General Terms and Conditions

Preamble

Owner: Joan Sanfeliu Vilarrasa (“Sanfeliu”), NIF 79279716G, with professional address in Barcelona. Contact: me@joansanfeliu.com · agencia.joansanfeliu.com

These General Terms and Conditions govern the relationship between Sanfeliu and the Client in respect of design, development, integration, deployment, hosting, maintenance and support services for software, websites and systems incorporating artificial intelligence, and in respect of technical audit and consultancy services. They are attached to each quote or specific contract and are deemed accepted upon acceptance of that quote or contract, whether by signature or by express confirmation by email.

1. Purpose and definitions

1.1. The purpose of these Terms and Conditions is to set out the legal framework for the services described in the quote accepted by the parties (hereinafter, the “Quote”), which prevails over this document in everything expressly agreed in it.

1.2. For the purposes of these Terms and Conditions, the following definitions apply:

1.2.1. Project: the set of services described in the Quote, including the design, code, configuration, deployment and, where applicable, the audit or consultancy reports.

1.2.2. Source Code: the set of code files, style sheets, templates, build scripts, configurations, artificial intelligence system instructions and graphic assets created by Sanfeliu specifically for the Project.

1.2.3. Reusable Components: the libraries, patterns, design systems, generators, templates, internationalization frameworks, deployment scripts, artificial intelligence instruction and agent templates, and development tools owned by Sanfeliu, which pre-exist the Project or are of general use, and which Sanfeliu incorporates into the Project and regularly uses in other engagements, even if they have been adapted for it. They are listed in Annex II.

1.2.4. Client Content: the texts, photographs, videos, logos, trademarks, brand guidelines, databases, business data and any other material that the Client provides or makes available to Sanfeliu for incorporation into the Project.

1.2.5. Third-Party Libraries: the software, typefaces, cartographic data, artificial intelligence models and other materials owned by third parties that are incorporated into or used by the Project under their respective licenses or terms. They are listed in Annex II.

1.2.6. Delivery: making the finished Project available to the Client, by deploying it to the domain indicated by the Client and handing over the access provided for in clause 6.

1.2.7. Preview: the provisional publication of the Project at a temporary web address provided by Sanfeliu, for the sole purpose of review and validation by the Client before Delivery.

1.2.8. Ongoing Services: the services that Sanfeliu provides on a recurring basis after Delivery or independently of a Project, such as hosting, monitoring, backups, security updates, error correction, changes and improvements, support or infrastructure operation, including the continuity plans that Sanfeliu offers. They are governed by clause 11.

1.2.9. Client Environment: any infrastructure, account, domain or service that Sanfeliu does not control and in which the Project is deployed, published or operated, by the Client itself or by a third party designated by the Client.

1.2.10. AI System: any functionality of the Project that uses artificial intelligence models, whether proprietary or third-party, to generate texts, images, summaries, classifications, responses, recommendations or predictions, within the meaning of Regulation (EU) 2024/1689 on artificial intelligence.

1.3. The Quote or the specific contract will expressly state whether Regime A (clause 2), Regime B (clause 3) or Regime C (clause 4) applies to the Project. In the absence of an express statement, Regime A will apply; if the document sets an hourly rate without a fixed price, Regime C will apply. Ongoing Services may be contracted together with any regime or independently, and are governed by clause 11. Fixed-price audit and consultancy engagements are governed by Regime A, and their Delivery consists of making the agreed report or results available.

1.4. Client’s business status. Sanfeliu provides its services to businesses and professionals. The Client declares that it enters into the contract in the course of its business or professional activity. If the Client is a natural person acting for purposes outside their trade, business, craft or profession, the Client is a consumer. In that case, Sanfeliu will provide the Client, together with the Quote, with the specific terms and conditions for consumers, which prevail over these Terms and Conditions, and the mandatory rules of the consolidated text of the General Law for the Defense of Consumers and Users (Royal Legislative Decree 1/2007) will apply in all cases.

1.5. Order of precedence. In the event of conflict, the Quote or the specific contract prevails over these Terms and Conditions, and these prevail over any other prior communication. Sanfeliu’s web pages, presentations and marketing materials are for information purposes only and do not form part of the contract except insofar as they are reproduced in the Quote.

2. Regime A — Fixed-price sale

2.1. Assignment of rights. Once the price has been paid in full in accordance with clause 5, Sanfeliu assigns to the Client, expressly and in writing for the purposes of Articles 43 et seq. of the consolidated text of the Intellectual Property Law (Royal Legislative Decree 1/1996), the exploitation rights over the Source Code, the design and the content created specifically for the Project.

2.2. The assignment covers the rights of reproduction, distribution, public communication and transformation, on an exclusive basis, worldwide and for the maximum duration provided for by applicable law. The Client may modify the Project, commission third parties to modify it and assign it to third parties, without the need for any additional authorization from Sanfeliu. The assignment covers such rights as exist over the results of the Project. With regard to any parts that are not subject to intellectual property, Sanfeliu hands over possession of them and undertakes not to provide the Project-specific Source Code to third parties.

2.3. Payment as a condition precedent. The assignment provided for in clauses 2.1 and 2.2 is expressly conditional upon full payment of the price. Until payment has been made, the Client holds only a temporary, non-exclusive and non-transferable license of use, limited to viewing and validating the Project on the Preview and, from the deployment to the Client’s domain provided for in clause 5.2, to publishing and exploiting it until the due date of the corresponding invoice. If the invoice is not paid by its due date, the license terminates and clause 5.5 applies. Any other exploitation prior to full payment falls outside the scope of the license.

2.4. Exclusion of Reusable Components. Reusable Components are not subject to assignment and remain the exclusive property of Sanfeliu. With respect to them, and only to the extent that they are incorporated into the Project, Sanfeliu grants the Client a license of use that is non-exclusive, perpetual, irrevocable once the price has been paid, free of charge and not transferable independently of the Project. This license allows the Client to use, modify and maintain the Project, including through third parties, but not to extract the Reusable Components in order to use them in different projects or to assign them separately to third parties.

2.5. Third-Party Libraries. Third-Party Libraries are governed by their own licenses, which the Client accepts and undertakes to respect. Sanfeliu does not assign any rights over them beyond what the corresponding licenses allow, and warrants that those incorporated into the Project are compatible with the use provided for in this clause, as listed in Annex II.

2.6. Moral rights and portfolio. In accordance with Article 14 of the Intellectual Property Law, moral rights are unwaivable and inalienable. Sanfeliu reserves the right of attribution over the work and, as expressly agreed between the parties:

2.6.1. If the Quote so provides, the Client will keep a discreet authorship credit in the website footer with the text “Web by Sanfeliu” linked to agencia.joansanfeliu.com. This credit may only be removed by written agreement between the parties. If the Quote does not so provide, the Project does not include any credit or link to Sanfeliu.

2.6.2. Sanfeliu may show the Project in its portfolio, website, professional networks and marketing materials, including the Client’s trade name and logo and screenshots of the Project, once the Project has been published. This right does not extend to confidential information of the Client under clause 10, and the Client may revoke it in writing at any time with respect to future uses.

2.6.3. Sanfeliu retains the know-how, techniques and general ideas acquired in the Project, which it may apply again without limitation, without using the Client’s confidential information.

2.7. Handover of assets. Upon full payment, Sanfeliu will make available to the Client the complete Source Code, the transfer of the code repository to the Client or its creation in the Client’s name, access to the hosting, and the domain configuration, as detailed in clause 6.

2.8. Evidence of the assignment. Full payment makes the assignment effective automatically, without the need for any further act. At the Client’s request, Sanfeliu will issue a document evidencing it.

2.9. No retained access. After Delivery, Sanfeliu will not retain any access to the Project, except for the access strictly necessary to provide the Ongoing Services contracted by the Client or the access expressly recorded in the handover certificate.

2.10. Materials not assigned. Sanfeliu’s commercial documents, proposals, sales reports, internal notes and correspondence do not form part of the Delivery or of the assignment, even if they have been kept in the same repository. Sanfeliu will remove them from the repository before transferring it.

3. Regime B — Subscription

3.1. Ownership. Under Regime B, the Source Code, the design and the infrastructure of the Project are and remain the exclusive property of Sanfeliu. There is no assignment of exploitation rights.

3.2. License of use. Sanfeliu grants the Client a non-exclusive, non-transferable and non-sublicensable license of use over the Project, in force for as long as payment of the fee agreed in the Quote is up to date. The license covers use of the website for the Client’s own activity, and includes the hosting, corrective maintenance and updates specified in the Quote.

3.3. Client Content. Client Content is and remains the property of the Client at all times, regardless of whether the subscription is in force.

3.4. Domain. The Project’s domain will always be registered in the Client’s name, also under Regime B. Sanfeliu may manage its technical configuration, but will never be its owner. If Sanfeliu has registered it for operational reasons, the Client may require its transfer at any time and free of charge.

3.5. Non-payment. In the event of non-payment of a fee:

3.5.1. The Client will have a grace period of fifteen (15) calendar days from the due date, during which the service will remain active.

3.5.2. Once this period has elapsed, Sanfeliu will send the Client a written notice granting an additional ten (10) calendar days to remedy the situation.

3.5.3. If payment has not been made within that period, Sanfeliu may suspend the service. The suspension does not release the Client from paying the fees accrued.

3.5.4. Once thirty (30) calendar days have passed since the suspension without the situation being remedied, Sanfeliu may permanently withdraw the Project, after first making available to the Client an export of its content and data in accordance with clause 3.6.4.

3.6. Termination. Either party may terminate the subscription by giving thirty (30) calendar days’ prior written notice, without the need to state a cause and without penalty. Upon termination:

3.6.1. The Client may exercise a purchase option (buyout) over the Project for the amount stated in the Quote.

3.6.2. Once the purchase option has been exercised and its amount paid, the assignment regime of clause 2 will apply in full, including the exclusion of Reusable Components.

3.6.3. If the Client does not exercise the purchase option, the license of use will terminate and the Project will be withdrawn. The Client will not acquire any rights over the Source Code or the design.

3.6.4. In any case, whether or not the purchase option is exercised, Sanfeliu will provide the Client, at no additional cost, with an export in an open and reusable format of the Client Content and of the data generated while the service was in force.

3.7. Prohibitions. For as long as the subscription lasts, the Client undertakes not to carry out, either directly or through third parties, any acts of reverse engineering, decompilation, or total or partial copying, nor any assignment, resale or sublicensing of the Project to third parties, except as mandatorily permitted by Article 100 of the Intellectual Property Law.

4. Regime C — Hourly services

4.1. Scope. Regime C applies when the Quote, the specific contract or the acceptance by email provides for software engineering services on a time basis (development, integration, corrective or evolutionary maintenance, deployment, support and technical advice) on the Client’s systems or through successive work orders, without a fixed price and invoiced by the hour at the agreed rate.

4.2. Work orders. The work is defined in successive work orders that the Client communicates in writing (by email, ticketing tool or code repository). Sanfeliu may provide an indicative estimate of hours. Estimates are neither a fixed price nor a binding deadline. The Client may prioritize, extend or stop work orders at any time, and the hours already worked are invoiced.

4.3. Time records and invoicing. Sanfeliu keeps a record of the hours spent on each work order and makes it available to the Client with each invoice. Unless otherwise agreed, invoicing is monthly in arrears, for the hours spent at the agreed rate, with payment due fifteen (15) days from the date of issue. The Client may object in writing to the breakdown of hours within ten (10) calendar days of receiving the invoice. Once that period has elapsed, the breakdown is deemed accepted.

4.4. Assignment of rights per work order. Sanfeliu assigns to the Client, expressly and in writing for the purposes of Articles 43 et seq. of the Intellectual Property Law, the exploitation rights of reproduction, distribution, public communication and transformation, on an exclusive basis, worldwide and for the maximum duration provided for by applicable law, over the source code, the documentation and the other results created specifically for the Client in each work order. For each invoice, the assignment takes effect upon full payment of that invoice and covers the work that the invoice includes. The Client may modify that work, commission third parties to modify it and assign it, without any additional authorization from Sanfeliu.

4.5. License pending payment. Until each invoice is paid, the Client holds a non-exclusive and non-transferable license of use over the work that the invoice includes, limited to its own systems and its own activity, so that systems in production do not stop. If non-payment exceeds thirty (30) calendar days from the due date, Sanfeliu may suspend the services and revoke this license in respect of the unpaid work, without prejudice to claiming the amount due and the interest under clause 5.4.

