[ TERMS OF SERVICE ]

§1. Definitions

The terms used in these Terms of Service shall have the following meanings:

1. Service Provider — KS-CYBER Sp. z o.o. with its registered office in Warsaw, ul. Marcina Kasprzaka 31/119, 01-234 Warszawa, Poland, entered into the Register of Entrepreneurs of the National Court Register (KRS) under number KRS 0001188597, NIP (Tax ID) 5273177065, REGON 542451510.
2. Platform (or KS-CYBER OPS) — the online service available at ops.ks-cyber.pl, through which the Service Provider delivers Services electronically.
3. Terms of Service — this document setting out the rules for the provision of electronic services by the Service Provider, constituting terms of service within the meaning of Article 8 of the Polish Act of 18 July 2002 on the Provision of Electronic Services (Dz.U. 2002 No. 144 item 1204, as amended).
4. Service — a service provided electronically by the Service Provider to the Client through the Platform, including in particular the provision of cybersecurity training modules, examinations, certificates, phishing simulations, and other functionalities described in §3.
5. Client — a natural person, legal entity, or organisational unit without legal personality that uses the Services provided by the Service Provider.
6. Organisation — an entity (company, institution) that has entered into an Agreement with the Service Provider and manages User accounts within the scope of its Subscription Plan.
7. User — a natural person holding an account within an Organisation, using the Platform on the basis of authorisation granted by the Organisation.
8. Organisation Administrator — a User designated by the Organisation to manage the Organisation's account, including adding and removing Users, assigning learning paths, and managing settings.
9. Agreement — an agreement for the provision of electronic services concluded between the Service Provider and the Client on the terms set out in these Terms of Service.
10. Subscription Plan (or Plan) — the variant of the Service selected by the Organisation, defining the scope of Platform functionalities and the rate per Licence, in accordance with §7. The Plan does not define the number of Users — the Organisation selects that independently, as the number of Licences.
11. Licence — the right of one User to use the Platform within the Organisation. The number of Licences is selected by the Organisation independently of the Plan and forms the basis for calculating the fee, in accordance with §7.
12. Trial Period (or Trial) — a free, 14-day period of access to the Platform, enabling the Client to test the Service before purchasing a paid Plan.
13. Account — an individual User account on the Platform, secured with a login and password.
14. Certificate — an electronic document confirming the completion of a training course or passing an examination on the Platform. The Certificate does not constitute a professional qualification within the meaning of applicable law.
15. Phishing Simulation — a controlled security test consisting of sending simulated phishing messages to Users of an Organisation in order to assess their resilience to social engineering attacks.
16. USB Drop Simulation — a controlled security test simulating scenarios of planted USB devices in order to assess User responses.
17. DPA (Data Processing Agreement) — a data processing agreement concluded between the Organisation and the Service Provider, constituting a separate document available at /dpa/.
18. Privacy Policy — a document describing the rules for the processing of personal data by the Service Provider, available at /privacy-policy/.
19. Stripe — the payment services provider (Stripe, Inc.), through which the Service Provider processes electronic payments.

§2. General Provisions

1. These Terms of Service define the types and scope of services provided electronically, the conditions for the provision of such services, the conditions for concluding and terminating agreements for the provision of electronic services, and the complaint procedure — in accordance with Article 8(1) of the Polish Act of 18 July 2002 on the Provision of Electronic Services.

2. The Service Provider is:

3. These Terms of Service are made available free of charge before the conclusion of the Agreement on the Platform's website in a manner that enables their acquisition, reproduction, and storage by means of an ICT system, in accordance with Article 8(1)(2) of the Polish Act on the Provision of Electronic Services.

4. The Client is required to familiarise themselves with these Terms of Service before commencing use of the Platform. Commencing use of the Services constitutes acceptance of these Terms of Service.

5. The Platform is primarily intended for business clients (B2B) — Organisations ordering cybersecurity training for their employees. To the extent that the Services are used by consumers within the meaning of Article 22¹ of the Polish Civil Code, the relevant consumer protection provisions shall apply.

