inmake Terms of Use

1. Introductory provisions

1. These Terms of Use (the “Terms”) govern the mutual rights and obligations between inbs s.r.o., with its registered office at třída Tomáše Bati 299, Louky, 763 02 Zlín, Czech Republic, company ID 23447923, registered in the Commercial Register kept by the Regional Court in Brno, file C 145989 (the “Provider”), and the customer (the “Customer”) in the use of the multi-tenant SaaS/PaaS platform inmake.
2. The inmake service is intended for natural and legal persons, whether acting in the course of their business or as non-business persons (consumers). Only a natural or legal person acting in the course of their business or other independent gainful activity may become a Customer. By submitting the registration, the Customer expressly declares and warrants that they are not a consumer within the meaning of Section 419 of Act No. 89/2012 Coll., the Civil Code (the “Civil Code”).
3. These Terms form an integral part of the contract for the provision of the Service concluded between the Provider and the Customer. Deviating provisions in the contract take precedence over these Terms.

2. Definitions

• Service: the inmake platform provided as software as a service (SaaS) and platform as a service (PaaS), including hosting, APIs, the admin, AI assistants, the database environment and related infrastructure.
• Shop: an e-shop, web application or website created, managed and operated by the Customer through the Service.
• Customer Content: all data, texts, images, video clips, source code (including custom JavaScript), databases and other materials uploaded, created or processed by the Customer within the Service.
• Credit: a prepaid internal unit used for specific advanced features of the Service (e.g. generative AI).
• End User: a customer, visitor or consumer buying in a Shop operated by the Customer.

3. User account and security

1. Using the Service requires registration and the creation of a user account in the Provider's admin. The Customer must provide accurate, true and up-to-date information on registration and while using the Service.
2. The Customer may create access for members of their team (authorised persons) within their account. The Customer bears full responsibility for all activity carried out under their account and the accounts of their team.
3. The Customer must protect their access credentials and API keys from misuse by third parties. On any suspicion that credentials have been disclosed or of unauthorised access, the Customer must inform the Provider without delay. The Provider is not liable for damage caused by the Customer's breach of this obligation.

4. Scope of the Service, plans, payments and credits

1. The Service is provided on a recurring subscription according to the chosen plan shown in the Provider's price list at www.inmake.cz. The subscription renews automatically for the next billing period (monthly or yearly) until the Customer cancels it.
2. Payment terms and late payment: Payment for the subscription is due at the start of each billing period. The Customer expressly agrees to the automatic charging of recurring subscription fees to a stored payment card (e.g. through the Stripe payment gateway) and to tax documents (invoices) being issued and sent electronically to the Customer's e-mail address. If the Customer is late with a payment, the Provider may suspend the Customer's website (Shop) itself — a notice of suspension (interruption of service) is shown on the Customer's domain. In that case the Customer keeps access to the Service's admin solely to settle the outstanding payment, but cannot use Credits or other active features until the debt is paid in full. In case of late payment the Provider may also claim statutory default interest.
3. Credits for AI and advanced features: Selected features of the Service, in particular generative AI operations, are drawn through a system of Credits. Credits are neither legal tender nor electronic money and are non-refundable. Credits work as follows:
   • Plan credits: The chosen subscription (plan) gives the Customer a set weekly limit of Credits. The limit resets automatically every week to the value in the price list. Plan credits not used in a week do not carry over and expire.
   • Purchased credits: When the Customer uses up their weekly plan credits, they can buy additional Credits in the admin. Unlike plan credits, unused purchased Credits carry over, do not expire and remain available until fully used. Plan credits are always used first; purchased credits are drawn only once they run out.
4. Demo environment: Where the Provider offers a trial version or a Demo environment, it is provided strictly “as is”, without any warranty. Uploading real personal data or production data to the Demo environment in breach of the GDPR is strictly prohibited.

5. Service level (SLA) and maintenance

1. The Provider makes every reasonable effort (best effort) to keep the Service highly available. The target availability of the Service is 99.99% per calendar month, excluding planned maintenance. This target is indicative; failing to meet it does not automatically entitle the Customer to financial compensation, discounts (service credits) or damages unless expressly agreed otherwise.
2. The Provider may carry out planned maintenance of the Service. The Customer will be informed of planned maintenance that interrupts the Service in the admin or by e-mail at least 24 hours in advance; maintenance is scheduled primarily outside peak hours.
3. Guaranteed availability does not include outages caused by failures of third-party infrastructure (e.g. the cloud services Google Cloud, Fly.io, vshosting), force majeure, or faults in the Customer's internet connection.

