Floral Terms of Service

These Terms govern the Floral software service supplied by Floral ApS, CVR 44598574, Vesterbrogade 29F, st., 1620 Copenhagen V, Denmark. Questions, support requests and legal notices can be sent to [email protected]. The Customer accepts these Terms on behalf of its organisation through online acceptance or a Floral Order Form. The standard legal terms apply to pilots, subscriptions and agreed implementation services. No individually negotiated legal agreement or separate DPA signature is required.

1 The customer and the agreement

1.1 The Customer is the business, public body or other organisation identified in the organisation profile and acceptance record. An individual operating a business may contract in that business capacity. The Services are for professional use, not consumer use. The person accepting must be at least 18 and authorised to bind the Customer. Merely having an email address at an organisation does not establish that authority.

1.2 The agreement takes effect when an authorised representative actively accepts these Terms and the accompanying DPA through Floral's signup, subscription or Order Form process and Floral makes the agreed service available. A Floral-issued Order Form may be accepted electronically, including in Contractbook or by a recorded written acceptance identifying that order. A separate Floral countersignature is unnecessary unless the order expressly requires it. The acceptance record identifies the Customer, accepting representative, date, order or checkout details and document versions. Floral will supply a copy for the Customer to retain. A pilot or trial is covered before Customer data is processed, even if payment details are added later.

1.3 The agreement consists of these Terms, the Floral DPA, English version 2026-09-07.1, its annexes and identified provider register, and any accepted Floral Order Form or checkout details. The Order Form or checkout records the selected service, scope, plan, prices, limits, dates, billing period and any implementation fee. A Floral Order Form controls those commercial particulars over inconsistent standard defaults or checkout particulars for the same service; it does not override the DPA or change other legal terms. Mandatory law and applicable international transfer clauses take precedence, followed by the DPA for data processing and these Terms for other matters. Customer purchase-order terms do not form part of the agreement.

1.4 Users invited to an existing Customer organisation use the Services under that Customer's agreement. Their acceptance of user rules does not make them personally liable for the organisation's subscription or give them authority to change its contract. The Customer controls user appointments, roles and access within the product's supported permissions. Joining another organisation does not transfer ownership of an existing organisation or its data.

1.5 These are Floral's standard terms. Terms in a Customer purchase order, supplier portal or other unilateral document do not apply unless Floral expressly accepts them in writing. Floral need not accept requests for individual changes. Mandatory customer and data-subject rights remain unaffected.

2 The Services and access

2.1 The Services are the subscribed Floral functions for business relationships, records, work, meetings, transcription, search, AI assistance and connected workflows, including the web and mobile clients and documented APIs where enabled. The selected plan and current service documentation describe the available functions and limits. Planned functions and roadmap statements are not delivery commitments.

2.2 Floral grants the Customer a limited, non-exclusive right to use the Services during the subscription for its professional activities, including its work for clients where lawful and covered by the DPA. The Customer may let its employees and authorised contractors use assigned accounts. It may not resell access or operate a competing hosted copy of the Services without permission. Each account is for one individual and may be reassigned when that individual is replaced. Mandatory interoperability and other statutory rights are preserved.

2.3 The Customer must provide accurate organisation, billing and contact details, keep credentials secure and promptly report suspected misuse. It must manage departures, sharing settings and connected systems. Floral remains responsible for the security and authorisation controls it is required to provide; Customer responsibilities do not excuse Floral's own breach.

2.4 Customer-selected integrations and external AI clients operate under the Customer's separate relationship with those providers. The Customer controls whether to enable a connection and must have the necessary authority. Floral remains responsible for its own integration implementation and for providers it appoints, as described in the DPA. An app-store provider's applicable distribution and payment terms also apply to an app obtained through that store; they do not replace the DPA.

