Terms and Conditions

This is a translation provided for information purposes. The Slovak version is legally binding.

Version 2.4 of 29 October 2026, effective from 29 October 2026. Replaces version 2.3 of 29 October 2026; change: the contract is formed by accepting an individual offer, not by an online order (Art. 3), no guarantee of a refund of a year's subscription (Art. 5). Change in version 2.3 compared with 2.2: the price is set by an individual offer according to the scope (Art. 2). Change in version 2.2 compared with 2.1: fixing of detected gaps as a separate service on order (Art. 9) and a personal data processing agreement under Article 28(3) GDPR for company addresses found in publicly known breaches (Art. 10).

1. Who and for whom

1. The service is provided by |UNl0R & Al s. r. o., Company ID (IČO) 45991961, VAT ID SK2023164891, Námestie Slobody 2357/33A, 083 01 Sabinov, registered in the Commercial Register of the District Court of Prešov, Section Sro, Insert No. 23885/P, under the brand Datahorses (hereinafter "we").
2. Only for entrepreneurs and legal entities (hereinafter "the company"), not for consumers.

2. Service and price

The price is set by an individual offer according to the scope and is stated in the offer. VAT of 23 % is added to the prices. A service means 1 domain, subdomain, URL or IP address that is listed in the offer.

3. How the contract is formed

1. We send the company an individual offer by email: the list of guarded services, the price excluding and including VAT, the billing period and a link to the current version of these terms. The offer is valid for 30 days unless it states otherwise.
2. The contract is formed when the company accepts the offer in writing (an email from its address is sufficient) or pays via the payment link in the offer. By accepting the offer the company also accepts these terms.
3. Before accepting the offer the company gives us its business name, Company ID and contact email.
4. We start the guarding and prepare the dashboard within 72 hours of acceptance of the offer; we send a confirmation with the list of services by email. If the offer requires payment in advance, the period runs from receipt of the payment.
5. A change of scope (adding or removing a service) is agreed in the same way, by a new offer and its acceptance.
6. We may refuse to start (not an entrepreneur, an obviously third-party or unclear service); anything the company has paid will be refunded in full.

4. What we do and what we do not

1. We guard only from the outside and passively, from public sources: public DNS, certificates, email headers (SPF, DKIM, DMARC), publicly visible parts of the website and published indexes. We do not enter the company's systems and we do not probe their specific addresses.
2. During guarding we never perform: active testing, intrusion, password guessing, phishing, phone calls, DoS and load testing, malicious code or changes to data. Everything stays within the limits of ordinary publicly available monitoring. We make changes only when fixing on order under Art. 9.
3. We guard the company as a whole and do not monitor individuals. The only personal data we process during guarding are company email addresses on the company's domain that appear in publicly known breaches: the address, the name of the breach, the date of the breach and the source. We never store or display passwords or their hashes. The terms of this processing are set out in Art. 10.
4. The company declares that it owns or controls the listed services (domains, URLs, IP addresses).

5. Start and alerts

1. Guarding runs continuously for the duration of the subscription.
2. We send an alert about a finding immediately by email and SMS, together with advice on what to do.
3. We warn you of an approaching expiry of a domain and certificate in advance, at the latest 30, 14 and 3 days before the end of its validity.

6. Confidentiality and data

1. We keep the findings confidential and do not name the company as a reference.
2. We process the basic data of the customer (business name, Company ID, contact email, billing details), the list of guarded services and, as a processor, company addresses from breaches under Art. 10. Details are at datahorses.com/en/ochrana-osobnych-udajov.html.
3. We do not send passwords or documents to third-party artificial intelligence models.

7. Payment, termination and withdrawal

1. Guarding is a subscription for the period stated in the offer (monthly unless the offer states otherwise) that renews automatically and is paid via Stripe or by invoice.
2. The company may cancel the subscription at any time by email with effect from the end of the paid period; amounts already paid are not refunded. We may terminate with 1 month notice, immediately in case of misuse.
3. The 14-day right of withdrawal for consumers does not apply.

8. Liability

1. We do not guarantee that we will find all risks. The service is outside guarding, it is not an audit, and by itself it does not fix the gaps found; the fixing procedure is included in the alert. We carry out fixes only as a separate service under Art. 9.
2. Compensation for damage and non-pecuniary harm is limited to the price for the last 12 months and never more than 5 000 € in total, including for a breach of confidentiality. This does not apply only in case of intent, where the law does not allow such a limitation.
3. Send objections within 30 days of discovering the error; we respond within 15 days and supplement a justified objection free of charge or refund part of the price.

9. Fixing on order

1. Guarding by itself does not fix gaps; for every finding it provides a fixing procedure.
2. We fix a detected gap as a separate optional service, only on a separate written order from the company (an email is enough) stating the scope of the fix. The price is set according to the scope; we announce it in advance and the company confirms it in writing before we start. We invoice after the fix.
3. Access to the domain and DNS is given to us by the company itself and only for the duration of the fix. After the fix the company revokes the access or changes the passwords. We change nothing outside the confirmed scope.
4. We confirm the scope and the result of the fix in writing (by email), including a list of the changes made.
5. Arts. 6 and 8 apply to the fix accordingly; compensation for damage in connection with it is limited to the price of the fix.

10. Processing of personal data (Article 28(3) GDPR)

1. In guarding, the company is the controller and we are the processor. By accepting the offer, the company also enters into this personal data processing agreement under Article 28(3) GDPR.
2. Subject matter and nature: searching for company email addresses on the company's domain in publicly known breaches, storing them and displaying them to the company in the dashboard and in alerts. Purpose: protecting the company's accounts so that it can change passwords and secure the affected accounts in time.
3. Duration: for the duration of the service; we erase the data within 30 days after it ends.
4. Type of data: email address, name of the breach, date of the breach and the source of the breach information. We never store or display passwords or their hashes. We do not process special categories of data.
5. Data subjects: employees and other persons who use or used an address on the company's domain.
6. We process data only on the company's documented instructions, which are these terms and the accepted offer; if in our view an instruction infringes the law, we inform the company.
7. Only persons bound by confidentiality have access to the data.
8. We take security measures under Article 32 GDPR: encrypted connections, access only for authorised persons, the company's dashboard available only via its own private link.
9. Sub-processors: Railway Corporation, USA (hosting and database, standard contractual clauses) and WebSupport s. r. o., Slovakia (alert emails). The company agrees to their use; we notify it of any change in advance by email and the company may object or cancel the subscription.
10. We assist the company in handling data subject rights and with its obligations under Articles 32 to 36 GDPR; we notify it of a personal data breach without undue delay.
11. After the service ends we erase the data and confirm this on request.
12. We provide the company with the information necessary to demonstrate compliance with these obligations and allow an audit or inspection on an agreed date.
13. The company fulfils the duty to inform data subjects under Articles 13 and 14 GDPR; we provide it with the supporting information (what data, from which source, for what purpose and for how long) on request.

11. Final provisions

Every commercial email contains an unsubscribe link. We announce changes to the terms 30 days in advance and anyone who disagrees may cancel the subscription. The laws of the Slovak Republic apply.

Contact: juraj@datahorses.com, datahorses.com.

You can request a proposal for cooperation at datahorses.com. The provider's contact details are on the contact page.