MAIN SERVICES AGREEMENT
This Main Services Agreement (MSA) governs Customer’s acquisition and use of SALESmanago services. Capitalised terms have the meaning as set forth in the definitions herein. This MSA applies to the Agreements concluded on or after 03.04.2025 unless specifically agreed with the Customer. Archived versions of the MSA are available below.
By accepting this Main Services Agreement or by executing an Order Form that references this MSA, Customer agrees to the terms of this MSA. If the individual accepting this MSA is accepting on behalf of a company or other legal entity, such individual represents that they have the authority to bind such entity to these terms and conditions, in which case the term “Customer” shall refer to such entity. If the individual accepting this MSA does not have such authority or does not agree with these terms and conditions, such individual must not accept this MSA and may not use the services.
I. DEFINITIONS
“Account” means an account enabling the use of the Services, understood as the use of a selected package.
"Active Contact" means a contact within the Customer’s or the end-customer’s website database who meets at least one of the following criteria within 180 days:
E-mail Communication Permission: The contact has explicitly granted permission to receive email communications from the Customer or the end-customer;
SMS Communication Permission: The contact has explicitly granted permission to receive SMS (text message) communications from the Customer or the end-customer;
Web Push Permission and Profile Creation: The contact has:
- Granted permission to the Customer or the end-customer to receive web push notifications from the Customer or the end-customer;
-A profile that has been successfully created within the SALESmanago platform;
Recent Purchase Activity: The contact has registered an external event of type "Purchase" within the past 180 days;
Recent Cart Activity: The contact has registered an external event of type "Cart" within the past 180 days.
“Agreement” means the agreement concluded between the Customer and SALESmanago on the basis of the Order Form and the MSA.
“Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with the Party. The definition also includes “related parties” within the meaning of the Polish Act of 29 September 1994 on accounting.
“Confidential Information” means all confidential information disclosed by either Party (“Disclosing Party”) to the other Party (“Receiving Party”), whether orally or in writing, that is designated as confidential or that reasonably should be understood as confidential given the nature of the information and the circumstances of disclosure. However, Confidential Information will not include any information that (i) is or becomes generally known to the public without breach of any obligation owed to the Disclosing Party, (ii) was known to the Receiving Party (including its directors, officers, employees, contractors or agents) prior to its disclosure by the Disclosing Party without breach of any obligation owed to the Disclosing Party, (iii) is received from a third party without breach of any obligation owed to the Disclosing Party, or (iv) was independently developed by the Receiving Party.
“Onboarding Services” means the Services, including implementation Services, provided to the Customer in accordance with the Terms of Onboarding Services, attached as Appendix no. 3 to the MSA.
“Customer” means the individual, a company or other legal entity which has entered into Order Forms.
“GDPR” means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
“MSA” means this Main Services Agreement.
“Order Form(s)” means an ordering document specifying the Services to be provided under said document that is entered into between Customer and SALESmanago, including any annexes and supplements to it.
“Parties” means the Customer and SALESmanago.
“Password” means a sequence of signs, including alphanumeric, necessary to perform an authentication process while accessing the Account, determined by the User during the registration process.
“Personal Data Protection Regulations” means the regulations regarding processing of Personal Data including GDPR and The Personal Data Protection Act.
“Personal Data” means any information relating to an identified or identifiable natural person according to the Personal Data Protection Regulations.
“SALESmanago” means Benhauer sp. z o. o. based in Cracow, address: ul. Stanisława Klimeckiego 4, 30- 705 Kraków, NIP: 676 244 77 54, entered into the Register of Entrepreneurs of the National Court Register kept by the District Court for Kraków Śródmieście in Kraków, XI Commercial Division of the National Court Register under KRS entry: 0000523346, with a share capital in the amount of PLN 1 407 450.00.
“Services” means the services that are ordered by Customer under an Order Form and made available online by SALESmanago including electronic services within the meaning of the Electronic Provision of Services Act of 18 July 2002 (Dz.U.2020.344 t.j., with subsequent amendments) which consist in: (i) providing the User an Account and (ii) enabling to use the System through the Account, including providing the User profile.
“System” means the online Customer Engagement Platform.
“The Personal Data Protection Act” means the Act of 10 May 2018 on the Protection of Personal Data (Dz.U. 2019.1781 t.j. with subsequent amendments).
“Third Party Provider” means a provider of Third Party Services approved by SALESmanago.
“Third Party Services” means the services provided by a Third Party Provider to Customer in connection with the use of the System.
“User profile” means an arrangement that can store information, made available by SALESmanago within the ICT system, that enables the User to enter, store and modify data necessary for proper usage of the features of the System. This information is provided to the System voluntarily and solely by the User.
“User” means a natural person above 18 years of age with legal capacity who uses Services on behalf of the Customer.
II. SUBJECT MATTER OF THE MSA
SALESmanago grants the Customer a non-exclusive, non-transferable right and licence to use the System available at www.salesmanago.com, which collects behavioural and transactional data about the Customer’s clients and delivers personalised communications across all marketing channels.
SALESmanago will provide Services described in the Order Form, including Onboarding Services (if applicable).
SALESmanago may, at its own discretion, temporarily provide the Customer with additional functionalities of the System free-of-charge (hereinafter referred to as “Additional Functionalities”). Customer agrees that SALESmanago, in its sole discretion and for any or no reason, may terminate Customer’s access to the Additional Functionalities or any part thereof. Customer agrees that any termination of Customer’s access to the Additional Functionalities may be without prior notice, and Customer agrees that SALESmanago will not be liable to Customer or any third party for such termination. Notwithstanding the “Liability” section below, the Additional Functionalities are provided “as-is” without any warranty and SALESmanago shall have no indemnification obligations nor liability of any type with respect to the Additional Functionalities unless such exclusion of liability is not enforceable under applicable law in which case SALESmanago’s liability with respect to the Additional Functionalities shall not exceed EUR 100.
In the event that the Customer decides to enter into an agreement regarding the sending of SMS messages, the terms and conditions available here1will apply.