§3. Type and Scope of Services

1. The Service Provider provides the following services electronically:

1. Training Modules — interactive e-learning courses in cybersecurity, comprising text, graphic, and multimedia materials.
2. Examinations and Certificates — knowledge verification tests for Users, concluded with the issuance of an electronic Certificate confirming the completion of training. Certificates issued by the Platform constitute solely a confirmation of training completion within KS-CYBER OPS and are not recognised professional qualifications within the meaning of separate legal provisions.
3. Phishing Simulations — controlled test campaigns consisting of sending simulated phishing messages to Users of an Organisation in order to build threat awareness.
4. USB Drop Simulations — controlled test scenarios simulating planted USB devices in order to assess User responses.
5. Team Management — administrative functions enabling the addition/removal of Users, creation of departments, and assignment of learning paths.
6. Learning Paths — structured sequences of training modules tailored to the needs of the Organisation or its departments.
7. Gamification — a system of experience points (XP), badges, rankings, and leaderboards motivating Users to learn.
8. Reports and Analytics — training progress statistics for Users and Organisations.
9. Microtraining — short, daily cybersecurity knowledge modules.

2. The detailed scope of functionalities available under individual Subscription Plans is described in §7.

3. The Service Provider reserves the right to develop and modify the scope of Services, including adding new functionalities, without prejudice to Services already paid for by the Client.

§4. Technical Requirements

1. In order to properly use the Platform, the following technical requirements must be met:

1. A device with Internet access (computer, tablet, smartphone).
2. A current version of a web browser: Google Chrome (version 90+), Mozilla Firefox (version 90+), Microsoft Edge (version 90+), Safari (version 14+), or another Chromium-based browser.
3. JavaScript and cookies enabled.
4. An active e-mail account — required for registration, login, and receiving notifications.
5. Minimum screen resolution: 320px width (the Platform is responsive).
6. Internet connection with a bandwidth of at least 1 Mb/s.

2. The Service Provider shall not be liable for technical issues resulting from the Client's failure to meet the above requirements.

3. The Platform may be installed as a Progressive Web App (PWA) on mobile devices; however, this is not required to use the Services.

§5. Rules for Using the Platform

1. The Client undertakes to use the Platform in accordance with applicable law, the provisions of these Terms of Service, and good practice.

2. It is prohibited for the Client to provide unlawful content within the meaning of Article 8(3)(2)(b) of the Polish Act on the Provision of Electronic Services, and in particular:

1. content infringing the rights of third parties, including intellectual property rights, personal rights, or trade secrets;
2. content inciting hatred, violence, or discrimination;
3. pornographic or obscene content;
4. content containing malicious software (malware, viruses, trojans, etc.);
5. content violating the privacy of other Users;
6. spam, unsolicited advertising messages, or chain messages.

3. The Client undertakes in particular to:

1. refrain from attempting unauthorised access to the Platform, other Users' accounts, or the Service Provider's systems;
2. refrain from reproducing, decompiling, or disassembling the Platform's source code;
3. refrain from sharing their Account with third parties;
4. maintain the confidentiality of login credentials (username and password);
5. promptly notify the Service Provider of any breach of Account security.

4. In the event of a violation of the above rules, the Service Provider shall have the right to immediately block or delete the Client's Account, without the right to a refund of fees paid.

Examination Integrity Monitoring

5. In order to ensure the fairness of the examination process, the Platform may monitor User activity during examinations, including:

1. detection of browser tab switching (tab switches);
2. detection of clipboard pasting (paste events);
3. recording of time spent on individual questions.

6. The above mechanisms are used solely to verify the independence of the User's work and do not include screen recording, camera, or microphone capture. Monitoring results are available to the Organisation Administrator within reports.

