Terms of Service

These Terms of Service ("Terms") govern the use of Collectionframe, the collection management software for museums and other organisations, and of the related websites and services described below (together, the "Service"). They are also the rules for services provided by electronic means (regulamin) within the meaning of the Polish Act of 18 July 2002 on Providing Services by Electronic Means. They are available free of charge at collectionframe.com/legal/terms, in a form that can be saved and printed.

Please read them carefully. Among other things, they make you responsible for the documents you sign in the Service and for any dispute about them, with our role limited to providing the audit trail (section 9), and they limit our liability (section 15).

1. Who we are

1.1. The Service is provided by Grzegorz Piechnik, who runs a business under the name BUGSPACE GRZEGORZ PIECHNIK, entered in the Central Register and Information on Economic Activity (CEIDG) of the Republic of Poland, tax ID (NIP) 5170424581, REGON 521697638, ul. Aleksandra Dworskiego 40/5A, 37-700 Przemyśl, Poland ("we", "us", "our").

1.2. You can reach us at grzegorz@collectionframe.com or by post at the address above. This e-mail address is also our single point of contact for users of the Service and for the authorities of the EU Member States, the European Commission and the European Board for Digital Services under Articles 11 and 12 of Regulation (EU) 2022/2065 (the Digital Services Act). We communicate in English and Polish.

2. Definitions

• Customer: the museum, institution, company or other organisation, or the person running a business, that uses the Service, in particular the one on whose behalf an Organization is created or a Plan is bought. "You" means the Customer and, where the context requires, a User.

• Organization: a workspace in the Service with its own content, members and Plan.

• User: a natural person who signs in to the Service, including the members of an Organization.

• Owner: a User who created an Organization or to whom its ownership was transferred.

• External Signer: a person who is not a member of the Organization and whom a Customer invites to review and sign a document.

• Customer Content: everything entered, uploaded or generated in an Organization by or for the Customer: object records, images, files, documents, templates, signature requests and their Audit Trails, content published on the Public Website, and any personal data contained in them.

• Signature Feature: the functions of the Service for requesting, making and recording electronic signatures of documents.

• Audit Trail: the record of a signature request kept by the Service, described in section 9.6.

• Public Website: the publicly accessible presentation of selected Customer Content at collectionframe.com/m/….

• Museum Directory: the public directory of museums at collectionframe.com/museums.

• Plan: the scope and limits of the Service for an Organization (currently Pro, Scale and Enterprise), as described on the pricing page.

3. The Service

3.1. Collectionframe is software provided as a service (SaaS) for managing collections: cataloguing objects, collections and inventory numbers, inventory cards and labels, documents and templates, the Signature Feature, the Public Website, roles and teams, and related functions. Its current description is on collectionframe.com.

3.2. Under these Terms we provide the following services by electronic means: the account and the application at app.collectionframe.com; the Signature Feature, for Customers and for External Signers; the Public Website; the Museum Directory and the website collectionframe.com; and support by e-mail and through the support form in the application.

3.3. The Service is intended exclusively for professional use by museums, cultural institutions, businesses and other organisations, and by people acting on their behalf. It is not intended for consumers. By using it you confirm that you do so for the purposes of your business, profession or institution.

3.4. Technical requirements: a device with internet access; a current version of Chrome, Firefox, Safari or Edge with JavaScript and cookies enabled; and an e-mail account that only you can access. Some functions are designed for a larger screen.

3.5. Risks. Using services over the internet carries risks such as malware, phishing, interception of data and unauthorised access to e-mail accounts. Signing in and signing documents are confirmed with one-time codes sent by e-mail, so anyone who controls your inbox can act as you. Keep your e-mail account secure and never share a code: we never ask for codes anywhere but on the sign-in and signing screens of the Service.

3.6. We may develop, change or withdraw functions of the Service. If a change materially reduces the core functionality of a paid Plan, we will tell the Owner in advance, and the Customer may terminate the agreement under section 13.2.