6. Intellectual property

1. All intellectual property rights in the Service itself, the inmake platform, its updates, source code, graphical interface, trademarks and know-how remain the exclusive property of the Provider.
2. For the duration of the contract, the Provider grants the Customer a limited, non-exclusive, non-transferable licence, without the right to sublicense, to use the Service in accordance with these Terms and the chosen plan.
3. The Customer is the sole owner of the copyright and intellectual property rights in the Customer Content. The Customer grants the Provider a free, worldwide operating licence to use the Customer Content solely to the extent necessary to operate, host, back up and provide the Service under this contract.
4. Platform credit: The Customer acknowledges and agrees that, for as long as the Store is operated through the Service, the footer of the Store carries an inmake platform credit (text or logo) linking to www.inmake.cz, in an unobtrusive form matched to the design of the Store. The Provider determines the specific form and wording of the credit and may change them. The Customer shall not remove, obscure or alter the credit. The credit may be removed for a fee under the Provider's price list or by individual agreement. The obligation to keep the credit ends when the Store ceases to be operated through the Service.

7. Responsibility for content, security and moderation (DSA)

1. The Customer bears sole responsibility for the lawfulness of the Customer Content and for the activity carried out in their Shop. The Customer undertakes not to store or distribute through the Service any content that breaches the law, copyright or personality rights, or that contains malware or harmful scripts.
2. No uploading of sensitive data: Objects uploaded to public Cloud Storage through the Service are publicly accessible. The Customer undertakes not to upload to such storage sensitive personal data (special categories under Art. 9 GDPR) or unsecured personal data without an appropriate legal basis and encryption.
3. Notices under the Digital Services Act (DSA): The Provider's point of contact for reporting illegal content is the e-mail address inmake@insightbase.cz. The Provider reserves the right (but not the obligation) to remove or block Customer Content on receiving a substantiated notice of its illegality, or on the order of a public authority.

8. Artificial intelligence (AI features and the AI Act)

1. The Service integrates features that use third-party artificial intelligence models (in particular Google Gemini services). The Customer acknowledges that AI outputs are generated automatically, are probabilistic in nature and may contain inaccuracies or wrong information (hallucinations). The Customer must verify all AI outputs before using them.
2. Where the Customer actively uses these AI features in their Shop to create content or to interact, they are fully responsible for complying with the obligations under the EU AI Act towards end users (e.g. clearly disclosing that users are interacting with an AI system or are consuming synthetically generated content).
3. The Customer warrants that they enter into the AI modules only data and inputs for which they hold all necessary rights, and that entering them breaches no third-party rights or confidentiality.

9. Payments and transactions in the Customer's Shops

1. All transactions, purchase contracts and payments between the Customer and their End Users take place solely and directly between those parties through the Customer's payment gateways (e.g. their own Stripe account).
2. The Provider is not a party to the relationship between the Customer and the End User, takes no part in the sale of the Customer's goods or services, and bears no responsibility for the Customer's tax, accounting or consumer-law obligations (including the requirements of the European Accessibility Act – EAA).

10. Termination and the Data Act

1. The Customer may cancel the subscription and the contract at any time in the Service's admin; cancellation takes effect on the last day of the billing period currently paid for. The contract may also end by agreement, or by withdrawal in the event of a material breach by the other party.
2. Migration and data (Data Act): In accordance with the Data Act, the Provider gives the Customer standardised features to export their data. The transition period after the Service ends lasts 30 days, during which the Customer can export their data. Assistance from the Provider beyond the self-service export is charged according to the current price list, up to the limits set by applicable law.

11. Limitation of liability and indemnification

1. To the maximum extent permitted by applicable law, the Provider is not liable to the Customer for indirect damage, lost profit, loss of data, loss of revenue or business interruption arising in connection with the use of, or inability to use, the Service.
2. The Provider expressly bears no liability for any damage, lost profit or loss of data caused by the suspension of the Shop (website outage) due to the Customer's late payment of the subscription (see Art. 4.2 of the Terms).
3. The Provider's total aggregate liability for any damage or harm arising in connection with the Service is (except for damage caused intentionally or by gross negligence) strictly limited to the amount the Customer actually paid the Provider for the use of the Service in the 12 months before the event giving rise to the damage.
4. Indemnification: The Customer undertakes to indemnify the Provider in full for any claims, losses, damage, fines or costs (including legal costs) incurred by the Provider as a result of:
   1. the Customer's breach of these Terms or of the law,
   2. Customer Content uploaded to the Service,
   3. disputes between the Customer and their End Users.
5. Force majeure: The Provider is not liable for failing to meet its obligations where this results from force majeure (e.g. natural disasters, armed conflicts, large-scale outages of the internet backbone, cyber attacks of exceptional scale, decisions of state authorities).

