SaaS Terms and Conditions

Effective 2026-10-31

These are the SaaS Terms and Conditions (the "Terms") for the Aitonomy service, offered by Aitonomy B.V., a private limited company established in Amsterdam, the Netherlands, registered with the Dutch Chamber of Commerce under number 42198573, and in these Terms referred to as "Aitonomy".

These Terms govern access to and use of the Service. Advisory, assessment, design and implementation work, including a Scan as defined there, is governed separately by the Services Terms and Conditions. Where an engagement covers both, both apply, each to its own subject, as set out in clause 2.12.

Aitonomy provides these Terms to the Customer together with the Order Form, before the Agreement is entered into, so that the Customer can read and store them. They can also be viewed and downloaded at joinaitonomy.ai/legal.

1. Definitions

1.1 In these Terms, words written with capitals and not defined elsewhere have the following meaning:

1.1.1 Affiliate: an entity that directly or indirectly controls, is controlled by, or is under common control with a party.

1.1.2 Agent: an automated process that runs through the Service and uses one or more AI models of third parties, which the Customer configures itself or which Aitonomy configures on the Customer's instruction, and which the Customer governs, reviews and approves for use in accordance with clause 5.

1.1.3 Aggregate Data: aggregated statistics derived by Aitonomy from Service Metrics across multiple customers that are not attributable to or identifiable with any customer.

1.1.4 Anonymous Data: Service Metrics from which the identity of the Customer and its source has been completely removed and which do not relate to an identified or identifiable natural person or to an identifiable customer.

1.1.5 Business Day: any weekday (Monday to Friday) other than a public holiday in the Netherlands.

1.1.6 Confidential Information: any information, in any form, disclosed by one party to the other that is marked confidential or that should reasonably be understood to be confidential given its nature or the circumstances of disclosure, including the Service, Customer Data, business and technical information, and the terms of the Agreement.

1.1.7 Customer: the legal person that has accepted these Terms or an Order Form in order to access and use the Service.

1.1.8 Customer AI Provider: a provider of AI models or AI services with which the Customer contracts itself, such as the Customer's own AI subscription, and which the Service connects to or operates on at the Customer's instruction. A Customer AI Provider is not engaged by Aitonomy and is not a sub-processor of Aitonomy.

1.1.9 Customer Data: all data, documents, records, source code, repositories, specifications, tickets, prompts, configurations and other materials that the Customer or its Users make available to the Service, or that are generated through the Customer's use of the Service, including output produced by Agents, but excluding Service Metrics, Anonymous Data and Aggregate Data.

1.1.10 Customer Environment: the Customer's own infrastructure or third party subscriptions, including the Customer's own AI subscription, within or upon which the Service operates.

1.1.11 Documentation: the user and technical documentation for the Service that Aitonomy makes available to the Customer, in the version applicable on the date of the Order Form, and provides on request.

1.1.12 Fees: the fees payable by the Customer for the Service as set out in the Order Form.

1.1.13 GDPR: the General Data Protection Regulation (Regulation (EU) 2016/679).

1.1.14 Intellectual Property: all intellectual property rights, whether registered or unregistered, including patents, copyrights (including rights in source code and object code), database rights, design rights, trademarks, trade names, and rights in know-how and trade secrets.

1.1.15 Order Form: the order, quote or written agreement between the parties that references these Terms and sets out the Service subscribed for, the Product Sheet, the configuration, the Fees, the term and any other agreed terms.

1.1.16 Personal Data: personal data as defined in the GDPR.

1.1.17 Product Sheet: the description of the Service subscribed for, in the version attached to or stated in the Order Form.

1.1.18 Security Measures: the technical and organisational security measures set out in Schedule 1 to the Data Processing Agreement.

1.1.19 Service: the Aitonomy software service that provides a governed layer around AI models and tools of third parties, through which the Customer deploys, configures, governs, audits and runs Agents to support or partly automate its processes, together with any related support and Documentation, in the configuration and scope set out in the Product Sheet and in one of the configurations in clause 3.3.

1.1.20 Service Metrics: operational and performance metrics and metadata generated by or through the Service, such as cycle time, throughput, cost per unit of work, adoption, gate pass rates, token consumption, the number of runs of an Agent, the types of Agents, processes and configurations used, and similar operational metrics and metadata, which do not include Customer Data and from which Customer Data and source code cannot be reconstructed.

1.1.21 SLA: the Service Level Agreement published at joinaitonomy.ai/legal/sla, which forms part of the Agreement for every subscription to the Service.