4. Your account and how the agreement is concluded

4.1. You create an account by entering your e-mail address and the one-time code we send to it. By continuing on the sign-in screen you accept these Terms and confirm that you have read the Privacy Policy. The agreement for the provision of the Service is concluded at that moment, for an indefinite period.

4.2. When you create an Organization, choose a Plan or otherwise use the Service on behalf of an organisation, you confirm that you are authorised to bind it to these Terms, and that organisation becomes the Customer. If you are not so authorised, you are bound by these Terms yourself.

4.3. You must give accurate information, keep your e-mail account secure, and tell us at once at grzegorz@collectionframe.com if you suspect unauthorised use. The Customer is responsible for everything done in its Organization by its Users and by anyone it gives access to.

4.4. The Customer decides who belongs to its Organization and what they may see and do (roles, teams and permissions), and is responsible for these settings, including removing access that is no longer needed.

5. Trial, plans and payments

5.1. Every new Organization starts with a free 21-day trial of the Scale plan, without a payment card. When the trial ends, a paid Plan must be chosen to continue using the Service; until then, access may be limited, and the Customer's data is kept. We may change or end trial offers for the future at any time.

5.2. Plans, prices and limits (for example, the number of members and objects, and how long deleted items can be restored) are as described on the pricing page and in the Service at the time of purchase. Prices are per Organization. When a limit is reached, some functions may be unavailable until the Plan is upgraded or usage is reduced.

5.3. Paid Plans are sold through our reseller and merchant of record, Polar Software, Inc. ("Polar"). Polar processes the payment, charges the applicable taxes and issues invoices; the purchase is also governed by Polar's terms for buyers. We do not receive or store payment card details.

5.4. Subscriptions renew automatically for the same period (a month or a year) until cancelled. You can cancel at any time in the Service; the cancellation takes effect at the end of the current billing period. Fees are not refundable, except where mandatory law or Polar's terms provide otherwise.

5.5. We may change prices with effect from the next billing period by notifying the Owner at least 30 days in advance. If the Customer does not accept the new prices, it may cancel before they take effect.

5.6. An Enterprise plan or other individually agreed terms are governed by a separate written agreement or order, which prevails over these Terms where they differ.

5.7. If a payment fails or is not made, we may limit or suspend the Organization under section 12.

6. Customer Content

6.1. The Customer keeps all rights in Customer Content. We claim no ownership of it.

6.2. The Customer grants us a non-exclusive, worldwide, royalty-free licence, for the duration of the agreement and the periods in sections 13.4 and 14.4, to host, store, copy, process, transmit, display and publish Customer Content to the extent needed to provide, secure and support the Service, including publishing what the Customer chooses to show on its Public Website and in the Museum Directory.

6.3. The Customer is solely responsible for Customer Content: for its accuracy and lawfulness; for having all the rights, licences and consents needed to upload, process and publish it (including copyright in images and texts, personal rights and the protection of personal data); and for meeting the laws and rules that apply to the Customer, for example on museum records, archives, access to public information and cultural heritage. We do not review Customer Content before it is uploaded or published, and we have no general obligation to monitor it.

6.4. We access Customer Content only to the extent necessary to provide the Service, to give support the Customer asks for, to maintain security, to deal with a notice under section 8, or when required by law, and we keep it confidential.

6.5. The Customer is responsible for keeping its own copies of important Customer Content; the Service lets you export objects, collections and documents. Items in the trash are permanently deleted after the period of the Plan, and a permanent deletion cannot be undone.

7. Acceptable use

7.1. You must not, and must not let anyone:

• provide or publish unlawful content, including content that infringes intellectual property, personal rights or privacy, or that is defamatory, discriminatory or incites violence;

• upload malware or use the Service to send spam or phishing;

• try to gain unauthorised access to the Service, to other Organizations or to accounts, test or circumvent its security without our written consent, or disrupt its operation;

• use the Signature Feature to impersonate anyone, to obtain a signature by deception, or to send requests to people without a legitimate reason;

• copy, decompile or reverse engineer the Service except as mandatory law permits, access it by automated means other than the interfaces we provide, or resell it without our consent;

• use the Service in breach of the law, of sanctions or of these Terms.