3 Lawful use and AI outputs

3.1 The Customer must use the Services lawfully and within its authority. It must not use them to infringe rights, distribute malicious code or unlawful material, bypass authentication or usage limits, interfere with other customers, or access data it is not authorised to access. Reverse engineering restrictions apply only to the extent permitted by law. Reasonable security reporting, lawful export and statutory interoperability rights are not prohibited.

3.2 The Customer determines why its data is processed and its lawful basis. It must provide the required information about recording and data processing and obtain consent where the law requires consent. Acceptance of these Terms is not consent from meeting participants and is not, by itself, a lawful basis for recording them.

3.3 Standard use covers ordinary business records and meetings. The Customer must not intentionally submit or instruct processing of the restricted categories in DPA Annex A4, including health information, criminal-offence information, CPR numbers and HR personnel-case files, unless Floral has expressly accepted a suitable service arrangement in writing. Ordinary employee business contact details remain covered. Public availability does not remove restrictions on sensitive personal information. The Customer must not place payment-card details, account passwords, API keys or other authentication secrets in records, uploads or prompts; supported secure payment and integration connection flows remain permitted.

3.4 AI outputs and transcripts can contain invented facts, omissions, misattributed speakers and inaccurate inferences, and may reproduce third-party material. The Customer must ensure a suitably informed person checks relevant source material and assesses accuracy, permissions and suitability before relying on an output, sharing it or taking a consequential action. Outputs do not constitute legal, medical, financial or other professional advice, and no particular accuracy, business result, uniqueness or third-party rights clearance is promised. Similar outputs may be produced for others. These qualifications do not override Floral's express service, security or DPA obligations.

3.5 The Services are not offered for safety-critical operations or for determining a natural person's eligibility for employment, credit, insurance, healthcare, education or essential public services. The Customer must not use them for unlawful discrimination, deception, harassment, covert surveillance, unlawful social scoring, biometric identification or categorisation, or inferring workplace emotions from biometric data. Analysis of statements about business needs or sentiment is not permission to infer protected characteristics or use a person-level risk score. Any separately supported lawful high-risk use requires prior assessment and express written agreement; agreement cannot authorise a prohibited use.

3.6 The Customer must not use outputs to make solely automated decisions producing legal or similarly significant effects on individuals, evade security or AI safeguards, extract another customer's data or deceive a person about an AI-generated identity or communication where disclosure is required. It must provide appropriate staff guidance on lawful recording, restricted data and AI limitations. Each party remains responsible for applicable AI-law duties arising from its own role.

3.7 AI chat and agent features act only within the Customer's authorised permissions and instructions. The Customer must check recipients, destinations and the scope of actions it approves. A sentence in a transcript, imported page or generated answer is not authority to change permissions, disclose content or perform an external action. Floral remains responsible for enforcing its access and action-authorisation controls.

3.8 If restricted or unlawfully supplied data is discovered, the Customer must promptly stop the affected use, restrict unnecessary access and contact Floral through an approved secure channel to agree removal or other lawful handling. Floral may proportionately restrict the affected data or function under Section 9. Accidental submission remains protected by the DPA and does not automatically end the agreement or remove Floral's obligations.

4 Subscriptions and payment

4.1 Fees, currency, included usage, metered rates and any pilot or trial are stated in the accepted Order Form or shown before the Customer subscribes. Unless expressly stated otherwise there, subscriptions renew monthly. Charges exclude applicable VAT and other transaction taxes, which are shown through the billing process. Floral is responsible for taxes on its own income.

4.2 Billing is at organisation level. Unless the accepted plan says otherwise, each distinct active billable user is counted once across that organisation's workspaces, and usage is aggregated across those workspaces. An enabled add-on may apply to all billable users in the organisation. Authorised additions, removals and add-on changes adjust charges using the proration treatment disclosed in the billing flow. Removing a user does not erase already incurred usage. A fixed seat minimum or different calculation applies only where disclosed before purchase.