4.6. Reusable Components and Third-Party Libraries. Clauses 2.4 and 2.5 apply. Under Regime C, Sanfeliu identifies the Reusable Components incorporated in the specific contract or, if there is none, when delivering them, and the Client receives the license under clause 2.4 over them upon payment of the corresponding invoice.

4.7. Client’s systems and environment. Under Regime C, the work is carried out on, or deployed to, repositories, accounts, servers and infrastructure owned by the Client. The Client owns these assets and operates them. Sanfeliu accesses them with individual named credentials granted by the Client, with the least privilege necessary, and uses them solely for the work orders. Sanfeliu does not assume the operation, availability, backups, monitoring or security of the Client’s systems, unless a work order expressly provides for it in writing and on an hourly basis. The specific contract or its operations annex sets out who operates each system, and clause 13 applies.

4.8. Obligation of means and correction of errors. Sanfeliu provides the services with the professional diligence expected of a software engineer. It does not guarantee results, performance or deadlines that have not been expressly agreed in writing. Programming errors attributable to Sanfeliu that the Client reports within fifteen (15) calendar days of delivery of the work order are corrected free of charge. All other issues, changes and improvements are invoiced by the hour.

4.9. Enhanced confidentiality and commercial reference. In addition to the provisions of clause 10, Sanfeliu treats as confidential the source code, credentials, internal documentation, business data and information about the Client’s own clients to which it has access, and does not use them for any other purpose or incorporate them into other projects. Under Regime C, the right under clause 2.6.2 is limited to citing the Client and the nature of the work as a reference, without showing code, data or internal screens without written authorization.

4.10. Data protection. When the services involve access to personal data for which the Client is the controller or processor, Annex I applies and the specific contract sets out the processing operations, the actual sub-processors and the security measures. If the Client acts as a processor on behalf of its own clients, Sanfeliu acts as a sub-processor (Articles 28.2 and 28.4 GDPR) and the Client warrants that it has the written authorization of the controllers to engage Sanfeliu.

4.11. Liability. Under Regime C, Sanfeliu’s total aggregate liability referred to in clause 9.1 is limited to the amount invoiced to the Client for the last three (3) months, subject to the exceptions in clause 9.3.

4.12. Non-exclusivity and independence. The relationship is not exclusive: Sanfeliu may provide services to third parties, and the Client may engage other providers for the same or similar work. Sanfeliu acts as an independent professional, with its own means and organization, without being subject to set working hours or to the Client’s hierarchical authority. Nothing in this Regime creates an employment, partnership or agency relationship between the parties.

4.13. Term and notice. Regime C is of indefinite duration. Either party may terminate it, without the need to state a cause and without penalty, by giving thirty (30) calendar days’ prior written notice. During the notice period, Sanfeliu completes or documents the work orders in progress, leaves the code and documentation in the Client’s repository, and returns or deletes any credentials and copies of the Client’s information that it holds. The hours spent are invoiced. Termination does not affect assignments of rights that have already taken effect or the license under clause 2.4.

4.14. Order of precedence. Under Regime C, clauses 2.3, 2.6.1 and 2.7 and clause 6 do not apply, except where this Regime expressly refers to them. Clause 5 applies subject to the specific provisions of clauses 4.3 and 4.5.

5. Price, payment terms and late payment

5.1. The price is the one stated in the accepted Quote and is always understood to be exclusive of VAT. The taxes and withholdings legally applicable at the time of invoicing will be applied to it.

5.2. Unless otherwise agreed in the Quote, under Regime A payment is made in full on delivery, against the final deployment to the Client’s domain, by means of an invoice due fifteen (15) days from its date of issue. If the Quote provides for payment in phases, each phase is invoiced on delivery, and the assignment under clause 2.1 takes effect upon full payment of all phases, unless the Quote provides that it takes place phase by phase. Under Regime B, the fee accrues in advance at the intervals indicated in the Quote.

5.3. The price does not include the third-party costs necessary for the Project to operate (domain registration and renewal, paid hosting services, commercial licenses, payment gateways, usage of artificial intelligence models), which are borne by the Client, unless the Quote expressly states otherwise. Sanfeliu will inform the Client of them before incurring them.

5.4. Late payment will automatically accrue, without the need for prior demand, the late-payment interest provided for in Law 3/2004, of December 29, establishing measures to combat late payment in commercial transactions, as well as the compensation for collection costs provided for in Article 8 of that law. This clause does not apply if the Client is a consumer.

5.5. Failure to pay the price in full under Regime A prevents, by application of clause 2.3, the assignment of rights from taking place, and entitles Sanfeliu to withdraw the Project and refuse the handover of access, after giving the Client written notice allowing ten (10) calendar days to settle the payment.

5.6. Suspension for non-payment. A delay of more than fifteen (15) calendar days from the due date in paying any invoice entitles Sanfeliu to suspend the work in progress, the Preview and the Ongoing Services, after giving written notice, without the suspension constituting a breach on its part. Committed deadlines are extended for as long as the suspension lasts.

5.7. Validity of the Quote. Unless the Quote states a different period, the Quote is valid for thirty (30) calendar days from its date.

5.8. Special prices and discounts. Discounts, rebates and special prices stated in the Quote apply only to the scope and period indicated in it. They do not carry over to renewals, extensions or new engagements, and do not set any precedent for the relationship with the Client, unless the Quote provides otherwise.

6. Delivery, preview, acceptance and warranty

6.1. Sanfeliu will publish the Project on a Preview and will inform the Client accordingly. The Preview is valid for thirty (30) calendar days, after which Sanfeliu may deactivate it.

6.2. The Client will have fifteen (15) calendar days from notification of the Preview to review the Project and to communicate in writing, in a single list, the objections or changes it considers necessary within the scope agreed in the Quote.

6.3. Tacit acceptance. If the period set out in clause 6.2 elapses without the Client having communicated objections in writing, the Project will be deemed accepted for all purposes, including invoicing. The Project is also deemed accepted if the Client publishes it on its domain, puts it into production or exploits it commercially before that period ends.