7.2. If we have reasonable grounds to believe that content or use of the Service breaches the law or these Terms, we may remove or disable the content and take the other measures described in section 12.

8. Public Websites, the Museum Directory and illegal content

8.1. The Customer decides what is published on its Public Website, whether search engines may index it, and whether it is linked with the Museum Directory. Published content is available to anyone on the internet, and the Customer is responsible for it as its publisher.

8.2. The Museum Directory shows publicly available information about museums, mostly from Wikidata and Wikimedia Commons under their licences, and the Public Websites of Customers who have linked their Organization to it. We do not guarantee that it is complete, current or accurate. A museum may ask us to correct or remove information about it at grzegorz@collectionframe.com.

8.3. Anyone may notify us of content in the Service that they consider illegal, in particular on a Public Website, by writing to grzegorz@collectionframe.com. The notice should contain: an explanation of why the content is considered illegal; its exact address (URL); the name and e-mail address of the person or organisation giving notice (not required for notices concerning offences referred to in Articles 3 to 7 of Directive 2011/93/EU); and a statement that the notifier believes in good faith that the information and allegations in it are accurate and complete.

8.4. We confirm receipt of each notice and decide on it diligently, objectively and without undue delay. Decisions are made by a person; we do not use automated tools to moderate content. We inform the notifier of our decision and, if we remove or restrict content or suspend a service, we give the Customer concerned a statement of reasons, unless the law prevents it. Either of them may contest our decision by replying to our message, and we will review it; this does not affect the right to go to court.

9. Electronic signatures and the Audit Trail

9.1. What the Signature Feature is. The Signature Feature lets a Customer send a fixed version of a document to Users and External Signers, who confirm control of an e-mail address with a one-time code and declare their intention to sign. A signature made in this way is an electronic signature within the meaning of Article 3(10) of Regulation (EU) No 910/2014 (eIDAS). It is neither an advanced nor a qualified electronic signature, and we are not a trust service provider. In particular, it does not meet the requirements of the written form (Article 78 of the Polish Civil Code), of the electronic form (Article 78¹ of the Polish Civil Code), or similar requirements under other laws.

9.2. What we check, and what we do not. The Service checks only that the person who signs controls, at the time of signing, the e-mail address the Customer gave for them. We do not check the identity of signers, their authority to represent anyone or their legal capacity, nor the content of documents or whether they are lawful.

9.3. The Customer's responsibility. The Customer alone decides whether a document is to be signed through the Service, and bears full and exclusive responsibility for:

• whether an electronic signature, and this kind of electronic signature, is permitted and sufficient for the document, the transaction and the parties, including any requirements of form, signature level, registration, filing, notarisation or witnessing, and any rules of public bodies, funders or the parties' own agreements;

• the content of documents and attachments, and the choice, identification, e-mail addresses, authority and capacity of the signers;

• the validity, effectiveness, enforceability and evidential value of documents and signatures;

• obtaining any agreement of signers that is needed, including to signing electronically, and informing External Signers about the processing of their personal data;

• keeping signed documents and records for as long as the law or its contracts require.

9.4. Not legal advice. What our website and the Service say about the legal effect of electronic signatures is general information. It is not legal advice, does not form part of the agreement, and is not a promise that any document or signature will be valid, effective or accepted as evidence. Seek legal advice where it matters.

9.5. We are not a party. We are not a party to any document signed through the Service, and we do not act as a representative, intermediary, depositary, notary or witness of the parties.

