODULE THREE: 1. Name: name of Sub-processor in Third Country as listed in LINK Mobility sub-processors list (https://linkmobility.com/list/). Address and contact details: as listed in LINK Mobility sub-processors list. Activities: provision/use of communication services towards recipients. Role: processor.

Data importer(s) relevant to MODULE FOUR: 2. Name: name of the Customer under the meaning of the GTC. Address: address of the Customer, provided as contact information in the Customer’s Account according to the GTC. Contact details: as provided by the Customer in the contact information in the Customer’s Account according to the GTC. Activities: provision/use of communication services towards recipients. Role: processor.

B. DESCRIPTION OF TRANSFER

MODULE THREE: The processing involves processing of personal data related to end-users of data exporter’s Customer (recipients and/or senders of messages depending on the data exporter’s Customer use of the services under the Agreement). MODULE FOUR: The processing involves processing of personal data related to data importer’s/controller’s end-users (recipients and/or senders of messages depending on the data importer’s/controller’s use of the services under the Agreement).

Categories of personal data transferred: Basic Personal Data (name, contact details such as email, phone number etc.); Location data (GPS, Wi-Fi location, location data derived from LINK’s network); Traffic data; Data related to content of communication (e-mails, voice mails, SMS/MMS, browsing data etc.). Special categories of personal data such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership or health data may be applicable.

The frequency of the transfer: continuous basis. Nature of the processing: as described in Scope Appendix. The period for which the personal data will be retained: for the duration of Customer’s contract with LINK.

C. COMPETENT SUPERVISORY AUTHORITY

MODULE THREE: The supervisory authority with responsibility for ensuring compliance by the data exporter with Regulation (EU) 2016/679 is the one competent in the state in which the data exporter is established. When the data exporter is based in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC) and the Norwegian Data Protection Authority apply as described in the SCC Appendix.

ANNEX II – Technical and Organisational Measures

MODULE THREE: Transfer processor to processor. Description of the technical and organizational measures implemented by the data importer(s) to ensure an appropriate level of security: the Security Appendix applies respectively.