Phishing and USB Drop Simulations

7. Phishing simulations and USB Drop simulations are initiated solely by the Organisation Administrator or at their request. The Organisation bears sole responsibility for:

1. informing its employees (Users) of the possibility of conducting phishing and USB Drop simulations as part of the training programme, in accordance with applicable labour law and data protection regulations;
2. obtaining all required consents or fulfilling information obligations towards its employees;
3. ensuring that simulations are conducted in accordance with the Organisation's internal policies.

8. The Service Provider provides only the technical tools for conducting simulations and shall not be liable for the manner in which they are used by the Organisation.

§6. Conclusion of the Agreement

Registration and Trial Period

1. The agreement for the provision of electronic services is concluded upon registration on the Platform, i.e., completion of the registration form and activation of the account.

2. Registration for the Trial Period is free of charge and does not require payment card details.

3. The Trial Period lasts 14 calendar days from the date of registration and provides access to the Platform with limited scope (up to 10 Users).

4. Upon expiry of the Trial Period, access to the Platform is suspended until a paid Subscription Plan is purchased. Organisation and User data is retained for 90 days following the end of the Trial Period, after which it may be deleted.

Paid Subscription

5. The Agreement for a paid Subscription Plan is concluded upon the Client's placing an order through the Platform and making payment.

6. The Client places an order by:

1. selecting a Subscription Plan and the number of Licences;
2. providing the Organisation's billing details (including NIP/Tax ID for VAT invoices);
3. accepting these Terms of Service;
4. making payment through the Stripe payment operator.

7. Confirmation of the conclusion of the Agreement is sent to the e-mail address provided during registration.

§7. Subscription Plans, Licences and Payments

Available Plans

1. The Subscription Plan defines the scope of Platform functionalities. The Organisation selects the number of Licences independently of the Plan — every Plan is available for any number of Licences, subject to section 4.

2. The Service Provider offers the following Plans:

Pricing

3. The net monthly rate per Licence depends on the Plan and on the total number of the Organisation's Licences:

4. The rate of a given tier applies to all of the Organisation's Licences, not only to Licences above the lower bound of the tier. The monthly fee is the product of the number of Licences and the rate applicable to the Plan and tier. Above 500 Licences the order is not available in the Platform on a self-service basis — the Service Provider presents a custom quotation. The ENTERPRISE Plan is available for any number of Licences.

5. The prices listed in the table are net prices (excluding VAT). VAT is added in accordance with applicable regulations:

1. Polish VAT taxpayers — VAT rate of 23%;
2. VAT taxpayers from EU countries (other than Poland) with a valid EU VAT number — reverse charge, 0% rate;
3. entities outside the EU — 0% VAT rate.

6. The Service Provider may offer billing in EUR, USD or GBP. The amount in a foreign currency shown in the Platform at the time of placing the order is binding for that order.

Licences

7. A Licence is occupied by every User assigned to the Organisation. An Organisation Administrator account used solely to manage the Organisation does not occupy a Licence. The number of occupied and free Licences is visible in the team panel.

8. Removing a User from the Organisation releases the Licence, which the Organisation may assign to another User within the same billing period. The Platform does not allow inviting or adding a User beyond the number of Licences held.

9. The Organisation may increase the number of Licences in the Platform at any time. A proportional (pro rata) surcharge is charged for the remaining part of the current billing period, calculated at the rate applicable to the Organisation's Plan and the new total number of Licences; from the next renewal the fee is charged for the new number of Licences. If the pro rata surcharge is lower than the minimum payment amount (PLN 5, EUR 2, USD 2 or GBP 2), the change is made without a surcharge and the new number of Licences is charged from the next renewal.

10. A reduction in the number of Licences takes effect upon renewal of the subscription for the next billing period; no refund is due for unused Licences in the current period. Upon renewal, the number of Licences may not be lower than the number of Users occupying Licences on the renewal date.

Billing Period

11. The subscription is billed in monthly or annual cycles, depending on the Client's selection.

12. For annual billing, the Client receives a 15% discount — the annual fee equals 85% of the equivalent of 12 months of subscription.

13. The subscription renews automatically for the subsequent billing period unless the Client cancels the subscription before the end of the current period.

