Parties and scope 1
These terms apply between Creedcon AB, organisation number 559604-9170 (‘Creedcon’), and the legal entity subscribing to the Qimbas™ service (the ‘Customer’). The service is provided to businesses and organisations only, not to consumers. The contract consists of the order confirmation, these terms and the data processing agreement, which is incorporated by reference.
The service 2
Qimbas™ is a cloud service that analyses the Customer’s security logs, detection rules, integrations and log quality, and produces evidence for audits and compliance work. The service reports observations and coverage. It makes no decisions about the Customer’s compliance and does not replace an audit. Creedcon develops the service continuously and may change features as long as its main purpose is maintained.
Connection and permissions 3
The Customer connects its sources through its own app registration in its own environment and chooses which sources to connect. The Customer is responsible for granting only the permissions the service specifies and no more. The Customer is responsible for having the right to connect the sources and for ensuring that Creedcon may lawfully process the content of the logs under the data processing agreement.
Subscription, price and payment 4
The subscription runs monthly and renews automatically until terminated. The price is set by the number of users and the size of the environment as stated in the order confirmation. Invoicing takes place monthly in advance with payment terms of 30 days. Late payment carries interest under the Swedish Interest Act. Price changes are announced at least 30 days before they take effect.
Customer responsibilities 5
The Customer is responsible for its users’ handling of credentials, for lawful use of the service, and for not attempting to circumvent the service’s security or isolation mechanisms.
Availability and support 6
Creedcon aims for high availability but does not guarantee uninterrupted operation. Planned maintenance is announced in advance where possible. Support is provided by email at hey@creedcon.se during office hours. The availability target is 99.5 per cent per calendar month. It is a target, not a guarantee, and does not give a right to service credits or other compensation.
Intellectual property 7
Creedcon owns all rights to the service, its software, analysis models and documentation. The Customer owns its data and the reports the service produces for the Customer. The Customer grants Creedcon the right to process the Customer’s data to the extent required to provide the service.
Confidentiality 8
Each party shall keep the other party’s confidential information secret and use it only for the purposes of the contract. The obligation applies during the contract term and for five years thereafter.
Personal data 9
For personal data in the Customer’s log data the Customer is the controller and Creedcon the processor. That processing is governed by the data processing agreement. For data about the Customer’s contact persons and users, Creedcon’s privacy policy applies.
Limitation of liability 10
Creedcon’s total liability under the agreement is limited to the fees the Customer has paid for the service during the twelve months immediately preceding the event giving rise to the claim. Creedcon is not liable for indirect loss, loss of profit or the consequences of decisions the Customer makes on the basis of the service’s analyses. The limitation does not apply in cases of intent or gross negligence.
Term and termination 11
The contract applies from the order confirmation and runs monthly. Notice of termination must be given no later than 30 days before a new monthly period. Either party may terminate with immediate effect in case of a material breach that is not remedied within 30 days of written notice. On termination the Customer’s data is deleted or returned in accordance with the data processing agreement.
Changes to the terms 12
Creedcon may change these terms with at least 30 days’ notice. The Customer may terminate the contract as of the date the change takes effect if it does not accept the change.
Governing law and disputes 13
Swedish law governs the contract. Disputes shall be settled by the Swedish general courts with the Gothenburg District Court (Göteborgs tingsrätt) as the court of first instance, unless the parties agree otherwise.