4.3 The Customer authorises the agreed recurring charges and must keep a valid payment method or approved invoice arrangement. Subscription charges are normally billed in advance and metered usage in arrears as stated in the Order Form or checkout. Approved invoices are due 30 days after invoice unless the accepted commercial particulars expressly specify another due date. Payment-card information must be entered through the approved payment flow, not stored in customer records or prompts.

4.4 A trial converts to a paid subscription only on the terms disclosed and accepted in the trial or checkout flow. If a trial requires a payment method for continuation and none is supplied, the paid subscription does not start. Floral will state what happens when the trial ends. Trial expiry does not waive the DPA's return and deletion requirements.

4.5 The Customer may cancel renewal through the billing controls or by notice to [email protected] before the next renewal. Ordinary cancellation takes effect at the end of the current paid period. Accrued fees remain due; there is no separate early-termination fee. Mid-period refunds arise where these Terms, the DPA or mandatory law provide them. Switching under Section 11 is also available and need not wait for a later renewal.

4.6 Floral may increase a recurring price or materially change its charging method only with at least 30 calendar days' email notice, effective from a renewal after that notice expires. The Customer may cancel before the increase takes effect. No increase is retroactive. Newly requested products are charged at the price accepted for that purchase.

4.7 The Customer should report a disputed invoice promptly with enough detail to investigate it and must pay undisputed amounts. Floral will investigate in good faith. It may suspend paid functionality for an undisputed overdue amount only after notice and at least seven calendar days to remedy it. A genuine billing dispute does not authorise withholding required data-protection assistance, export or deletion. Statutory late-payment interest and recovery costs apply only to the extent permitted by Danish law.

4.8 A pilot runs for the dates, scope and fee stated in the Order Form. It ends without automatic conversion or renewal unless the Customer expressly accepts a clearly completed continuation option, including the subscription start date, price, billing period and cancellation arrangement. If those particulars or the continuation choice are blank, no paid continuation is authorised. A pilot may use real Customer data only within the same DPA and permitted-use rules as a paid subscription. Unsuccessful evaluation does not itself create a refund right or a promised business result. Export and deletion duties apply when a pilot ends.

4.9 Optional implementation services, such as onboarding, configuration, data import and training, are supplied only for the scope and one-time fee stated in an accepted Order Form. A blank or zero implementation fee means no additional implementation charge. Unless the order states otherwise, the fee is invoiced at the agreed kickoff and payable within 30 days. The order must identify the deliverables or included sessions and when they will be provided. Customer dependencies may reasonably adjust delivery dates; they do not permit undisclosed charges. Extra work needs prior written approval of its scope and fee. Floral shall perform agreed work with reasonable care and skill and remedy material defects in its performance. If work is cancelled, the Customer pays only for work actually performed and any specifically pre-approved non-cancellable third-party costs, up to the agreed fee; unused prepayments are refunded. Implementation charges cannot be used to charge for mandatory switching, standard export, deletion or included DPA assistance.

5 Customer data and processing locations

5.1 Customer Content includes the Customer's recordings, transcripts, business and CRM records, documents, meeting details, free-text submissions, prompts, outputs, content-derived embeddings and copies. The Customer keeps its rights in that content. Floral may process it only to supply, secure and support the contracted Services and follow documented instructions. The DPA governs all personal data processed on the Customer's behalf, including personal data in operational records.

5.2 Except for the optional invitation-email route in Section 5.4 and the limited Microsoft human abuse review described in DPA Annex C2, Floral's storage, AI inference, transcription, document processing and support access to Customer Content shall take place within the EU, including through its appointed providers. Azure OpenAI inference uses EU Data Zone deployments, with the Azure resource in Sweden Central. Inference may take place elsewhere in the EU; provider content access remains subject to the DPA's EU restriction, with the specifically permitted Microsoft human abuse review within the EEA. Floral personnel access Customer Content from Denmark. Separately sourced public-information research is described in Section 5.7. Provider incorporation, technical processing location and international-transfer safeguards are distinct matters; the DPA records the applicable limits.