12. Final provisions

1. The Provider may change these Terms unilaterally to a reasonable extent (Section 1752 of the Civil Code). The Provider will notify the Customer of a change by e-mail or in the admin at least 30 days before the new version takes effect. If the Customer does not agree with the changes, they may terminate the contract without penalty as of the date the change takes effect.
2. These Terms and all legal relationships arising from them are governed by the laws of the Czech Republic. Any disputes will be settled by the court of the Czech Republic with subject-matter and territorial jurisdiction according to the Provider's registered office.
3. These Terms take effect on 1 June 2026.

Data processing agreement (DPA)

This Data Processing Agreement (the “DPA”) forms an integral part of the inmake Terms of Use and is concluded automatically when the Customer accepts the Terms of Use.

Parties:

1. the company inbs s.r.o., with its registered office at třída Tomáše Bati 299, Louky, 763 02 Zlín, Czech Republic, company ID 23447923, registered in the Commercial Register kept by the Regional Court in Brno, file C 145989 (as the Processor of personal data), and
2. the Customer, as identified in the registration to the inmake Service (as the Controller of personal data).

1. Subject and purpose of processing

1. The subject of this DPA is the Controller's appointment of the Processor to process the personal data of the end customers, users and visitors of the Shops the Controller runs on the inmake platform.
2. Within the inmake Service the Processor provides the Controller solely with technological infrastructure and tools. The Controller alone, and at their full responsibility, determines the purpose, scope and means of processing — that is, what data they collect from their end users, in what volume and why. The Processor processes personal data solely to run databases, provide hosting, deliver e-commerce features and support, and always only on the documented instructions of the Controller (given by using the Service's features).

2. Duration of processing

1. Processing lasts for the duration of the contractual relationship established by the Terms of Use and then until the data are irreversibly deleted or anonymised after the Service ends, under Article 7 of this DPA.

3. Categories of data subjects and types of personal data

1. Data subjects: end shoppers in the Controller's Shop, visitors of the Shop, people filling in web forms in the Shop.
2. Types of personal data: identification data (first name, surname), contact data (e-mail, phone), delivery and billing addresses, order data, the content of messages sent through forms, IP addresses and technical identifiers.
3. Special categories of data: The Controller undertakes not to store or process in the Service special categories of personal data under Art. 9 GDPR (e.g. health data, biometric data) without prior written agreement with the Processor.

4. Obligations of the Processor

The Processor undertakes to:

1. process personal data only on the documented instructions of the Controller; the Controller's use of the features and interfaces of the inmake platform counts as a documented instruction;
2. ensure that persons authorised to process personal data at the Processor have committed to confidentiality or are under an appropriate statutory obligation of confidentiality;
3. take all security measures required under Article 32 GDPR (AES-256 encryption for sensitive data, HTTPS, access control, backups);
4. cooperation on security breaches: notify the Controller of any personal data breach without undue delay and in any case within 48 hours of discovering it, and give the Controller sufficient information to meet its notification duty towards the supervisory authority (ÚOOÚ);
5. cooperation on DPIAs and requests: give the Controller reasonable assistance in handling data subjects' requests to exercise their rights under Chapter III GDPR and in carrying out data protection impact assessments (DPIA) under Art. 35 GDPR.

5. Engaging other processors (sub-processors)

1. The Controller gives the Processor general written authorisation to engage other processors (providers of servers, databases and tools) for which the Processor guarantees that they meet strict security standards and process data preferably within the European Union.
2. The Processor will inform the Controller of any intended changes concerning the addition or replacement of other processors (e.g. by e-mail or in the admin) at least 15 days in advance. The Controller may object to the change on reasonable data-protection grounds. If the parties do not reach agreement, the Controller may terminate the contract as of the date the change takes effect.
3. Where the Processor engages another processor, it must impose on that processor the same data protection obligations as are set out in this DPA.

6. Audits and inspections

1. On written request, the Processor will provide the Controller with all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR.
2. The Processor will allow the Controller, or an auditor appointed by the Controller, to audit (including inspections) its technical and organisational security. Given the nature of a multi-tenant cloud infrastructure, the Controller agrees that an audit will preferably be carried out by presenting independent security certificates (e.g. ISO/IEC 27001), third-party audit reports or a security questionnaire completed by the Processor. A physical on-site audit can be carried out by agreement, during normal working hours and without compromising the security of other clients' data.

7. Termination and deletion of data

1. When the Service ends, the Processor must, at the Controller's choice, either delete all personal data or return it to the Controller in a common format (export), and delete existing copies.
2. Data are finally and irreversibly deleted from the Processor's databases and backup systems automatically once a retention period of 30 calendar days from the end of the contract has passed, unless a specific law requires the personal data to be kept longer.