Terms of Service

1. Identification and acceptance

These Terms of Service (the "Terms") govern access to and use of the Integrasec platform, owned by Javier de la Mota Parras, trading under the business name "Integrasec", with Spanish tax ID (NIF) 11865511H and registered address at Paseo de Yeserías 15, Portal G, 6B, 28005 Madrid, Spain (hereinafter, "Integrasec").

Accessing or using the Service, as well as installing the add-on for Gmail or for Microsoft Outlook, constitutes full and unreserved acceptance of these Terms. If you do not agree with them, please refrain from using the Service.

If you accept these Terms on behalf of an organisation, you represent and warrant that you have sufficient authority to bind it, and references to the "Customer" shall be understood as referring to that organisation.

Where a framework agreement, purchase order or commercial proposal has been signed between Integrasec and the Customer, that document shall prevail over these Terms to the extent of any conflict.

2. Definitions

3. Subject matter and description of the service

Integrasec is an email security support tool that allows Authorised Users to report suspicious messages and receive an automated analysis assessing the likelihood that the message is phishing, fraud, impersonation, unsolicited mail or another threat.

Depending on the plan contracted, the Service includes:

• Reporting add-ons integrated into Gmail, Google Workspace, Microsoft Outlook and Microsoft 365, which are the only reporting route: the Service does not receive messages forwarded by email.
• Automated message analysis: sender authentication, domain and link reputation (including a verification visit to the links, without filling in any form), attachment inspection and artificial intelligence assessment.
• Delivery to the user of a report containing the verdict and recommended actions.
• A web management dashboard with history, statistics, user management and verdict validation.
• Additional features that may be contracted, such as corporate directory synchronisation.

Integrasec may evolve the Service, add features or modify existing ones, provided this does not substantially degrade the performance contracted during the term in force.

4. Nature of the verdict

The Customer expressly acknowledges and accepts that:

• No threat detection system, including Integrasec, achieves one hundred per cent accuracy. False negatives may occur (a dangerous message classified as safe) and false positives (a legitimate message classified as dangerous).
• The quality of the analysis depends on the information contained in the reported message and on the availability and accuracy of third-party sources that Integrasec does not control.
• Attackers continuously develop new techniques specifically designed to evade detection systems.
• The Verdict does not replace human judgement or the Customer's own security controls, and must not be used as the sole basis for decisions of material impact, such as making payments, transferring funds, handing over credentials or disclosing confidential information.
• The Customer retains at all times ultimate responsibility for its own security, for its decisions and for the security policies it applies within its organisation.
• Integrasec is a complementary layer of defence and does not replace perimeter security measures, antivirus, email filters, backups, staff training or internal verification procedures.

The Customer undertakes to pass this warning on to its Authorised Users.

5. Registration, accounts and licences

5.1. Licence to use

Subject to compliance with these Terms and payment of the price, Integrasec grants the Customer a non-exclusive, non-transferable, non-sublicensable and revocable licence to access and use the Service for the duration of the contract, exclusively for its internal security purposes.

5.2. Scope of licences

Access to the Service is enabled through one of the following arrangements, as agreed:

• By corporate directory: access is granted to users synchronised from the Customer's directory, with an exact licence count.
• By domain: access is granted to accounts belonging to the authorised email domains.
• By individual account: access is granted to the specific addresses registered.

The Customer may not share credentials, allow persons outside its organisation to use the Service, or exceed the number of licences contracted.

5.3. Credentials

The Customer and its Authorised Users are responsible for safeguarding their credentials and for all activity carried out with them. They must notify Integrasec without delay of any unauthorised use or suspected compromise of an account.

6. Customer obligations

The Customer undertakes to:

• Provide truthful, up-to-date information when contracting and configuring the Service.
• Properly inform its Authorised Users that it uses Integrasec, of the data processing this entails and its effects, and to have a valid legal basis for such processing.
• Comply with the employment and data protection legislation applicable to it when deploying the Service, including, where appropriate, consulting or informing employee representatives.
• Enter into the corresponding data processing agreement with Integrasec.
• Keep the list of Authorised Users up to date and report departures.
• Not use the Service for purposes other than email security and, in particular, not to use it as a tool for surveillance, performance monitoring or oversight of the content of its employees' communications.
• Use its own complementary security measures and not rely exclusively on the Service.

7. Acceptable use

The following are expressly prohibited:

• Reporting messages from mailboxes to which the Authorised User does not have legitimate access.
• Using the Service to access third parties' communications without authorisation.
• Reverse engineering, decompiling, disassembling or attempting to obtain the source code of the Service, except to the extent mandatorily permitted by law.
• Circumventing, disabling or interfering with security, authentication, licence control or usage limitation mechanisms.
• Carrying out penetration testing, vulnerability scanning or security audits against Integrasec's infrastructure without prior written authorisation.
• Using the Service to develop a competing product or service, or for benchmarking intended for publication, without prior consent.
• Subjecting the Service to automated, bulk or manifestly disproportionate usage volumes relative to normal use.
• Deliberately introducing malicious code into the Service for any purpose other than the legitimate analysis of a received message.
• Using the Service in a manner contrary to law, public policy or the rights of third parties.