6.4. Changes. The Quote will state the number of rounds of changes included. Unless otherwise agreed, minor content changes requested during the thirty (30) calendar days following the issue of the invoice are included. Changes that exceed the agreed scope, new features and additional rounds will be quoted separately, at a fixed price, at the current hourly rate indicated in the Quote or through the continuity plan contracted by the Client, and will require the Client’s prior acceptance before being carried out.

6.5. Warranty. For thirty (30) calendar days from Delivery, or for any longer period indicated in the Quote, Sanfeliu warrants the correction, at no cost to the Client, of programming errors attributable to the delivered Project, meaning any behavior of the Project that departs from what is described in the Quote. The following are excluded from the warranty:

6.5.1. Issues arising from modifications made by the Client or by third parties to the Source Code, the configuration or the content.

6.5.2. Issues caused by third-party services, platforms or libraries, or by changes to them.

6.5.3. Requests for new features, content changes and improvements, which are governed by clause 6.4.

6.5.4. Issues caused by changes to browsers, devices or operating systems after Delivery.

6.6. Handover of access. Upon Delivery, and provided that the price has been paid, Sanfeliu will transfer to the Client, or create in the Client’s name, the code repository and the domain configuration, and will hand over the corresponding credentials through a secure channel. From that moment on, the Client is responsible for safeguarding those credentials. Delivery is recorded in a handover certificate that the parties sign or accept by email.

6.7. Hosting. The Quote will indicate the hosting arrangement:

6.7.1. Client account: the hosting application is created in, or transferred to, the Client’s account, and the Client bears its costs directly with the provider. Clause 13 applies.

6.7.2. Sanfeliu account: the Project is hosted on infrastructure contracted by Sanfeliu, at the monthly price indicated in the Quote (which may be zero euros for low-usage static websites). The Client may request migration to its own account at any time. Sanfeliu will hand over the Source Code, the deployment configuration and an export of the data, and the Client will bear the cost of the migration in accordance with clause 6.4 if it exceeds the standard handover. This arrangement does not alter the ownership of rights agreed under Regime A or the ownership of the domain, which always belongs to the Client. Where the Quote states that hosting is included with no fee, it is included only for as long as the Project is hosted on Sanfeliu’s infrastructure. If the Client moves the Project to its own account, this obligation is extinguished. Sanfeliu may cease hosting on ninety (90) calendar days’ notice, first handing over the Source Code and what is provided for in this paragraph.

6.8. The warranty is not a maintenance service. Any subsequent maintenance, monitoring, updates and support, if contracted, are governed by clause 11.

7. Client content and materials

7.1. The Client warrants that it is the owner of, or holds the necessary rights, licenses and authorizations over, all the Client Content it provides, including the exploitation rights over texts and photographs, the authorizations of the authors and, where applicable, the consent of the people who appear in them.

7.2. The Client specifically warrants that it holds the rights over materials originating from systems, servers, accounts, social networks, platforms or companies other than its own, and is liable to Sanfeliu and to third parties for the legitimacy of that origin.

7.3. The Client will hold Sanfeliu harmless against any claim, judicial or out-of-court, brought by third parties for infringement of intellectual or industrial property rights, image rights or unfair competition arising from the Client Content, and will bear the resulting defense costs and compensation.

7.4. Sanfeliu may refuse or postpone the incorporation into the Project of any content that, in its reasonable judgment, may infringe third-party rights or current legislation, until the Client proves that it is lawful.

7.5. Materials from the previous website. When the Project is based on the content of a previous website of the Client, the Client warrants that it may freely make use of that content, regardless of who designed or hosted it.

7.6. Lawfulness of published content. The Client is solely responsible for ensuring that the content it publishes, or has published, on the Project is lawful, truthful and up to date, including prices, opening hours, terms of sale or booking, allergens, registration numbers and any other information that is mandatory in its sector.

7.7. Typefaces and commercial licenses. Typefaces, images or other paid materials prescribed by the Client’s brand guidelines are at the Client’s expense, and the Client must prove that it holds a license for the intended use. Sanfeliu does not distribute commercial typefaces: it may reference them by name and configure equivalent free alternatives.

8. Personal data protection

8.1. Position of the parties. With regard to the personal data of the users of the website or software, the Client acts as Data Controller and Sanfeliu as Data Processor when it accesses that data to provide its services, within the meaning of Articles 4.7 and 4.8 of Regulation (EU) 2016/679 (GDPR). Annex I to this document constitutes the data processor agreement required by Article 28.3 of the GDPR.

8.2. Each party will comply, insofar as it is concerned, with the GDPR and with Organic Law 3/2018, of December 5, on the protection of personal data and the guarantee of digital rights (LOPDGDD).

8.3. The Client is responsible for publishing on the website the legal notice, the privacy policy and, where applicable, the cookie policy and the consent mechanism, with the content required by Law 34/2002 on information society services (LSSI) and by the GDPR. Sanfeliu may provide baseline drafts for guidance, without this constituting legal advice or transferring to Sanfeliu responsibility for their content.

8.4. The professional contact data that the parties exchange for the performance of the contract is processed by each of them as data controller, on the basis of the performance of the contract (art. 6.1.b GDPR), and is kept for as long as the relationship lasts and for the statutory limitation periods.

8.5. Sanfeliu does not process the Project’s personal data for its own purposes, does not disclose it to third parties and does not use it to train artificial intelligence models, whether its own or those of third parties.

9. Limitation of liability

9.1. Sanfeliu is liable for direct damage caused by its culpable breach of its obligations. Sanfeliu’s total aggregate liability on any grounds arising from the contract is limited to the amount actually received from the Client during the twelve (12) months preceding the event giving rise to the claim.

9.2. Liability for loss of profits, loss of business, loss of bookings or sales, loss of opportunity, reputational damage, loss of data attributable to the Client or to third parties, and indirect or consequential damage is excluded.

9.3. The limitations in clauses 9.1 and 9.2 do not apply in cases of willful misconduct, gross negligence or personal injury, or in any other case in which the law does not allow liability to be limited. Nor do they apply if the Client is a consumer, to the extent that they would impair the Client’s mandatory rights.

