Terms of Service

1.1 The parties

These Terms of Service ("Terms") govern your use of the ITSailor platform and offerings (collectively, the "Services") operated by Michal Jatczak, a sole trader registered in Malta and trading under the name ITSailor ("we", "us", "ITSailor"), with principal place of business at Level 1, Unit 60, Door No 63, Connecticlub Business Center, Triq Il-Ballut (Zona Industrijali, Mosta), MST 4001, Mosta, Malta. Malta VAT MT32760411, DUNS 507601021.

ITSailor is a trading name and not a separate legal entity; the contracting party is Michal Jatczak. Where these Terms name Michal Jatczak T/A ITSailor, that is the same person.

1.2 Acceptance

By purchasing, accessing, or using the Services you ("Customer", "you") agree to these Terms.

1.3 Documents forming the agreement

More than one document can apply to the same purchase. Where they conflict, the following order controls, highest first:

1. A signed Order Form, Statement of Work (SOW) or Master Services Agreement (MSA), for the Services it identifies. It cannot vary Microsoft New Commerce Experience rules, or any other vendor term we are not free to vary as a reseller.
2. A Data Processing Agreement, where one has been agreed with you, for personal data we process on your behalf. We do not attach one by default. Section 13 sets out when it is agreed and what governs the processing that runs without it; this section does not repeat that.
3. The CSP Marketplace Terms, for licences bought through the marketplace checkout.
4. These Terms.
5. The Refund Policy.

The CSP Marketplace Terms and the Refund Policy are incorporated into these Terms by reference and form part of them. The Privacy Policy and the Cookie Policy are transparency notices about how we handle data. They are not contractual terms, and nothing in them creates an obligation you owe us.

What these Terms are, and what they are not. These Terms are the contract for a purchase you can make without signing anything: a workshop, an eBook, a code kit, a marketplace licence or a self-serve subscription. They are complete for that purchase. Where an engagement is scoped and signed instead, the Order Form, Statement of Work or Master Services Agreement at the top of the list carries the terms only a signed engagement needs, and it ranks above this document for the Services it identifies. Those documents are issued at contract time. They are not published here, are not offered for click-acceptance, and cannot vary a vendor term we are not free to vary as a reseller.

Nothing in this section limits any mandatory right you have as a consumer, or replaces the pre-contractual information we must give you before you place a consumer order.

Most Services are sold business-to-business. By accepting these Terms for a B2B offering you confirm that you are acting on behalf of a legal entity, are authorised to bind that entity, and that the purchase is for purposes related to your trade, business, or profession. Consumer-protection statutes that apply only to business-to-consumer contracts (including the 14-day cooling-off period under EU Directive 2011/83/EU) do not apply to B2B purchases. Whether you are a consumer is determined by your status at purchase (a natural person acting wholly or mainly outside your trade, business, or profession), not by the marketing label of the Service.

We currently offer the following categories of Services:

3.1 Free diagnostic tools

Calculators, scanners, and assessments at /tools (Microsoft 365 license estimator, security scorecard, AI readiness scan, SaaS auditor, deliverability scanner, offboarding risk profiler, automation ROI calculator, DevEx maturity scan). Provided free, anonymously, without warranty. You retain ownership of inputs you submit; we retain anonymised aggregate metrics for product improvement.

3.2 Paid workshops

Fixed-price live engagements delivered by the founder (Michal Jatczak). Currently:

• €499 Architecture & Security Design Workshop (B2B). 2-hour live session in your tenant, ITSailor Microsoft 365 Security Baseline assessment, Azure landing-zone sketch, written architecture review delivered within 5 business days, and a deployable architecture plan with ready-to-merge Terraform / Power Automate flows. If the deliverable misses that 5-business-day window, the fee is refunded in full under the Refund Policy, and the documents remain licensed to you when they land.
• €149 Microsoft 365 Tenant Hardening (B2C variant). 90-minute live session for solo operators and very small teams. Covers the Essential profile of the ITSailor Microsoft 365 Security Baseline at a reduced scope.

3.3 Paid eBooks and knowledge bundles

Downloadable PDFs (currently €99 per title - Microsoft 365 Hardening for Regulated Industries and DORA & NIS2 Roadmap; release schedule on the handbook page). Personal licence for the purchasing organisation, or for the individual purchaser where an eBook is bought by a consumer; redistribution or resale is prohibited.

3.4 Microsoft 365 and partner-marketplace licensing

We act as a Microsoft CSP Indirect Reseller (PLA ID 7113951) through the Pax8 marketplace. Where you purchase third-party licences (Microsoft 365, Google Workspace, others) through us, the underlying vendor's end-user terms also apply. Self-serve marketplace purchases are additionally governed by the CSP Marketplace Terms, which control for those purchases. We are the billing party and primary support contact; the vendor retains licence ownership and platform-level terms.