5.3 This is not a promise that all personal data stays in the EU. The limited account, authentication, billing, delivery and operational information identified in DPA Annex C may be processed in the US. This can include Floral user names, work email addresses, IP addresses, account and organisation identifiers, subscription information and delivery events. It remains personal data where it relates to an identifiable person. Customer prose, recordings, meeting details, CRM records, prompts and outputs must not be disguised as operational metadata. The additional invitation-email and public-information cases are disclosed separately below.

5.4 Calendar forwarding is disabled by default and requires the organisation's express opt-in by an authorised representative. Accepting these Terms or using the calendar integration does not enable it. Only for an organisation that opts in, calendar invitations sent or forwarded to a Floral invitation email address, including through a mailto link, are received and processed by Resend in the US even though the sending domain uses Ireland. This optional route can expose the complete invitation email and associated personal data, including senders, recipients, participants, titles, dates, descriptions, meeting links, headers and attachments. Ordinary email and associated log copies may remain with Resend for up to 30 calendar days from receipt; restricted backup copies may persist for up to a further seven days after ordinary deletion. After that opt-in, using the route within the Customer's authority instructs this processing under the DPA; it does not constitute consent from meeting participants or replace required transfer safeguards. The Customer can use the supported calendar integration instead to avoid this Resend invitation-email route. Only necessary invitations should be forwarded, without unrelated email threads or attachments. Accepted calendar information stored in Floral then follows the EU service's normal retention. Outbound account and service notifications remain generic and link to Floral; this exception does not authorise emailing transcripts, summaries or CRM content through Resend.

5.5 Floral shall not use Customer Content to train or fine-tune its own or third-party AI models, including through de-identified or aggregated derivatives. Inference, transcription and retrieval for the requested service are permitted under the DPA. Only narrowly defined anonymous operational statistics may be used as permitted there. There is no advertising, sale-of-content or general product-development licence.

5.6 Floral's separate Privacy Policy explains its website, enquiries, business contacts, invoices and other limited independent processing. It does not override the DPA or create additional rights to Customer Content. Acknowledging the policy is not blanket consent to processing, marketing or optional cookies. Where consent is needed, it must be obtained separately.

5.7 Firecrawl and Perplexity support public-web collection and company research and may process that public information in the US. Mintlify receives general questions about Floral's public documentation. These services must not receive private Customer records, meeting content, uploaded private files, customer-specific prompts or credentials. Necessary public company names, websites and publicly available business information can still identify individuals and remain protected by the DPA where processed on the Customer's behalf. Annex C identifies these distinct uses. Combining public research with private workspace context and using that context in Floral AI features takes place through the EU processing route.

5.8 Standard processing retains full text transcripts, summaries, notes and permitted derived indexes and embeddings so authorised users can search, ask questions in AI chat, produce follow-ups and use other subscribed meeting-intelligence features. There is no automatic transcript expiry in standard mode, but retention must remain necessary for the Customer's lawful purpose and is subject to deletion, agreed shorter instructions and end-of-service limits. This is retrieval and inference, not model training. A supported summary-only arrangement can reduce features that need raw transcripts, including interactive AI chat; its availability and effect must be explained before activation.

5.9 Audio is temporary processing material, not a long-term recording archive. Floral requests deletion after obtaining the final transcription and removes remaining temporary R2 audio within seven calendar days after upload, including failed jobs. Provider copies follow the limits in DPA Annex D. The Customer should keep any independently required original recording in its own authorised system. Retaining a text transcript or summary does not require retaining its audio.

6 Confidentiality

6.1 Each party shall protect the other's information that is marked confidential or reasonably understood to be confidential. Customer Content is confidential regardless of a marking. The receiving party may use it only for the agreement and may disclose it only to persons who need access and are bound by confidentiality. It is responsible for those persons' compliance.

6.2 This duty does not cover information the recipient can demonstrate was lawfully public, already known without a duty of confidence, independently developed, or lawfully obtained from another source without such a duty. Disclosure required by law is limited to what the law requires, with prior notice where lawful. For personal data and international government demands, the stricter DPA rules apply.

6.3 These duties continue for five years after termination, and longer for trade secrets while they remain protected and for personal data while retained. Return, restricted retention and deletion follow the DPA for personal data and otherwise the same protective approach. Floral may not name the Customer, display its logo or use its content in publicity without separate permission.

7 Intellectual property

7.1 Floral and its licensors retain the software, reusable implementation tools, service design and documentation. The Customer keeps its content and customer-specific data mappings and configurations. To the extent Floral acquires transferable intellectual-property rights in outputs produced specifically from Customer Content for the Customer, it assigns those rights to the Customer. This does not transfer Floral's underlying software or third-party rights, promise that an output is copyrightable or unique, or permit reuse of Customer confidential information. Any included implementation deliverable is usable by the Customer for its contracted purpose.

7.2 The Customer grants only the rights needed to carry out the authorised processing and provide the Services for the relevant period. No licence survives for general reuse of Customer Content after that purpose ends. Retained copies remain subject to the DPA.

7.3 Floral may use suggestions voluntarily supplied as product feedback without a fee. This permission covers the suggestion itself, not customer records, personal data, confidential attachments or meeting content accompanying it. Feedback cannot authorise training or override confidentiality.

8 Service quality and support

8.1 Floral shall provide the paid Services with reasonable care and skill and substantially in accordance with their published description. It shall maintain the security, resilience and recovery measures in the DPA and use reasonable efforts to restore interrupted service. If a material failure is not remedied under Section 10, the Customer has the termination and refund rights there.

8.2 Routine support is available through [email protected] on Danish business days, normally 09:00 to 17:00 Copenhagen time. Floral aims to acknowledge routine requests within two business days. This is a support target, not a guaranteed resolution time. The DPA's binding incident and assistance deadlines apply independently and are not limited to support opening hours.

8.3 The standard subscription includes no numerical uptime guarantee, service credits or fixed recovery-time or recovery-point guarantee. Maintenance, internet failures, third-party dependencies and AI errors may affect availability. These limitations do not waive express obligations, excuse a failure to take required precautions or reduce statutory rights. A separate service-level commitment applies only if Floral expressly offers and accepts it.

8.4 Floral may improve and change the Services. It shall give at least 30 days' notice of discontinuing a material paid function or materially reducing the contracted service. If the change materially impairs the Customer's agreed use, it may terminate the affected service before the change with a proportionate refund of prepaid unused fees. Necessary security or legal changes may take effect sooner, with notice as soon as reasonably possible. Data-purpose, location and subprocessor changes remain subject to the DPA.

9 Proportionate suspension

9.1 Floral may restrict only the affected accounts or functions where reasonably necessary to address a material security threat, unlawful use or a material breach. It shall give the reason and a reasonable opportunity to remedy the issue where doing so is lawful and does not worsen an urgent risk. It shall restore access promptly when the grounds cease.

9.2 Suspension does not erase Customer data or end the DPA. Floral shall preserve appropriate access for account recovery and provide lawful export and data-protection assistance through a secure alternative if ordinary access is restricted. It may not retain data as security for payment.

10 Duration and ending the service

10.1 The agreement continues while the Customer has an active subscription or trial and afterwards to the extent necessary for outstanding duties. Cancelling one add-on does not terminate unrelated services or automatically delete shared records. Organisation closure and deletion are separate verified instructions.

10.2 Either party may terminate for a material breach that remains unremedied 30 calendar days after written notice. Termination may be immediate where the breach is incapable of remedy or continued performance is unlawful. More urgent rights under the DPA and mandatory law remain available.

10.3 Floral may end a monthly subscription without Customer fault with at least 30 calendar days' notice, allowing the Customer to export or switch. If the Customer terminates for Floral's breach, or Floral ends the service without Customer fault, Floral will refund prepaid fees for the unused terminated period. Fees accrued before termination remain due. There is no acceleration of future renewal charges.

10.4 At termination the Customer may choose return, deletion, or return followed by deletion under the DPA. The default is a standard return followed by deletion. Normal service access ends on the applicable termination date, subject to the switching and retrieval arrangements in Section 11. Confidentiality, accrued payment duties, liability, dispute rules and the DPA survive as needed to give them effect.

11 Export and switching

11.1 The Customer may request transfer to another provider or its own infrastructure, or deletion instead, by contacting [email protected] through its authorised representative. No advance notice period is required to start the switching process. Floral shall verify authority promptly without using verification to obstruct a valid request. These rights also apply to a Customer using a free tier of the production service.

11.2 Floral shall support the exit, provide reasonable assistance to the Customer and its authorised destination provider, and complete the transition without undue delay, normally within 30 calendar days after the verified request. It shall maintain the contracted functions, continuity and security during transition and explain known risks. The Customer and any destination provider must cooperate in good faith and provide the information needed to receive the data.

11.3 If completing that transition within 30 days is technically unfeasible, Floral shall explain and justify this within 14 working days of the switching request and specify an alternative transition no longer than seven months. The Customer may extend the transition once for a period it considers appropriate. A delay must not result merely from a fee dispute or commercial preference. Continued service during an extended transition is charged only at the existing agreed rates for the service actually supplied.

11.4 The affected subscription ends when switching is successfully completed, and Floral shall notify the Customer. If the Customer chooses erasure instead, it may choose immediate termination or the end of its current period, with deletion under the DPA. Prepaid fees for service after successful switching or an earlier agreed termination are refunded proportionately. No early-termination, switching or data-egress fee applies. Reasonable switching assistance and required export and deletion are included. A separately requested custom transformation or destination implementation outside mandatory switching assistance needs a prior scope and price agreement.

11.5 Export covers the Customer's available business and CRM records, relationship links, custom fields, work items, meeting and calendar records, stored files and recordings, transcripts, summaries, prompts and outputs, content-derived indexes and embeddings where available, user and permission mappings, workflow settings, relevant usage and activity metadata, and other customer-specific digital assets needed to interpret or move those records. Structured records are supplied in commonly used machine-readable formats with stable identifiers and a field description; files are supplied in their stored usable formats. Data already lawfully deleted is not recreated.

11.6 Export excludes Floral source code, proprietary general model weights and system algorithms, secrets and reusable service credentials, other customers' information, and confidential internal infrastructure and threat-detection details. These exclusions must not hide the Customer's own exportable data, prevent switching or restrict information that law requires Floral to provide. Credentials are revoked or re-established through a secure connection flow. Floral does not promise that another provider can reproduce every Floral function.

11.7 Floral shall publish and maintain accessible information on export procedures, formats, data structures, relevant interoperability specifications and known limitations, linked with its legal and help information. The Customer may obtain the current information before accepting these Terms. Floral shall provide the export in a structured, commonly used, machine-readable format and meet applicable interoperability duties.

11.8 After the transition ends, the Customer has at least 30 calendar days to retrieve its data. The DPA's deletion clock starts only as specified in Annex D, so an early export does not cut short this retrieval period. The parties agree the bounded residual-backup period in that annex as the later period for those restricted copies; it does not permit continued product use. Full erasure follows the applicable period and successful completion of switching, subject only to legally required retention and the DPA.

12 Responsibility and liability

12.1 Each party is responsible for direct loss caused by its breach under Danish law. Neither is liable for indirect loss, including lost profit or opportunity, except where the loss cannot lawfully be excluded. Reasonable costs of restoring lost Customer data and directly responding to a breach of confidentiality or data protection are treated as direct loss, subject to the applicable cap below.

12.2 Each party's total aggregate liability arising out of or relating to the agreement, including the DPA, AI features, pilots and Order Forms, is limited to the fees actually paid by the Customer for the Services giving rise to the liability in the 12 months before the first incident giving rise to it. Relevant pilot and implementation fees count where they relate to those Services. There is no minimum monetary floor or separate higher cap for confidentiality or data protection. Claims arising under different orders or legal theories do not multiply this aggregate limit, and the same loss cannot be recovered twice. The limit can be zero where no fees have been paid, subject to Section 12.3.

12.3 These limits do not restrict payment of agreed fees, fraud, wilful misconduct, gross negligence, liability that Danish law prohibits limiting, data subjects' GDPR rights, supervisory powers, or rights and liabilities that mandatory law or applicable transfer clauses prohibit restricting. They do not excuse compliance, return or deletion. Each party remains responsible for its own regulatory sanctions to the extent the law requires.

12.4 These Terms create no general duty for the Customer to defend or indemnify Floral for every claim involving Customer data. Each party must mitigate loss and cooperate reasonably over relevant claims. No disclaimer of AI accuracy or third-party operation overrides Floral's own express duties or responsibility for its subprocessors.

12.5 An inaccurate AI output alone does not establish a breach; responsibility is assessed against the agreement and applicable law. Loss caused by unlawful inputs, prohibited use or failure to perform required human review is allocated according to causation and each party's contribution. Recoverable direct loss may include reasonable third-party claim costs caused by the other party's breach, subject to the applicable cap and exceptions. The party facing a claim shall notify the other promptly and permit reasonable participation in the defence; no settlement may impose an admission, non-monetary obligation or payment on the other without its written agreement. This is not an unlimited customer indemnity and does not excuse Floral's security failures or override data-subject rights.

13 Changes and notices

13.1 Floral may propose a new version of these Terms with at least 30 calendar days' email notice. Material contractual changes require renewed acceptance by a representative authorised to bind the Customer; ordinary use by an invited user is insufficient. If a Customer declines, the existing version continues for the current period and Floral may give notice of non-renewal. Changes required immediately by law apply only to the extent the law requires, with prompt notice. Price changes follow Section 4.6. Subprocessor and security changes follow the DPA's specific procedures.

13.2 Notices go to [email protected] and the Customer's designated contractual or incident contact. Both parties must keep those contacts current. A marketing unsubscribe does not stop necessary service or legal notices. Floral shall use an available alternative contact for an urgent incident if delivery or attention is uncertain. The DPA's seven-calendar-day subprocessor notice is separate from the general 30-day terms-change period.

14 General terms

14.1 Danish law governs this agreement. The courts of Copenhagen have jurisdiction, subject to mandatory jurisdiction rules, data-subject rights and applicable transfer clauses. The parties should try to resolve a dispute promptly through their designated contacts; this does not prevent urgent court relief or pause a statutory deadline. There is no mandatory US arbitration, jury waiver or class-action waiver.

14.2 Neither party is responsible for delay caused by an event beyond its reasonable control to the extent it could not reasonably prevent or mitigate it. It must promptly notify the other and take reasonable steps to continue or restore performance. This clause does not suspend required security, breach notification, data protection or feasible export and deletion. If the affected service cannot resume within 30 days, either party may terminate it and prepaid unused service fees are refunded.

14.3 A party may transfer the agreement in connection with a genuine merger or sale of the relevant business only if the successor can and does assume its obligations. Floral shall notify the Customer before a transfer that materially affects its rights, subject to lawful confidentiality constraints, and must follow the DPA for any changed recipient or processing. Other assignments require the other party's consent, not unreasonably withheld. The Customer may terminate with an unused-fee refund if a transfer materially reduces its protection and no reasonable remedy is provided.

14.4 If a provision is unenforceable, the remaining provisions continue to apply to the extent lawful. A delay in exercising a right is not a waiver. These Terms and the documents identified in Section 1.3 form the agreement for the covered service; they do not retroactively replace an existing customer contract without valid acceptance. Electronic acceptance and records may establish the agreement without handwritten signatures.