Payments

14. Payments are processed through the payment operator Stripe, Inc. The Service Provider does not store the Client's payment card data — such data is processed and stored exclusively by Stripe in accordance with the PCI DSS standard.

15. The Service Provider issues an electronic VAT invoice for each billing period and for each surcharge referred to in sections 9 and 17. The invoice is sent exclusively to the Organisation Administrator's e-mail address.

16. In the event of an unsuccessful card charge, the Service Provider will make up to 3 retry attempts within 14 days. After all attempts are exhausted, access to the Platform may be suspended until payment is settled.

Plan Changes

17. The Client may upgrade the Plan at any time. A proportional (pro rata) surcharge equal to the difference between the rates of the two Plans for the number of Licences held is charged for the remaining part of the current billing period; the scope of the higher Plan becomes available immediately after the surcharge is received. If the surcharge is lower than the minimum payment amount specified in section 9, the change is made without a surcharge and the rate of the higher Plan is charged from the next renewal.

18. A downgrade to a lower Plan takes effect immediately and without a refund of the fee for the current billing period. The limits of the lower Plan apply from the moment of the change: previously created Simulations, custom modules and questions remain available, while the creation of new ones is subject to the limits of the lower Plan, and features not available in the lower Plan (in particular the monthly security report) cease to be provided. The lower rate is charged from the next renewal.

19. A change of Plan does not change the number of Licences, and a change in the number of Licences does not change the Plan. A change to or from the ENTERPRISE Plan, and a change in the number of Licences in the ENTERPRISE Plan, are made on individually agreed terms.

§8. Right of Withdrawal

Business Clients (B2B)

1. A Client that is an entrepreneur within the meaning of Article 43¹ of the Polish Civil Code does not have a statutory right of withdrawal from the Agreement. The Client may terminate the Agreement on the terms set out in §13.

Consumers

2. A Client that is a consumer within the meaning of Article 22¹ of the Polish Civil Code has the right to withdraw from the Agreement concluded at a distance without stating a reason within 14 days from the date of conclusion of the Agreement, in accordance with Article 27 of the Polish Act of 30 May 2014 on Consumer Rights.

3. A withdrawal statement shall be submitted electronically to: kontakt@ks-cyber.pl or in writing to the Service Provider's registered office address.

4. A model withdrawal form is available upon request at kontakt@ks-cyber.pl.

5. The right of withdrawal shall not apply to a consumer if the Service Provider has fully performed the service with the express and prior consent of the consumer, who was informed before the commencement of performance that they will lose the right of withdrawal upon full performance by the Service Provider (Article 38(1) of the Polish Act on Consumer Rights).

6. In the event of an effective withdrawal from the Agreement, the Service Provider shall refund to the consumer all payments received without undue delay, and no later than 14 days from the date of receipt of the withdrawal statement, using the same means of payment as used by the consumer.

Sole Traders with Consumer Rights

7. The provisions of paragraphs 2–6 shall apply accordingly to a natural person concluding an agreement directly related to their business activity, where the content of such agreement indicates that it does not have a professional character for that person (Article 38a of the Polish Act on Consumer Rights).

§9. Liability and SLA

Platform Availability

1. The Service Provider shall make every effort to ensure the continuity and reliability of the Platform's operation. The Service Provider aims to maintain Platform availability at a level of 99.5% per month (SLA), excluding scheduled maintenance windows.

2. Scheduled maintenance windows are, where possible, carried out during night hours (22:00–06:00 CET) and communicated to Clients at least 24 hours in advance by electronic means.

Limitation of Liability

3. The Service Provider shall not be liable for:

1. interruptions in the provision of Services resulting from failures or disruptions in the functioning of the Internet for which the Service Provider is not at fault;
2. damages resulting from the use or inability to use the Platform, unless they result from intentional misconduct or gross negligence on the part of the Service Provider;
3. consequences of the Client's violation of the rules for using the Platform set out in §5;
4. content and materials submitted by the Client or Users;
5. the manner in which phishing and USB Drop simulations are used by the Organisation;
6. personnel, disciplinary, or other decisions made by the Organisation on the basis of training, examination, or simulation results;
7. consequences resulting from the Client's disclosure of login credentials to third parties.