Microsoft New Commerce Experience (NCE) subscriptions follow Microsoft's cancellation rules: cancellation within 24 hours of a term earns a full refund; cancellation or seat reductions are otherwise available only within the first 7 calendar days of each subscription term, including on renewal, unless Microsoft or the vendor publishes a different written term for that SKU.

3.5 SaaS subscriptions

Two things are sold under this heading and they are bought in different ways, so they are set out separately.

3.5.1 Self-serve subscriptions

These are bought at checkout on this site, with no Order Form. Fees are stated net of VAT and renew automatically until cancelled:

• Tenant Monitor and Offboarding Evidence - one subscription covering both products for one tenant, bought from either product page, or from the free offboarding scan. €249 per month, or €199 per month billed annually.
• SEAWALL Managed - managed AWS FinOps, 10 named engineering hours a month, scope reviewed quarterly, unused hours do not roll over. €1,490 per month.

Cancellation follows section 07; refunds follow the Refund Policy; switching and export follow section 22.

3.5.2 Subscriptions sold under an Order Form

HELMGATE (approval-gated administrative actions for Microsoft 365) and DECKLOG (Microsoft 365 Copilot readiness and knowledge operations for internal knowledge sources) are in sales-MVP phase and are not sold self-serve. Tiers, pricing, and availability for these are confirmed in an Order Form or Master Services Agreement signed before service activation.

SEAWALL Engine is the FinOps platform behind SEAWALL Managed and the SEAWALL code kit in 3.7. It is not sold as a standalone self-serve subscription.

3.6 Custom consulting and implementation engagements

Custom Cloud, Security, and AI architecture engagements scoped per a separate Statement of Work (SOW) anchored to the €499 Architecture Workshop output. All consulting engagements close with an Exit Kit (see section 05).

Where the rest of a scoped engagement is written down. These Terms are the contract you accept at a self-serve checkout. A scoped engagement is a different motion and carries machinery a checkout does not need: how work is ordered and what a signature commits, who delivers it and when a subcontractor may be used, what each party owes the other before delivery can start, how a change of scope is agreed and priced, how a deliverable is accepted or rejected, and the payment period for an invoice. None of that is on this page. It is set out in the ITSailor Master Services Agreement and in the Statement of Work signed under it, which are issued at contract time and rank above these Terms under section 1.3. This paragraph takes nothing away from what these Terms give you. It says where the rest of the detail lives, so that a buyer who is not signing an engagement is not reading an engagement's apparatus.

3.7 Code kits and infrastructure templates

SEAWALL DIY (€199, one-time). A self-guided AWS FinOps code kit. It is not a subscription and it is not a hosted service. On payment we send an invitation to a private Git repository, addressed to the GitHub username you give at checkout, and you hold collaborator access to that repository. What you receive is delivered code and documentation, licensed under section 04 as a Deliverable rather than as access to a hosted service, which means section 22 does not apply to it: you already hold the repository. Refunds are governed by the Refund Policy.

In these Terms, "Deliverables" means the material we produce for you or hand to you under a workshop, a consulting or implementation engagement, or a code kit: architecture documents, Terraform and other infrastructure-as-code modules, Intune and Conditional Access baselines, runbooks, scripts, written reviews, and the Exit Kit contents described in section 05. Deliverables do not include the hosted SaaS products or their source code.

Subject to payment in full and ongoing compliance with these Terms, four layers apply:

• Background IP stays ours. The methods, templates, checklists, baselines, tooling and know-how we hold before an engagement, or develop outside it, remain ours. Nothing in these Terms transfers them, and nothing in a Deliverable grants you a licence to them beyond using that Deliverable.
• Deliverables are licensed to you, perpetually. You receive a perpetual, irrevocable, royalty-free, worldwide licence to use, modify and keep the Deliverables within your organisation, and to transfer that licence to a successor supplier without asking us. Ownership stays with ITSailor or its licensors. That is what the Exit Kit promise means: you can leave and take the work with you, not that title changes hands.
• Foreground IP under a SOW. Where a Statement of Work provides that intellectual property created specifically for you is assigned to you, that assignment takes effect on payment in full, and the SOW controls over the paragraph above for the material it identifies. Material the SOW does not identify is licensed under the paragraph above rather than assigned. The mechanics of an assignment, including what title is warranted and which further documents we will execute to give it effect, are in the Master Services Agreement and in the SOW itself, not on this page.
• Third-party and open-source components. Deliverables contain third-party and open-source components that we do not own and cannot license to you. Those are governed by their own licence terms, which are identified in the Deliverable or its documentation. Sections 10 and 12 exclude them from our warranty and from our indemnity.