1.1.22 Sub-processors list: the list of sub-processors published at joinaitonomy.ai/legal/sub-processors, as amended from time to time in accordance with clause 5.3 of the Data Processing Agreement, in the version provided with the Order Form and as subsequently notified.

1.1.23 User: an individual authorised by the Customer to access and use the Service.

1.2 Unless the context requires otherwise, words in the singular include the plural and vice versa.

2. General

2.1 These Terms apply to all offers and quotes of, and agreements with, Aitonomy relating to the Service. By signing an Order Form that refers to these Terms, the Customer expressly accepts them.

2.2 These Terms, together with the Order Form, the Product Sheet, the Acceptable Use Policy, the Sub-processors list, the SLA, and the Data Processing Agreement referred to in clause 8.3, constitute the entire agreement between the parties in relation to the Service (the "Agreement") and replace all previous oral or written agreements on the same subject.

2.3 Any purchase or other general terms of the Customer do not apply, as expressly rejected in the Order Form. Additions to or deviations from these Terms apply only where agreed in writing in the Order Form.

2.4 In the event of a conflict, the Order Form prevails over these Terms in respect of commercial matters and the matters these Terms leave to it, the SLA prevails in respect of service levels, and the Data Processing Agreement prevails in respect of the processing of Personal Data, the Acceptable Use Policy prevails in respect of permitted use, and the Sub-processors list prevails in respect of which sub-processors are engaged. The Product Sheet describes the Service; where it conflicts with these Terms, these Terms prevail. A deviation expressly stated as such in the Order Form prevails over these Terms, the SLA and the Data Processing Agreement for that Order Form, except that it cannot reduce the protection of Personal Data that the GDPR requires.

2.5 If any provision of these Terms is held invalid or unenforceable, the remaining provisions remain in full force, and the invalid provision will be replaced by a valid provision that reflects the intention of the original as closely as possible.

2.6 The version of these Terms in force on the date of the Order Form applies for the duration of that Order Form's then-current term. Aitonomy may amend these Terms with effect from the start of the next renewal term, on at least thirty (30) days' written notice before the end of the then-current term. Where an amendment is material, the Customer may object in writing within that period and terminate with effect from the end of that term. Amendments required by mandatory law take effect on the date the law requires, and Aitonomy notifies the Customer as soon as reasonably possible.

2.7 Aitonomy may assign or transfer its rights and obligations under the Agreement to an Affiliate or in connection with a merger, reorganisation or sale of business. The Customer may not assign or transfer its rights or obligations without Aitonomy's prior written consent.

2.8 Aitonomy may engage Affiliates or third parties, including sub-processors and providers of AI models, to perform parts of the Service, in accordance with the Data Processing Agreement. Aitonomy remains responsible for the Service as a whole. The terms of those third parties, as referred to in the Sub-processors list, apply to the part of the Service they provide, and a functional or technical limitation in those terms, such as supported features, usage limits or model behaviour, applies correspondingly to that part of the Service. This does not affect Aitonomy's own obligations in respect of security (clause 8.2), confidentiality (clause 8.1), data protection under the Data Processing Agreement, or the use of Customer Data for training (clause 7.4).

2.9 These Terms are also made for the benefit of Aitonomy's Affiliates and the persons it engages, who may invoke them as a third party stipulation within the meaning of Section 6:253 of the Dutch Civil Code.

2.10 No failure or delay in exercising a right under the Agreement operates as a waiver of that right.

2.11 Notices under the Agreement must be in writing. Notices to Aitonomy may be sent to mik@joinaitonomy.ai, and notices to the Customer to the contact stated in the Order Form.

2.12 Where an Order Form covers both the Service and services under the Services Terms and Conditions, such as set-up or implementation work, each is a separate agreement governed by its own terms. Termination, dissolution or suspension of one does not affect the other. By way of exception, where those services serve solely to set up the Service and the Service cannot be provided as a result of Aitonomy's material breach that is not remedied under clause 9.3, the Customer may terminate both.

3. The Service

3.1 The Service is a governed layer around AI models and tools provided by third parties. It enables the Customer to deploy, configure, orchestrate, govern, audit and run Agents across its operations, in order to support or partly automate its processes. The Service provides governance controls, guardrails, audit logging and delivery metrics intended to help the Customer control and understand what its Agents do. Aitonomy does not provide AI models of its own.

3.2 The Service is model and tooling agnostic. Aitonomy does not build, train or provide foundation models. Every AI model used through the Service is provided by a third party, and the terms of that third party apply to the use of that model in addition to these Terms. Which of the following applies follows from the configuration: where the Customer brings its own AI subscription or AI service, (b) applies to that use, and otherwise (a) applies. The Order Form need not state it.

