Terms and Conditions of the edubba Platform

§ 1. Definitions

1. Service Provider – IBIS Świderski Sp. K. with its registered office in Krakow, ul. Leona Wyczółkowskiego 7, 30-118 Krakow, Poland, entered into the Register of Entrepreneurs of the National Court Register (KRS), NIP (Tax ID): 9452243846, e-mail address: contact@edubba.ai.
2. Platform (edubba) – the website and software available in the SaaS (Software as a Service) model at www.edubba.ai, constituting an educational tool based on artificial intelligence technologies.
3. User – any natural person, legal person, or organizational unit without legal personality that uses the Platform.
4. Individual User – a teacher or specialist using the Platform for the purposes of their own professional practice.
5. Institutional User (School) – a school, educational institution, or entity that has purchased an organizational subscription for its employees.
6. Source Materials (Input) – any materials, texts, data, and documents entered into the Platform by the User.
7. Generated Materials (Output) – lesson plans, worksheets, tests and other materials created by artificial intelligence algorithms based on the User's Source Materials.
8. Sole Trader with Consumer Rights (PNPK) – a natural person concluding an agreement with the Service Provider directly related to their business activity, when the content of this agreement indicates that it does not possess a professional character for this person, resulting in particular from the subject of their business activity (made available on the basis of the provisions on the Central Registration and Information on Business Activity – CEIDG).

§ 2. Types and Scope of Services

1. The Service Provider provides digital services via the Platform consisting in making available tools supporting the didactic process, including:
   1. generating educational materials (lesson plans, tests, worksheets, flashcards) using AI;
   2. analyzing curricula and source materials;
   3. organizing teachers' work and managing a specialized module (psychologist).
2. Services are provided under a subscription model (individual or organizational).

§ 3. Technical Conditions and Account Registration

1. To use the Platform, the following are required: a device with Internet access, an updated web browser (e.g., Chrome, Firefox, Safari, Edge), and an active e-mail address.
2. Using the full functionality of the Platform requires Account registration. Registration is completed by filling out the form on the Platform website and accepting these Terms of Service along with acknowledging the Privacy Policy.
3. The User is obliged to provide true data during registration and to protect the password against access by third parties.

§ 4. Subscriptions

1. Payments for subscriptions are made in advance (monthly or annually) via a certified payment operator (Stripe).
2. Upon expiry of the paid subscription period and in the absence of its renewal, the Account of an Individual User automatically transitions into a free, inactive state. In the inactive state, the User retains access to the Account and the accumulated Source and Generated Materials; however, all functionalities based on artificial intelligence (AI) are blocked until the subscription is paid again. The rules for the complete deletion of data from an Inactive Account at the User's request are specified in Section 13 of the Privacy Policy.
3. The rules for data deletion after the end of a subscription are defined in Section 13 of the Privacy Policy and the DPA Agreement.

§ 5. Intellectual Property and Copyright

1. The Service Provider declares that all rights to the edubba Platform itself, its source code, unique system prompts, interface, graphic layout, logos, and databases constitute the exclusive intellectual property of the Service Provider and are subject to legal protection. Users are prohibited from copying, modifying, decompiling, disassembling, reverse engineering the Platform or any part thereof, as well as using any automated tools, bots, crawlers, spiders, or scraping software for the purpose of downloading, analyzing, data mapping, or extracting source code from the Platform without the prior, express consent of the Service Provider granted in writing under pain of nullity.
2. User's rights to Generated Materials (Output): The Service Provider declares that it does not claim any copyright, proprietary, or related rights to the Materials Generated by AI algorithms for the benefit of the User. The Service Provider recognizes the User (or the School) as the entity entitled to the exclusive use, disposal of, and benefit from the Generated Materials to the widest extent permitted by law. The User acknowledges that under applicable law, copyright protection for Generated Materials applies only to the extent that they constitute a manifestation of individual, creative human activity (e.g., through a unique substantive contribution, modification, or selection made by the Teacher).
3. License to edubba: By placing Source Materials on the Platform, the User grants the Service Provider a non-exclusive, territorially unlimited, and royalty-free license to use these materials solely for the purpose of proper performance of services, maintenance, technical support, and development of internal functionalities of the Platform for the benefit of that User or a given School.
4. AI Confidentiality Principle: The Service Provider guarantees that by virtue of commercial B2B agreements with technology providers (including OpenAI), data transmitted via the API are not used by these entities to train public artificial intelligence models.