The other Services are licensed as follows:

• eBooks and knowledge bundles. Personal licence for the purchasing organisation's internal use, or for the individual purchaser where bought by a consumer. Redistribution, resale, sublicensing, or public republication is prohibited.
• SaaS products. Subscription right to access the hosted service for the term and seat count agreed. No licence to underlying source code.
• Free tool outputs. You own your inputs and the per-session report generated; we may use anonymised aggregate metrics to improve the tools.

The credentials map is a map, not a copy of the secrets. It records what exists, who holds it, and where the value lives. The values themselves stay in your own vault, which the map names rather than reproduces, and the 90-day self-management guide inside the kit opens by instructing you to rotate every credential in the map during week one: the map is a list of things to change, not a list of things to keep. Credential values are not written into the Exit Kit. Neither party sends passwords, private keys, recovery codes, live access tokens or production credentials by email, through our contact form, or in any tracked document; they move through your own vault or through a credential-sharing mechanism we agree in writing.

This is the stronger position for you, not a reduced one. A credential value copied into a handover document is a credential that has been disclosed to a document, and that document then has to be guarded, tracked and destroyed for as long as the value stays live. Naming the vault leaves the value under your own access controls, and rotation in week one ends any access we held, on a date you choose.

If you hold no vault of your own. Handing you a list of names would not satisfy this section. Where you have no vault at the point of handover, the engagement either stands one up or records in writing, before the engagement closes, where each value will live and who will hold it. That is agreed in the Statement of Work while the work is being scoped rather than discovered at handover, and the Exit Kit is not complete without it.

Two delivery windows apply, because two different things are being bought:

• €499 Architecture & Security Design Workshop. The written deliverable pack, including the Exit Kit materials, is due within 5 business days of the session closing. For this workshop the pack also contains the credentials map, infrastructure-as-code state exports, runbooks, vendor list, cost-attribution map and 90-day self-management guide described on the workshop page. If the window is missed, the fee is refunded in full under the Refund Policy, and the documents remain licensed to you when they land. You do not have to ask for it.
• Consulting and implementation engagements under a SOW. The Exit Kit is delivered within 24 hours of engagement close.

No vendor lock-in is a contractual commitment, not a marketing line. For hosted subscriptions the equivalent commitment is the switching, export and exit right in section 22.

Fees are stated in EUR exclusive of VAT, sales, withholding, or similar taxes which are payable by the Customer where applicable, except for the self-serve eBooks and the Microsoft 365 Tenant Hardening workshop, whose stated prices are the totals the Customer pays, with VAT included where it applies. Reverse-charge VAT applies for valid EU business customers outside Malta with valid VIES-verified VAT numbers. One-time fees are charged immediately on order. Subscription fees renew automatically on the same calendar day each month/year and are charged in advance via Stripe.

Consumers and VAT. Prices shown on this site are net of VAT, except for the self-serve eBooks and the Microsoft 365 Tenant Hardening workshop, whose stated prices already include VAT. Where any other Service is sold to a consumer, VAT at the rate of the consumer's country of residence is added, and the VAT-inclusive total is displayed before the order is placed (Consumer Rights Directive 2011/83/EU, Articles 6(1)(e) and 6(6); Unfair Commercial Practices Directive 2005/29/EC, Article 7(4)(c)).

Renewal and price changes for subscriptions.

• We send a renewal reminder at least 30 days before each annual renewal, stating the price that will be charged.
• Auto-renewal can be switched off at any time in the Stripe Customer Portal reachable from your account. Switching it off leaves the period you have already paid for running to its end.
• We give at least 30 days' written notice of any price increase. An increase takes effect at your next renewal; we do not change the price inside a period you have already paid for. Section 15 gives you a termination right where you do not accept a change.

You may cancel a subscription at any time through the Stripe Customer Portal accessible from your account. Except where the Refund Policy states otherwise for a specific Service, cancellation takes effect at the end of the current billing period, we do not pro-rate the unused portion, and we do not refund billing periods already elapsed absent a service-credit event under section 08. Where the Refund Policy gives a money-back window for a Service, that window controls and this paragraph yields to it.

Suspension. We may suspend access for non-payment on 7 days' written notice. We may suspend immediately where fraud or a security risk requires it, where an acceptable-use breach under section 18 is active, or where the law requires it. We tell you why, and we restore access once the cause is resolved.

Termination for breach. Either party may terminate for the other's material breach where the breach is capable of remedy and is not remedied within 30 days of written notice describing it. This right is reciprocal: it applies to our breach on the same terms as it applies to yours.