9.4. Third-party services. The Project is hosted on, and depends on, third-party services (cloud providers, code repositories, domain registrars, and email, booking, payment, analytics and artificial intelligence model providers). Sanfeliu does not control these services and is not liable for their availability, their performance, changes to their terms or prices, or their interruption or discontinuation. If any of these services changes or is discontinued, Sanfeliu will inform the Client and propose a reasonable alternative, which will be quoted if it goes beyond the warranty or the Ongoing Services contracted. Sanfeliu does not guarantee any specific level of availability of the website unless a service level agreement has been expressly agreed in writing.

9.5. Force majeure. Neither party is liable for any failure to perform caused by unforeseeable or unavoidable events beyond its reasonable control, including widespread outages of networks or of infrastructure providers, cyberattacks by third parties, regulatory changes and decisions of authorities. The affected party will notify the other party without delay.

9.6. Security. Sanfeliu will apply reasonable technical measures in line with the state of the art, but does not guarantee that the Project is impregnable. Once the Project has been delivered, and unless Ongoing Services that include it are in force, responsibility for applying security updates lies with the Client.

9.7. Results. Sanfeliu applies good technical practice in performance, accessibility and search engine optimization, but does not guarantee any ranking in search engines or artificial intelligence assistants, any volume of visits, sales or bookings, or any specific time saving or financial result, unless the Quote expressly sets it as a measurable objective.

9.8. Accessibility. The Project is developed in line with reasonable accessibility criteria. If the Client is bound by the accessibility regulations for products and services (Law 11/2023, of May 8) or by any other sector-specific rules, it must say so before the Quote is issued so that the relevant requirements can be included in the scope. Otherwise, compliance with those regulations does not form part of the contracted scope.

9.9. Invoicing systems. Unless the Quote expressly provides otherwise, the Project is not a computerized invoicing system within the meaning of Royal Decree 1007/2023, of December 5, and the documents it generates (quotes, pro forma invoices, orders or delivery notes) are not invoices. If the Quote includes issuing invoices, it must define the scope of regulatory compliance (invoicing records, QR code, submission to the Spanish Tax Agency and the producer’s statement of compliance) and the corresponding price, and the Client must check that use with its tax adviser.

10. Confidentiality

10.1. Each party undertakes to keep secret the other party’s confidential information to which it has access in connection with the contract, to use it solely for the performance of the contract, and not to disclose it to third parties without written authorization.

10.2. The confidentiality obligation will remain in effect for the term of the contract and for three (3) years after its termination, and indefinitely with regard to trade secrets protected by Law 1/2019, of February 20, on trade secrets.

10.3. Confidential information does not include information that is in the public domain, information that the receiving party already lawfully knew, information that it receives from a third party with no duty of confidentiality, or information whose disclosure is required by a competent authority or by law, in which case the other party will be informed where possible.

10.4. The confidentiality obligation is without prejudice to Sanfeliu’s right under clause 2.6.2, which is limited to information already published by the Client or to the published Project.

10.5. Credentials and secrets are shared through encrypted channels, never by plain-text email, and are kept safe with appropriate technical means.

11. Ongoing Services and continuity plans

11.1. Scope. This clause applies to the Ongoing Services contracted by the Client, whether one of the standard continuity plans that Sanfeliu publishes or a custom plan or service. The contracted service is always the one set out in writing in the Quote or in Annex III, with its content, fee, allowances and response targets.

11.1.1. Standard plans. The descriptions and amounts of the plans published on Sanfeliu’s website are indicative. They apply only if the Client contracts a standard plan without a specific Quote. In that case, Sanfeliu will confirm to the Client in writing the description in force on the date of contracting, which is the binding one.

11.1.2. Custom plans. Sanfeliu may agree with a Client a plan with content, allowances, response targets or a fee different from those published. A custom plan is governed by the Quote or Annex III and, in everything not provided for in them, by this clause 11. The terms of a custom plan are personal to the Client, do not extend to other services or other clients, and do not continue to apply if the Client changes its scope, unless agreed in writing.

11.1.3. Anything not expressly included in the contracted service is excluded from it and is quoted separately.

11.2. Term. Ongoing Services are contracted by calendar month with no minimum term, unless the Quote provides for a longer period paid in advance. In the latter case, early cancellation at the Client’s decision does not entitle the Client to a refund for the unused months, unless it is due to a breach by Sanfeliu.

11.3. Invoicing. The fee is invoiced in advance at the start of each period, using the payment method indicated in the Quote, with payment due fifteen (15) days from issue. Non-payment is governed by clauses 5.4 and 5.6 and, if the service includes hosting the Project, by clause 3.5 insofar as it is applicable.

11.4. Cancellation and change of plan. The Client may cancel the Ongoing Services or change plan by giving written notice before the start of the following period. Cancellation takes effect at the end of the period already invoiced, without penalty. Sanfeliu may stop providing an Ongoing Service by giving thirty (30) calendar days’ written notice or, if the service includes hosting the Project on Sanfeliu’s infrastructure, the ninety (90) days’ notice under clause 6.7.2.

11.5. Software hosting. Where the Quote states that a plan is required while software is hosted on Sanfeliu’s infrastructure, canceling that plan entails migrating the software to the Client Environment in accordance with clause 11.11. For as long as the migration has not been completed for reasons not attributable to Sanfeliu, the fee continues to accrue monthly, up to a maximum of two (2) months from the date on which the cancellation takes effect. Once that period has elapsed, Sanfeliu may stop the service after handing over what is provided for in clause 11.11.

11.6. Allowances. Allowances for changes, improvements or features included in a plan are calculated per calendar month. Unused allowances may be used, at most, during the following month, and give rise to no right to a refund or compensation.

11.7. Small changes and medium-sized features. A small change means a modification that does not alter the data structure or the logic of the Project, such as changing a text, an image, a price, a form field or a date. A medium-sized feature means a well-defined extension that can be delivered and tested independently, such as a new report, a new screen or a simple integration with a service that is already available. If a request exceeds the allowance or the category of the plan, Sanfeliu will say so before carrying it out and will quote it separately.

11.8. Response targets. The response times indicated in the plans are response targets in business days in Barcelona, not a service level agreement. Sanfeliu does not guarantee the availability of the Project or resolution times, unless the Quote expressly agrees a service level agreement and its consequences.

11.9. Exclusions. Unless the plan or the Quote expressly includes them, Ongoing Services do not cover new features, redesigns, new languages, platform migrations, training, issues caused by the Client, by third parties or in the Client Environment, or the third-party costs under clause 5.3.