(a) models of providers engaged by Aitonomy, under licences held by Aitonomy. Aitonomy contracts with these providers and configures them for the Service, and they process Customer Data as sub-processors of Aitonomy, as set out in the Data Processing Agreement and the Sub-processors list. Clause 7.4 applies to the use of Customer Data for training by those providers; or

(b) models of a Customer AI Provider. The Customer contracts with the Customer AI Provider itself and is responsible for that contract, for holding the right to use the model, plan or variant concerned, and for the settings of its own account, including data retention, data location and the use of data for training. Aitonomy is not a party to that contract, cannot change its terms, and is not responsible for the services of the Customer AI Provider. Clause 3.8 applies.

Where (a) applies, Aitonomy selects the model used for a given task and may change it; where (b) applies, the model follows from the Customer's own subscription and settings. A change of sub-processor is notified in accordance with clause 5.3 of the Data Processing Agreement, and Aitonomy informs the Customer on request which providers are in use and records the model used for each Agent in the audit trail. Processing takes place within the European Economic Area, or outside it only where a valid transfer mechanism under Chapter V of the GDPR is in place; the Data Processing Agreement governs this, and the Sub-processors list states per provider where processing takes place and which mechanism applies. The restrictions in clauses 3.5 and 3.6 of the Data Processing Agreement on special categories of personal data apply in any event, and a restriction recorded in the Order Form is applied.

Where the Service connects to other third party tools or services, the terms of those third parties may additionally apply, and Aitonomy is not responsible for those third party services.

3.3 The Product Sheet, and the Order Form where it differs from the Product Sheet, specify the configuration of the Service, including what is hosted where. This may be a configuration hosted by Aitonomy, where Aitonomy hosts the Service on infrastructure it operates and processes Customer Data on the Customer's behalf, or a configuration that runs on the Customer's own environment or AI subscription, where the Service provides a governed layer over the Customer's own tools. Aitonomy's access is limited to what is reasonably necessary to provide and support the Service.

3.4 Aitonomy is model-independent and aims to provide the Service with both European data residency and European data sovereignty, save where a specific model or provider established outside the European Economic Area is used for a given task, in which case clause 3.2 and clause 6 of the Data Processing Agreement apply. The data flows, hosting locations, and any providers outside the European Economic Area that apply are set out in the Data Processing Agreement and the Sub-processors list, together with the transfer mechanism that applies, so the Customer can see what applies to it. This clause does not extend to a Customer AI Provider, whose data location and jurisdiction follow from the Customer's own contract with it.

3.5 After Aitonomy has accepted an Order Form, Aitonomy provides the Customer with access to the Service. Any dates or timelines stated by Aitonomy are target dates and are not binding.

3.6 Aitonomy may modify, add to, or discontinue features of the Service from time to time, and will not materially reduce the core functionality of the Service during a term without reasonable notice.

3.7 The Customer manages access to the Service for its Users, including issuing and revoking access and keeping credentials confidential, and is responsible for all activity under its account.

3.8 Where the Service uses a Customer AI Provider, the contract with that provider, the plan or model used, and the settings of the Customer's own account, including data retention, data location and the use of data for training, are the Customer's responsibility. Aitonomy may share information it has about those settings, but does not undertake to do so and does not warrant that such information is complete or current.

3.9 Where the Order Form or the Product Sheet provides that Aitonomy sets up or configures the Service within the Customer Environment or within an account of a Customer AI Provider, the Customer authorises Aitonomy to do so on its behalf, within the scope set out in the Order Form or the Product Sheet and using the access the Customer provides. Aitonomy does not change organisation-wide settings of that environment or account without the prior approval of the Customer's administrator, and informs the Customer in writing of material risks it identifies in doing so. The Customer ensures that this access and these actions by Aitonomy are permitted under its agreements with the relevant providers.

3.10 The scope of the Service subscribed for is described in the Product Sheet and the Order Form. The Fees relate to that scope. Functionality outside that scope is not included unless agreed in writing. These Terms apply to every configuration of the Service, whatever its commercial name; the Product Sheet describes the configuration subscribed for.

3.11 Aitonomy is responsible for the governed layer it provides and for operating the Service as configured. Aitonomy is not responsible for the AI models themselves, for the systems, tools and data that the Customer connects or makes available, or for the output that the Customer puts into use.