After termination. SaaS account access is revoked. For 30 days after termination we keep your data available for export and provide it on request in the formats listed in section 22; where that section's longer switching process has been started, its windows apply instead. Workshop Deliverables and Exit Kit materials already delivered remain licensed to you under section 04. Prepaid fees are not refunded where we terminate for your material breach; where we terminate for convenience, we refund prepaid fees pro rata for the period after termination.

Free tools and B2B workshops are delivered as-is (workshops carry a written warranty of professional execution - see section 10), with one exception that is a term rather than a target: the €499 workshop deliverable carries a 5-business-day window and a full refund if it is missed, under the Refund Policy.

Service level description. What follows is the service level description for the Services, and the mechanism by which it is updated and revised. It is published here rather than supplied on request because Article 30(2)(e) of Regulation (EU) 2022/2554 requires a service level description in every contractual arrangement for ICT services, not only in one supporting a critical or important function.

What is committed. Every commitment below is a term of this contract or of a document it incorporates, and each carries a stated consequence for missing it. The first repeats the exception named above, because a description that left out the only dated delivery commitment would not be a description:

• The €499 workshop deliverable pack: 5 business days from the close of the live session, measured in working days in Malta, with the fee refunded in full if the window is missed (Refund Policy). The window pauses only for time we spend waiting on access or information we asked you for in writing.
• Marketplace orders: one business day from confirmed payment to the order being placed with our wholesale supplier, with a service credit of 10% of the first month's fees where we miss it through our own fault (CSP Marketplace Terms, section 04). Where provisioning fails outright rather than late, the same section commits us to a full refund.
• Complaints: acknowledged in 2 business days, answered in 14 days (section 23). Refund requests follow the timetable in the Refund Policy, and a consumer withdrawal is reimbursed within 14 calendar days whatever that timetable says.
• Notice periods: 30 days before a price increase (section 06), 30 days before a material change to these Terms (section 15), and the notice and transitional periods for switching in section 22.

What is not committed. There is no uptime target, no committed availability percentage and no service credit for unavailability, for any Service, self-serve or otherwise. Our monitoring provider publishes an uptime percentage on a public status page; that is a measurement of what happened, not a level we have agreed to meet, and no measurement we or our providers take of our systems is a contractual measurement of availability. There is no committed incident response time and no committed support coverage window. Stating it this way is deliberate: a number published here without a measurement behind it would be a target you could not check and we could not defend.

Where a service level can come into existence. Only in a signed Order Form, Statement of Work or Master Services Agreement, and only where that document states the metric, the measurement method, the measurement window, the target and the credit. A target with no measurement method and no credit is not a service level and we do not agree one. Where such a document states a service credit, that credit is your sole remedy for a missed target under it.

How this description is updated and revised. A change to this section is a change to these Terms and is notified under section 15, which gives at least 30 days' email notice to every customer with a live entitlement and never applies a change retrospectively to a purchase already made. A service level stated in a signed document is revised only by a signed change to that document.

The service-credit sole remedy in this section does not limit any right granted to a financial-entity Customer under the DORA Addendum described in section 21, including access, inspection and audit rights, cooperation with threat-led penetration testing, and the exit and transition rights required by Article 30(3) of Regulation (EU) 2022/2554. Where the service supports a critical or important function, Article 30(3)(a) additionally requires full service level descriptions with precise quantitative and qualitative performance targets. This page does not contain them, and it does not pretend to; section 21 is how they are reached.

Consumers. Nothing in this section applies to a consumer. Where you bought as a consumer you keep your rights under the Consumer Affairs Act (Cap. 378) and the Consumer Rights Regulations (S.L. 378.17), and, for digital content and digital services, the statutory guarantee of conformity described in section 23.

You are responsible for:

• Operating your cloud accounts (Microsoft, AWS, Google, others) and the production environments you deploy;
• Reviewing Terraform plans, Intune baselines, Conditional Access policies, and other changes we recommend before applying them in your environments;
• Managing your own credentials, MFA tokens, and access policies;
• Backing up data and configuration outside scope of any SaaS we provide;
• Reviewing AI-generated output before acting on it, as set out in section 20;
• Complying with the regulatory obligations that apply to you: the instruments that reach your business, including Regulation (EU) 2022/2554 (DORA), Directive (EU) 2022/2555 (NIS2) as transposed in the Member State that regulates you, and Regulation (EU) 2016/679 (GDPR); and, separately, the conditions attached to any authorisation, licence or registration you hold, which you owe to the body that granted it.

We warrant that we have the right to deliver the Services and that we will perform any included professional services in a workmanlike manner consistent with industry practice.