4. For Clients that are entrepreneurs, the Service Provider's aggregate liability under the Agreement shall be limited to the amount of fees paid by the Client in the 12 months preceding the event giving rise to the damage. This limitation shall not apply to damages caused intentionally.

5. The Service Provider shall not be liable for loss of profits, revenue, data (except for obligations arising under GDPR), or for indirect, consequential, or incidental damages, to the extent permitted by law.

§10. Intellectual Property

1. The KS-CYBER OPS Platform, including its graphical interface, source code, database, training materials, examination content, graphics, logos, and other elements constitute the intellectual property of the Service Provider or entities from which the Service Provider has obtained appropriate licences, and are protected under the Polish Act of 4 February 1994 on Copyright and Related Rights and other intellectual property legislation.

2. Upon conclusion of the Agreement, the Service Provider grants the Client a non-exclusive, non-transferable, time-limited (for the duration of the Agreement) licence to use the Platform to the extent necessary for the use of the Services, solely for the Organisation's internal purposes.

3. The licence referred to in paragraph 2 does not include the right to:

1. copy, distribute, or publicly share training materials outside the Organisation;
2. modify, translate, decompile, or disassemble any elements of the Platform;
3. grant sublicences to third parties;
4. use training materials for commercial purposes unrelated to the internal training of the Organisation's employees.

4. Certificates generated by the Platform may be shared by Users and the Organisation for documentation purposes (e.g., in portfolios, CVs, compliance audits). This does not authorise the reproduction of training materials.

§11. Personal Data Protection

1. The data controller for the personal data of Clients (Organisation Administrators) is the Service Provider. Detailed information regarding the processing of personal data, including purposes, legal bases, retention periods, and the rights of data subjects, is contained in the Privacy Policy.

2. With respect to the personal data of Users (employees of the Organisation), the Service Provider acts as a data processor within the meaning of Article 28 of Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR). The terms of data processing are set out in the Data Processing Agreement (DPA), which constitutes an integral part of these Terms of Service.

3. The Organisation, as the data controller of its employees' personal data, is obligated to:

1. have a valid legal basis for the processing of its Users' personal data within the Platform;
2. fulfil the information obligation towards its Users (Article 13 or 14 of the GDPR);
3. inform Users about the examination integrity monitoring mechanisms (§5 paragraphs 5–6) and the possibility of conducting phishing simulations (§5 paragraph 7).

4. The Service Provider applies appropriate technical and organisational measures to ensure the security of personal data processed, in accordance with Article 32 of the GDPR.

§12. Complaint Procedure

1. The Client has the right to file complaints regarding the Services provided, in accordance with Article 8(3)(4) of the Polish Act on the Provision of Electronic Services.

2. Complaints should be submitted electronically to: kontakt@ks-cyber.pl or in writing to the Service Provider's registered office address.

3. A complaint should contain:

1. data identifying the Client (first and last name or company name, e-mail address associated with the Account);
2. a description of the problem that is the subject of the complaint;
3. circumstances justifying the complaint (date, description of the event);
4. the expected manner of resolving the complaint.

4. The Service Provider shall process the complaint within 14 calendar days from the date of its receipt. If the complaint requires supplementation, the period shall run from the date of delivery of the supplementary information.

5. The response to the complaint shall be sent to the e-mail address from which the complaint was submitted, unless the Client indicates another preferred method of contact.

6. In the event that the complaint is not upheld, the Service Provider shall provide reasons for its decision.

7. A Client that is a consumer has the right to use out-of-court complaint and redress mechanisms, including:

1. filing a request to initiate mediation proceedings with the Provincial Inspector of the Trade Inspection (Wojewódzki Inspektor Inspekcji Handlowej);
2. applying to the permanent consumer arbitration court at the Provincial Inspector of the Trade Inspection;
3. using the ODR (Online Dispute Resolution) platform available at: https://consumer-redress.ec.europa.eu/index_en.