3.12 The parties may change the order-specific inputs recorded in the Order Form, such as the connected sources and their resources, the access rights per resource, the maximum number of Users and the included assistants or processes, by agreement in writing, including by email, between authorised representatives of both parties, without a new Order Form. Aitonomy confirms each change in writing, stating what changes and from when. Where a change carries a fee under the Order Form or the Product Sheet, for example an additional connected source, that fee applies from the start of the month in which the change takes effect, such as the month in which the source is made available. A change that reduces the Fees, such as removing a connected source or lowering the maximum number of Users, takes effect at the end of the then-current minimum term or renewal period.

3.13 The Service processes content from the Customer's connected systems, such as documents, messages and records, to perform a task, and where the task writes a result, writes it back to the Customer's own systems. The Service is not a store or repository for that content: the Customer's own systems remain the place where it is kept, and the Customer remains responsible for keeping and backing it up there. What Aitonomy does keep, and for how long, is set out in Schedule 1 to the Data Processing Agreement.

4. Fees and payment

4.1 The Customer will pay the Fees set out in the Order Form. The pricing model, the billable unit and the invoicing schedule are set out in the Order Form. Unless the Order Form states otherwise, clauses 4.2 to 4.6 apply.

4.2 All Fees are exclusive of VAT and other government levies, and are payable in euros.

4.3 Invoices are due within thirty (30) days of the invoice date. The Customer may not suspend payment or set off any amount.

4.4 Aitonomy may adjust the Fees once per calendar year in line with the change over the preceding twelve (12) months in the consumer price index (CPI) for all households published by Statistics Netherlands (CBS), or its successor index, on at least thirty (30) days' prior notice, unless the Order Form provides otherwise.

4.5 If the Customer fails to pay on time, statutory commercial interest accrues without notice of default, and Aitonomy may, after notice, suspend or limit access to the Service until payment is made. The Customer is liable for the reasonable costs of collection.

4.6 Where the costs to Aitonomy of third party services on which the Service depends, such as hosting or the use of AI models engaged by Aitonomy, increase demonstrably and materially, Aitonomy may adjust the Fees correspondingly on at least sixty (60) days' prior written notice stating the increase. In that case the Customer may terminate the affected Service by written notice with effect from the date on which the adjustment takes effect.

5. Use of the Service

5.1 The Customer determines which Agents run through the Service, on what inputs, and under what policies, including the level of autonomy of each Agent and where human review or approval applies. Agents operate under the Customer's configuration and direction.

5.2 Actions taken by an Agent under the Customer's configuration are deemed authorised by the Customer, and the outputs of an Agent are deemed made by the Customer. The Customer is solely responsible for reviewing, approving and deciding what is put into use, and for maintaining human oversight appropriate to its use. Aitonomy does not produce the Customer's work product or make the Customer's operational decisions, and is not responsible for the output, content or decisions that the Customer puts into use. Where the Customer configures Agents, skills or prompts itself through self-service functionality of the Service, the Customer is responsible for those configurations and for the inputs and outputs resulting from them.

5.3 The Customer is responsible for the Customer Data, including its accuracy, completeness and lawfulness, and for ensuring that its use of the Service and the Customer Data is lawful and does not infringe the rights of any third party. The Customer indemnifies Aitonomy against third party claims arising from the Customer Data or from the Customer's use of the Service in breach of these Terms.

5.4 Where the Service connects to systems of the Customer or of third parties, the Customer procures the necessary access, warrants that it is entitled to grant it, and indemnifies Aitonomy against third party claims arising from that access.

5.5 The Customer's use of the Service is subject to the Acceptable Use Policy published at joinaitonomy.ai/legal/acceptable-use-policy, which forms part of the Agreement and sets out what is and is not permitted. The Customer ensures that its Users comply with it.

5.6 Aitonomy may take proportionate measures, including suspending access, where it reasonably determines that the Customer is in material breach of this clause 5 or the Acceptable Use Policy, or that continued use poses a security or legal risk. Where practicable, Aitonomy will give prior notice and an opportunity to remedy.

5.7 The Customer uses the Service in line with the fair use rules in the Acceptable Use Policy and with the subscribed configuration set out in the Order Form. Aitonomy may set and enforce reasonable technical safeguards, including rate, concurrency and volume limits, quotas and anti-abuse controls, to protect the security, integrity, availability and performance of the Service for all customers. Aitonomy applies these so as not to materially degrade normal use within the subscribed configuration, and will, where practicable, give notice before applying a limit that materially affects the Customer's use. Where use materially exceeds the subscribed configuration and persists, the parties will agree the appropriate configuration or Fees, failing which clause 5.6 applies. Specific limits, where agreed, are set out in the Order Form.