III. CUSTOMER SERVICE AND TRAINING
The Customer can use the support Service available at support@salesmanago.com with a maximum response time of 24 hours free-of-charge.
SALESmanago enables the Customer to participate in free weekly online training on the use of the System carried out by SALESmanago Specialists.
IV. RESPONSIBILITIES OF THE PARTIES
SALESmanago will provide Services with the due diligence required.
Each Party agrees to keep in confidence any Confidential Information disclosed by the other Party, not to use any Confidential Information belonging to the other Party for any purpose outside the scope of the Agreement and to limit access to Confidential Information to those of its directors, officers, employees, contractors, subcontractors and agents who need such access for the purpose of the Agreement. The confidentiality obligations shall remain in effect for the term of the Agreement and 5 years after its termination. Either Party may disclose Confidential Information if it is compelled by the applicable law to do so, provided it gives the other Party prior notice of such compelled disclosure (to the extent legally permitted) and reasonable assistance to contest the disclosure. SALESmanago reserves the right to share data, including Confidential Information, with its Affiliates for commercial purposes including analysis, compilation of summaries or marketing or sales activities (including offering) subject to an obligation of confidentiality under similar conditions.
The Customer is obliged to use the System in compliance with the rules of law and in good faith, including compliance with SALESmanago Marketing Automation Anti-Spam Policy as described below.
While using the Services, the Customer is obliged, in particular to:
use the System in a way that does not violate the SALESmanago’s intellectual property rights, especially in a way that does not distort its functioning, in particular through the use of certain software or devices;
keep the Password secret and make every effort to prevent third parties from gaining possession of the Password; and
not using the System for the purpose of any illegal activity.
The Customer is responsible for:
any User’s use and/or misuse of the Service;
the legality, reliability, integrity, accuracy and quality of its data; and
the integration between its resources and the System.
The minimum technical requirements which enable using the Services and/or the System are as follows:
Services available through the Customer's website (widgets): any modern browser which supports HTML5, CSS3, JavaScript, cookie files, LocalStorage, Web Push notifications, and is not restricted from accessing the resources located on SALESmanago infrastructure.
Services available through salesmanago website (admin panel): access to the internet, the latest version of one of the following web browsers: Google Chrome, Mozilla Firefox with a default configuration.
At the time of signing the Agreement, the System is compatible with the above requirements. Temporary incompatibility may result from changes made by third-party vendors. SALESmanago will exercise due professional care in ensuring the continued compatibility of the System.
The Customer may choose to obtain Third Party Services to use with features within the System (e.g. applications) and/or for implementation or onboarding service. In this regard, the Customer will be required to obtain access to Third Party Services from Third Party Providers. The Customer agrees to comply with the terms and conditions of the Third Party Services and the policies and guidelines pertaining thereto. Notwithstanding the foregoing, SALESmanago does not assume any responsibility for the Third Party Services, the terms of which have been regulated directly between the Customer and the Third Party Provider and specifically disclaims any liability, warranty, and obligation with respect to such Third Party Services, whether or not it is recommended or approved by SALESmanago, or otherwise noted. SALESmanago may terminate the cooperation with any Third Party Provider at any time without reason or change the Third Party Provider and such change shall not constitute a breach of the Agreement. SALESmanago assumes no responsibility for: (i) claims arising from the combination of any Services with any other products, services, hardware, data or business processes or use of Services by Customer other than in accordance with the Agreement; and (ii) for any amendment or modification to the Services not carried out by SALESmanago or one of its approved partners.
The Customer shall only use the Services for its own internal business operations. The Customer acknowledges and agrees that it will not allow any third party, including Customer’s vendors and service providers, to access or use the Services unless such third party is allowed access for the purpose of providing authorised customer support services or in connection with Customer’s appropriate use of the Services for its business purposes.
SALESmanago reserves the right to temporarily or permanently restrict the functionality of the System in the event that the Customer violates generally applicable laws or the Agreement (and this restriction does not affect the remuneration payable to SALESmanago).
SALESmanago reserves the right to suspend the dispatch of messages planned by the Customer via the System when:
there is a risk that a significant decrease in the deliverability of messages sent via the SALESmanago will occur in connection with that dispatch, or
the dispatch will or may adversely affect the reputation of SALESmanago's dispatch servers, or
the dispatch will or may negatively affect the reputation of the SALESmanago brand, or
the dispatch does not comply with generally accepted good email marketing practices including SALESmanago Marketing Automation Anti-Spam Policy as described below.
SALESmanago for security reasons, reserves the right to block any Account in the System that has not been logged in correctly for a period of 2 years (and this restriction does not affect the remuneration payable to SALESmanago). The Customer will be informed well in advance if the account is to be blocked for this reason.
For some of the System's functionalities, there may be quantitative and qualitative limits specified in the System (e.g. a certain number of uses per month). If the specified limit is reached, the respective functionality may not be available until the conditions for the provision of a new limit are met. Concurrently, the Customer agrees that, where applicable, an additional paid limit shall be automatically triggered upon reaching the assumed limit, without requiring further confirmation from the Customer.
V. FEE AND PAYMENTS
The Customer will be charged a fee for the Services under the detailed price list described in the Order Form. Some fees may be calculated on the basis of the number of contacts or Active Contacts, which shall be determined in the Order Form.
The terms of payment for Services are described in the Order Form. Invoices will be issued at the end of each first month of the settlement period.
Fees indicated in the Order Form will be increased by the indicated value on each anniversary of the entry into force of the Agreement in the form of an Annual Innovation Premium. The beforementioned fee increase does not require an amendment to the Agreement. The indexation rate is:
for fees in euro - increase in the annual Harmonised Index of Consumer Prices (HICP) of the euro area (inflation in the euro area) announced by Eurostat +3% with a minimum of 5%;
for fees in US dollars - increase in the annual Consumer Price Index (CPI) announced by the Bureau of Labor Statistics +3% with a minimum of 5%.
If during the term of the Agreement the Customer reaches a given threshold of the number of contacts or Active Contacts in the System database, indicated in the Order Form, the charge for this threshold becomes the minimum commitment monthly amount for the Customer under the Agreement in terms of the fee depending on the number of e-mail contacts / Active Contacts stored in the System database.
Except as otherwise specified herein or in an Order Form, (i) fees are based on the number of contacts / Active Contacts stored in the System database and not actual usage of the System, (ii) payment obligations are non- cancelable and fees paid are non-refundable.
The payment terms for the Services are agreed in the Order Form. Failure to make timely payment may result in the initiation of bad debt collection proceedings, the imposition of interest for late payment or the temporary restriction of System functionality (and this restriction does not affect the remuneration payable to SALESmanago).
All amounts due or payable by the Customer under this Agreement shall be paid free and clear of any deduction, withholding or set off.
VI. COMPLIANCE
The Customer shall comply with all applicable export controls, economic sanctions, and import laws and regulations, including without limitation the regulations of the European Union, United Kingdom, and the United States, as in force and amended from time to time. This means that Customer will not, directly or indirectly enter into a business relation with any person or entity resident in, located in, or organised under the laws of any country or territory subject to comprehensive economic sanctions (including, currently, Crimea, Cuba, Iran, North Korea, and Syria) (hereafter “Sanctioned Countries”), or (ii) identified on any applicable restricted party lists (including without limitation the U.S. Treasury, Office of Foreign Assets Control’s Specially Designated Nationals List; the HM Treasury Consolidated List of Financial Targets in the UK; and the European Union’s Consolidated List of Sanctioned Individuals and Entities) (hereafter “Restricted Party Lists”).
The Customer warrants that it is, and will remain during the term of this Agreement, not (i) resident in, located in, or organised under the laws of a Sanctioned Country, or (ii) identified on, or majority-owned or controlled by one or more parties identified on, a Restricted Party List. SALESmanago reserves the right to request the Customer to periodically confirm in writing that it complies with the obligation under the Agreement and specifically with those in this section VI, Compliance.
VII. LIABILITY
In no event shall the aggregate liability of SALESmanago arising out of or related to the Agreement exceed the total amount paid by Customer hereunder for the services giving rise to the liability in the twelve months preceding the first incident out of which the liability arose or € 10,000, whichever amount is lower. In no event will SALESmanago have any liability arising out of or related to the Agreement for any lost profits, revenues, goodwill, or indirect, special, incidental, consequential, cover, business interruption or punitive damages. The foregoing disclaimer will not apply to the extent prohibited by law.
SALESmanago will not be responsible for delays, delivery failures or other loss resulting from the transfer of Customer’s data over communications network or facilities, including the internet.
If the Service are held or are likely to be held infringing intellectual property rights of a third party, SALESmanago will have the option, at its expense to (i) replace or modify the Services as appropriate, (ii) obtain a licence for Customer to continue using the Services, (iii) replace the Services with a functionality equivalent service or (iv) terminate the applicable Services and refund any prepaid charges applicable Services following the effective date of termination. To the fullest extent permitted by law, remedies described in the preceding sentence will constitute the sole and exclusive remedy available to Customer in relation to third party claims.
Without prejudice to the foregoing, SALESmanago's liability arising out of or in connection with the Agreement shall be excluded to the extent that the Customer has suffered damage due to a failure to comply with certain industry requirements applicable to the Customer's business (e.g. arising from the provisions of Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011); hereinafter “DORA”) of which SALESmanago has not been informed in advance and SALESmanago declared that it will meet these requirements to the extent they apply to SALESmanago.
To the maximum extent permitted by applicable law, the Services including all functions thereof, are provided on an ‘as is’ basis, without representations or warranties whether express, implied or otherwise, including any implied warranty of merchantability or fitness for a particular purpose.
VIII. TERM AND TERMINATION
The Agreement enters into force on the date and for a fixed period indicated in the Order Form and will automatically renew for successive periods indicated in the Order Form unless terminated by the Customer in writing at least 30 days before the end of the Agreement.
The Customer has the right to terminate the Agreement if the main System’s features remain unavailable for consecutive 7 days from receiving the notification from the Customer.
SALESmanago has the right to terminate the Agreement in the following cases:
the Customer's failure to pay invoices by more than 30 days; or
violation by the Customer of the fundamental rules of social coexistence or business ethics having an impact on SALESmanago’s image or SALESmanago brand in particular violation of the SALESmanago Marketing Automation Anti-Spam Policy available here2; or
breach by the Customer of the rules of law or any material obligation under this Agreement;
violation by the Customer of the business ethics in communication with SALESmanago (in particular abusive behaviour).
SALESmanago has the right to terminate the Agreement without reason effective at the end of the current Agreement term, and in the case of Agreement of indefinite duration, with three months' notice.
Declaration of termination of the Agreement by the Customer must be, under pain of invalidity, sent: (i) by e- mail to support@salesmanago.com or (ii) by mail to the address of the SALESmanago's registered office. The declaration of termination of the Agreement for its effectiveness must be submitted by a person authorised to represent the Customer.
In the event of termination of the Agreement by SALESmanago for reasons attributable to the Customer, SALESmanago shall be entitled to charge a contractual penalty in the amount corresponding to the unpaid portion of SALESmanago's remuneration under the current Agreement term based on the remuneration from the last month before the termination times: (i) the Agreement duration till end of the Agreement or (ii) next renewal date or (iii) three months (for agreements on indefinite duration). The charging of contractual penalty does not exclude SALESmanago to claim the deficiency compensation transferring the amount of withheld contractual penalty. The Customer will be obliged to pay the contractual penalty within 7 days from the date of receipt of the debit note to the bank account indicated in the note.
The above breaches, in the event of a written notice to the other Party, result in the immediate termination of the Agreement along with the cessation of the provision of Services to the Customer, and the Customer is obliged to pay remuneration to SALESmanago for each day on which the service was performed.