Except for the foregoing, the Services are provided "as-is" without warranty of any kind, express or implied, including merchantability, fitness for a particular purpose, or non-infringement. We do not warrant that the Services will be uninterrupted, error-free, or meet your specific requirements. This disclaimer extends to the third-party and open-source components identified under section 04, which are warranted, if at all, only by whoever publishes them.

Consumers. Nothing in this section applies to a consumer. Where you bought as a consumer you keep your rights under the Consumer Affairs Act (Cap. 378) and the Consumer Rights Regulations (S.L. 378.17). For digital content and digital services, meaning our eBooks, code kits and SaaS subscriptions, the statutory guarantee of conformity under Directive (EU) 2019/770 as transposed in Malta applies (Articles 8, 11 and 14): we must bring the Service into conformity, and where we do not, you are entitled to a proportionate reduction of the price or to end the contract, free of charge in every case (Article 14(1) and (4)). A live workshop is a service rather than digital content, so the non-performance and remedy rules of the Consumer Affairs Act apply to it instead.

To the maximum extent permitted by law, neither party will be liable for indirect, incidental, special, consequential, or punitive damages, or for lost profits, revenue, anticipated savings, goodwill, data, or business opportunities, however caused and on any theory of liability, even if advised of the possibility of such damages.

Which cap governs where a signed agreement also carries one. The cap above is the self-serve cap. It is the one that applies to anything you buy at a checkout on this site, and it is stated here because that is the only place a self-serve buyer would look. Where you have signed a Master Services Agreement or a Statement of Work that states its own aggregate cap, that figure replaces the cap above for the Services that document covers: it does not sit alongside it and it does not create a second cap. The cap above continues to govern everything the signed document does not cover, including any self-serve purchase you make. Where a signed document states no cap, the cap above governs there too, unchanged. A deal-specific figure belongs in a signed instrument rather than on a public page, because it is a function of one engagement's exposure, which is why it is not published here.

What is never excluded or capped. Nothing in these Terms excludes or limits either party's liability for: (a) fraud or fraudulent misrepresentation; (b) wilful misconduct or gross negligence; (c) death or personal injury caused by negligence; or (d) any other liability which cannot be excluded or limited under Maltese or EU law.

Consumers. This section as a whole does not apply where you bought as a consumer. That includes the exclusion of liability for lost data in the first paragraph and the cap above. Your statutory remedies, and any liability we owe you under Maltese or EU consumer law, are unaffected by anything in this section.

This section does not apply where you are acting as a consumer, as determined under section 02.

Your indemnity. You will indemnify and hold Michal Jatczak T/A ITSailor harmless from any third-party claim arising from (a) your use of the Services in breach of these Terms, (b) infrastructure or applications you operate using Deliverables from us, and (c) data you process through the Services in breach of applicable law.

Our indemnity. We will defend you against a third-party claim that a Deliverable, as delivered by us and used in accordance with these Terms, infringes that party's intellectual property rights, and we will pay damages finally awarded or agreed in settlement. This indemnity covers only material originally authored by ITSailor. It expressly excludes third-party and open-source components (see section 04); Microsoft and other vendor products, which are covered by the vendor's own terms and, for marketplace licences, by the Microsoft Customer Agreement routed through the CSP Marketplace Terms; any modification you make; any combination with anything we did not supply; anything built to your written specification; and continued use after we have told you to stop. Where such a claim is made or is likely, our sole obligation and your sole remedy is that we may, at our option, repair the Deliverable, replace it with a functionally equivalent one, or refund what you paid for it.

How an indemnity is run. The party seeking indemnity gives prompt written notice of the claim. The indemnifying party controls the defence and any settlement, consulting the other reasonably. No settlement that admits fault, or that imposes a non-monetary obligation on the other party, may be made without that party's consent, which is not to be unreasonably withheld. The party seeking indemnity gives reasonable assistance at the indemnifying party's cost. Late notice reduces the indemnity only to the extent the delay actually prejudiced the defence.

Relationship to the cap. Amounts payable under either indemnity in this section count against the cap in section 11. They do not sit outside it.

Where ITSailor processes personal data on behalf of Customer, ITSailor acts as a processor and Customer as controller (Regulation (EU) 2016/679, Articles 4(7) and 4(8)). That arises in two places: the read-only tenant connectors described in section 11 of the Privacy Policy, and personal data Customer instructs ITSailor to process inside Customer systems during a scoped engagement. It does not extend to registration, account and billing data, which ITSailor processes as controller on the basis in Article 6(1)(b).

No purchase by itself appoints ITSailor as Customer's processor, and ITSailor does not attach a standard Data Processing Agreement by default. For the free scan and for a self-serve subscription, the authorisation Customer's administrator grants at connection is the whole of the instruction, and it is revocable at any time. Where Customer requires the Article 28(3) terms in writing, they are agreed before that processing begins; for a scoped engagement they are agreed during scoping, and once agreed they rank as set out in section 01. The Privacy Policy describes how we handle personal data we collect as controller, and section 08 of that policy describes the technical and organisational measures we apply.

Each party will protect the other's confidential information using at least the same degree of care it uses for its own confidential information, and never less than reasonable care. Architecture documents, source code, credentials, and audit findings are confidential information.

The current list of subprocessors is maintained in section 03 of the Privacy Policy, which is the single canonical source. We deliberately do not restate it here, so the two cannot drift apart. We will provide reasonable advance notice (at least 30 days) of additions.

We may update these Terms from time to time. Material changes are notified by email at least 30 days before they take effect, to every customer with a live entitlement: an active subscription, an open engagement, or a purchase still inside a refund or withdrawal window. Continued use of the Services after the effective date constitutes acceptance.

A change never applies retrospectively to a purchase already made: the version in force when you ordered governs that order. If you do not accept a material change, you may terminate the affected subscription with effect from the date the change takes effect, without penalty, and we will refund prepaid fees for the period after termination.

These Terms, and any dispute or claim arising out of or in connection with them, are governed by the laws of Malta.

Business customers. The courts of Malta have exclusive jurisdiction over any dispute arising out of or in connection with the Services.

Consumers. Two EU instruments decide this and both turn on the same fact: whether we direct our commercial activities to the country you live in. We sell online across the EU, in euro, with EU VAT handling, so we proceed on the basis that we do, and we do not ask a consumer to argue the point.

Which law applies. Under Article 6(1) of Regulation (EC) No 593/2008 (Rome I), a consumer contract is governed by the law of the country where you have your habitual residence, provided that the professional pursues commercial activities in that country or by any means directs them to it, and the contract falls within the scope of those activities. Where that condition is met, the choice of Maltese law above cannot deprive you of the protection of the provisions of that law which cannot be derogated from by agreement (Article 6(2)). Where it is not met, Article 6(2) does not bite and Maltese law governs. We state the condition rather than the saving alone, because the saving only exists if the condition is satisfied.

Which courts. Jurisdiction turns on the same test. Under Article 17(1)(c) of Regulation (EU) No 1215/2012 (Brussels Ia), the consumer jurisdiction rules apply where the contract has been concluded with a person who pursues commercial or professional activities in the Member State of your domicile, or by any means directs such activities to it, and the contract falls within the scope of those activities. Where they apply, you may bring proceedings against us either in Malta or in the courts for the place where you are domiciled, and we may bring proceedings against you only in the courts of the Member State where you are domiciled (Articles 18 and 19). Article 19 allows a departure from those rules only by an agreement entered into after the dispute has arisen, one that gives you additional courts to choose from, or one between parties both domiciled in the same Member State that confers jurisdiction on that State's courts. Nothing agreed before a dispute arises takes those choices away from you.

If you are a consumer domiciled outside the EU, you keep any mandatory protection and any forum that the law of your own country gives you; Maltese law and the Maltese courts apply for everything else.

Complaints and redress. Write to legal@itsailor.io first. We handle complaints on the timetable in section 23. Consumers in Malta may also refer a complaint to the Malta Competition and Consumer Affairs Authority (MCCAA), Office for Consumer Affairs; consumers elsewhere in the EU may refer it to the consumer protection authority or the European Consumer Centre of their own country.

Neither party is liable for delays or failures caused by events beyond its reasonable control, including natural disasters, fire or flood, war, terrorism, civil unrest, labour action, epidemic or pandemic and the public-health measures taken in response, energy shortage or grid failure, failure of a public telecommunications or internet network, cyber-attack or ransomware affecting either party or its suppliers, failure of a third-party cloud platform or subprocessor, and government action. The affected party will give prompt notice and use reasonable efforts to mitigate the impact.

If the event continues for more than 30 consecutive days, either party may terminate the affected Service on written notice, and we will refund prepaid fees pro rata for the period that was not performed.

When using the Services you will not:

• use them for unlawful purposes, or to store, send, or publish unlawful content;
• run penetration tests, vulnerability scans, load tests, or other security testing against our infrastructure without our prior written authorisation;
• reverse engineer, decompile, or disassemble the hosted products, or attempt to derive their source code, except to the extent that restriction is void under applicable law;
• resell, sublicense, timeshare, or otherwise make SaaS access available to anyone outside your organisation, except where an Order Form says you may;
• use the Services in a way that degrades them for other customers, or that exceeds a fair-use or rate limit we have told you about.

Breach of this section is a ground for suspension under section 07.

Both parties will comply with applicable export control and sanctions laws, including those of the European Union, the United Kingdom, and the United States.

You warrant that you are not a restricted or designated party under any of those regimes, that you are not owned or controlled by one, and that you will not make the Services or any Deliverable available, directly or indirectly, to a restricted party or to a territory subject to comprehensive sanctions. If that ceases to be true, tell us immediately. We may suspend or terminate the Services, in whole or in part, where we reasonably believe that continuing would breach one of those regimes, and a suspension or termination on that ground is not a breach of these Terms by us.

Some Services use AI models to draft reports, briefs, summaries, and recommendations. Where they do:

• The output is advisory. It is generated by automated means, it can be wrong, and it is not a professional opinion. You are responsible for human review before acting on it, which is part of the review duty in section 09.
• What you may submit. Do not submit special category data (GDPR Article 9), or personal data about other people, to an opt-in AI feature unless you have a lawful basis for doing so and it is consistent with your own privacy notices.
• Our role. The underlying foundation models are supplied by third parties. We act as a deployer of those models, not as their provider, and we tell you at the point of use where you are interacting with AI-generated output (Regulation (EU) 2024/1689, Article 50, which applies from 2 August 2026). The providers we use are named in section 03 of the Privacy Policy.
• No high-risk use by default. Nothing in these Terms puts a Service into a high-risk use case under Regulation (EU) 2024/1689. If you intend to use the output in a way that would, we have to agree it in a signed Order Form that addresses the obligations first.

This section applies where you are a financial entity within the meaning of Article 2 of Regulation (EU) 2022/2554 (DORA) and we provide ICT services to you.

These Terms on their own do not contain the contractual elements that Article 30(2) requires, and they do not contain the additional Article 30(3) elements that apply where the service supports a critical or important function. Where you are such a customer, the parties will execute the ITSailor DORA Addendum before service activation, and that addendum controls over these Terms for the matters it covers.

We will supply the information you need to maintain your register of information under Article 28(3), in the format set out in Implementing Regulation (EU) 2024/2956.

Nothing in this section makes us a financial entity or subjects us directly to DORA. DORA binds you; it reaches us through this contract and through your oversight of us as an ICT third-party service provider.

This section gives effect to Chapter VI of Regulation (EU) 2023/2854 (the Data Act). It is published here, before you order, because that is where the Regulation requires it to be available to you (Article 25(1)).

Scope. It applies to the hosted subscription services we operate ourselves, listed in section 3.5. It does not apply to Microsoft 365 or other third-party licences we resell: those run on the vendor's own platform, and switching or exporting from them is the vendor's obligation under the Microsoft Customer Agreement or the equivalent vendor terms, exercised through your own tenant administrator. It does not apply to SEAWALL DIY or to any other Deliverable, because you already hold those under section 04.

Notice and transitional period. To start switching, tell us in writing. The maximum notice period we require to begin is 30 calendar days. A 30-calendar-day transitional period then runs from the end of that notice period, during which the service keeps running and we assist your migration. Where technical infeasibility genuinely prevents completion in 30 days, we may extend the transitional period to a maximum of seven months, and we will tell you within 14 working days of your request, with reasons (Article 25(4)). You may also extend it once, for a period you choose (Article 25(5)).

What we export, and in what format. On request during the notice or transitional period, we provide:

• Account and subscription records (contact details, subscription history, entitlement state) as CSV.
• Invoices and billing documents as PDF.
• Monitoring findings, scan results, and evidence records from Tenant Monitor and Offboarding Evidence as JSON for the full records, and as CSV for the tabular view.
• Generated reports, briefs, and evidence packs as PDF, as generated.
• Infrastructure-as-code we delivered to you as Terraform HCL, in the Git repository you already hold.

What is not exportable. Our own product source code, model prompts, and internal tooling. Data held by third parties on your behalf under their own contracts, in particular the contents of your Microsoft 365 tenant. Security and HTTP request logs beyond the retention window stated in section 05 of the Privacy Policy. Aggregate statistics that no longer identify you or your tenant.

Retrieval and erasure. After the transitional period ends, you have at least 30 calendar days to retrieve the exported data. At the end of that retrieval window we erase it from our production systems (Article 25(2)(f) and (g)); copies inside routine backups are removed as those backups roll over. What survives is limited to what section 05 of the Privacy Policy describes: billing and tax records we are required to keep, and account and audit records retained for 12 months after termination so that we can answer an access or dispute request.

Cost. We charge nothing for switching, export, or data egress.

Custom-built engagements. Where we build something for you alone under a SOW rather than offering it at commercial scale, Chapter VI of Regulation (EU) 2023/2854 does not apply to it, and this sentence is the notice of that which Article 31 requires; the Exit Kit in section 05 is what covers that case instead.

This section is for buyers who are consumers. It repeats, in one place, information the Consumer Rights Directive requires us to give you before you order. Each heading below names the point of Article 6(1) of Directive 2011/83/EU it answers, so that you can check what is here against what the law asks for rather than taking our word that the list is complete.

Legal guarantee of conformity (Article 6(1)(l)). For digital content and digital services, meaning our eBooks, code kits and SaaS subscriptions, you have a statutory guarantee that what you receive conforms to what was described. It comes from Directive (EU) 2019/770 as transposed in Malta (Articles 8, 11 and 14), it costs you nothing to rely on, and it applies alongside, not instead of, any voluntary window in the Refund Policy. Where a Service does not conform we must bring it into conformity; where we do not, you are entitled to a proportionate reduction of the price or to end the contract (Article 14(1) and (4)).

Complaint handling (Article 6(1)(g)). Write to legal@itsailor.io. We acknowledge a complaint within 2 business days and give a substantive reply within 14 days. If the answer does not resolve it, consumers in Malta may refer the complaint to the Malta Competition and Consumer Affairs Authority (MCCAA), Office for Consumer Affairs, and consumers elsewhere in the EU may refer it to the consumer protection authority or European Consumer Centre of their own country.

Functionality, compatibility and interoperability (Articles 6(1)(r) and 6(1)(s)).

• eBooks. Delivered as PDF. Readable on any device with a PDF reader. No digital rights management, no activation, no online check, no expiry. The file carries a single-user licence line naming the purchaser.
• Workshops. Delivered as a live session by video call, plus written deliverables as PDF and, where the engagement includes them, Terraform and other infrastructure-as-code files as plain text.
• SEAWALL DIY. Delivered as collaborator access to a private Git repository. You need a GitHub account to accept the invitation, and an AWS or Azure account to run what is in it. Nothing in the kit runs on our infrastructure.
• SaaS subscriptions. Delivered through a browser. Tenant Monitor and Offboarding Evidence connect to your Microsoft 365 tenant with your administrator's consent; SEAWALL connects to your AWS or Azure account. You need the relevant account and the rights to grant that consent.

Duration, minimum term, and termination (Articles 6(1)(o) and 6(1)(p)). Monthly subscriptions run month to month with no minimum term and renew on the same calendar day each month. Annual subscriptions run for 12 months and renew annually. Either can be cancelled at any time in the Stripe Customer Portal; cancellation takes effect at the end of the period you have paid for, subject to any money-back window in the Refund Policy. Workshops, eBooks, and code kits are one-time purchases with no recurring charge and nothing to cancel.

24.1 Entire agreement

The documents listed in section 1.3, in that order, are the whole agreement between us for the Services they cover, and they replace anything said or written before. Nothing in this clause limits liability for fraudulent misrepresentation, and it does not apply where you bought as a consumer.

24.2 Severability

If a provision is held invalid or unenforceable, it is severed to the minimum extent necessary and the rest stays in force.

24.3 Survival

The following survive termination: section 04 (licence and ownership), section 06 for fees already accrued, section 10, section 11, section 12, section 13, section 16, and this section 24.

24.4 Assignment

Neither party may assign these Terms without the other's written consent, except that either may assign to a successor in a bona fide transfer of the business or the relevant part of it, including on incorporation of the business into a company. We will tell you if that happens.

24.5 No waiver

Not enforcing a term is not a waiver of it, and a waiver given once does not carry to the next time.

24.6 Notices

Formal notices under these Terms are given by email: to us at legal@itsailor.io, and to you at the email address on your account. A notice sent on a business day is treated as received the next business day. Cancelling a subscription in the Stripe Customer Portal remains valid without any notice under this clause. You may also write to us by post at the address in section 25, but you are never required to: no notice, cancellation, or withdrawal has to be in any particular form to count.

24.7 No partnership or agency

Nothing in these Terms creates a partnership, joint venture, employment, or agency relationship between us. Neither party may bind the other.

• Contract and legal questions: legal@itsailor.io
• Billing: billing@itsailor.io
• Data Subject Rights (GDPR access / erasure / portability / objection): dsr@itsailor.io - see also our Privacy Policy section 06.
• Operational and security: support@itsailor.io
• General: hello@itsailor.io

Postal: Michal Jatczak T/A ITSailor, Level 1, Unit 60, Door No 63, Connecticlub Business Center, Triq Il-Ballut (Zona Industrijali, Mosta), MST 4001, Mosta, Malta.