11.10. Correction of errors and work done within the plan. Errors attributable to Sanfeliu are corrected free of charge during the warranty under clause 6.5 and, after that, within any plan that includes it. The assignment of changes and improvements made within the plan is governed by the Project’s regime and takes effect upon payment of the fee for the period in which they are delivered. Under Regime B, they become part of the licensed Project.

11.11. End of Ongoing Services. When the Ongoing Services end, Sanfeliu provides the Client with an export of its data and, if Sanfeliu was hosting the Project and the regime so allows, the Source Code and the deployment configuration. It also returns or deletes any of the Client’s credentials in its safekeeping, and cooperates in the migration, which is quoted separately if it goes beyond the standard handover.

11.12. Fee updates. Sanfeliu may update the fees once a year, giving thirty (30) calendar days’ written notice, in line with the annual change in the consumer price index published by the Spanish National Statistics Institute (INE). Any other change to the fee requires sixty (60) calendar days’ notice and entitles the Client to cancel the service without penalty before the change applies. If the Quote sets a fixed fee for a specific period, it will be honored until that period ends.

12. Services involving artificial intelligence

12.1. Scope. This clause applies when the Project includes an AI System or when Sanfeliu uses artificial intelligence models to process the Client’s information in providing the services.

12.2. Nature of the outputs. Artificial intelligence systems generate probabilistic outputs that may be inaccurate, incomplete or inappropriate. Sanfeliu designs, configures and tests the AI System with professional diligence, but does not guarantee the accuracy of its outputs. The Client maintains appropriate human oversight and reviews the outputs before using them in decisions with legal or economic effects or with effects on individuals.

12.3. Purpose and excluded uses. The AI System is delivered for the purpose described in the Quote. The Client will not use it for the AI practices prohibited by Article 5 of Regulation (EU) 2024/1689 or for the high-risk uses listed in Annex III to that Regulation (such as the selection or evaluation of workers, the assessment of the creditworthiness of natural persons or access to essential services) without a specific engagement that includes the corresponding assessment and obligations. If the Client uses the AI System for a purpose other than the one agreed, it assumes the resulting obligations and liability.

12.4. Roles. Where the Client puts into service, under its own name or trademark, an AI System that Sanfeliu develops on commission, the Client is the provider and the deployer for the purposes of Regulation (EU) 2024/1689, and Sanfeliu acts as developer on the Client’s behalf. Sanfeliu will provide the Client with reasonable technical information on the purpose, the models used, the data, the testing and the known limitations, so that the Client can comply with the obligations that apply to it. Where the AI System is part of one of Sanfeliu’s own products that the Client uses, Sanfeliu is its provider and the Client is the deployer.

12.5. Transparency. Where the AI System interacts directly with natural persons, Sanfeliu will design it so that those persons are informed that they are interacting with an AI system, unless this is obvious, and the Client will not remove that notice. If the AI System generates synthetic audio, image, video or text content, Sanfeliu will configure it, to the extent that the models used allow, so that its outputs can be identified as artificially generated where the law requires it. The Client will label those outputs as such when publishing them in the cases where the law so requires.

12.6. Third-party models. The AI System may use third-party models, which are identified in the Quote or in Annex II. By default, Sanfeliu configures them to process data within the European Union and under arrangements in which the provider does not use the data to train its models. The use of models that process data outside the European Economic Area requires the Client’s written authorization and the safeguards of Chapter V of the GDPR. Clause 9.4 applies to changes to, withdrawals of and price variations in these models.

12.7. Data. The Client will not enter into the AI System special categories of data (Article 9 of the GDPR), data of minors or data that it cannot lawfully process, without having agreed and assessed this in advance. If the AI System processes personal data on behalf of the Client, Annex I applies, and Sanfeliu will assist the Client, where necessary, with the data protection impact assessment under Article 35 of the GDPR. The AI System will not take decisions based solely on automated processing that produce legal effects concerning individuals or similarly significantly affect them, unless the Client has so decided with the safeguards of Article 22 of the GDPR.

12.8. Usage costs. The usage of third-party models is a cost under clause 5.3, unless the Quote or the plan includes it up to a limit. If that limit is expected to be exceeded, Sanfeliu will inform the Client before invoicing the excess, or will limit the service.

12.9. Outputs and instructions. To the extent that they are subject to rights, the outputs generated by the AI System for the Client and the instructions and configurations created specifically for the Project follow the applicable assignment regime. Instruction, agent and evaluation templates of general use are Reusable Components. Sanfeliu does not warrant that the outputs generated are original or that they do not coincide with third-party materials. The Client reviews their use before publishing them.

12.10. AI literacy. When delivering the AI System, Sanfeliu explains to the Client how it works, its limitations and how to oversee it. The Client takes measures to help ensure that the staff who use it have an adequate level of AI literacy (Article 4 of Regulation (EU) 2024/1689).

12.11. Development assistance tools. Sanfeliu may use assistance tools based on artificial intelligence to develop the Project, under its own supervision and professional responsibility, without entering into them personal data or confidential information of the Client beyond what Annex I and clause 10 allow.

13. Deployment and operation in the Client Environment

13.1. Scope. This clause applies when the Project is deployed, published or operated in the Client Environment, by the Client or by a third party designated by the Client, and to the extent that Sanfeliu does not provide Ongoing Services in that environment.

13.2. Designated third parties. Third parties designated by the Client are its employees, collaborators, IT professionals, agencies, referrers, intermediaries and any other person whom the Client engages or allows to work on the Project.

13.3. Position of the third party. A third party designated by the Client acts exclusively on the Client’s behalf. It is in no case a subcontractor, auxiliary or employee of Sanfeliu. Sanfeliu does not direct or supervise it and is not liable for its acts or omissions.

13.4. Transfer of risk. From the date of the handover certificate, or from the first deployment of the Project to the Client Environment if earlier, responsibility for the deployment, publication, operation, availability, security, backups, updates and monitoring of the Project lies with the Client.

