Terms of Service

Version 1.0Effective date: 1 October 2026

1. Contract and Access to Arkata

1.1 These Terms

These Terms of Service govern access to and use of the Arkata software-as-a-service platform and related services supplied by the provider identified in the applicable Customer Contract, referred to as the Provider.

The person or organisation receiving the Services is the Customer.

The Provider and Customer are each a Party and together the Parties.

Arkata is supplied only for business and professional use. The Customer confirms that it acts for purposes relating to its trade, business or profession and not as a consumer.

1.2 Contract

The agreement between the Provider and Customer, the Contract, consists of:

(a) the Customer Contract, containing the Customer-specific commercial terms; and

(b) these Terms, in the version incorporated into the Customer Contract.

If there is a conflict, the Customer Contract prevails for the Customer-specific commercial matter concerned.

The Contract may be entered into electronically. A person signing or accepting it for the Customer confirms that they are authorised to bind the Customer.

1.3 Trial access

Where the Provider gives the Customer evaluation or trial access before a Customer Contract is entered into, these Terms apply to that trial where they are incorporated into the trial invitation, signup or access process.

For such a trial:

(a) the trial invitation or access confirmation determines the trial duration and permitted Users;

(b) no subscription Fee is payable unless expressly stated;

(c) provisions which by their nature require a paid subscription apply only once a Customer Contract is entered into; and

(d) provisions concerning Customer Data, data protection, confidentiality, intellectual property, professional responsibility, access and use restrictions, suspension, liability and data exit apply during the trial.

Trial access does not oblige the Provider or Customer to enter into a paid subscription.

1.4 Definitions

Applicable Law means applicable Maltese and European Union law.

Arkata means the hosted Arkata platform and functionality made available to the Customer from time to time under the applicable Services.

Authority means any public authority or official body relevant to the Customer's professional work, including the Malta Planning Authority and the Building and Construction Authority.

Customer Contract means the written commercial agreement between the Provider and Customer, including any written commercial confirmation expressly accepted by the Parties, which sets out the Customer-specific commercial terms for the Services and incorporates these Terms.

Customer Data means data, records, documents, files, correspondence and other content submitted to, stored in, generated through or processed through Arkata by or for the Customer, excluding Provider IP.

Customer Personal Data means personal data contained in Customer Data which the Provider processes on behalf of the Customer.

Data Act means Regulation (EU) 2023/2854, as amended or replaced.

Data Protection Laws means Regulation (EU) 2016/679, the GDPR, the Maltese Data Protection Act and other applicable data-protection legislation.

Exportable Data has the meaning given to exportable data under the Data Act.

Fees means fees payable for the Services under the Customer Contract or another written agreement between the Parties.

Provider IP means Arkata and the Provider's software, source code, technical architecture, workflows, automation logic, methods, designs, know-how, documentation, technical materials and other intellectual property, excluding Customer Data.

Services means Arkata and any implementation, migration, support or related service expressly included in the Customer Contract.

Subscription Term means the subscription period stated in the Customer Contract.

User means an individual authorised by the Customer to access Arkata.

1.5 Right to use Arkata

During an active trial or subscription, the Provider grants the Customer a limited, non-exclusive, non-transferable and non-sublicensable right to allow authorised Users to access and use Arkata for the Customer's internal business operations and ordinary provision of professional services to its clients.

Each User must use their own authorised account. Shared logins and password sharing are prohibited.

The Customer is responsible for its Users and must promptly notify the Provider if access should be removed or credentials may have been compromised.

1.6 Restrictions

Except where Applicable Law prevents the restriction, the Customer must not:

(a) copy, reproduce, distribute, resell, rent, sublicense, white-label or commercially exploit Arkata other than through its ordinary professional use;

(b) reverse engineer, decompile or disassemble Arkata or attempt to obtain its source code or proprietary underlying methods;

(d) obtain or attempt to obtain unauthorised access to systems or data;

(e) knowingly introduce malware or harmful code;

(f) use Arkata unlawfully or in a manner that infringes third-party rights; or

(g) permit unauthorised persons to access Arkata.

1.7 Product development

The Provider may maintain, update and improve Arkata.

Features discussed, demonstrated, requested or appearing on a roadmap are not contractual commitments unless expressly included in the Customer Contract.

During a paid Subscription Term, the Provider will not intentionally remove functionality in a manner that materially defeats the overall purpose of the subscribed Services, except where reasonably required because of Applicable Law, security, third-party dependencies or circumstances outside the Provider's reasonable control.

2. Professional Responsibility and Third-Party Systems

2.1 Purpose of Arkata

Arkata assists architecture firms with operational matters including clients, projects, permit workflows, documents, tasks, deadlines, Authority-related communications and billing workflows.

2.2 Authority systems

Arkata is not the Planning Authority, Building and Construction Authority, eApps or any other Authority system.

Arkata does not replace official Authority systems, inboxes, notices, decisions, conditions, records or communications.

2.3 Professional responsibility

Arkata is an operational tool. It does not replace the Customer's professional judgement and does not provide architectural, engineering, legal, accounting, tax or other professional advice.

The Customer remains responsible for:

(a) monitoring relevant Authority systems, official inboxes and communications;

(b) independently verifying material deadlines, project information, application status, conditions, documents and communications;

(d) reviewing information before relying on it or providing it to clients or third parties;

(e) the accuracy and appropriateness of invoices, billing stages and billing decisions; and

(f) meeting its professional, contractual, regulatory and legal obligations.

2.4 Automations and deadlines

Automated email processing, data extraction, workflow updates, reminders, notifications, task generation, deadline calculations and similar functionality may depend on supported formats, Customer configuration, source information and third-party systems.

Arkata may not capture every communication, deadline, document, status, event or task.

Where an error or omission could affect a professional, legal, regulatory, financial or contractual obligation, the Customer must independently verify the relevant information.

2.5 Third-party services

Arkata may interact with or depend on Authority systems and other third-party services.

The Provider does not control their availability, accuracy, delivery, interfaces, formats, security or changes.

The Provider may modify, suspend or discontinue an affected integration or workflow where a third party changes, restricts, suspends or withdraws functionality.

Where a third-party service requires the Customer to maintain its own account, licence or agreement, the Customer is responsible for doing so and for complying with the relevant third-party terms.

3. Implementation, Migration, Support and Fees

3.1 Scope

Implementation, onboarding, migration, configuration, training and other professional services are included only to the extent stated in the Customer Contract or otherwise agreed in writing.

The Customer must provide timely and accurate information, data, access, decisions and reasonable cooperation required to perform those Services.

Delays caused by the Customer may affect the implementation or migration timetable.

3.2 Data migration

Where migration is included, the Provider will use reasonable efforts to migrate the agreed data, subject to its format, quality, consistency, completeness, accessibility, volume and technical compatibility.

The Customer is responsible for:

(a) having the right to provide the source data;

(b) retaining any source records or backups it requires;

(d) promptly identifying material migration errors.

The Provider does not guarantee successful migration of corrupted, incomplete, inaccurate, unsupported or technically incompatible data.

Internal migration scripts, tools, methods and utilities remain Provider IP.

3.3 Additional work

Unless expressly included in the Customer Contract, the Services do not include:

(a) custom development;

(b) bespoke integrations;

(d) historical reconstruction;

(e) ongoing managed data entry;

(f) substantial additional migration;

(g) unlimited training or retraining; or

(h) material expansion of the agreed implementation scope.

Additional work requires separate written agreement and may incur additional Fees.

3.4 Support

The Provider will provide reasonable support through its designated support channels.

Unless expressly stated in the Customer Contract, there is no guaranteed uptime, service level, response time, resolution time or 24-hour support commitment.

3.5 Fees and taxes

Subscription Fees, billing frequency, User quantities, Subscription Term, implementation Fees, migration Fees and Customer-specific discounts are stated in the Customer Contract.

Fees are exclusive of VAT and other applicable taxes unless expressly stated otherwise.

Invoices must be paid within the period stated in the Customer Contract.

3.6 Late payment

If an undisputed amount remains overdue after written notice and a reasonable opportunity to remedy the non-payment, the Provider may suspend the affected Services until payment is received.

Statutory late-payment interest and recovery costs may apply where permitted by Applicable Law.

4. Customer Data, Confidentiality and Intellectual Property

4.1 Customer Data

As between the Parties, the Customer retains its rights in Customer Data.

The Customer authorises the Provider to host, store, transmit, organise, retrieve, display and otherwise process Customer Data as necessary to provide, secure, maintain, support and administer the Services and comply with lawful instructions under the Contract.

Personal data is additionally governed by clause 5.

4.2 Customer responsibilities for data

The Customer is responsible for:

(a) the legality, accuracy, quality and relevance of Customer Data;

(b) having the rights, lawful bases and permissions required to use that data through Arkata;

(d) complying with applicable professional secrecy and confidentiality obligations; and

(e) applying reasonable data minimisation.

4.3 Restricted data

The Customer must not intentionally use Arkata to store:

(a) passwords or authentication credentials;

(b) full payment-card information;

(d) other information which the Provider has expressly identified as unsupported,

unless the Provider has expressly confirmed in writing that the relevant processing is supported and any required safeguards have been agreed.

Where Customer Data includes special-category personal data under Article 9 GDPR, criminal-conviction or offence data under Article 10 GDPR, identification documents, national identification numbers or other sensitive personal data, the Customer remains responsible for ensuring that the processing is lawful, necessary and proportionate and that any additional requirements under Data Protection Laws are satisfied.

4.4 Provider IP

The Provider and its licensors retain all rights in Provider IP.

The Contract does not transfer ownership of Arkata, its source code, repositories, workflows, methods, technical architecture or other Provider IP to the Customer.

Unless expressly agreed otherwise, configurations, changes, improvements and features made to Arkata remain Provider IP, including where developed following Customer feedback or requirements.

4.5 Feedback

The Customer is not required to provide product feedback.

Where the Customer voluntarily provides feedback, suggestions or feature requests, the Provider may use them to develop or improve Arkata without payment or restriction, provided that this does not authorise disclosure of Customer Confidential Information.

4.6 Anonymised information

The Provider may use information which has been irreversibly anonymised so that it no longer identifies an individual or the Customer for analytics, security, service measurement and product improvement.

4.7 Confidentiality

Each Party must keep confidential the other Party's non-public business, commercial, financial, client, technical, product, operational and security information and use it only for the purposes of the Contract.

A Party may disclose Confidential Information only:

(a) to personnel, professional advisers and service providers who need it for those purposes and are subject to appropriate confidentiality obligations;

(b) with the other Party's permission; or

These obligations do not apply to information which the receiving Party can demonstrate:

(a) is lawfully public;

(b) was already lawfully known without restriction;

(d) was lawfully received from a third party without confidentiality restriction.

The obligations in this clause continue for as long as the relevant information remains confidential.

5. Data Protection

This clause constitutes the Parties' agreement under Article 28 GDPR for Customer Personal Data processed by the Provider on behalf of the Customer.

A separate data processing agreement is not required unless the Parties expressly agree otherwise.

5.1 Roles

Where the Provider processes Customer Personal Data on behalf of the Customer, the Customer is the controller and the Provider is the processor.

Where the Customer itself acts as processor for another controller, the Provider acts as the Customer's subprocessor.

The Customer determines the purposes of the relevant processing and is responsible for ensuring that its instructions, lawful basis and use of Arkata comply with Data Protection Laws.

5.2 Processing details

The subject matter of the processing is the provision and operation of Arkata and any agreed implementation, migration, support and related Services.

Processing continues for the duration of the relevant Services and any lawful period required for return, retrieval or deletion afterwards.

Processing may include receiving, recording, organising, structuring, storing, retrieving, consulting, displaying, transmitting, migrating and deleting Customer Personal Data.

The purposes are to provide Arkata, perform the agreed Services, provide support, maintain security and execute the Customer's lawful documented instructions.

Customer Personal Data may include:

(a) names and contact details;

(b) professional and employment information;

(d) client, project, property, permit and application information;

(e) correspondence and emails;

(f) documents and files;

(g) tasks, deadlines, calendar and workflow information;

(h) quotation, invoice, billing and payment-status information;

(i) identification information and documents where uploaded through supported Arkata functionality;

(j) special-category or other sensitive personal data where lawfully submitted by the Customer through supported Arkata functionality; and

(k) other personal data submitted through supported Arkata functionality.

Data subjects may include:

(a) the Customer's Users and personnel;

(b) clients and prospective clients;

(d) consultants, collaborators, contractors and suppliers;

(e) representatives or personnel of Authorities;

(f) correspondents; and

(g) persons identified in Customer documents or information.

5.3 Instructions

The Provider will process Customer Personal Data only:

(a) as necessary to provide the Services in accordance with the Contract;

(b) on other documented instructions from the Customer, including instructions concerning transfers; or

Where law requires processing outside the Customer's instructions, the Provider will inform the Customer before processing unless prohibited from doing so by law.

The Provider will inform the Customer if, in its opinion, an instruction infringes applicable EU or Maltese data-protection law.

5.4 Confidentiality and security

The Provider will ensure that persons authorised to process Customer Personal Data are subject to appropriate confidentiality obligations.

The Provider will implement and maintain appropriate technical and organisational measures taking into account the nature of the processing and the risks to individuals.

Arkata's measures currently include, as applicable:

(a) AWS Cognito authentication with multi-factor authentication for production access;

(b) password controls;

(d) HTTPS for data transmitted between supported user interfaces and the service;

(e) non-public database infrastructure and network access restrictions;

(f) server-side tenant resolution and database-level tenant isolation controls;

(g) separation of production and development environments;

(h) access controls based on authorised Users and roles;

(i) backup, versioning and monitoring controls; and

(j) logging and operational security controls.

Arkata's core AWS production infrastructure is configured in the AWS eu-central-1 region.

The Provider may update its technical and organisational measures as technology, risks and the Services develop, provided that the overall level of protection is not materially reduced.

5.5 Subprocessors

The Customer gives the Provider general written authorisation to engage subprocessors where necessary to provide the Services.

The Provider currently uses the following direct subprocessor for Customer Personal Data:

Amazon Web Services EMEA SARL (AWS), for cloud hosting, storage, database, authentication, backup and related infrastructure services. Arkata's core production infrastructure is configured in the AWS eu-central-1 region in Frankfurt, Germany.

The Provider will:

(a) impose on each subprocessor the applicable data-protection obligations required by Article 28 GDPR;

(b) remain responsible for the subprocessor's performance of those obligations to the extent required by GDPR; and

(c) give the Customer reasonable advance written notice before adding or replacing a direct subprocessor which processes Customer Personal Data.

The Customer may object to a proposed new direct subprocessor on reasonable documented data-protection grounds.

The Parties will reasonably attempt to resolve the objection. If they cannot, the Provider may choose not to appoint the proposed subprocessor, provide a reasonable alternative where available, or allow the Customer to terminate the materially affected Services without an early-termination penalty.

5.6 International transfers

Where Customer Personal Data is transferred outside the European Economic Area in circumstances governed by Chapter V GDPR, the Provider will ensure that an applicable lawful transfer mechanism and required safeguards are in place.

5.7 Data-subject requests

Taking into account the nature of the processing, the Provider will provide reasonable assistance through appropriate technical and organisational measures to help the Customer fulfil its obligations concerning data-subject rights.

If the Provider receives a request directly concerning Customer Personal Data, it will direct or notify the Customer where reasonably possible and will not independently determine the response unless legally required or authorised by the Customer.

5.8 Compliance assistance

Taking into account the nature of processing and information available to it, the Provider will provide reasonable assistance to enable the Customer to comply with its obligations under Articles 32 to 36 GDPR, including obligations relating to security, personal-data breaches, data-protection impact assessments and prior consultation.

The Provider may charge reasonable costs for exceptional assistance materially beyond the ordinary operation of the Services where permitted by law and agreed with the Customer in advance, except to the extent the assistance is required because of the Provider's breach of the Contract or Data Protection Laws.

5.9 Personal-data breaches

The Provider will notify the Customer without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data.

The Provider will provide information reasonably available to it which the Customer requires to assess and fulfil its obligations under Articles 33 and 34 GDPR.

5.10 Return and deletion

At the end of the relevant Services, and subject to clause 6 and Applicable Law, the Provider will, at the Customer's choice, return or delete all Customer Personal Data and delete remaining copies, unless Applicable Law requires continued storage.

Where continued storage is required by Applicable Law, the retained Customer Personal Data will remain protected and will not be processed for another purpose except as permitted or required by law.

5.11 Compliance information and audits

The Provider will make available information reasonably necessary to demonstrate compliance with Article 28 GDPR.

The Customer or an independent auditor appointed by it may conduct an audit where reasonably necessary to verify compliance.

Unless a personal-data breach, material compliance concern or competent authority requires otherwise:

(a) the Customer will first use information and documentation supplied by the Provider where this can reasonably establish compliance;

(b) an inspection must take place on reasonable prior notice and during normal business hours;

(d) the auditor must be independent and subject to appropriate confidentiality obligations; and

(e) the Customer will bear its own audit costs.

Nothing in this clause limits an audit or inspection required by Article 28 GDPR.

5.12 Provider as controller

Where the Provider determines the purposes and means of its own processing, including for contracting, billing, account administration, website operation, sales, support administration, security or its own legal and business administration, the Provider acts as an independent controller.

That processing is governed by the Arkata Privacy Policy.

6. EU Data Act, Switching and Portability

This clause applies to the extent that Chapter VI of the Data Act applies to Arkata.

6.1 Switching rights

The Provider will not impose contractual, commercial, technical or organisational obstacles prohibited by the Data Act which prevent the Customer from:

(a) switching to another provider covering the same service type;

(b) porting Exportable Data and any applicable digital assets to its own ICT infrastructure; or

Switching requests must be sent to legal@arkata.mt.

6.2 Notice and switching process

The notice period to initiate a switching process is 30 calendar days.

After that notice period, the Provider will complete the switching process without undue delay and, where required by the Data Act, within a maximum transitional period of 30 calendar days.

During the transitional period, the Provider will:

(a) provide reasonable assistance to the Customer and third parties authorised by the Customer;

(b) act with due care to maintain business continuity and continue the functions or Services required under the Contract;

(d) maintain an appropriate level of security for the relevant data throughout transfer and retrieval.

The Provider will provide information reasonably necessary to support the Customer's exit strategy.

If the 30-day transitional period is technically infeasible, the Provider will notify the Customer within 14 working days of the switching request, explain the technical reasons and specify an alternative transitional period not exceeding seven months.

The Customer may extend the transitional period once for a period it considers appropriate for its purposes, as permitted by the Data Act.

6.3 Customer's exit choice

Following the notice period, the Customer may require the Provider to:

(a) facilitate switching to another provider, in which case the Customer must provide the necessary destination details;

(b) port Exportable Data and any applicable digital assets to the Customer's own ICT infrastructure; or

Where the Customer switches provider, the affected Services will be considered terminated when the switching process has been successfully completed.

Where the Customer chooses erasure without switching, the affected Services will be considered terminated at the end of the applicable notice period.

The Provider will notify the Customer when the Contract is considered terminated under this clause.

Termination through the Data Act switching process does not affect accrued Fees or any lawful early-termination payment expressly stated in the Customer Contract.

6.4 Retrieval and erasure

Following the end of the transitional period, the Customer will have at least 30 calendar days to retrieve its Exportable Data and any applicable digital assets.

After that retrieval period, or a later period agreed with the Customer, the Provider will erase Exportable Data and digital assets generated directly by or relating directly to the Customer where required by the Data Act, except where continued retention is required by Applicable Law.

Personal data remains additionally subject to clause 5.

6.5 Portable categories

The following are the categories of data and digital assets that can be ported during the switching process, to the extent that they exist in the Customer's Arkata workspace and constitute Exportable Data:

(a) client, prospective-client, contact and collaborator records and associated Customer-entered metadata;

(b) project, property, site, reference, application, permit, workflow, lifecycle, stage, status and date information;

(d) calendar events and associated Customer-entered information;

(e) documents and files uploaded or generated for the Customer through supported Arkata functionality, together with available Customer-facing metadata;

(f) Authority-related correspondence and email information retained within Arkata;

(g) quotations, services, billing plans, invoices, payments, expenses and related financial workflow records;

(h) Customer User and team information, roles, preferences and Customer-specific configuration, excluding authentication secrets;

(i) Customer-facing activity records and history generated through the Customer's use of Arkata where those records constitute Exportable Data; and

(j) other inputs, outputs, records, files and metadata directly or indirectly generated or co-generated through the Customer's use of supported Arkata functionality and qualifying as Exportable Data under the Data Act.

6.6 Internal-function exclusions

The following categories are excluded from portability to the extent permitted by the Data Act because they relate to the Provider's internal functioning, intellectual property, trade secrets, security or data which is not Exportable Data:

(a) Arkata source code, object code and proprietary software components;

(b) proprietary algorithms, automation logic and internal technical methods;

(d) internal security, vulnerability, anti-abuse and access-control information;

(e) passwords, authentication secrets, MFA secrets, security tokens and cryptographic credentials;

(f) internal infrastructure, application and security logs or monitoring information which do not form part of Customer-facing activity records;

(g) internal support, development, administration and product-management records;

(h) Provider analytics and derived information which does not constitute Exportable Data; and

(i) data belonging to other customers or third parties which the Customer has no right to receive.

These exclusions will not be applied in a way that unlawfully prevents or delays switching.

6.7 Technical portability

The Provider will make available the interfaces, information and portability functionality required by the Data Act to facilitate switching.

Where required by the Data Act, applicable interfaces will be made available free of charge to the Customer and an authorised destination provider.

Where no applicable common specification or harmonised interoperability standard governs the relevant export, the Provider will, where required by the Data Act, make Exportable Data available in a structured, commonly used and machine-readable format.

The Provider is not required to disclose Provider IP, trade secrets or security information except to the extent required by Applicable Law.

6.8 Switching charges

The Provider does not charge the Customer a switching charge for assistance, data egress or other activities which the Provider is required to perform under Chapter VI of the Data Act.

This does not prevent the Customer from requesting, and the Parties separately agreeing, optional professional services which genuinely go beyond the Provider's statutory switching obligations.

Standard subscription Fees and any lawful early-termination payment expressly provided for in the Customer Contract are not switching charges and remain payable to the extent permitted by Applicable Law.

7. Suspension, Termination and Data Exit

7.1 Suspension

The Provider may suspend affected access where reasonably necessary because:

(a) the Customer materially breaches the Contract and, where capable of remedy, does not remedy the breach after reasonable written notice;

(b) undisputed Fees remain overdue after notice;

(d) there is unauthorised access, credential misuse or material abuse of Arkata; or

(e) suspension is required by Applicable Law or a competent authority.

Where reasonably possible, the Provider will limit suspension to the affected Users, functionality or activity and restore access after the relevant issue has been resolved.

Prior notice is not required where immediate action is reasonably necessary to address an urgent security or legal risk. Where legally permitted, notice will be given as soon as reasonably practicable afterwards.

Suspension will not be used to obstruct mandatory switching, portability or data-retrieval rights.

7.2 Subscription Term and ordinary cancellation

The Subscription Term, renewal arrangements and applicable cancellation notice are stated in the Customer Contract.

Either Party may cancel the subscription for convenience by giving the cancellation notice stated in the Customer Contract.

Access to the Services and applicable Fees will continue until the cancellation takes effect, unless the Parties agree otherwise in writing.

Monthly subscription Fees already paid or payable for a billing period are non-refundable.

Where annual subscription Fees have been paid in advance and ordinary cancellation takes effect before the end of the relevant annual subscription period, the Provider will refund the portion attributable to the unused period after access ends, calculated on a daily pro-rata basis.

No refund is due where access is suspended or terminated because of the Customer's material breach, unlawful or unauthorised use, misuse of Arkata, a material security or data-protection risk created by the Customer, unauthorised access caused by the Customer, or unpaid Fees.

7.3 Material breach

Either Party may terminate the affected Contract by written notice if the other Party materially breaches it and does not remedy a remediable breach within 14 days after written notice requiring it to do so.