8. Price and billing

The price, licensing model, billing period and payment terms shall be those set out in the commercial proposal, order or contract accepted by the Customer.

• Unless otherwise agreed, prices are expressed in euros and exclude taxes, which will be charged in accordance with applicable legislation.
• Non-payment of sums due entitles Integrasec to suspend the Service in accordance with section 16, having given the Customer at least 10 days' prior notice.
• Amounts paid for periods already begun are non-refundable, save where mandatory legal provisions or express agreement provide otherwise.
• Integrasec may update its rates for renewal periods, giving at least 30 days' notice before the renewal date. The Customer may choose not to renew if it does not accept the new rate.

9. Intellectual and industrial property

9.1. Integrasec's ownership

The Service, including its software, analysis engines, algorithms, interfaces, designs, knowledge bases, documentation, trade marks and distinctive signs, is the exclusive property of Integrasec or its licensors. These Terms transfer no intellectual or industrial property rights to the Customer beyond the licence to use described in section 5.

9.2. Customer's ownership

Customer Content remains the property of the Customer. The Customer grants Integrasec a limited, non-exclusive licence, for a term equivalent to that of the contract, to process such content strictly to the extent necessary to provide the Service.

9.3. Threat indicators

Integrasec may incorporate into its detection systems the technical threat indicators identified during analyses (malicious domains and URLs, file cryptographic hashes, attacking IP addresses and impersonation patterns), provided they are dissociated from any reference to the Customer, its Authorised Users and the content of its communications. These indicators are technical data relating to the attacker.

9.4. Aggregated data

Integrasec may produce aggregated, anonymised statistics on the use and performance of the Service, provided they do not permit identification of the Customer, its Authorised Users or the content of its communications.

10. Confidentiality

Each party undertakes to keep confidential the other party's information to which it gains access by reason of the contractual relationship, not to disclose it to third parties without authorisation and to use it solely for the performance of the contract. This obligation shall survive for 5 years following the end of the relationship and, in respect of trade secrets, for as long as they retain that status.

Information shall not be considered confidential where it is in the public domain without breach, where the receiving party already lawfully knew it, where it was independently developed, or where it must be disclosed by legal requirement or at the request of a competent authority, in which case the other party shall be notified where legally possible.

11. Data protection

The processing of personal data is governed by Integrasec's Privacy Policy, which forms an integral part of these Terms.

Where Integrasec processes personal data on the Customer's behalf, it shall act as a processor pursuant to Article 28 GDPR, on the terms set out in the data processing agreement entered into between the parties, which shall prevail over these Terms in matters of data protection.

The Customer, in its capacity as controller, warrants that it has a sufficient legal basis for the processing of the data it enters into or submits to the Service and that it has complied with its information duties towards data subjects.

Integrasec undertakes towards the Customer, without prejudice to the provisions of the data processing agreement, two commitments set out in detail in the Privacy Policy: to give at least 30 days' notice before engaging or replacing any sub-processor, the Customer being entitled to object on reasonable grounds; and to notify the Customer of any security breach affecting its data without undue delay and in any event within 72 hours of becoming aware of it.

Integrasec's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

12. Availability and support

Integrasec will use commercially reasonable efforts to keep the Service continuously available. Nevertheless, the Customer accepts that the Service may be interrupted by:

• Scheduled maintenance, which will be announced with reasonable notice where possible.
• Urgent maintenance for security reasons.
• Incidents or outages affecting infrastructure, email or artificial intelligence providers, beyond Integrasec's control.
• Force majeure events.

Unless a specific Service Level Agreement has been entered into, Integrasec does not guarantee any particular availability percentage. Support is provided by email, at administracion@integrasec.net, from 9:00 to 20:00 (Spanish peninsular time), Monday to Friday, excluding public holidays.

13. Warranties and disclaimers

Integrasec warrants that it will provide the Service with the professional diligence required and in accordance with the description contained in these Terms.

Nothing in this section excludes warranties that are mandatory under applicable law, nor limits any rights available to consumers where the Customer holds that status.

14. Limitation of liability

To the maximum extent permitted by applicable law:

1. Exclusion of indirect damages. Integrasec shall not be liable for indirect damages, loss of profit, loss of revenue, loss of business opportunity, loss of or corruption of data, business interruption or reputational harm, even if advised of their possibility.
2. Cap on liability. Integrasec's total aggregate liability to the Customer, on any ground and regardless of the basis of the claim, shall not exceed the amount actually paid by the Customer in the 12 months preceding the event giving rise to the claim.
3. Specific exclusion. Integrasec shall not be liable for damages arising from a false negative, a false positive or any other inaccuracy in a Verdict, nor for the decisions the Customer or its Authorised Users take on the basis of it, as warned in section 4.
4. Attacks suffered by the Customer. Integrasec shall not be liable for losses caused by phishing, fraud, impersonation, ransomware or other security incidents affecting the Customer, given that their cause is the action of a third-party attacker and that the Service constitutes a support measure rather than a comprehensive blocking or prevention system.
5. Third parties. Integrasec shall not be liable for the unavailability, failure or modification of third-party services necessary for the operation of the Service, such as email providers, add-on platforms or infrastructure services.

15. Indemnity

The Customer shall indemnify Integrasec against claims, penalties, damages and costs, including reasonable legal defence fees, arising from:

• Use of the Service contrary to these Terms or to applicable law.
• Breach of its information duties or of the requirement to obtain a valid legal basis in respect of its Authorised Users or third parties.
• Use of the Service for impermissible workplace surveillance or monitoring purposes.
• Third-party claims relating to Customer Content.

Reciprocally, Integrasec shall indemnify the Customer against third-party claims alleging that the Service, used in accordance with these Terms, infringes their intellectual or industrial property rights, subject to the limits in section 14.

16. Suspension of the service

Integrasec may suspend the Service in whole or in part, with prior notice where possible, in the following cases:

• Non-payment of sums due, once the notice period provided for in section 8 has elapsed.
• Material breach of section 7 on acceptable use.
• Demonstrated risk to the security, integrity or availability of the platform or of other customers.
• Request from a competent authority.

The suspension shall be lifted once the cause giving rise to it ceases. Suspension for reasons attributable to the Customer does not relieve it of payment of accrued amounts.

17. Term and termination

The contract shall run for the term agreed in the commercial proposal or accepted order and shall renew automatically for equal periods, unless either party gives notice of non-renewal at least 30 days before the expiry date.

Either party may terminate the contract early in the event of material breach by the other that is not remedied within 15 days of formal notice, or if the other party becomes insolvent or enters insolvency proceedings.

17.1. Effects of termination

• Access to the Service and to installed add-ons shall cease.
• The Customer shall have 15 days to request an export of its information. 30 days after termination, its data is deleted automatically in accordance with the Privacy Policy.
• Once that period has elapsed, Integrasec shall delete or return Customer Content in accordance with the data processing agreement, save where retention is legally required.
• Sections 8 (in respect of amounts already accrued), 9, 10, 11, 13, 14, 15, 19 and 20 shall survive termination.

18. Changes to the terms

Integrasec may amend these Terms to reflect changes in the Service, in applicable legislation or in third-party platform policies. Substantial amendments will be communicated at least 30 days in advance by email or through a prominent notice in the dashboard.

If the Customer does not accept the amendments, it may terminate the contract without penalty before they take effect. Continued use of the Service after that date shall constitute acceptance.

19. General provisions

• Assignment. The Customer may not assign its contractual position without Integrasec's prior written consent. Integrasec may assign it, by simple written notice to the Customer 15 calendar days in advance and without need for further consent, to a company incorporated by the owner of the business, or in which the owner holds an interest, that continues to operate the Service, as well as in cases of corporate restructuring, merger or sale of assets. The assignee shall assume in full the obligations under these Terms and under the data processing agreement; should the assignment entail a change in the location of the processing or in the categories of data processed, the prior notice and objection procedure in section 11 shall apply.
• Subcontracting. Integrasec may subcontract services to third parties, remaining liable for their conduct as if it were its own and observing what has been agreed in relation to data protection.
• Partial invalidity. A declaration that any clause is void shall not affect the validity of the remainder, which shall remain fully enforceable.
• No waiver. Tolerance of or delay in exercising a right shall not constitute a waiver of it.
• Entire agreement. These Terms, together with the Privacy Policy, the data processing agreement and the accepted commercial proposal, constitute the entire agreement between the parties and supersede any prior understanding on their subject matter.
• Force majeure. Neither party shall be liable for failure to perform due to causes beyond its reasonable control, including natural disasters, armed conflict, strikes, widespread failures of telecommunications networks or cloud service providers, or acts of authority.
• Commercial references. Integrasec shall not use the Customer's name or distinctive signs for promotional purposes without its prior written authorisation.
• Notices. Notices between the parties shall be sent by email to the addresses designated in the contract, without prejudice to the validity of any other reliable means.

20. Governing law and jurisdiction

These Terms are governed by Spanish law.

For the resolution of any dispute arising from their interpretation or performance, the parties submit, expressly waiving any other jurisdiction to which they might be entitled, to the Courts and Tribunals of Madrid.

The foregoing is without prejudice to the mandatory jurisdiction applicable where the Customer holds the legal status of a consumer, in which case the courts of their domicile shall have jurisdiction and they shall enjoy the rights recognised by consumer protection legislation, including the possibility of using the European online dispute resolution platform.