§ 6. Specifics of AI Technology and the Psychologist Module

1. The User acknowledges that the Materials Generated by AI algorithms are of an auxiliary and educational nature. Due to the specific nature of artificial intelligence technology, these materials may contain inaccuracies. The final substantive verification and didactic decision always belong to a human (teacher/specialist).
2. AI algorithms operating within the Platform do not make automated decisions producing legal effects concerning students or teachers within the meaning of Art. 22 GDPR.
3. In the case of using the psychologist module, the specialist module, or entering student data into the system, the Institutional User (School / Educational Institution) declares and guarantees that it possesses an appropriate and lawful legal basis for processing students' personal data (including special categories of data regarding mental health, opinions, or educational difficulties), resulting directly from the provisions of educational law implemented by the School (Art. 9(2)(g) GDPR in conjunction with the Educational Law Act) or proper consents of legal guardians – depending on the legal requirements assigned to a given diagnostic and therapeutic activity.

§ 7. Rights and Obligations of the User and Liability

1. The User is obliged to use the Platform in a manner consistent with the law, good customs, and these Terms and Conditions.
2. It is prohibited to introduce into the Platform content that is unlawful, vulgar, or infringes the personal rights of third parties or the copyrights of other entities.
3. The Service Provider makes every effort to ensure the continuous and fault-free operation of the Platform; however, it does not guarantee its constant availability in the event of technical or maintenance breaks, or failures independent of the Service Provider (e.g., interruptions in the operation of servers of external AI providers).
4. The Service Provider is not liable for the content of Generated Materials (Output), including their substantive correctness, didactic utility, potential factual errors (so-called artificial intelligence hallucinations), nor for any infringements of third-party rights (including copyrights) arising from the generation of Output by external providers' algorithms. The final verification of Generated Materials before their use in the educational process rests exclusively with the User.

§ 8. Personal Data Protection

1. The rules for processing the personal data of individual Users and technical telemetry data are specified in the Privacy Policy.
2. In the case of Institutional Users (Schools), the rules for entrusting the personal data of employees and students are regulated by the Data Processing Agreement (DPA), which constitutes integral Annex No. 1 to these Terms of Service.

§ 9. Complaints and Withdrawal from the Agreement

1. The User has the right to submit a complaint regarding the operation of the Platform electronically to the address: contact@edubba.ai.
2. The complaint should contain a description of the problem and the identification details of the Account. The Service Provider considers the complaint within 14 days from the date of its receipt.
3. Right to withdraw: A User who is a consumer or a natural person concluding an agreement directly related to their business activity, when the agreement does not possess a professional character for them (Sole Trader with Consumer Rights – PNPK), has the right to withdraw from the agreement for the provision of a digital service without giving a reason within 14 days from the day of its conclusion.
4. Withdrawal button: Withdrawal from the agreement by a Consumer or PNPK may be executed via an explicit, easily visible "Withdraw from agreement" button available in the User panel after logging in and in the footer of the Platform's homepage, or by sending a statement via e-mail to: contact@edubba.ai.
5. Loss of the right to withdraw: Pursuant to Art. 38(1)(13) of the Consumer Rights Act, the right to withdraw from an agreement for the supply of digital content or digital services which are not supplied on a tangible medium does not apply if the performance has begun with the consumer's prior express consent before the expiry of the withdrawal period and after the Service Provider has informed them about the loss of the right of withdrawal. The User acknowledges that upon the execution of the first content generation operation by the AI (which occurs at the moment of clicking the button launching the algorithm based on the entered data), the performance is deemed fully completed, and the consumer's right to withdraw from the agreement without giving a reason expires.
6. In the case of Institutional Users (Schools, educational institutions, and B2B entities), the rules for resignation and cancellation of subscriptions result directly from the selected plan in the Platform's panel and the provisions of these Terms and Conditions, excluding the consumer's right to withdraw from the agreement within 14 days without giving a reason.