Either Party may terminate immediately where continued performance would be unlawful.

The Provider may terminate immediately where the Customer engages in serious unlawful use or creates a serious security risk which cannot reasonably be remedied.

7.4 Discontinuation by the Provider

If the Provider permanently discontinues the subscribed Arkata Services during a prepaid Subscription Term for reasons not caused by the Customer, the Provider will give reasonable prior notice where practicable.

The Provider will refund prepaid subscription Fees attributable to the unused terminated period.

7.5 Effect of termination

Termination or expiry ends the Customer's right to use the affected Services, subject to applicable retrieval, portability, return and deletion rights under clauses 5, 6 and 7.6.

Termination does not affect rights or obligations accrued before termination.

Provisions intended by their nature to continue after termination remain effective.

7.6 General data retrieval

Without limiting any broader rights under clauses 5 or 6, following expiry or termination the Customer may request a standard available export of its Customer Data within 30 calendar days after access ends.

The export will be provided using the export functionality or format reasonably available to the Provider and does not include Provider IP, internal implementation tools, internal security information, data belonging to another customer or data which the Customer has no right to receive.

The Provider is not required under this clause to perform custom development, data cleansing, correction, restructuring or historical reconstruction.

After the 30-day retrieval period, the Provider may delete or anonymise Customer Data in accordance with the Contract and Applicable Law.

8. Warranties and Liability

8.1 Standard of service

The Provider will perform the Services with reasonable skill and care and warrants that it has the right to provide the rights of access granted under the Contract.

Unless expressly stated in the Customer Contract, the Provider does not warrant that Arkata will be uninterrupted, continuously available or entirely error-free.

8.2 Customer and third-party causes

The Provider is not responsible for a defect, delay, omission or failure to the extent caused by:

(a) Customer systems, configuration, instructions or Customer Data;

(b) unauthorised modifications;

(d) internet or communications services outside the Provider's reasonable control;

(e) an Authority or third-party service outside the Provider's control; or

(f) the Customer's failure to provide required cooperation, access or information.

8.3 Professional reliance

Subject to clause 8.5, the Provider is not liable to the extent that loss results from:

(a) the Customer failing to monitor an official Authority system, inbox, notice or communication;

(b) the Customer failing independently to verify a material deadline or professional matter;

(d) inaccurate, incomplete or unlawful Customer Data;

(e) an unsupported workflow or third-party service; or

(f) use of Arkata contrary to the Contract.

8.4 Indirect loss

Subject to clause 8.5, neither Party is liable to the other for:

(a) indirect or consequential loss; or

(b) loss of profit, revenue, business, opportunity or goodwill,

arising out of or in connection with the Contract.

8.5 Liability that cannot be excluded

Nothing in the Contract excludes or limits liability:

(a) for fraud or fraudulent misrepresentation;

(b) for wilful misconduct or gross negligence to the extent liability cannot lawfully be excluded or limited;

(d) to the extent exclusion or limitation is prohibited by Applicable Law.

Nothing in the Contract limits the rights of data subjects or the powers of a competent supervisory or regulatory authority.

8.6 Liability cap

Subject to clause 8.5, the Provider's total aggregate liability arising out of or in connection with the Contract will not exceed the Fees paid or payable for the affected Services during the 12 months immediately preceding the event giving rise to the claim.

If the event occurs during the first 12 months of the Contract, the cap will instead be the Fees paid or payable for the affected Services during the first 12 months of the Contract.

For a free trial or other Services for which no Fee is payable, the Provider's total aggregate liability is limited to €100, to the extent permitted by Applicable Law.

The Customer's obligation to pay properly due Fees is not limited by this clause.

8.7 Customer indemnity

The Customer will indemnify the Provider against third-party claims and reasonable external legal costs to the extent directly arising from:

(a) Customer Data which the Customer did not have the legal right to submit or use through Arkata;

(b) Customer Data infringing a third party's intellectual-property rights; or

except to the extent the claim was caused by the Provider's breach of the Contract or Applicable Law.