9.6. The Audit Trail. For each signature request, the Service records as it happens: a snapshot of the document as presented for signature and its SHA-256 fingerprint; the names and e-mail addresses given for the signers; the events of the request (its creation; invitations sent, re-sent, undelivered and opened; one-time codes sent, verified and entered wrongly; signatures; completion; cancellation; voiding, with its reason); the date and time of each event; where available, the IP address and browser (user agent) from which an action was taken; and, for each signature and each void, an HMAC-SHA-256 value binding it to the signer, the e-mail address, the fingerprint, the version of the signing statement and the times. The Audit Trail is shown with the document in the Service.

9.7. In a dispute, our role is limited to the Audit Trail. If the existence, authenticity, content, validity or effect of a document or of a signature made through the Service is disputed, whether between the Customer and a signer, a counterparty or any third party, and whether in or out of court, before an arbitral tribunal or before an authority, the Customer conducts the matter at its own cost and risk. Our only obligation is to make available, at the Customer's written request to grzegorz@collectionframe.com, the Audit Trail and the evidence data stored in the Service for that request (including the document snapshot and its fingerprint), in electronic form, within 14 days of the request. Any further assistance, such as technical explanations, written statements, expert opinions or testimony, is given only if we agree to it or the law requires it; to the extent the law permits, the Customer will reimburse our reasonable costs and pay for our time at our current rates.

9.8. We do not guarantee the outcome of any dispute or proceedings, or that a court, an authority or a counterparty will accept a document, a signature or the Audit Trail as sufficient evidence. We are not liable for any loss resulting from the content of a document, or from a document or signature being found invalid, ineffective, unenforceable or insufficient.

9.9. Integrity and retention. Once a request has been sent, the document is locked; once anyone has signed, the request and its Audit Trail cannot be deleted by the Customer. A document can then only be voided, with a reason, and the void is recorded as well. The Customer instructs us to keep Audit Trails as set out in section 14.4.

9.10. The Customer will indemnify us and hold us harmless against all claims of signers, counterparties, authorities and other third parties, and against the related damages, fines, costs and reasonable legal fees, arising from documents signed or sent for signature through the Service by the Customer or from the Customer's use of the Signature Feature, except to the extent caused by our wilful misconduct. We will tell the Customer of such a claim without undue delay and, where the law allows, let it conduct the defence.

10. Availability and support

10.1. The Service is provided "as is" and "as available". We take reasonable care to keep it available and secure, but we do not guarantee that it will be uninterrupted, free of errors or available at any particular time, unless a service level is agreed in an individual agreement.

10.2. We may interrupt the Service for maintenance, updates or security reasons, and it may be interrupted by failures of the infrastructure we rely on. We try to carry out planned maintenance when the Service is little used.

10.3. Support is given by e-mail and through the support form in the Service, on business days, without guaranteed response times unless otherwise agreed.

11. Our intellectual property

11.1. The Service, its software, design and documentation, our trademarks and the content of our websites (except Customer Content and third-party content) belong to us or our licensors. For the duration of the agreement we grant the Customer and its Users a non-exclusive, non-transferable right to use the Service within its Plan and these Terms.

11.2. We may use any suggestions or feedback you give us freely and without obligation to you.

12. Suspension

12.1. We may suspend, in whole or in part, access to the Service, to an Organization, to an account or to a Public Website, or remove or disable content, if: fees remain unpaid after a reminder; we have reasonable grounds to believe that the Customer or a User is seriously breaching these Terms or the law; it is needed to avert a threat to the security of the Service, of other customers or of third parties; or a court, an authority or the law requires it.

12.2. Measures will be proportionate. We will inform the Owner of a suspension and its reasons in advance or, where that is not possible, promptly afterwards, and we will restore access when the reason ends.

13. Term and termination

13.1. The agreement is concluded for an indefinite period. A paid Plan runs for the billing period chosen.

13.2. The Customer may terminate the agreement at any time by cancelling its subscription and deleting its Organization in the Service, or by writing to us. A User may leave an Organization at any time and may ask us to delete their account at grzegorz@collectionframe.com. Fees already paid are not refunded for the rest of the billing period, unless mandatory law provides otherwise.

13.3. We may terminate the agreement on 30 days' notice. We may terminate it with immediate effect if the Customer seriously breaches these Terms and does not remedy the breach within 7 days of our request, if the breach cannot be remedied, or if breaches are repeated. If we terminate on notice and not because of a breach by the Customer, we will refund prepaid fees for the unused period.

13.4. After the agreement ends, the Customer may ask us within 30 days for an export of its data. We then delete Customer Content within a further 90 days, except the Audit Trails kept under section 14.4 and data we must keep by law. An Organization with signature history cannot be deleted from within the Service; it is closed at the Customer's request.

14. Personal data and data processing

14.1. How we process personal data as a controller, for example the data of Users for their accounts, billing and correspondence, and the data of visitors to our websites, is described in the Privacy Policy.

14.2. For personal data in Customer Content, including the data of External Signers and of people named in records and documents, the Customer is the controller and we are its processor. This section 14 is the data processing agreement required by Article 28 of Regulation (EU) 2016/679 (GDPR):

• subject matter and duration: the provision of the Service, for the duration of the agreement and the periods in sections 13.4 and 14.4;

• nature and purpose: hosting, storing, organising, displaying, transmitting and, at the Customer's choice, publishing data; the Signature Feature, including sending invitations and codes and keeping the Audit Trail; backups, support and security;

• types of personal data: identification and contact data (such as names, e-mail addresses, telephone numbers and postal addresses), data in object records, documents and files, data of the Audit Trail (including IP addresses, browser information and times), and any other data the Customer chooses to enter. The Customer should not enter special categories of personal data (Article 9 GDPR) or data relating to criminal convictions unless this is necessary and the Customer has made sure it is lawful;

• categories of data subjects: Users, External Signers, and people whose data the Customer enters, such as donors, lenders, artists, staff and contractors.

14.3. As processor, we:

• process the data only on the Customer's documented instructions, which are these Terms and the Customer's use and settings of the Service, unless EU or Member State law requires otherwise, in which case we will tell the Customer before processing unless that law forbids it; and we will tell the Customer if, in our opinion, an instruction infringes data protection law;

• ensure that the people authorised to process the data are bound to confidentiality;

• take the measures required by Article 32 GDPR, including encryption in transit, access control, separation of Organizations' data and backups;

• engage the sub-processors listed in the Privacy Policy, which the Customer hereby generally authorises. We will announce any intended addition or replacement at least 14 days in advance by updating that list and e-mailing the Owners. The Customer may object on reasonable grounds within that time; if we cannot resolve the objection, the Customer may terminate the agreement before the change. We impose on sub-processors the same data protection obligations as in this section;

• taking into account the nature of the processing and the information available to us, help the Customer, as far as possible, to respond to requests from data subjects and to meet its obligations under Articles 32 to 36 GDPR; help that goes beyond the functions of the Service may be charged at our current rates;

• notify the Customer of a personal data breach without undue delay after becoming aware of it;

• at the end of the agreement, delete or return the data as set out in sections 13.4 and 14.4;

• make available the information needed to demonstrate compliance with this section, and allow audits, including inspections, by the Customer or by an auditor it mandates who is bound to confidentiality: on at least 30 days' notice, no more than once a year (unless a supervisory authority requires it or after a personal data breach), during business hours, without disrupting the Service, and at the Customer's cost. We may first answer with written information and with the certifications of our sub-processors.

14.4. Keeping signature evidence. The Customer instructs us to keep each Audit Trail, together with the document snapshot and the signers' data recorded in it, for the duration of the agreement and for 6 years after it ends, solely so that the Customer can obtain it to establish, exercise or defend legal claims, and to delete it after that time. The Customer may give us a different written instruction at any time, bearing in mind its own obligations to signers and counterparties.