§ 10. Amendments to the Terms of Service

1. The Service Provider reserves the right to amend these Terms and Conditions for important reasons, which include: changes in legal provisions affecting the provision of services, imposition of specific obligations by state authorities, implementation of new technical safeguards, or technological modifications to the Platform.
2. Registered Users will be informed of any amendments to the Terms and Conditions via e-mail at least 14 days in advance.
3. Special provisions for Consumers and Sole Traders with Consumer Rights (PNPK): a) Amendments to the Terms and Conditions regarding an increase in subscription fees or a significant limitation of the existing functionalities of the Platform do not apply to agreements during the course of an already paid billing period. b) The introduction of changes specified in point a) requires the prior, express consent of the User renewing the subscription for the next billing period. In the absence of such consent, the agreement terminates upon the expiry of the current, paid subscription period. c) Amendments to the Terms and Conditions that are exclusively beneficial to the User (e.g., adding new, free features) or of a neutral nature (e.g., changing the address details of the Service Provider) enter into force on the day of their publication and do not require the procedure from paragraph 3 points a) and b).

§ 11. Final Provisions

1. In matters not regulated by these Terms of Service, the provisions of Polish law shall apply, including the Civil Code and the Act on the Provision of Services by Electronic Means.
2. Governing Court: In relations with Users who are not consumers (including Schools and educational institutions), any disputes arising from the application of these Terms of Service shall be resolved by the common court having jurisdiction over the registered office of the Service Provider. In the case of consumers, court jurisdiction is determined on general legal principles.

Annexes to the Terms of Service

• Annex No. 1: Data Processing Agreement (DPA).
• Annex No. 2: Refund and Subscription Cancellation Policy.

Data Processing Agreement

Annex No. 1 to the Terms of Service of the edubba Platform

This Data Processing Agreement (hereinafter: "Data Processing Agreement" or "DPA") is concluded on the basis of Art. 28 ust. 3 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter: "GDPR") between:

The Institutional User (e.g., School, Educational Institution) that has accepted the Terms of Service of the edubba Platform, hereinafter referred to as the "Controller",

and

IBIS Świderski Sp. K. with its registered office in Krakow, ul. Leona Wyczółkowskiego 7, 30-118 Krakow, Poland, entered into the Register of Entrepreneurs of the National Court Register kept by the District Court for Kraków-Śródmieście in Kraków, XI Commercial Division of the National Court Register, under the KRS number: 0000960648, NIP: 9452243846, REGON: 384461420, represented by its General Partner, Bartosz Świderski, hereinafter referred to as the "Processor" or "edubba".

The Controller and the Processor shall hereinafter be referred to collectively as the "Parties" and individually as a "Party".

§ 1 Statements of the Parties and Subject of the Agreement

1. The Controller declares that it is the controller of the personal data entered into the edubba Platform within the organizational subscription or possesses another effective legal basis to decide on the purposes and means of processing them, in accordance with applicable legal regulations.
2. For the purpose of executing the agreement for the provision of services by electronic means (in accordance with the Terms of Service), the Controller entrusts the Processor with the processing of personal data specified in § 2 of this Data Processing Agreement.
3. The Processor undertakes to process the entrusted personal data solely on documented instructions from the Controller, which also includes processing operations necessary to deliver the services via the edubba Platform.
4. The Processor shall immediately inform the Controller if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions.

§ 2. Scope, Purpose, and Nature of Data Processing

1. Purpose of processing: The data is entrusted solely for the purpose and to the extent necessary to deliver digital services via the edubba Platform, including: generating lesson plans, worksheets, tests using AI technology, organizing teachers' work, and managing a specialized module (psychologist).
2. Categories of data subjects:
   1. Employees and associates of the Controller (teachers, management, system administrators).
   2. Students of the Controller's educational institution.
3. Scope of personal data (categories of data):
   1. Teachers'/employees' data: first name, last name, e-mail address, school name, system role, system logs.
   2. Students' data (in the general module): first name, last name, class/group assignment.
   3. Students' data (in the psychologist / specialist module) – Special categories of data (Art. 9 GDPR): educational and psychological recommendations, specialists' notes, information about educational difficulties or the student's functioning, information about didactic adjustments.

§ 3. Obligations of the Processor

The Processor undertakes to:

1. Implement appropriate technical and organizational measures before beginning the processing of data to ensure a level of security appropriate to the risk, meet the requirements of the GDPR, and protect the rights of data subjects. In particular, edubba applies data encryption in transit and at rest (SSL/TLS, database encryption).
2. Ensure that persons authorized to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
3. Assist the Controller, as far as possible and through appropriate technical and organizational measures, in fulfilling the Controller's obligation to respond to requests for exercising the data subject's rights laid down in Chapter III of the GDPR.
4. Assist the Controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR (security of processing, notification of a personal data breach to the supervisory authority, communication of a personal data breach to the data subject, data protection impact assessment, and prior consultation).

§ 4 Sub-processing of Data (Sub-processors)

1. The Controller grants a general authorization to the Processor to engage other processors (hereinafter: "Sub-processors") for the execution of this Agreement.
2. The Processor shall only engage Sub-processors that guarantee a high level of data protection in accordance with the GDPR. The key entities supporting the operation of the system are:
   1. OpenAI Ireland Ltd. (or OpenAI, L.L.C.) – for the provision of artificial intelligence infrastructure services via an API key.
   2. Stripe Payments Europe Ltd. – for processing financial transactions and settlements.
   3. Cloud hosting providers, database system providers, and CRM/mailing system providers specified in the Privacy Policy.
3. The Processor shall inform the Controller of any intended changes concerning the addition or replacement of other processors via e-mail or the Platform's panel, thereby giving the Controller the opportunity to object to such changes within 14 days from the date of receiving the information. In the event of an objection which the Parties cannot resolve amicably, the agreement for the provision of Services shall terminate with effect on the date of the planned introduction of the new Sub-processor. The Service Provider shall refund to the Controller a proportional part of the unused subscription fee paid in advance.
4. The Processor shall impose the same data protection obligations on Sub-processors as those set out in this Data Processing Agreement.
5. The Processor ensures that it possesses commercial agreements with AI technology providers (OpenAI) guaranteeing that data transmitted via the API are not used to train public artificial intelligence models.

§ 5. Transfer of Data Outside the EEA

1. The Controller acknowledges and authorizes the Processor to transfer data outside the European Economic Area (EEA) to the extent necessary to deliver the Services (within the context of using Sub-processors such as OpenAI or Stripe).
2. The Processor ensures that these transfers are carried out solely in compliance with the appropriate safeguards required by the GDPR, based on adequacy decisions of the European Commission (e.g., EU-US Data Privacy Framework) or on the basis of Standard Contractual Clauses (SCC) approved by the European Commission along with additional security measures.

§ 6. Data Protection Breach Notification Procedure

1. The Processor, upon becoming aware of a personal data breach affecting the entrusted personal data, shall notify the Controller without undue delay (and no later than 72 hours after detection).
2. The notification shall at least describe the nature of the personal data breach, the categories and approximate number of data subjects and personal data records concerned, the likely consequences of the personal data breach, and the measures taken or planned to be taken to address the breach.

§ 7. Right to Audit

1. The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Art. 28 GDPR and allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller.
2. The verification referred to in paragraph 1 shall be executed in the first instance by edubba providing the Controller with the necessary information, including security certificates, statements, or reports from independent technical audits. In justified cases, the Parties may agree to conduct a direct inspection at the Controller's expense, in a manner that does not disrupt the ongoing operation of the Platform.

§ 8. Duration of the Agreement and Data Retention

1. This Data Processing Agreement shall remain in force for the duration of the agreement for the provision of services (the possession of an active account or organizational subscription) between the Controller and edubba.
2. Upon termination or expiry of the agreement for the provision of services, the Processor shall, depending on the choice and decision of the Controller (the School): a) permanently and irreversibly delete all entrusted personal data (including student and teacher data) and their existing copies, in a manner preventing their recovery, within 14 days from the date of expiry of the services; or b) return to the Controller all entrusted personal data in a commonly used machine-readable format, and subsequently delete all existing copies of such data.

§ 9. Final Provisions

1. In matters not regulated by this Data Processing Agreement, the provisions of the GDPR, the Polish Civil Code, and the Terms of Service of the edubba Platform shall apply.
2. Acceptance of the Terms of Service of the edubba Platform is equivalent to the conclusion of this Data Processing Agreement.