In the event of termination of the Agreement by the Customer or by SALESmanago for reasons attributable to the Customer before the expiration of the term for which the Agreement - related to the granting of the discount to the Customer - has been concluded, SALESmanago shall be entitled to claim reimbursement of the discount granted to the Customer less its pro rata value for the period from the date of conclusion of the Agreement until the date of its expiration. The Customer will be obliged to return the relief granted to the Customer in the amount indicated in the preceding sentence within 7 days from the date of receipt of the debit note to the bank account indicated in the note.
IX. PROCEDURE FOR REPORTING IRREGULARITIES AND COMPLAINT PROCEDURE
During the use of the Services, the Customer is obliged to immediately notify SALESmanago of any irregularities, malfunctions, or interruptions in the functioning of the Services or the System, as well as any deficiencies in the quality of the Services, no later than 14 days from the date of becoming aware of such irregularities.
Notifications in this respect should be addressed to SALESmanago via email to: support@salesmanago.com.
In the case of technical problem reports related to the System, the Customer must obtain confirmation from the SALESmanago Support department that the cause of the reported problem lies with SALESmanago before submitting any complaint as mentioned below. The Customer may file a complaint regarding technical problems related to the System within 14 days from the date of confirmation by the SALESmanago Support department that the cause of the reported problem lies with SALESmanago.
Customers' complaints regarding SALESmanago's improper performance of any contractual provisions should include, in particular:
full registration name of the Customer;
address details;
TAX ID number;
login;
the contact details of the User and Customer;
detailed description of the circumstances giving rise to the Customer’s complaint;
duration of the irregularities (e.g. error);
description of the complainant's request;
signature and position of the person reporting the incident who is authorised to do so.
A response to the complaint will be provided electronically or possibly by telephone.
The complainant will be notified of the outcome of the considered complaint by e-mail to the e-mail address provided in the complaint application within 30 (thirty) days from the date of submission of a complete and correct complaint, with the proviso that the deadline may be extended in particularly complicated cases. Exceeding the deadline for responding to the complaint does not constitute recognition of the complaint.
The Customer has the right to appeal the decision on the complaint once within 14 days of receiving the response to the complaint. The above provisions shall apply accordingly.
X. COOPERATION WITH THE AFFILIATES
The Customer may enter into agreements regarding the use of products or services of the Affiliates of SALESmanago, in particular Leadoo Marketing Technologies Ltd, 2922046-1, based in Helsinki, Finland.
To the extent that there is integration between the System and the products or services of the Affiliates ( e.g. in terms of monitoring code, transferring data to and from the System, linking the System's functionalities with products or services of the Affilates), the Parties indicate that this is done at the direction of the Customer.
The Customer agrees to comply with the terms and conditions of the Affiliates and the policies and guidelines pertaining thereto. Notwithstanding the foregoing, SALESmanago does not assume any responsibility for the Affiliates, the terms of which have been regulated directly between the Customer and the Affiliates and specifically disclaims any liability, warranty, and obligation with respect to such Affiliates.
XI. MISCELLANEOUS
The Customer authorises SALESmanago to use the Customer’s name and trademark (or logo) to represent the fact that the Customer is a customer of SALESmanago, especially for the purpose of informing about using the System on its website and social media channels.
SALESmanago may at any time make any change to any Service that is necessary to comply with applicable law. The names of the System functionalities may change over time and such a change does not constitute an amendment to the Agreement. SALESmanago may make commercially reasonable updates to the Services from time to time to which the Customer agrees on beforehand. SALESmanago will inform Customer via the System if SALESmanago makes a material change to the Services that has a material impact on Customer's use of the Services.
SALESmanago may make changes to URLs in the Agreement from time to time. SALESmanago may amend the MSA for important reasons, which are: a) changes in generally applicable laws affecting the provisions of the MSA; b) the issuance of a judgement or decision directly affecting the provisions of the MSA by a court or public administration authority; c) introduction of new functionalities of the System or changes to them; d) removal of ambiguities or doubts of interpretation. In case of the amendment of the MSA, SALESmanago shall notify the Customer of the change by the message that will be communicated to the User via the System.The Parties agree that the User is authorised to accept or reject the new terms and conditions on behalf of the Customer. Failure to respond to information about the change in the MSA within 14 days from the date of notification of the change is considered acceptance of the new terms and conditions. Customer's objection to the new terms and conditions means that the existing MSA applies to the performance of the Agreement, whereby, the Customer may not object to changes resulting from the reasons indicated in letters a) and b) above.
Any limitation or modification which SALESmanago is entitled to make under the Agreement shall not affect the assessment of the SALESmanago's due performance under the Agreement and does not affect the remuneration payable to SALESmanago under the Agreement.
According to the Personal Data Protection Regulations, Parties have regulated the principles of entrusting the processing of Personal Data, in the agreement constituting Appendix No. 1 to the MSA. Appendix No. 1 shall apply when the performance of the Agreement involves the processing of personal data to which the provisions of the GDPR apply.
To execute the Agreement, the Parties, as independent data controllers, will share the personal data of their representatives indicated in the Agreement, representatives and persons appointed to execute the Agreement, including the following categories of data: identification data (including, but not limited to, name, position of representative). In connection with the execution of the Agreement, the Parties may also transfer the personal data of employees and associates not listed in the Agreement.
SALESmanago implements the information obligation to representatives and employees whose data is listed in the Agreement through the information clause, attached as Appendix 2 to the MSA.
Persons representing the Customer acknowledge receipt of information regarding processing their personal data in connection with the Agreement. The Customer agrees to provide this information to employees and associates not mentioned in the content of the MSA, whose data will be transferred between the Parties to perform the Agreement.
SALESmanago will be entitled to use data processed as part of the Services to produce: statistical analyses, insights, market data and predictive models to assist development of SALESmanago Services and third party products or services designed for use with them (hereinafter referred to as the “Analytics”). No Personal Data is used for the purpose of Analytics nor will Analytics identify Customer.
Neither Party will be liable for any delay or failure to perform its obligation under the Agreement if the delay or failure is due to extraordinary and unforeseeable event or circumstance beyond its reasonable control (force majeure), such as a strike, blockade, war, act of terrorism, riot, natural disaster, failure or reduction of power or telecommunications or data networks or services, or government act.
Subject to the provisions of the MSA stating that it may be amended, any amendment or variation to the Agreement must be in writing or a document form via the digital signature tools (e.g. DocuSign) or in the form of a scanned document. Otherwise null and void. The Parties exclude the application of Art. 661 § 1-3 of the Polish Civil Code.
If any provision of the MSA is held by a court or other competent authority to be unlawful, void or unenforceable, it shall be deemed to be deleted from the MSA. It shall be of no force and effect, and the MSA shall remain in full force and effect as if such provision had not originally been contained in the MSA. In the event of any such deletion the Parties shall negotiate in good faith in order to agree the terms of a mutually acceptable and satisfactory alternative provision in place of the provision so deleted.
The Agreement is governed by and constructed under Polish law.
Any dispute in connection to the Agreement shall be subject to the exclusive jurisdiction of the courts having jurisdiction over SALESmanago registered office.
Appendices shall form an integral part of the MSA.
If a conflict occurs between this MSA, appendices to the MSA and the Order Form, unless otherwise specifically stated in these documents, the order of precedence shall be:
Order Form
Appendix No. 1 to the MSA
Appendix No. 3 to the MSA
MSA.
Appendix No. 1 to the MSA Personal Data Processing Agreement
Personal Data Processing Agreement
hereinafter referred to as „PDPA”
between
Customer, hereinafter referred to as “Entruster”
and
SALESmanago, hereinafter referred to as “Processor”
Whereas,
the Parties have concluded the Agreement, Parties hereby agree as follows:
§ 1 Statements of the Parties
The Entruster declares that, regarding the entrusted personal data, it is either the data controller or the processor and has the right to process the data and entrust its processing and when the Entruster is a processor, the Entruster also declares that all requirements in relation with the data controller have been met.
The Processor shall ensure that appropriate technical and organisational measures are implemented so that the processing meets the requirements of the Act and the GDPR and provides the protection of the rights of the data subject.
The Processor declares that he applies all required technical and organisational measures so that the processing is carried out in accordance with Article 32 of the GDPR.
The Processor declares that the Processor has the resources, including infrastructure resources, experience, knowledge, and qualified personnel, to the extent that it is able to duly perform the PDPA, in compliance with the applicable laws. In particular, the Processor declares that it is familiar with the principles of personal data processing and security resulting from the GDPR.
§ 2 Subject matter of PDPA
Parties agree that for the purpose of fulfilling statutory obligations imposed by law, these being, in particular, the provisions of GDPR and the provisions of other Member States data protection laws that apply to the Agreement as well as the proper performance of the Agreement, the Entruster, entrusts the Processor with the processing of personal data in the scope as defined by this PDPA.
The Parties declare that processing is to be carried out on behalf of the Entruster and the Processor provides sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of the GDPR and ensure the protection of the rights of the data subject.
Where terms defined in the GDPR are used in this PDPA, these terms have the same meaning as in the GDPR.
§ 3 Description and scope of processing
This PDPA applies to the processing of personal data set out below:
categories of data subjects: users of the Entruster’s websites who are clients or potential clients of the Entruster;
the type of personal data: name and surname, e-mail address, telephone number, Contact ID, IP number, location information, online behavioural data of data subjects;
the nature and purpose of personal data processing: performing the Agreement, using resources provided by the Processor;
the subject-matter of the processing: personal data stored in the System in the duration of the same term as the performance of the Agreement.
The Parties jointly agree that the Entruster entrusts the Processor only with personal data within the scope of and concerning the categories of persons specified in § 3(1) of the PDPA. In entrusting a broader scope of personal data than in § 3(1) of the PDPA (in particular special categories of personal data/sensitive data), the Entruster is obliged to indicate in the Order Form a new scope of personal data that will be entrusted on the date of the Agreement. If the scope of processed personal data changes during the execution of the Agreement, the Entruster is obliged to indicate a new scope of personal data to the Processor.
The Processor undertakes to process entrusted personal data only for the purpose and scope specified in above, based on documented instructions from the Entruster, which also applies to the transfer of personal data to a third country or international organisation (unless such obligation is imposed by Union law or the law of the Member State to which the Processor is subject; in this case, the Processor shall inform the Entruster of this legal obligation prior to the commencement of processing, unless such law prohibits the provision of such information on grounds of important public interest).
§ 4 Rights and obligations of Parties
The Entruster entrusts to the Processor only lawfully collected personal data and confirms that obtained all needed consents for processing personal data and all other consents to obtaining which applies data protection provisions.
Following a written request by the Entruster, the Processor shall be obliged to provide information regarding the processing of personal data entrusted to him, including details of technical and organisational means used for the purpose of processing data covered by the request, within 14 days of receiving such a request. Before sending a request mentioned above, the Entruster has to make an effort to obtain on its own all the necessary information related to processing personal data, for example, using documents and correspondence between parties while negotiating and executing PDPA.
The Processor shall inform the Entruster prior to the commencement of processing of data on the implementation of a possible legal obligation consisting of the transfer of personal data to a third country or an international organisation, in accordance with Article 28(3) point a of the GDPR.
The Processor ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, in accordance with Article 28(3) point b of the GDPR.
The Processor undertakes to ensure that every person acting under the authority of the Processor who has access to personal data processes them only at the request of the Entruster for the purposes and scope provided for in the PDPA.
The Processor declares that he has taken safeguard measures required under Article 32 of the GDPR, in accordance with Article 28(3) point c of the GDPR. Ensuring data security includes data protection against security breaches leading to breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data (personal data breach). When assessing the appropriate level of security, the Parties shall take into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons.
The Processor declares that he respects the conditions referred to in paragraphs 2 and 4 of Article 28 of the GDPR for engaging another processor, in accordance with Article 28(3) point d of the GDPR. The Entruster grants the Processor a general authorisation for further entrustment of personal data. The Processor shall publish on its website a current list of both existing and planned sub-processors. The Entruster is obligated to periodically review this list, and in the event of any objection to the engagement of a specific sub-processor, the Entruster may exercise its right to object to such sub-processing. The right to object may be exercised solely prior to the planned sub-processing of personal data.
The full list of sub-processors is available here.
The Processor shall be fully responsible to the Entruster for fulfilling the obligations under the personal data processing agreement entered into between the Processor and the sub-processor. If the sub-processor fails to comply with its data protection obligations, the full responsibility to the Entruster for the fulfilment of the obligations of such sub-processor shall rest with the Processor.
The Processor takes into account the nature of the processing, assists the Entruster by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Entruster's obligation to respond to requests for exercising the data subject's rights laid down in Chapter III of the GDPR, in accordance with Article 28(3) point e of the GDPR. The Processor is neither entitled nor obliged to respond directly to the requests of the data subjects. The Processor may inform the data subject that her or his request has been sent to the Entruster. The Processor may restrict the processing of the data subject's personal data for the duration of the Entruster's response to the data subject's request, particularly when the request concerns an objection to the processing of personal data for direct marketing purposes.The Processor assists the Entruster in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR taking into account the nature of processing and the information available to the Processor, in accordance with Article 28(3) point f of the GDPR. In particular:
10.1.[Data breach concerning data processed by the Entruster] In the event of a personal data breach concerning data processed by the Entruster, the Processor shall assist the Entruster:
in notifying the personal data breach to the competent supervisory authority, without undue delay after the Entruster has become aware of it, where relevant (unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons);
in obtaining the following information which, pursuant to Article 33(3) of the GDPR, shall be stated in the Entruster’s notification, and should include:
-the nature of the personal data including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;
-the likely consequences of the personal data breach;
-the measures taken or proposed to be taken by the Entruster to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.
Where, and insofar as, it is not possible to provide all this information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.
in complying, pursuant to Article 34 of the GDPR, with the obligation to communicate without undue delay the personal data breach to the data subject, when the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons.
10.2. [Data breach concerning data processed by the Processor] In the event of a personal data breach concerning data processed by the Processor, the Processor shall notify the Entruster without undue delay but no later than 24 hours after the Processor having become aware of the breach. Such notification shall contain:
a description of the nature of the breach (including, where possible, the categories and approximate number of data subjects and data records concerned);
the details of a contact point where more information concerning the personal data breach can be obtained;
its likely consequences and the measures taken or proposed to be taken to address the breach, including to mitigate its possible adverse effects.
Where, and insofar as, it is not possible to provide all this information at the same time, the initial notification shall contain the information then available and further information shall, as it becomes available, subsequently be provided without undue delay.
The Processor makes available to the Entruster all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR and allow for and contribute to audits, including inspections, conducted by the Entrusteror another auditor mandated by the Entruster, in accordance with Article 28(3) point h of the GDPR and under the conditions set out in §5 below.
When required for personal data security reasons, for the duration of the investigation or until the causes of the breach are eliminated, the Processor may restrict the processing of personal data whose security is or could potentially be compromised (e.g., temporarily turning off a particular service or blocking mailings to specific contacts).
The Processor shall immediately inform the Entruster if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions.
§5 Audits
The Entruster is entitled to carry out, not more than once during each subsequent calendar year, an audit of the security of personal data processing, in terms of compliance of their processing with the PDPA and applicable law, in particular the GDPR.
The basic form of auditing is an audit carried out by electronic means. It consists in sending by the Entruster to the Processor questions regarding the compliance of the processing by the Processor of the entrusted personal data with the PDPA, the GDPR or the provisions of generally applicable law on the protection of personal data, including the security measures applied. The Processor is obliged to answer the Entruster's questions, insofar as this is possible, within 30 days of receiving them.
After the audit referred to in point 2 above, the Entruster, if necessary, is entitled to conduct an audit in a different form. After receiving a request to conduct such an audit, the Parties will determine the date of its commencement (which may not take place earlier than 10 business days from receipt of the Entruster's request), its exact scope, and persons authorised to conduct it.
Audits will be carried out during the working hours of the Processor's business, to the extent and in the area necessary for the processing of personal data, without prejudice to the normal conduct of business by the Processor, the business secrets of the Processor and confidential information belonging to third parties. The Entruster undertakes to keep the above-mentioned information confidential. Before starting the audit activities, the Parties (and an external auditor appointed by the Entruster, if applicable) will sign an appropriate confidentiality agreement.
The costs of the audit are borne by the Entruster.
§6 Data transfer outside the European Economic Area
The Processor shall not transfer personal data entrusted by the Entruster outside the European Economic Area.
In situations where the Entruster processes personal data or has an establishment outside the European Economic Area (hereinafter: EEA) and therefore a transfer of personal data is necessary as referred to in §6(1) of the PDPA, the standard contractual clauses referred to in Commission Implementing Decision (EU) 2021/914 of June 4, 2021 on standard contractual clauses for the transfer of personal data to third countries under Regulation (EU) 2016/679 of the European Parliament and of the Council, with the following content, shall apply:
An amendment to the “List of sub-processors” appendix does not constitute an amendment to the PDPA.
If it is necessary to conclude the standard contractual clauses referred to in § 6(2) of the PDPA in written form, the Processor shall forward the request to conclude them in this form to the Processor at dpo@salesmanago.com.
Standard contractual clauses referred to in §6(2) of the PDPA apply only in the absence of a decision pursuant to Article 45(3) GDPR.
§ 7 Liability
Each Party shall be liable for any damage caused to the other Party or to any third parties in connection with the performance of this PDPA, pursuant to provisions of the GDPR or this PDPA.
The Processor shall not be responsible for the personal data provided by the Entruster beyond the scope specified in §3(1) of the PDPA unless the Entruster indicates the new scope of data in the Order Form. To avoid any doubts, the Processor shall be responsible for the personal data specified in the Order Form to the same extent as the data specified in §3(1) of the PDPA.
In the event of damage caused by actions undertaken by the Processor, the Processor shall be liable as guilty of the actual damage incurred by the Entruster. In no event shall the aggregate liability of the Processor arising out of or related to the PDPA exceed the total amount paid by the Entruster for the services giving rise to the liability in the twelve months preceding the first incident out of which the liability arose. In no event will Processor have any liability arising out of or related to the PDPA for any lost profits, revenues, goodwill, or indirect, special, incidental, consequential, cover, business interruption or punitive damages. The foregoing disclaimer will not apply to the extent prohibited by law.
The Processor shall be excluded from liability for”
adequately securing personal data in accordance with this PDPA in the part of the information system administered by the Entruster (for example, in case of improper security of the user account by assigning too weak password by the Entruster or disclosure of this password by the Entruster);
processing personal data without the required consents that should have been obtained by the Entruster, and for processing personal data on the basis of defectively obtained consents;
for processing personal data in violation of the Agreement or applicable laws if such processing results from improper integration of the System by the Entruster;
failing to meet specific requirements under sector regulations that the Entruster is subject to (e.g., NIS2 Directive, DORA) unless the Entruster has informed the Processor about these requirements before the execution of the Agreement or within 14 days after these requirements took effect, and the Processor declared that it will meet these requirements to the extent they apply to the Processor.
§8 Representatives of the Parties
For the purposes of implementing this PDPA, the Entrustera nd the Processor appoint a contact person:
The Entruster: contact person indicated in the Order Form
The Processor: email: dpo@salesmanago.com
- the indicated person may be changed at any time via email. Such change does not constitute an amendment to the PDPA.
§9 Final provisions
The Processor shall not charge any additional fees for the performance of any of the provisions of this PDPA.
Without prejudice to the other provisions of the PDPA, this PDPA shall remain in force for the entire duration of the processing of the Personal Data entrusted by the Entruster, regardless of the termination or expiry of the Agreement.
In the event of terminating the Agreement, the Entruster shall, within 13 days of the date of expiry hereof, individually secure any personal data entrusted to Processor for processing. 14 days following the date of expiry of the PDPA, the Processor shall permanently delete any and all records containing personal data entrusted for processing, made in connection with or while performing the Agreement,except for Personal Data processed as part of backups. Backups shall be created, in particular, to safeguard the data and ensure its availability during the Main Agreement's performance. The backups shall be stored for a maximum period of 12 months from their creation and automatically deleted after this period. The personal data stored in the backups are 'excluded from processing', which means that their processing is restricted to storage in encrypted form only, except if it becomes necessary to use the backup copy in connection with the performance of the Agreement, in accordance with the purpose of the backup copy, for example as a result of a failure of the system in which the data are processed during the performance of the Agreement. Only authorised persons acting on behalf of the Processor shall have access to such data. Concerning the backups, this Agreement shall be terminated upon the expiry of the storage period of the backups referred to above.
The Parties declare that any previously signed agreements regarding the processing of personal data are revoked and replaced by this PDPA.
Any issues falling outside the scope of this PDPA shall be governed by the provisions of the GDPR.
Appendix No. 2 to the MSA Information on the processing of personal data for the Customer, persons representing the Customer, Users and contact persons
The data controller: The data controller of your personal data is Benhauer sp. z o.o. based in Cracow, address: ul. Klimeckiego 4, 30-705 Cracow, entered in the Register of Entrepreneurs of the National Court Register kept by XI Commercial Division of the National Court Register of the District Court for Kraków-Śródmieście in Kraków under KRS number 0000523346, and NIP 6762447754 (hereinafter referred to as “Benhauer” or “the controller”).
Purposes and legal basis of personal data processing: The controller will process personal data of the contractors who are natural persons:
to perform an agreement between the contractors and the controller or take action at the request of the contractors before the conclusion of the contract (Article 6(1)(b) of the GDPR);
fulfilling the legal obligations incumbent on the controller, arising in particular from tax and accounting legislation (Article 6(1)(c) of the GDPR);
pursuing or defending against claims, which is the legitimate interest of the controller (article 6(1)(f) of the GDPR).
Purposes and legal basis of personal data processing: The controller will process personal data of the contractor’s representatives persons conducting agreements, users and contact person:
to maintain business contacts, which is the legitimate interest of the controller (Article 6(1)(f) of the GDPR);
fulfilling the legal obligations incumbent on the controller, arising in particular from tax and accounting legislation (Article 6(1)(c) of the GDPR);
for the purpose of creating a user account to perform the contract concluded with the customer, which is a legitimate interest of the controller (Article 6(1)(f) of the GDPR);
pursuing or defending against claims, which is the legitimate interest of the controller (Article 6(1)(f) of the GDPR).
The recipients of the personal data: The controller may disclose the personal data of the contractors to entities authorised by the law. Entities supporting the controller, including IT services providers, may also have access to the personal data of the contractors on the basis of agreements conducted with the controller.
Processing period: The personal data of the contractors shall be processed for the period required by the law or by the limitation period for any claims, depending on which of these events occurs later. The personal data processed for contact purposes will be processed for the time for the duration of the business relationship.
Voluntary/obligation to provide personal data: Providing personal data is voluntary however necessary to conclude an agreement with the controller.
Transfers of personal data to third countries or international organisations: Your personal data will also be processed in tools/systems provided by the entities supporting the data controller that are based or process data outside the European Economic Area. In this case, personal data is transferred on the basis of standard contractual clauses approved by the European Commission or a decision of the European Commission stating an adequate level of protection in a given country, e.g. on the basis of the EU-US Data Protection Framework.
Decision-based solely on automated processing/profiling: The controller is not making decisions based solely on automated processing, including profiling (concerning the purposes of data processing described above).
Data subjects rights: You have the right, as applicable, to:
request access to your personal data, rectification, deletion and limitation of processing, and if your personal data is processed by automated means on the basis of a contract, you also have the right to transfer your personal data;
withdraw your consent at any time, if that data was processed on the basis of this consent. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
object to the processing of your personal data - when the data is processed on the basis of the controller's legitimate interest.
You also have the right to lodge a complaint with the supervisory authority (PUODO - President of the Office for Personal Data Protection) Stawki 2 st., 00-193 Warszawa, email: kancelaria@uodo.gov.pl
The data controller:
Benhauer sp. z o.o. based in Cracow
Stanisława Klimeckiego 4
30-705 Kraków
e-mail: dpo@salesmanago.com
Data Protection Officer:
e-mail: rodo@salesmanago.com
Appendix No. 3 to the MSA - Terms of Onboarding Services
These Terms of Onboarding Services (“Terms”) govern Customer’s acquisition of SALESmanago Onboarding Services. Capitalized terms have the definitions set in the MSA unless expressly stated otherwise below.
§ 1 Subject matter of the Terms
SALESmanago agrees to provide to the Customer the Onboarding Services in accordance with the onboarding package selected by the Customer, as indicated in the Order Form. The scope of Onboarding Services is derived from the licence package selected by the Customer unless the Parties agree otherwise.
usunięto
The MSA shall apply to these Terms to the extent not covered by these Terms, unless expressly stated otherwise.
In the event of any discrepancy between the provisions of the MSA and these Terms, these Terms shall prevail.
Onboarding services are billed on the basis of Service Units (SU), the number of which is specified in the Order Form.
§ 2 Project scope and objectives
Notwithstanding anything to the contrary, the Parties acknowledge and agree that the Onboarding Services provided hereunder are limited in scope to the following. SALESmanago and Customer jointly agree there shall be no customizations to System’s standard features and functionalities.
SALESmanago and the Customer shall work together to achieve the agreed-upon objectives below, according to the selected Onboarding Service package. Depending on the licence package selected by the Customer, the Onboarding Services will include the basic use cases described here3.
By mutual agreement between the Parties, the Customer may use the purchased Service Units to carry out, in part instead of the base use cases, other use cases as indicated in the tables above.
The costs of the individual activities of the Onboarding Services expressed in SU and the scope of implementation are described here. For non-standard or complex implementations, the number of Service Units required may vary from the estimates provided here.
§ 3 Project assumptions and considerations
It is estimated that the chosen Onboarding Services will be completed within the time indicated in the Order Form starting from the Agreement start date according to the Order Form. If the Onboarding Services (or any part thereof) provided are not complete at the end of the above mentioned period due to Customer’s failure to make the necessary resources (e.g. data which should be imported into the System) available to SALESmanago or to perform other Customer obligations in timely manner (e.g. unavailability of contact persons, failure to implement System integration), such Onboarding Services will be deemed to be complete at the end of the above mentioned delivery period.
All services shall be delivered remotely. Travel and related expenses shall not be required, and are not included in the fixed fee amount. No other fees and/or expenses will be permitted without the prior written approval of the Customer and SALESmanago.
SALESmanago may choose to change any personnel assigned to the Onboarding Services at any time for any or no reason.
The Customer will provide:
appropriately qualified personnel, knowledgeable regarding the existing Customer’s environment to support SALESmanago’s activities in terms of the Onboarding Services. These personnel will be available without undue delay to clarify the business requirements and for validation of results as needed.
ongoing access to the software required for this effort (e.g. plug-ins, if applicable);
reasonably quick and expeditious resolution for business or technical questions or issues arising from the effort;
that any data transferred to SALESmanago will be password protected and that the size of any file transferred will not exceed 20 MB
Website integration, product feed, database, graphic design and materials, content, strategic guidelines.
The Customer undertakes to perform full System integration (monitoring code, transaction events submission, submission and contact monitoring, contact consent and subscription management, XML or product API configuration).
The Customer undertakes to inform about a possible change of the persons referred to in point 5a well in advance.
The Onboarding Services are limited only to the services related to the System. SALESmanago will not provide the content and will not configure external platforms.
§ 4 Fees and payments
The Customer will be charged a fixed fee for the Onboarding Services under the price list described in the Order Form.
The terms of payment for the Onboarding Services are described in the Order Form. Invoice for the Onboarding Services will be issued on Agreement start date, according to the Order Form (upfront payments).
Failure to make timely payment may result in the initiation of bad debt collection proceedings, the imposition of interest for late payment or withholding the provision of Onboarding Services.
Unknown circumstances may cause actual cost and effort to vary from the fees and timing outlined in these Terms and the Order Form. Any services beyond those described above will be subject to separate pricing.
Onboarding Services are non-cancellable, and all fees for Onboarding Services are non-refundable.
§ 5 Liability
In no event shall the aggregate liability of SALESmanago arising out of or related to the Onboarding Services exceed the total amount paid by Customer hereunder for the Onboarding Services. In no event will SALESmanago have any liability arising out of or related to the Onboarding Services for any lost profits, revenues, goodwill, or indirect, special, incidental, consequential, cover, business interruption or punitive damages. The foregoing disclaimer will not apply to the extent prohibited by law.
Any limitation or modification which SALESmanago is entitled to make under these Terms shall not affect the assessment of the SALESmanago's due performance under these Terms and does not affect the remuneration payable to SALESmanago under these Terms.
The services provided under these Terms constitute a separate obligation from the remaining provisions of the Agreement. Therefore, SALESmanago's performance under these Terms shall not affect: (i) the assessment of the SALESmanago's due performance of the remaining obligations of the Agreement, nor shall it affect the validity of the Agreement or constitute a breach thereof in any other respect; (ii) the remuneration payable to SALESmanago under remaining part of the Agreement.
§ 6 Miscellaneous
The Terms apply only to the services indicated therein and do not regulate any Customer support after SALESmanago has completed their provision within the meaning of these Terms.
Termination of the provision of services under these Terms does not affect the validity and scope of the agreement regarding the use of the System.
1https://www.salesmanago.com/marketing-automation/salesmanago-order-form-sms.htm
3https://www.salesmanago.com/marketing-automation/use-cases.htm
Download MSA in PDF
Previous versions:
