Terms of Service

1. Parties, purpose and acceptance

1.1. These terms form the contract between Cryptaguard BV, a private limited company (BV) under Belgian law, company number 1007.610.660, EUID BEKBOBCE1007610660, with its registered office at Fazantenlaan 9, 1600 Sint-Pieters-Leeuw, Belgium ("Cryptaguard"), and the organisation that uses the ResiPlan platform (the "Service"), referred to here as "you" or "the Customer".

1.2. The Service is for companies, public bodies and other organisations, for their professional activity. It is not intended for consumers. The person who creates the account or subscribes to a plan declares that they can bind the organisation.

1.3. You accept these terms by creating an account or subscribing to a plan. They stay published on this page, where you can save and print them before committing.

1.4. The contract consists of, in order of priority: a signed contract or order form, if there is one; the data processing agreement (DPA) for personal data; these terms. The DPA applies without a signature, under the rules of its section 2.5: its fields in square brackets count only in a signed version. For switching providers, section 12 applies unless a signed clause is more favourable to the Customer.

1.5. These terms exist in French, English and Dutch. If they differ, the French version prevails.

2. The Service

2.1. ResiPlan is an online business continuity management platform. Depending on the plan, it includes business impact analysis (BIA), continuity and recovery plans, risk management, an inventory of assets and contracts, regulatory compliance tracking, exercises and crisis management, dashboards and reports, and assistance features based on artificial intelligence.

2.2. The AI features rely on models from third-party providers, listed on the Trust Center or, for an organisation whose signed contract provides for it, in Annex 3 of its DPA. They produce proposals, labelled as such, that you must check before using them. An administrator of the organisation can turn them off.

2.3. Cryptaguard does not run a data centre. The Service is hosted by the sub-processors listed on the Trust Center, in particular:

• Convex, Inc. (United States): Database, serverless functions, real-time sync and file storage. European Union — AWS eu-west-1 (Ireland), dedicated EU deployment.
• OVH SAS (France): Application hosting (web server of the Service) and encrypted backup copies. European Union — France.

2.4. ResiPlan helps you prepare and document your programme. It does not guarantee a certification or compliance with a standard or a regulation, and it does not replace legal advice.

2.5. Cryptaguard develops the Service and may add, change or remove a feature. If a change significantly reduces what you subscribed to, section 13 applies: notice and a right to leave.

3. Accounts and security

3.1. You provide accurate and up-to-date information. You are responsible for keeping credentials confidential, for what is done with your organisation's accounts and for the rights your administrators grant. You tell us without delay about any unauthorised use.

3.2. Each organisation has its own data space, logically separate from those of other customers.

3.3. Cryptaguard may suspend an account or an API key without notice where there is a serious risk to the security of the Service or of other customers. It informs you as soon as possible and lifts the suspension once the risk has gone. If a suspension prevents you from reaching the export of your data, Cryptaguard hands it to you on request, unless the law forbids it.

4. Plans, prices and payment

4.1. The base plans are the following. Prices are in euros, excluding taxes, and the pricing page details what each includes.

4.2. There are also an operator licence (for a firm that runs its clients) and a group licence (parent company and subsidiaries), and the Enterprise+ plan is on quote: the order form then sets the price, duration and content. If they differ, the price shown when you ordered applies.

4.3. Payment goes through our provider Stripe, using the methods offered on the payment page, or by invoice for plans on quote. VAT is calculated from your country and VAT number.

4.4. Subscriptions are billed in advance for the month or the year. They renew automatically for the same duration unless cancelled before the renewal date from the Billing page.

4.5. If a payment fails, a grace period of 14 days opens. After it, the paid features are turned off. Your data remains retrievable under section 12.

4.6. Cryptaguard may change its prices for a valid reason, with at least 30 days' notice. The new price applies at the next renewal. If you refuse it, you may cancel at no cost before that date.

4.7. Amounts paid for a period that has started are not refunded, except in the cases of sections 11.4, 11.5 and 13.3 and of section 5.4.2 of the DPA.

5. Free trial and demonstration space

5.1. Cryptaguard may offer a free trial of 14 days, with no payment method, followed by a grace period of 3 days. When that period ends, access is limited to billing and to the Reversibility page.

5.2. In a trial organisation of your own, section 12 applies: an administrator can export the data, obtain an exit key and request deletion.

5.3. The shared demonstration space is a test version, not meant for production and limited in time, within the meaning of Article 31(2) of Regulation (EU) 2023/2854: the rules of section 12 do not apply to it. Several users share it. Do not enter any real data in it. Your user account (name, e-mail, phone) has no automatic deletion date there: it is deleted on request to privacy@resiplan.eu.

6. Your data

6.1. Your data belongs to you. You keep all your rights over what you enter, import or produce with the Service, including plans and reports generated with AI.

6.2. You grant Cryptaguard a limited, non-exclusive licence, for as long as necessary, to host, process and display this data for the sole purpose of providing the Service, securing it and answering your requests.

6.3. Cryptaguard does not sell your data. It discloses it only to its sub-processors listed on the Trust Center, to the recipients you choose, or where the law requires. Cryptaguard does not use your data to train AI models. Model providers process requests on the conditions described in the DPA; an option limits AI to a provider established in the European Union.

6.4. For the personal data you entrust to us, the DPA applies. The privacy policy describes the processing for which Cryptaguard is the controller.

6.5. The measures against access by third-country authorities to non-personal data are described on the Switching providers page and in Annex 4 of the DPA.

7. Intellectual property

7.1. The Service, its code, interface, algorithms, documentation and trademarks, as well as the frameworks and templates it provides, remain the property of Cryptaguard or of their owners.

7.2. Your subscription gives you, for its duration, a non-exclusive and non-transferable right to use the Service. You may not copy it, resell it, decompile it or reverse engineer it, except where the law allows it.

7.3. What you wrote from these templates is part of your data: you may keep it and use it after the contract ends.

8. Acceptable use and API

8.1. You agree not to:

• use the Service for illegal purposes;
• attempt to gain unauthorised access to the systems, networks or data of other customers;
• introduce malware or harmful code;
• deliberately overload the infrastructure, or collect content in bulk outside the interfaces provided;
• share your credentials with unauthorised third parties;
• process special categories of data under Article 9 GDPR systematically or in a structured way, without prior written agreement (section 6.3 of the DPA);
• circumvent the technical limits of your plan.

8.2. Depending on the plan, the Service gives access to a REST API, an OData feed and an MCP server (developer API module, from the Professional plan). An administrator creates the API keys. A key is shown only once: you are responsible for keeping it and for what is done with it, and you can revoke it at any time. Unless the key has its own limit, a key is limited to 60 requests per minute.

8.3. Cryptaguard may develop these interfaces. It announces any incompatible change at least 30 days in advance, except in a security emergency, and may limit a key whose use threatens the Service.

8.4. The exit interface of section 12.7 does not depend on the plan: it is free for all customers.

8.5. A breach of this section may lead to a suspension (section 3.3) or a termination (section 11).

9. Availability, support and backups

9.1. Availability target: 99.5% per calendar month, excluding announced planned maintenance, force majeure and causes attributable to the Customer or its suppliers.

9.2. This figure is a target, not a guarantee. It gives no right to any service credit or automatic penalty. Your other rights remain intact, in particular termination for serious breach (section 11.4) and compensation under section 10. The state of the Service is published on the status page.

9.3. Routine updates normally interrupt access for only a few minutes. If a planned operation risks interrupting it for longer, Cryptaguard warns administrators in advance, by e-mail or in the application, where possible.

9.4. Support: by e-mail at contact@resiplan.eu, on working days (Monday to Friday, excluding public holidays in Belgium). Cryptaguard answers no later than the working day after it receives your request. An answer is not necessarily a resolution. There is no on-call service in the evening, at night or at the weekend. A higher level of support (priority, dedicated contact) exists only if the order form defines it.

9.5. An encrypted backup of the database and files is made every night and kept for 30 days. If a restore is needed, what was entered after the last backup may be lost: the recovery point target is 24 hours. These backups exist to resume the Service. They do not replace the exports you can start at any time.

9.6. The Service may contain errors. Cryptaguard strives to fix them within a reasonable time, without guaranteeing that it is free of them or fit for a particular purpose.

10. Liability

10.1. Nothing in this contract excludes or limits a party's liability for intentional misconduct, fraud or gross negligence, for death or bodily injury, or where the law forbids such a limitation.

10.2. In other cases, each party is liable for its breaches within the following limits:

• it compensates direct damage. This includes reasonable costs of determining the cause and extent of the damage, of limiting it, and of reconstituting lost, corrupted or unavailable data;
• it does not compensate indirect damage, such as loss of profit, loss of customers or harm to reputation;
• the total owed for the events of a 12-month period does not exceed the fees paid or due for the Service during the 12 months before the event. If no fee is due (trial), this ceiling is 500 euros.

10.3. These limits do not reduce the amounts due under the contract. For breaches of the DPA, section 8 of the DPA applies, and no limit stands against the rights of data subjects under the GDPR.

10.4. You remain responsible for decisions made on the basis of the Service, in particular from content proposed by AI.

10.5. Neither party is liable for a delay or failure caused by force majeure: an unforeseeable, irresistible event beyond its control. The failure of a sub-processor of Cryptaguard counts only if that sub-processor itself suffers such an event. The party prevented informs the other without delay. Your rights under section 12 remain.

11. Term and termination

11.1. The contract lasts as long as a subscription runs, until it is terminated. A plan on quote has the duration set in the order form.

11.2. Ordinary cancellation. You may cancel at any time from the Billing page, with no notice. It takes effect at the end of the period already paid, month or year.

11.3. Leaving before the end of a period. You may at any time use section 12 to switch providers or have your data erased.

11.4. Breach. Either party may terminate in writing if the other commits a serious breach and does not remedy it within 30 days of a formal notice. If the breach is Cryptaguard's, it refunds pro rata the paid period that has not elapsed.

11.5. By Cryptaguard. Cryptaguard may terminate for non-payment after the grace period of section 4.5, for a serious breach of section 8, or where a competent authority or the law requires it. It may also discontinue the Service or end the contract without a reason, with at least 3 months' notice and a pro rata refund of the paid period that has not elapsed.

11.6. After the end. Whatever the cause, sections 12.9 (retrieval) and 12.10 (deletion) apply. If you give a switching notice after a termination by Cryptaguard, the contract continues until that switch ends, unless the law forbids it, and the normal fees remain due.

12. Switching providers and exit

12.1. Your right. At any time and whatever your plan, you may move to a service of another provider or to your own infrastructure, transfer your data and digital assets, or have them erased without switching. This section implements Articles 23 to 31 of Regulation (EU) 2023/2854 (Data Act). The Switching providers page details the procedure, the lists of data and the formats: it is part of the contract. Its register and its lists of tables follow the Service without being a change within the meaning of section 13, unless a change reduces what can be exported or adds an exclusion: section 13 then applies.

12.2. Notice. An administrator of the organisation writes to contact@resiplan.eu stating the organisation, what you want to do (another provider, with its name and a contact; your own infrastructure; erasure only), the notice period chosen and the person to contact. A template is on the page. Cryptaguard confirms receipt within 3 working days, by the same means. This notice is not a cancellation of the subscription: to keep all your features during the switch, do not cancel the subscription before it ends.

12.3. Notice period. The notice period is the one you state, from zero to 2 months at most. If you state none, there is no notice period and the transition starts on the date of the confirmation of receipt.

12.4. Transition. The switch takes place without undue delay, during a transitional period of at most 30 calendar days, which starts at the end of the notice period. If that period is technically unfeasible, Cryptaguard notifies you within 14 working days of your request, justifying it and indicating another period of at most 7 months. You may extend the transitional period once, for the duration you consider appropriate, by telling us before it ends.

12.5. During the switch, the contract continues and the normal fees remain due. From the receipt of your notice, your subscription is no longer renewed for a new period. If its renewal date falls before the end of the contract, whether during the notice period, the transition, its extension or while waiting for your confirmation, it is extended until that end, pro rata at the current price. If you give up the switch or it is deemed not to have succeeded (section 12.8), section 4.4 applies again from the next renewal date. During the transition, Cryptaguard:

• gives reasonable assistance to you and to the third parties you authorise, including the destination provider;
• acts with due care to maintain continuity and keeps providing the functions under the contract;
• gives you clear information on the known risks to that continuity;
• maintains a high level of security, in particular during the transfer and during retrieval;
• supports your exit strategy by giving you the relevant information.

For your part, you take reasonable measures to make the switch succeed, you import the data into the destination environment and you tell us when the switch has succeeded. All parties, including the destination provider, cooperate in good faith.

12.6. Data concerned. Exportable are all the data you entered or imported, those your use of the Service produced, including their metadata (audit and activity logs, subscription and consumption history), and your files. Your digital assets within the meaning of the Regulation are limited to your configuration and to what you created in the Service (roles and rights, settings, templates and methodologies you wrote): they are exported and erased with your data. The Service hosts no application of the Customer. The page gives the exhaustive list by table. It also gives the exhaustive list of what is excluded, with the reason for each exclusion: access secrets, internal security and operations logs whose disclosure would expose a trade secret or the security of the Service, Cryptaguard's own commercial ledgers and the publisher's protected content. These exclusions neither prevent nor delay the switch.

12.7. Formats and interfaces. The full export is self-service on the Reversibility page, for any administrator, whatever the plan: ZIP archive, data in JSON Lines (UTF-8), manifest with SHA-256 hashes, data dictionary, files in their original format and Excel workbook. An exit interface (REST API) is free for all customers, and you may hand its key to the destination provider. The online register of structures and formats is published on the page. You may also use the export and this interface during the contract to use the Service in parallel with another service (Article 34 of the Regulation), without a switching notice and with no data egress fees.