5.8 The Service supports operations that read data and operations that create, modify or delete data in a connected source. Which systems and resources are connected, and which operations are permitted on each, are set out in the Order Form, as changed under clause 3.12. Within that scope the Customer may restrict them further in the Service. Where read-only access is agreed for a source or resource, Aitonomy enables only read, list and search operations for it. Clause 5.13 applies to operations that create, modify or delete data.

5.9 Each party complies with the obligations under Regulation (EU) 2024/1689 (the AI Act) that apply to it in its own role. A use that would qualify as high-risk under the AI Act is put into production through the Service only where the Order Form provides for it.

5.10 Schedule 1 to these Terms summarises the allocation of responsibilities between the parties. In the event of a conflict, the clauses of these Terms prevail.

5.11 Before the Service is put into use, Aitonomy provides the Customer with information on the capabilities, limitations and risks of the Agents and of the AI models used within the subscribed configuration, as far as known to Aitonomy, so that the Customer can meet its own obligations, including those on AI literacy under Article 4 of Regulation (EU) 2024/1689 (the AI Act). Aitonomy provides that information in writing and records when it was provided. The Customer makes it available to its Users. Where a change in the models used within the subscribed configuration materially affects those capabilities, limitations or risks, Aitonomy updates that information.

5.12 An Agent is put into production for a process only after the Customer has approved it in writing for that process, stating the operations it may perform, the systems it may write to, the level of autonomy and the points at which human approval applies. Aitonomy records each approval in the audit trail. A material change to any of those matters requires a new approval. Until the Customer has given that approval, an Agent runs in a monitoring or proposal mode only. This clause applies to an Agent that runs without a User initiating each run. Where a User works interactively with the Service through an AI client, the User's instruction takes the place of that approval, and clause 5.13 applies to operations that create, modify or delete data.

5.13 For an Agent that creates, modifies or deletes data in a connected source, the Customer sets which operations are permitted per source, any limit on their number or value, and the point at which human approval is required, and approves the Agent for production use under clause 5.12. The Service provides the means to set those boundaries and to suspend or stop an Agent immediately. Aitonomy may suspend an Agent where it reasonably suspects that it is acting outside what the Customer set. Aitonomy applies safeguards designed to reduce the risk of misuse and of unintended actions; those safeguards do not replace the oversight the Customer configures under clause 5.1. At the Customer's request and against its reasonable costs, Aitonomy assists in identifying and correcting entries that an Agent made in a connected source.

6. Warranties and availability

6.1 Aitonomy will provide the Service with reasonable care and skill, and warrants that the Service will materially conform to the Product Sheet and the Documentation, in the versions applicable on the date of the Order Form. Except as expressly stated in these Terms, in the Acceptable Use Policy, in the security measures in Schedule 1 to the Data Processing Agreement, or in the SLA, the Service is provided on an "as is" and "as available" basis.

6.2 Aitonomy does not warrant that the Service will be uninterrupted or error free, or that the output of Agents will be accurate, complete or fit for a particular purpose. The Customer is responsible for reviewing and validating output in accordance with clause 5.

6.3 Aitonomy will use commercially reasonable efforts to make the Service available. Service levels, support response times and any related remedies are as set out in the SLA or the Order Form. Availability excludes planned maintenance, force majeure, the Customer's systems or breach, and third party services that the Customer brings or contracts itself under clause 3.2(b).

6.4 Force majeure means any event outside Aitonomy's reasonable control, such as general failures of the internet or telecommunications networks, power failures, and the acts or omissions of suppliers prescribed by the Customer. A failure of a provider that Aitonomy engages to deliver the Service is not force majeure.

7. Intellectual property and Customer Data

7.1 All Intellectual Property in and relating to the Service, the platform, the software, the generic components and the Documentation vests exclusively in Aitonomy or its licensors. Subject to payment of the Fees, Aitonomy grants the Customer a non-exclusive, non-transferable and non-sublicensable right to use the Service for its internal business use during the term.

7.2 As between the parties, the Customer owns all Customer Data, including all Intellectual Property in it. Aitonomy claims no ownership of Customer Data and processes it only as needed to provide the Service, as set out in these Terms and the Data Processing Agreement.

7.3 The Customer-specific configuration created through the Customer's use of the Service (Agent definitions, the company context, prompts, the Customer's own skills and the Customer-specific adaptations of generic skills, evaluation sets, guardrail settings, access mapping) is Customer Data and carries a lasting right of use and export for the Customer as set out in clause 9.