13.5. Exclusions. In particular, Sanfeliu is not liable for:

13.5.1. Configuration, deployment or network errors in the Client Environment.

13.5.2. Modifications to the code, content or configuration made by the Client or by a third party.

13.5.3. The addition to the Project of code, tracking tags, extensions, redirects or affiliate links by third parties.

13.5.4. Failure to renew the domain, the security certificates or the services contracted by the Client.

13.5.5. The absence of backups and the loss of data in the Client Environment.

13.5.6. Security incidents, unauthorized access and data leaks in the Client Environment.

13.5.7. Non-compliance with data protection, e-commerce or sector-specific regulations in the Client Environment.

13.5.8. Expenses, usage charges or invoices from providers engaged by the Client or by the third party.

13.6. Warranty in the Client Environment. The warranty under clause 6.5 covers only errors that can be reproduced in the delivered code when cleanly deployed in accordance with the instructions provided. If the error cannot be reproduced under those conditions, diagnosis and correction are quoted separately.

13.7. Data protection. Where the Project is operated by the Client or by a third party designated by the Client, Sanfeliu is not a data processor for that processing. Annex I applies only to the services that Sanfeliu actually provides. If it provides none, Annex I does not apply and the parties record this in the handover certificate.

13.8. Credentials. The handover of credentials, access and secrets is recorded in the handover certificate, stating who receives them. From that moment on, their safekeeping lies with the Client. Sanfeliu deletes any copies it holds and confirms this in writing.

13.9. Subsequent access. Sanfeliu does not retain any access to the Client Environment. If the Client grants it access on a one-off basis, Sanfeliu acts on the Client’s written instructions, and that intervention does not make Sanfeliu responsible for the environment or its maintenance.

13.10. Subsequent work. Any work by Sanfeliu after the handover certificate that is not covered by the warranty or by the contracted Ongoing Services constitutes a new engagement, is quoted separately and does not reopen the warranty or extend its scope.

13.11. Included hosting. Any reference to hosting as “included,” “for life,” “forever” or “with no fee” in quotes, proposals or handover documents refers to the infrastructure operated by Sanfeliu and is always subject to clause 6.7.2. If the Project is moved to the Client Environment, the obligation to host is extinguished without consideration or compensation for either party.

13.12. Indemnity. The Client will hold Sanfeliu harmless against any third-party claim, including claims by persons designated by the Client, arising from the deployment, operation or modification of the Project in the Client Environment.

14. Term, amendment, applicable law and jurisdiction

14.1. These General Terms and Conditions remain in force for as long as the contractual relationship lasts. Sanfeliu may amend their text for future projects. Amendments do not affect projects already contracted, which are governed by the version attached to their Quote. Changes to Ongoing Services in progress are governed by clause 11.12.

14.2. The nullity of any clause does not affect the validity of the rest, which will remain in force to the extent that it is severable.

14.3. These Terms and Conditions, the Quote, its annexes and the handover certificate constitute the entire agreement between the parties on their subject matter. Amendments must be made in writing, and express confirmation by email from both parties is accepted. Communications between the parties relating to the contract, including those under clauses 3.5, 5.5, 5.6, 11.4 and 14.5, may be made by email to the addresses stated in the Quote or to those that the parties notify to each other in writing. They are valid provided that there is a record of their sending, content and receipt.

14.4. The contract is governed by Spanish law.

14.5. Prior negotiation. Before bringing any legal action, including order for payment proceedings, the party wishing to make a claim will notify the other party in writing, setting out the details of the claim and a specific proposal for resolving it, and the parties will negotiate in good faith. If no agreement is reached or no reply is received within thirty (30) calendar days of receipt of the notice, the negotiation is deemed to have ended without agreement. This negotiation is deemed to be an appropriate means of dispute resolution for the purposes of Organic Law 1/2025, of January 2, on measures concerning the efficiency of the Public Justice Service, without prejudice to interim measures.

14.6. For the resolution of any dispute, the parties submit to the courts of the city of Barcelona, expressly waiving any other jurisdiction to which they may be entitled.

14.7. Clauses 14.5 and 14.6 do not apply to the detriment of a Client who is a consumer within the meaning of the consolidated text of the General Law for the Defense of Consumers and Users (RDL 1/2007). In that case, jurisdiction will lie with the courts mandatorily determined by law, ordinarily those of the consumer’s domicile, and the consumer may use the alternative dispute resolution channels available under the applicable regulations.

Acceptance

These General Terms and Conditions are deemed accepted upon acceptance of the Quote that refers to them, by signature or by express confirmation by email sent from an address of the Client. The version applicable to each Project is the one in force on the date of the Quote.

Annex I — Data processor agreement (art. 28 GDPR)

This Annex forms an inseparable part of the General Terms and Conditions and governs the processing of personal data that Sanfeliu (the Processor) carries out on behalf of the Client (the Controller).

I.1. Subject matter, duration and nature

I.1.1. The subject matter is the processing of personal data necessary to develop, integrate, deploy and, where applicable, host, maintain, operate or support the Client’s website, software or AI System, including, under Regime C, access to the Client’s systems as required by the work orders.

I.1.2. The duration coincides with that of the main contract and, where applicable, with that of the Ongoing Services. Upon termination, the provisions of clause I.7 apply.

I.1.3. If the Client acts as a processor on behalf of its own clients, this Annex applies as a sub-processing agreement (Article 28.4 GDPR). The Client is liable to the controllers and warrants that it has their authorization to engage Sanfeliu.

I.2. Processing operations, categories of data and of data subjects

I.2.0. The following table sets out the usual processing operations. For each Project, the Quote or the handover certificate adapts it to the processing operations actually carried out.

• Processing — Data processed — Data subjects — Purpose
• Website forms (contact, information request, order or booking) — Name, email address, telephone, message and, where applicable, the order or booking details — Website users — Forwarding the request to the Client and, where applicable, managing the order or booking
• User accounts and management dashboards — Email address, name, role and activity logs — The Client’s users — Providing access to the software and protecting it
• AI Systems, if the Project includes any — Information entered into them and outputs generated — Persons about whom the Client enters information, and users of the system — Providing the AI functionality described in the Quote
• Access to the Client’s systems (Regime C) — The data contained in the Client’s databases, files, records and applications that need to be accessed for each work order — Employees, clients, suppliers and contacts of the Client and, where applicable, of its clients — Development, integration, diagnosis, deployment and support
• Hosting and technical logs — IP address, user agent, timestamps — Visitors and users — Serving the website or software and keeping technical security logs
• Development and support — The above, when accessed incidentally during technical tasks — The above — Diagnosing and fixing issues

I.2.1. As a general rule, neither special categories of data under Article 9 of the GDPR nor data of minors are processed. If a booking or order form may collect health data (allergies and intolerances) that the user provides voluntarily, such data is processed with the user’s explicit consent (art. 9.2.a GDPR) and solely to handle the booking or order.