8.8 Indemnity procedure

Where the Provider seeks indemnification under clause 8.7, it will:

(a) notify the Customer promptly after becoming aware of the relevant third-party claim;

(b) provide reasonable cooperation in the defence of the claim; and

provided that the Customer may not agree to a settlement which requires the Provider to admit wrongdoing, make a payment not covered by the indemnity or accept a continuing obligation without the Provider's prior written consent, such consent not to be unreasonably withheld.

9. General Terms

9.1 Changes to these Terms

The version of these Terms identified in the Customer Contract governs the applicable Subscription Term.

The Provider may revise these Terms from time to time and will directly notify the Customer in writing of any material revision.

Except as stated below, a material revision affecting a paid subscription will apply from the Customer's next renewal.

A material revision may take effect earlier where reasonably required by Applicable Law, a binding regulatory requirement, an urgent security requirement or a material change to the Services which cannot reasonably be deferred until renewal.

Where an earlier revision materially adversely affects the Customer's contractual rights or obligations, the Customer may object in writing within 30 days after receiving notice. The Provider may then:

(a) continue to provide the affected Services under the previous Terms until the next renewal, where reasonably practicable;

(b) agree an alternative with the Customer; or

(c) terminate the materially affected Services and refund any prepaid subscription Fees attributable to the unused terminated period.

Non-material changes, corrections and clarifications may take effect on the date specified in the Provider's notice.

Any proposed modification to clause 5 will be directly notified to the Customer. Where Data Protection Laws require the Customer's approval of that modification, the Provider will obtain that approval before the modification takes effect.

Changes to subprocessors are governed separately by clause 5.5.

The Provider will not amend these Terms in a manner which removes mandatory rights under Data Protection Laws or the Data Act.

The Provider will notify the Customer by email of any material amendment to these Terms before the amended Terms take effect.

9.2 Notices

Formal contractual notices must be sent by email to the addresses stated in the Customer Contract or to a replacement address notified in writing.

Formal notices to the Provider must be sent to:

legal@arkata.mt

Routine support communications do not constitute formal contractual notices unless they expressly state that they are a formal contractual notice.

This clause does not govern formal service of court proceedings where Applicable Law requires another method.

9.3 Assignment

The Customer may not assign the Contract without the Provider's prior written consent, such consent not to be unreasonably withheld in connection with a genuine transfer of the Customer's business.

The Provider may assign or novate the Contract to an entity which succeeds to the Arkata business through incorporation, restructuring, merger, acquisition or sale, provided that:

(a) the successor assumes the Provider's material obligations under the Contract; and

(b) the Customer is notified in writing.

This clause is subject to any mandatory consent requirement under Applicable Law.

9.4 Force majeure

Neither Party is liable for delay or failure to perform, other than a payment obligation, to the extent caused by circumstances beyond its reasonable control, provided that it takes reasonable steps to reduce the effect.

9.5 Entire agreement

The Contract constitutes the entire agreement between the Parties concerning Arkata and the Services and replaces previous proposals, statements, understandings and agreements concerning the same subject matter, except where the Customer Contract expressly preserves a previous right or obligation and except in the case of fraudulent misrepresentation.

9.6 No waiver

Failure or delay in exercising a contractual right does not waive that right.

9.7 Severability

If a provision is invalid or unenforceable, it will, where possible, be interpreted or limited only to the minimum extent necessary to make it lawful and enforceable.

The remaining provisions remain effective.

9.8 Relationship

The Parties are independent contracting parties.

Nothing in the Contract creates a partnership, employment, fiduciary, joint-venture or agency relationship between them.

9.9 Third-party rights

Except where Applicable Law expressly provides otherwise, a person who is not a Party to the Contract has no contractual right to enforce it.

9.10 Governing law and jurisdiction

The Contract is governed by Maltese law.

Subject to any mandatory jurisdiction which cannot lawfully be excluded, the courts of Malta have exclusive jurisdiction over disputes arising out of or in connection with the Contract.

9.11 Survival

Provisions concerning accrued Fees, Customer Data, data protection, data portability and retrieval, intellectual property, confidentiality, liability and any provision intended by its nature to continue after termination survive to the extent necessary to give them effect.