7.4 Aitonomy does not use Customer Data or source code to train, fine-tune or otherwise improve any AI model, whether of Aitonomy or of a third party. In this clause, an AI model is the model itself: its weights and its training. The instructions, skills, checks and configuration of the Service that use a model are not an AI model, and improving them under clause 7.9 is not improving an AI model.

Where Aitonomy holds the licence for the AI model and contracts the provider itself (clause 3.2(a)), Aitonomy contracts and configures that provider so that Customer Data passing through the Service is not used to train, fine-tune or otherwise improve that provider's models. Aitonomy engages only providers whose terms allow this; where a provider's terms do not, Aitonomy does not use that provider for Customer Data. This applies notwithstanding clause 2.8.

Where the Customer holds the licence and contracts the AI provider itself (clause 3.2(b)), the use of data for training follows from the Customer's own contract with that provider and the settings of the Customer's own account. Aitonomy cannot change those terms or that contract, and gives no undertaking in respect of them (clause 3.8).

7.5 Aitonomy generates Service Metrics through the operation of the Service. Aitonomy may use Service Metrics as operational telemetry to provide, secure, maintain and improve the Service, and may retain, use, publish and share them in anonymised or aggregated form, including for benchmarking, research, reporting and the development of Aitonomy's products and services. Because such data contains no Customer Data and is not attributable to or identifiable with the Customer, this does not require the Customer's consent. Aitonomy will not publish or share data in a form that identifies, or could reasonably be used to identify, the Customer or any individual, and none of this extends to Customer Data or source code, or to anything from which either could be reconstructed. Anonymous Data and Aggregate Data are produced in such a way that they no longer relate to an identified or identifiable natural person, and Aitonomy does not attempt to re-identify them. Where Service Metrics relate to an identified or identifiable natural person, Aitonomy processes them for the purposes in this clause as a controller, as described in the Privacy Statement published at joinaitonomy.ai/legal/privacy, and, where they form part of the processing Aitonomy carries out on the Customer's behalf, under the Data Processing Agreement.

7.6 Aitonomy identifies the Customer as a customer, and uses the Customer's name or logo as a reference, only with the Customer's prior written consent for each instance. The Customer may withhold that consent. The Customer may instead give a standing consent in the Order Form, and may withdraw it at any time with effect for the future.

7.7 Where the Customer or its Users provide feedback or suggestions about the Service, Aitonomy may use them freely, perpetually and irrevocably to improve the Service and its other products and services, without any obligation to the Customer. This gives Aitonomy no rights in Customer Data, which remains governed by the other provisions of this clause 7.

7.8 Aitonomy defends the Customer against a claim by a third party that the Service as provided by Aitonomy infringes that third party's Intellectual Property, and pays the damages and costs finally awarded or agreed in settlement, provided that the Customer notifies Aitonomy without undue delay, leaves the conduct of the defence and any settlement to Aitonomy, and gives reasonable assistance. This does not apply to a claim arising from Customer Data, from output produced by an Agent, from use in breach of the Agreement, or from a combination of the Service with materials not provided by Aitonomy. Where such a claim arises, Aitonomy may modify or replace the affected part of the Service, or terminate the affected Service and refund prepaid Fees pro rata. Aitonomy's liability under this clause is subject to clause 10.1, and this clause states the Customer's exclusive remedy for infringement of Intellectual Property by the Service.

7.9 Aitonomy may use the conversations held through the Service and the inputs and outputs of Agents and of other features of the Service, including the approvals, rejections and corrections made by Users, for example the questions an assistant asks and the answers it receives, to evaluate and improve the Service, including its Agents and their instructions, skills and checks. Before such data are stored for this purpose, Aitonomy removes Personal Data from them with automated filters, with reasonable care and skill and in line with good industry practice. This is an obligation of means: no filter detects all Personal Data, and Aitonomy does not guarantee that all Personal Data are removed. Personal Data that remain are protected as set out in clause 8. Aitonomy keeps such data for the term of the Agreement and deletes them within thirty (30) days of its end. They remain Customer Data and Confidential Information, are processed only by Aitonomy and its Sub-processors under the Data Processing Agreement, and are never used to train, fine-tune or otherwise improve any AI model (clause 7.4). What Aitonomy derives from them is a Derived Artefact under clause 7.10.

7.10 From its operation of the Service and from the data it uses under clauses 7.5 and 7.9, Aitonomy may create structured artefacts, such as categories and taxonomies of processes, steps, intents, outcomes and failures, quality and evaluation scores, counts and statistics, and evaluation and test cases written by Aitonomy ("Derived Artefacts"). Aitonomy owns the Derived Artefacts and may keep and use them without a time limit, including after the end of the Agreement, to provide, secure, evaluate and improve the Service and to develop its products and services. Aitonomy designs Derived Artefacts so that they contain no Customer Data or Personal Data, do not identify the Customer or any individual, and do not allow Customer Data to be reconstructed, and takes reasonable steps in line with good industry practice to achieve this where an artefact is derived from free text. Where Aitonomy finds that a Derived Artefact does not meet this standard, it corrects or deletes it without undue delay. Aitonomy shares or publishes Derived Artefacts outside Aitonomy and its Sub-processors only in aggregated form that combines data of at least five customers.

8. Confidentiality, security and data protection

8.1 Each party will keep the other party's Confidential Information confidential and will not use or disclose it except as reasonably necessary to perform the Agreement or as permitted by it. The confidentiality obligation does not apply to information that is or becomes public without breach, is independently developed, is rightfully obtained from a third party free of any duty of confidentiality, or whose disclosure is required by a competent authority or by law.

8.2 Aitonomy implements and maintains appropriate technical and organisational measures designed to protect Customer Data against loss and unlawful processing. The measures apply to all Customer Data, whether or not it contains Personal Data, and are set out in the Security Measures, being Schedule 1 to the Data Processing Agreement.

8.3 To the extent Aitonomy processes Personal Data on behalf of the Customer in connection with the Service, the Data Processing Agreement published at joinaitonomy.ai/legal/dpa applies and forms an integral part of the Agreement. In that processing Aitonomy acts as processor and the Customer as controller. The Customer is responsible for the lawfulness of the Personal Data it makes available and warrants that it is entitled to provide it for processing under the Agreement.

8.4 Aitonomy notifies the Customer without undue delay of a security incident that materially affects the confidentiality, integrity or availability of the Service or the Customer Data. Aitonomy takes measures against attempts to manipulate Agents through the content they process, but cannot exclude such attempts; a successful attempt that affects the Service or the Customer Data is handled as a security incident under this clause. Personal Data Breaches, as defined in the Data Processing Agreement, are handled under that agreement.

9. Term, termination and exit

9.1 The Service starts on the date set out in the Order Form and runs for the minimum term stated there. After the minimum term, the Service renews for the renewal period stated in the Order Form, unless either party gives written notice of non-renewal at least one (1) month before the end of the then-current term. Where the Order Form states no renewal period, the Service renews for successive periods equal to the minimum term. Where the Order Form provides for a trial, pilot or other temporary or preferential arrangement, the terms of that arrangement prevail for its duration. Where the Order Form or the Product Sheet sets a separate start per process, such as its go-live, the minimum term and the renewal periods run per process from that start.

9.2 Notwithstanding clause 9.1, the Customer may terminate the Service at any time by written notice of two (2) months, including in order to switch to another provider or to its own infrastructure. Fees for the notice period remain due. Where the Customer terminates under this clause with effect before the end of the minimum term, an early termination fee is due equal to the Fees for the remainder of the minimum term. Where the Customer terminates under this clause with effect before the end of a renewal period, an early termination fee is due equal to the Fees for the remainder of that period, up to a maximum of three (3) months' Fees, and Aitonomy refunds pro rata any Fees paid in advance for the period after that. No early termination fee is due where the Customer terminates because of Aitonomy's material breach, under clause 2.6 or 4.6, or under clause 5.3 of the Data Processing Agreement. Where the renewal period is one month, the Customer may instead give notice of non-renewal under clause 9.1. Fees for set-up or other work under the Services Terms and Conditions are not refunded.

9.3 Either party may terminate with immediate effect by written notice if the other commits a material breach that, where capable of remedy, is not remedied within a reasonable period after written notice. Aitonomy may also terminate with immediate effect on the Customer's bankruptcy, suspension of payment, inability to pay its debts, or cessation of business.

9.4 On termination, the Customer's right to use the Service ends. The Customer is not entitled to a refund of Fees already due, except as provided in clause 9.2 and except that on termination by the Customer for Aitonomy's uncured material breach, under clause 4.6, or under clause 5.3 of the Data Processing Agreement, any prepaid Fees for the period after termination are refunded pro rata.