I.2.2. Sanfeliu does not access the Client’s mailboxes, or the data once it has been delivered to them, unless an Ongoing Service expressly provides for it.

I.3. Obligations of Sanfeliu as Processor

I.3.1. To process the data only on documented instructions from the Controller, including with regard to international transfers, and to inform the Controller if it considers that an instruction infringes the applicable regulations.

I.3.2. Not to use the data for any other purpose, not to use it to train artificial intelligence models, and not to communicate or disclose it to third parties, not even for its storage, unless required by law.

I.3.3. To ensure that the persons authorized to process the data have committed themselves to confidentiality.

I.3.4. To apply the technical and organisational measures of Article 32 of the GDPR that are detailed in clause I.6.

I.3.5. To assist the Controller, taking into account the nature of the processing, in responding to the exercise of data subjects’ rights (access, rectification, erasure, objection, restriction and portability). If a data subject exercises a right with Sanfeliu, Sanfeliu will notify the Controller without undue delay.

I.3.6. To assist the Controller in complying with the obligations under Articles 32 to 36 of the GDPR, including the notification of security breaches and, where necessary, the impact assessment.

I.3.7. To notify the Controller of any data security breach of which it becomes aware, without undue delay and, in any case, within a maximum of 48 hours, with the information available to it.

I.3.8. To make available to the Controller the information necessary to demonstrate compliance and to allow reasonable audits, with fifteen (15) days’ prior notice and without interfering with its activity.

I.3.9. To maintain the record of processing activities carried out on behalf of third parties required by Article 30.2 of the GDPR.

I.4. Obligations of the Client as Controller

I.4.1. To determine the purposes and means of the processing, and to give Sanfeliu documented instructions.

I.4.2. To have a valid legal basis for each processing operation and to inform data subjects under the terms of Articles 13 and 14 of the GDPR, through the privacy policy of the website or software.

I.4.3. To publish, and keep up to date, the legal notice, the privacy policy and, where applicable, the cookie policy and the prior consent mechanism.

I.4.4. To ensure the accuracy of the data and to respond to the exercise of data subjects’ rights.

I.5. Sub-processors

I.5.1. The Controller expressly authorizes Sanfeliu to engage the following sub-processors. The additional sub-processors specific to each Project (booking, payment, analytics, email or artificial intelligence model provider) are listed in the Quote, the specific contract or the handover certificate.

• Sub-processor — Service — Location of processing
• Amazon Web Services EMEA SARL — Website hosting (AWS Amplify), backend (API Gateway, Lambda, DynamoDB, S3, Cognito, SES) and, if the Project includes an AI System, models on Amazon Bedrock — European Union: region eu-west-1 (Ireland), eu-west-3 (Paris) or the region indicated in the Quote
• GitHub, Inc. (Microsoft) — Source code repository, with no user personal data or credentials — United States, under the EU-U.S. Data Privacy Framework and standard contractual clauses

I.5.2. Sanfeliu will inform the Controller of any intended change involving the addition or replacement of sub-processors thirty (30) days in advance, and the Controller may object on reasonable grounds.

I.5.3. Sanfeliu will impose on the sub-processors, by contract, the same obligations that it assumes under this Annex, and will be liable to the Controller for their non-compliance.

I.6. Security measures

I.6.1. Encryption in transit using TLS across the entire website and mandatory redirection to HTTPS; encryption at rest on the storage services that support it.

I.6.2. Individual access control for infrastructure accounts, with two-factor authentication on the providers that support it.

I.6.3. Principle of least privilege when granting access, and revocation when the relationship ends.

I.6.4. Backups of the code in the repository and the ability to restore the website or software to a previous version.

I.6.5. No credentials, keys or secrets in the version-controlled source code; secrets kept in secrets management services.

I.6.6. Minimization: the website or software does not collect more data than is strictly necessary for the purpose.

I.6.7. Limited retention of technical logs containing IP addresses, for a maximum of ninety (90) days, unless the Quote sets a different period or the logs need to be kept to investigate a security incident.

I.7. Disposition of the data upon termination

I.7.1. Upon termination of the contract, Sanfeliu will, at the Controller’s choice, return the personal data to the Controller or delete it, together with any copies, within thirty (30) days.

I.7.2. Sanfeliu may retain the data, duly blocked, for the limitation periods of legal and contractual liabilities.

Annex II — Reusable Components and Third-Party Libraries

II.1. The specific list of Sanfeliu’s Reusable Components incorporated into each Project, of the third-party materials with their licenses, of the artificial intelligence models used and of the Client Content is attached to the Quote or to the handover certificate for each Project, and forms an inseparable part of these Terms and Conditions.

II.2. Sanfeliu warrants that the third-party libraries incorporated into a Project are distributed under licenses compatible with the use provided for under the contracted Regime, and identifies in the annex to the Quote any attribution or license obligation that the Client must maintain.

II.3. Sanfeliu does not assign any rights over third-party materials beyond what their respective licenses or terms allow.

Annex III — Ongoing Services for the Project

III.1. When the Client contracts Ongoing Services, or when Sanfeliu keeps any service on its infrastructure after Delivery, the Ongoing Services schedule for the Project is attached to the Quote or to the handover certificate. The schedule states the service or plan, what it includes, the monthly fee excluding VAT, the start date, the infrastructure and region, and the notice period for termination.

III.2. Safekeeping of credentials. If the service so requires, the Client expressly authorizes Sanfeliu to keep the access credentials listed in the handover certificate and to use them solely to provide the service. The credentials are stored encrypted in a secrets management service, with access limited to those who need them, and are never included in the code or in visitors’ browsers.

III.3. Third-party systems. Where the service queries or operates systems belonging to the Client’s providers, the Client declares that its contracts with those providers allow access through Sanfeliu. Clauses 9.4 and 11.8 apply.

Previous versions

Version 1.0 (September 3, 2026) continues to apply to projects contracted before September 14, 2026.

General Terms and Conditions v1.0 (PDF, in Catalan)