12.8. End of the contract. The contract ends when you tell us the switch has succeeded or, if you ask only for erasure, at the end of the notice period. Cryptaguard notifies you of the end. If you say nothing although the switch seems complete, Cryptaguard may ask you: with no answer within 30 working days, the switch is deemed not to have succeeded and the contract continues. If the switch fails, the parties cooperate in good faith to find the cause, on the same terms as to charges.

12.9. Retrieval. After the end of the transition, you have at least 30 calendar days to retrieve your data, which stays protected during this period. The Reversibility page and the exit interface remain accessible. This period also applies after any other end of the contract and after the end of a trial.

12.10. Deletion. At the end of the retrieval period, once the switch has succeeded, Cryptaguard erases all your exportable data, your digital assets and your files. You request the closure on the Reversibility page, or Cryptaguard opens it on your written instruction. The deletion takes place 30 calendar days later: you may cancel it until then, unless you ask in writing to bring it forward. A certificate of deletion is then sent to you. Without an instruction from you, Cryptaguard opens the closure no later than 90 days after the end of the contract or trial, and the administrators are warned by e-mail. A parent or an operator is closed only once the organisations attached to it have been closed or transferred: this period then runs from that moment. An organisation managed by an operator comes under that operator's contract: it is closed at the request of its administrator or of the operator, with no automatic period. Encrypted backups disappear through rotation, no later than 35 days after the deletion. Only the following remain: the trace of the closure, which proves the deletion and allows a claim to be answered (name and identifier of the organisation, name and e-mail of the requester, any reason given, dates, counts, hashes and certificate), for 10 years; and invoices and accounting records, which do not stay in the Service: they are kept in Cryptaguard's accounts and at its payment provider for 10 years, the period set by Belgian tax law. A user account that also belongs to another organisation is kept for that organisation.

12.11. No switching charges. The export, the exit interface, the transfer of your data and reasonable assistance are free. What remains due is the normal fees until the end of the contract and, where applicable, the penalty of section 12.12. Support going beyond these obligations, for example developing an import into the destination tool, is provided only if you ask for it, on an accepted quote. The switch never depends on it.

12.12. Early termination penalty. Monthly subscription: none. Annual subscription: if the contract ends before the end of the paid year, the amount already paid for that year stays with Cryptaguard as a penalty, and nothing more is due. Plan on quote: the amount set in the order form. No penalty is due if you leave because of a breach by Cryptaguard (section 11.4), a refused change (section 13.3) or an objection to a sub-processor (section 5.4.2 of the DPA). A renewal date falling after your notice does not start a new year (section 12.5).

12.13. Particular services. Only the demonstration space of section 5.3 falls outside this section. If a custom-built service were to come under Article 31(1) of the Regulation, the order form would tell you before you sign it.

13. Changes to these terms

13.1. Cryptaguard changes these terms only for a valid reason: a change in the law, in security, in the Service or in its plans.

13.2. It tells you at least 30 days before the change takes effect, by e-mail to administrators and in the application, stating what changes, why and on what date. A shorter period is possible only if the law requires it.

13.3. If you refuse a change, you may cancel at no cost before it takes effect, with a pro rata refund of the paid period that has not elapsed. Section 12 still applies. Otherwise, the new version applies on the announced date.

13.4. During a current annual period, an unfavourable change to the price or the duration applies only at renewal. No change is retroactive.

13.5. The version date is at the top of this page, and earlier versions are available on request.

13.6. This version applies from its effective date to contracts concluded from that date and to existing accounts, which are informed of it. An existing account that refuses it may stop using the Service at no cost.

14. Governing law and disputes

14.1. These terms are governed by Belgian law. This choice does not deprive the Customer of the mandatory rules that protect it.

14.2. The parties first seek an amicable solution. Failing that, the courts of the place of Cryptaguard's registered office (judicial district of Brussels) have sole jurisdiction, subject to mandatory rules of jurisdiction.

14.3. For a dispute on Articles 23 to 31 of Regulation (EU) 2023/2854, you may also go to a certified dispute settlement body (Article 10 of the Regulation) or lodge a complaint with the competent authority (Article 38).

15. Contact and notices

• Company: Cryptaguard BV, Fazantenlaan 9, 1600 Sint-Pieters-Leeuw, Belgium, company number 1007.610.660
• Support, contract and switching providers: contact@resiplan.eu
• Security: security@resiplan.eu
• Personal data: privacy@resiplan.eu

15.1. Cryptaguard writes to the e-mail address of the organisation's administrators or of the contact named in a signed DPA. You keep these addresses up to date.

15.2. The jurisdiction the infrastructure is subject to and the measures against access by third-country authorities are published on the Switching providers page and on the Trust Center.