9.5 On request, and in any event on notice of termination, Aitonomy provides within ten (10) Business Days an export, in structured, commonly used and machine-readable formats, of the following exportable data and digital assets, which is an exhaustive list: (a) the Customer Data held in the Service, including the inputs to and outputs of Agents to the extent retained under Schedule 1 to the Data Processing Agreement; (b) the metadata generated by the Customer's use of the Service, being the event and audit log and the Service Metrics relating to the Customer; and (c) the Customer-specific configuration, being the Agent definitions, the company context, the learned context the Service keeps for the Customer, prompts, the Customer's own skills and the Customer-specific adaptations of Aitonomy's generic skills, evaluation sets, guardrail settings, and the access mapping of connected systems, resources and permissions. The following are excluded, as data specific to the internal functioning of the Service whose export would risk a breach of Aitonomy's trade secrets, which is also an exhaustive list: the source code, runtime and orchestration logic of the Service; Aitonomy's generic components, methods, generic skills, generic evaluation sets and standard guardrails, as distinct from their Customer-specific adaptations; system logs on the internal functioning of the Service that do not relate to the Customer's use; and Aitonomy's own credentials and secrets. These exclusions do not impede or delay the switching process. Data or assets protected by intellectual property rights or trade secrets of a third party, such as an AI model or the software of a connected system, are not exportable data.

9.6 Where the Customer terminates in order to switch to another provider or to its own infrastructure, Aitonomy: (a) continues to provide the Service during the notice period and, at the Customer's request, during a transition period of up to thirty (30) days after it, against the Fees applicable to that period; where that period is technically not feasible, Aitonomy informs the Customer within fourteen (14) Business Days of the request, with reasons, and the transition period is extended to what is needed, up to seven (7) months in total; (b) provides reasonable assistance with the switch, including the export under clause 9.5; (c) keeps the exported data available for retrieval for at least thirty (30) days after the end of the transition period; and (d) then returns or deletes the Customer Data at the Customer's choice, and in respect of Personal Data in accordance with clause 9 of the Data Processing Agreement. Aitonomy does not charge switching or data export fees.

9.7 Before the Agreement is entered into, Aitonomy makes available to the Customer the information on switching required by Regulation (EU) 2023/2854 (the Data Act): the procedure in clauses 9.2, 9.5 and 9.6; the exportable data and digital assets in clause 9.5; the jurisdiction of the ICT infrastructure used for the Service and the measures against unlawful access by public authorities of third countries, set out in the Sub-processors list and in Schedule 1 to the Data Processing Agreement; and any fee under clause 9.2.

9.8 Provisions that by their nature survive termination, including those on Intellectual Property and Customer Data, confidentiality, liability and governing law, survive termination.

10. Liability

10.1 Aitonomy's total aggregate liability under or in connection with the Agreement, on any legal basis, is limited to an amount equal to twelve (12) times the monthly Fees (excluding VAT) payable for the Service under the Order Form, or, where the Order Form states annual Fees, to those annual Fees. Where the Fee is not stated per month or per year, the limit is the total Fees (excluding VAT) payable for the Service under the Order Form over twelve (12) months, calculated on the Fees applicable at the time of the event giving rise to the liability. Where a single event gives rise to liability under both these Terms and the Services Terms and Conditions, the higher of the two limits applies, and not both.

10.2 Aitonomy is not liable for indirect or consequential loss, including loss of profit, loss of revenue, missed savings, loss of goodwill or loss from business interruption. The reasonable costs of restoring Customer Data from the most recent available backup, and of correcting entries that an Agent made in a connected source, are not excluded by this clause and are recoverable within the limit in clause 10.1.

10.3 Aitonomy is not liable for damage resulting from force majeure.

10.4 The limitations in clauses 10.1 to 10.3 and the period in clause 10.6 do not apply in the event of intent or deliberate recklessness on the part of Aitonomy's management, or to liability that cannot be limited or excluded under mandatory law.

10.5 Where loss results from the Customer's configuration, its instructions, its data or its access decisions, clause 5.2 applies. Where loss results from a defect in the Service itself, clause 5.2 does not apply and Aitonomy's liability is governed by this clause 10.

10.6 A claim for damages must be notified in writing as soon as reasonably possible after the Customer discovers the loss, and in any event lapses twelve (12) months after the Customer discovered or could reasonably have discovered the loss, unless legal proceedings have been commenced before then.

11. Governing law and disputes

11.1 The Agreement is governed exclusively by the laws of the Netherlands.

11.2 Any dispute that cannot be resolved amicably will be submitted exclusively to the competent court of The Hague (Rechtbank Den Haag), the Netherlands.

Schedule 1: Allocation of responsibilities

This schedule summarises who is responsible for what under these Terms. In the event of a conflict, the clauses of these Terms prevail.

Aitonomy B.V. · KvK 42198573

Version 2026-04-02