§13. Termination of the Agreement

Termination by the Client

1. A Client using the Trial Period may terminate the Agreement at any time, without stating a reason, by ceasing to use the Platform or contacting the Service Provider.

2. A Client with a paid Subscription Plan may cancel the subscription at any time. Cancellation of the subscription results in non-renewal for the next billing period — access to the Platform is maintained until the end of the paid period.

3. The Client may request the immediate deletion of their Account and Organisation data. In such a case, no refund for the unused period shall be due, unless mandatory legal provisions provide otherwise.

Termination by the Service Provider

4. The Service Provider may terminate the Agreement with immediate effect in the event of:

1. a material breach of these Terms of Service by the Client, in particular a violation of the rules described in §5;
2. use of the Platform in a manner that threatens the security of the Platform or other Clients;
3. provision of false information during registration;
4. failure to settle payment despite a notice and the granting of an additional 14-day deadline.

5. In the event of termination of the Agreement due to the Client's fault, no refund of fees paid shall be due.

Effects of Termination

6. Upon termination of the Agreement:

1. the Client's and Users' access to the Platform shall be blocked;
2. Organisation and User data shall be retained for 90 days, enabling possible resumption of cooperation or data export;
3. after the expiry of 90 days, data may be permanently deleted, subject to obligations arising from legal provisions (e.g., retention of invoices for 5 years);
4. the Client may request the export of their data before its deletion by contacting the Service Provider.

§14. Amendments to the Terms of Service

1. The Service Provider reserves the right to amend these Terms of Service for important reasons, such as:

1. changes in legislation affecting the provision of Services;
2. changes in the scope or manner of provision of Services;
3. the need to adapt the Terms of Service to court rulings, administrative decisions, or recommendations of supervisory authorities;
4. technological or organisational changes on the part of the Service Provider.

2. The Service Provider shall notify Clients of a planned amendment to the Terms of Service by electronic means (e-mail to the Organisation Administrator's address) at least 14 days before the amendments take effect.

3. The amended Terms of Service shall be made available on the Platform's website. A Client who does not accept the amendments has the right to terminate the Agreement by the date the amendments take effect. Failure to terminate the Agreement within this period shall constitute acceptance of the amended Terms of Service.

4. Amendments to the Terms of Service shall not affect Agreements concluded and paid for prior to the date the amendments take effect — with respect to the current, paid billing period, the provisions of the Terms of Service in force on the date of the conclusion of the Agreement or the last subscription renewal shall apply.

§15. Final Provisions

1. In matters not regulated by these Terms of Service, the provisions of Polish law shall apply, in particular:

1. the Act of 18 July 2002 on the Provision of Electronic Services (ustawa o świadczeniu usług drogą elektroniczną);
2. the Act of 23 April 1964 — the Polish Civil Code (Kodeks cywilny);
3. the Act of 30 May 2014 on Consumer Rights (ustawa o prawach konsumenta);
4. Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR);
5. the Act of 10 May 2018 on the Protection of Personal Data (ustawa o ochronie danych osobowych).

2. Any disputes arising from the Agreement shall be resolved by the court having jurisdiction over the Service Provider's registered office (Warsaw), subject to mandatory provisions on jurisdiction for consumers.

3. Should any provision of these Terms of Service be found invalid or ineffective in whole or in part, this shall not affect the validity and effectiveness of the remaining provisions (severability clause). In place of the invalid or ineffective provision, the provision closest to the objectives of the provision found invalid shall apply.

4. These Terms of Service shall enter into force on 10 April 2026.

5. These Terms of Service are available in Polish and English. In the event of any discrepancy between the language versions, the Polish version shall prevail.

6. Section headings are for informational purposes only and shall not affect the interpretation of the provisions of these Terms of Service.

§16. Contact

For matters related to these Terms of Service, the Services, or the operation of the Platform, please contact: