Terms and conditions

• Customer: the individual or legal entity that creates an account and uses the service. If acting for purposes outside their trade, business, craft or profession, the customer is a consumer.
• Organisation: the portal space in which the customer groups its devices and users, and which is the billing unit.
• Device: each Windows computer on which the agent is installed.
• Agent: the Arkivion software installed on devices that runs the backups.
• Repository: the destination where backups are stored (local disk, NAS or S3-compatible storage), chosen and controlled by the customer.

The agent backs up devices using restic, an open-source program, and stores the backups in the repository configured by the customer. Arkivion does not store or receive the content of the backups.

The portal lets you check the status of backups and devices, receive information about incidents and send certain remote actions to devices. To do so, the agent sends Arkivion technical data about the devices, described in the Privacy policy.

Arkivion may improve or change the features of the service. If a change substantially reduces the features purchased, the customer will be informed reasonably in advance and may terminate the contract.

• You must provide accurate information and keep it up to date.
• You are responsible for keeping your credentials safe and for activity carried out with your account. Let us know at info@arkivion.com if you suspect unauthorised access.
• You must be of legal age and have legal capacity to enter into contracts.

Each new organisation can try the service free of charge for 30 days, without providing payment details. When the trial ends, a paid plan is required to keep using the service; otherwise, Arkivion may limit or suspend the features of the portal and the agent. Backups already made remain in the customer's repository and under the customer's control.

• Monthly plan: €2 per device per month.
• Annual plan: €1 per device per month, billed annually.
• The service is billed per organisation, based on the number of protected devices.
• Published prices exclude VAT and other applicable taxes, which will be added to the invoice in accordance with the law.

The specific payment terms, available payment methods and renewal will be shown before a paid plan is purchased. Arkivion may change prices by giving at least 30 days' notice; the new price will apply from the next billing period and the customer may cancel before it takes effect.

• Use the service lawfully and only with devices and data you own or are authorised to use.
• Where applicable, inform the users of managed devices about the use of the agent and the processing of their data.
• Configure and maintain the backup repository, its capacity and its credentials.
• Keep the repository password or encryption key safe: without it, backups cannot be restored and Arkivion cannot recover it.
• Regularly check that backups complete successfully and perform restore tests.
• Do not reverse engineer the software except where permitted by law, do not circumvent licence controls and do not abuse the API.

Arkivion uses reasonable means to keep the portal and the API available, but does not guarantee uninterrupted operation and does not offer a service level agreement (SLA). There may be interruptions for maintenance, updates or external causes. The agent keeps running scheduled backups even if the portal is temporarily unavailable.

Support is provided by email at info@arkivion.com, on working days and without guaranteed response times, unless otherwise agreed in writing.

While the service is active, Arkivion grants the customer a non-exclusive, non-transferable licence to use the agent and the portal, limited to the devices of its organisation. The software is licensed, not sold, and remains the property of Arkivion or its licensors.

Open-source components included in the agent, such as restic, are governed by their own licences.

Arkivion is a tool that helps perform and monitor backups. The availability, integrity and capacity of the repository depend on the storage chosen by the customer. Arkivion is not liable for data loss caused by failures or lack of space in the repository, incorrect configuration, loss of the repository password, misuse of the service or force majeure.

For customers who are not consumers, Arkivion's total liability arising from the service is limited to the amounts paid by the customer in the 12 months preceding the event giving rise to it, and Arkivion is not liable for loss of profits or indirect damage. These limitations do not apply in cases of wilful misconduct or gross negligence, or where the law does not allow them.

If you are a consumer, nothing in these terms limits the rights granted to you by consumer protection law.

The processing of personal data for which Arkivion is the controller is described in the Privacy policy. The processing that Arkivion carries out on behalf of the customer on the data of its devices is governed by the data processing annex at the end of these terms, which forms part of the contract.

The contract remains in force while the customer keeps the service active. There is no minimum commitment: the customer can cancel at any time by writing to info@arkivion.com or using the portal options when available. Cancellation takes effect at the end of the period already paid and does not entitle the customer to a refund for the current period, unless the law provides otherwise.

Arkivion may suspend or terminate the service if the customer seriously breaches these terms, fails to pay amounts due or uses the service in a way that endangers the security of the service or of third parties, giving prior notice where possible.

When the contract ends, Arkivion will delete or return the device data as set out in the data processing annex. Backups stored in the customer's repository are not affected.

If you are a consumer, you may withdraw from the purchase of a paid plan within 14 calendar days of purchase, without giving any reason, by notifying info@arkivion.com. If you expressly requested that the paid service start during that period, you will have to pay the proportional part of the service provided until you notify us of your withdrawal.

Arkivion may change these terms. Significant changes will be notified by email or through the portal at least 30 days in advance. If you do not agree, you may cancel the service before they take effect; if you keep using it afterwards, you will be deemed to accept them.

These terms are governed by Spanish law. If the customer is a consumer, the courts of the consumer's place of residence shall have jurisdiction. If the customer is not a consumer, the parties submit to the courts of Málaga.

This annex applies when the customer, as controller, uses Arkivion to manage devices whose information contains personal data, and Arkivion processes it on the customer's behalf as processor.

A.1. Subject matter, nature and purpose: receiving, storing and displaying in the portal the information sent by the agents installed on the customer's devices, in order to monitor backups, show the inventory, generate alerts and execute the remote actions requested by the customer.

A.2. Types of data: device name (hostname), technical installation and machine identifiers, agent version, status and result of backup jobs (dates, size, errors) and basic device inventory (operating system and hardware), as well as the email addresses of the organisation's portal users. Arkivion does not process the content of backups.

A.3. Categories of data subjects: users and employees of the customer who use the managed devices and authorised portal users.

A.4. Duration: the term of the service contract.

A.5. Arkivion's obligations as processor:

• process the data only on the customer's documented instructions, set out in these terms and in the configuration the customer makes in the service, unless required by Union or Member State law, in which case it will inform the customer beforehand where the law allows;
• inform the customer if it considers that an instruction infringes data protection law;
• ensure that persons authorised to process the data have committed themselves to confidentiality;
• implement appropriate security measures in accordance with Article 32 GDPR;
• assist the customer, taking into account the nature of the processing, in responding to requests from data subjects exercising their rights and in complying with the obligations of Articles 32 to 36 GDPR;
• notify the customer without undue delay of any personal data breach it becomes aware of, with the information available;
• at the end of the service, delete the data or, if the customer so requests before termination, return it, unless the law requires its retention;
• make available to the customer the information necessary to demonstrate compliance with this annex and allow for and contribute to reasonable audits requested by the customer, with sufficient notice and at the customer's expense.

A.6. Sub-processors: the customer gives general authorisation for Arkivion to engage the sub-processors listed in the Privacy policy (Vercel, Supabase, Resend, Upstash and GitHub). Arkivion will impose on sub-processors data protection obligations equivalent to those of this annex, will inform the customer of any intended change to the list, and the customer may object on reasonable grounds; if no solution is reached, the customer may cancel the service.

A.7. International transfers: some sub-processors are US companies. Transfers are based on the EU-US Data Privacy Framework, where the sub-processor is certified, and/or on the European Commission's standard contractual clauses.

A.8. Customer obligations: ensure it has a legal basis for the processing, inform data subjects, give Arkivion lawful instructions and oversee the processing.