14.5. Our sub-processors store and process data also in the United States. The Customer authorises these transfers, which are made under the safeguards described in the Privacy Policy.

15. Liability

15.1. To the fullest extent permitted by law, we give no warranties or guarantees other than those expressly stated in these Terms, and the statutory warranty for defects (rękojmia) under the Polish Civil Code is excluded.

15.2. We are liable only for damage caused by our breach of the agreement through our fault, and only for the actual loss. We are not liable for lost profits, lost revenue, business or goodwill, loss of opportunity, indirect or consequential loss, or the cost of substitute services.

15.3. We are not liable for:

• Customer Content and its publication, or the acts and omissions of Users, External Signers and other third parties;

• the matters described in section 9, including the validity, effect and evidential value of any document or signature and the outcome of any dispute;

• the loss of data that the Customer could have prevented by exporting it, or damage caused by a permanent deletion made by the Customer or under its settings;

• unavailability or errors caused by the internet, by the Customer's equipment or software, by third-party services (for example, e-mail providers that delay or reject messages), or by force majeure;

• damage caused by the unauthorised use of a User's e-mail account or of one-time codes, unless we are at fault.

15.4. Our total liability arising out of or in connection with the agreement, on whatever legal basis, is limited to the fees actually paid for the Service for the Organization concerned in the 12 months before the event giving rise to it, or, if no fees were paid, to PLN 500. This limit applies to all claims of the Customer and its Users together.

15.5. Nothing in these Terms excludes or limits liability for damage caused intentionally, or any other liability that cannot be excluded or limited under mandatory law.

15.6. The Customer will indemnify us and hold us harmless against claims of third parties, including data subjects, rights holders and authorities, arising from Customer Content, from the Customer's breach of these Terms or of the law, or from its use of the Service, together with the related damages, fines and reasonable costs, except to the extent caused by our wilful misconduct.

16. Complaints

16.1. You can make a complaint about the Service by writing to grzegorz@collectionframe.com or to our postal address. Please include the e-mail address of your account, the Organization concerned and a description of the problem.

16.2. We reply by e-mail within 14 days of receiving the complaint.

17. Changes to these Terms

17.1. We may change these Terms for important reasons, such as changes in the law, in the Service, in our sub-processors or in our business, or for security or clarity. We will notify Owners by e-mail or in the Service at least 14 days before a material change takes effect, unless the law or a security reason requires a shorter time. The current version, with its effective date, is always at collectionframe.com/legal/terms.

17.2. If the Customer does not accept a change, it may terminate the agreement before the change takes effect. Using the Service after that date means accepting the change.

18. Final provisions

18.1. These Terms and the agreement are governed by Polish law, without regard to its conflict-of-law rules.

18.2. Disputes will be resolved by the common court having jurisdiction over our business address.

18.3. If you are a natural person who concludes the agreement in direct connection with your business, but the agreement is not of a professional nature for you (Articles 385⁵, 556⁴, 556⁵ and 576⁵ of the Polish Civil Code), these Terms do not limit the rights those provisions give you, including, where applicable, the right of withdrawal under Article 38a of the Polish Consumer Rights Act, and any provision of these Terms inconsistent with them does not apply to you.

18.4. We may transfer the agreement, including the processing of personal data under section 14, to an entity that takes over the Service, for example a company we set up, after informing the Customer at least 14 days in advance; the Customer may terminate the agreement before the transfer. The Customer may transfer the agreement only with our consent.

18.5. If a provision of these Terms is found invalid or unenforceable, the rest remains in force, and the provision is replaced by a valid one that comes closest to its purpose.

18.6. These Terms, together with the Privacy Policy and any order or individual agreement, are the entire agreement on the Service.

18.7. We send notices to the e-mail address of the Owner or of the User concerned; you send notices to grzegorz@collectionframe.com.

18.8. These Terms are available in English and Polish. If the Customer is established in Poland, the Polish version prevails; otherwise, the English version prevails.