PhiFlow General Terms and Conditions

Version 1.0 · 30 September 2026

If this English text and the Dutch version differ, the Dutch version prevails.

Provider: YouthCommerce, trading as PhiFlow, Chamber of Commerce (KvK) 75504014, Breukelaarweg 4, 7051 DX Varsseveld, VAT number NL002404490B72.

Article 1 Definitions

In these terms and conditions the following definitions apply:

Provider: YouthCommerce, trading as PhiFlow.
Customer: the natural person or legal entity that, in the exercise of a profession or business, enters into an Agreement with Provider.
Agreement: the agreement between Provider and Customer for the use of the Platform, consisting of the order or quotation, these terms and conditions, the Data Processing Agreement, the SLA and the AUP.
Platform: the online software service PhiFlow, accessible via https://app.phiflow.ai, including the underlying software, functions and Modules.
Module: a function or group of functions of the Platform that Customer can activate per Workspace and that is switched off by default.
Workspace: the separate environment in the Platform in which Customer processes its Customer Data.
User: a person who has access to a Workspace on behalf of Customer.
Customer Data: all data that Customer or Users enter into the Platform, connect to it, or have retrieved from Customer's systems.
Output: the results that the Platform generates for Customer on the basis of Customer Data, such as reports, analyses, summaries, scores, recommendations and draft text.
Documentation: the manuals, instructions and descriptions that Provider makes available about the Platform.
Data Processing Agreement: the data processing agreement between Provider and Customer, which Provider supplies with the quotation and on request.
SLA: the Service Level Agreement, which Provider supplies with the quotation and on request.
AUP: the acceptable use policy, which can be consulted at https://phiflow.ai/legal/gebruiksbeleid.
Anonymised Statistics: data that has been aggregated and anonymised and can no longer be traced to a person or to Customer.

Article 2 Applicability and delivery of the terms

These terms and conditions apply to every offer from, every Agreement with and every service of Provider that relates to the Platform. For other services of YouthCommerce, the YouthCommerce General Terms and Conditions apply.
Provider supplies exclusively to Customers acting in the exercise of a profession or business. Consumers are expressly excluded. On entering into the Agreement, Customer declares that it is not acting as a consumer. Provider does not supply to healthcare providers outside the European Economic Area, unless agreed otherwise in writing.
Customer's general or purchasing terms and conditions do not apply. Provider hereby expressly rejects them, even if they refer to these terms and conditions.
Provider makes these terms and conditions, the Data Processing Agreement, the SLA and the AUP available to Customer electronically before or at the latest when the Agreement is entered into, in a manner that enables Customer to store them and consult them later (art. 6:234 of the Dutch Civil Code). These terms and conditions and the AUP can be downloaded at https://phiflow.ai/legal; the Data Processing Agreement and the SLA are supplied with the quotation.
In the event of a conflict, the following order of precedence applies: (a) the Data Processing Agreement, insofar as personal data is concerned; (b) the order or quotation; (c) the SLA; (d) the AUP; (e) these terms and conditions.
If a provision is void or is annulled, the remaining provisions remain in force. The parties will replace the provision with a valid provision that has as far as possible the same purport.

Article 3 Formation

The Agreement is formed when Customer accepts a quotation from Provider, places an order that Provider confirms, or takes a Workspace into use after an invitation from Provider, whichever happens first.
Provider's quotations are non-binding and are valid for 30 days, unless stated otherwise.
Provider may refuse an application without giving reasons.

Article 4 Services

Provider makes the Platform available to Customer as an online service (SaaS) and will make reasonable efforts to do so with care and skill. All obligations of Provider are best-efforts obligations, unless a result is expressly promised in the SLA.
Modules are switched off by default. Customer activates a Module per Workspace and only if Customer has a valid basis for doing so (article 6). Not all functions or Modules are always available. Provider may keep functions out of use, for example because they do not yet meet Provider's requirements.
Provider may change, improve and adapt the Platform, including with a view to laws and regulations or security. Provider will announce a change that demonstrably worsens the core functions of the Platform 30 days in advance.
The Platform uses integrations with third-party platforms and services (such as CRM, analytics, advertising and search platforms). Customer has its own relationship with those third parties. Provider is not responsible for the availability, changes or terms of those third parties.
Support, maintenance and availability are governed by the SLA.

Article 5 Right of use

For the duration of the Agreement, Provider grants Customer a non-exclusive, non-transferable and non-sublicensable right to use the Platform for Customer's own internal business operations, in accordance with the Documentation, these terms and conditions and the AUP.
The number of Users and Workspaces follows from the order. Each User has a personal account. Sharing accounts is not permitted.
Use by subsidiaries or other third parties is only permitted if agreed in the order.
All rights that are not expressly granted to Customer remain with Provider.

Article 6 Customer's obligations

Customer ensures that Users keep their login credentials confidential, do not share accounts and report suspicious activity to Provider immediately. Actions under an account are deemed to be actions of Customer.
Customer is the controller of the personal data in Customer Data. Customer ensures that it obtains Customer Data lawfully, that it has a valid basis for having that data processed by Provider (including for each activated Module and for each integration) and that data subjects have been informed. For special categories of personal data and data of children, the AUP applies.
Customer ensures that it is authorised to connect third-party systems to the Platform and that it complies with the terms of those third parties.
Customer provides in good time the information and cooperation that Provider reasonably needs.
Customer and Users comply with the AUP. Provider may reasonably amend the AUP; article 18 applies mutatis mutandis.
Customer indemnifies Provider against claims of third parties, including supervisory authorities, arising from Customer Data, from use of the Platform in breach of the law, the Agreement or the AUP, or from a missing basis for the processing of Customer Data, and reimburses the reasonable costs of defence.

Article 7 AI functionality

The Platform contains AI functions with which, among other things, Customer Data is analysed, summarised and prioritised. These functions support Users. Output may be incorrect or incomplete. Provider does not warrant the accuracy, completeness or suitability of Output for a particular purpose.
Customer decides for itself on the use of Output and checks Output before basing decisions on it or using Output externally.
Actions with external impact require approval by a User. Customer remains responsible for actions it has approved.
Customer does not take decisions on the basis of Output that are taken solely by automated means and that have legal effects for persons or similarly significantly affect them (art. 22 GDPR). The Platform itself does not take any such decisions.
If Customer uses Output externally, for example in communications to customers, leads or the public, Customer is responsible for any transparency obligations towards those persons, including disclosing that content has been created with AI insofar as the law requires this.
For Regulation (EU) 2024/1689 (AI Act), the following applies: Provider is the provider of the AI functions in the Platform and Customer is the deployer. Each party complies with the obligations that apply to its role. Provider makes Documentation and instructions for use available. Customer uses the AI functions in accordance with those instructions and ensures human oversight and sufficient knowledge among Users, insofar as the regulation prescribes this.
Provider does not allow third-party AI models to be trained on Customer Data. See further the Data Processing Agreement.
The Platform is intended for commercial analysis and for supporting marketing and sales. Customer does not use the Platform for: assessing, selecting or monitoring employees or applicants; assessing creditworthiness or access to essential services; biometric identification or emotion recognition; or profiling of children. If Customer nevertheless uses the Platform for these, Customer is responsible for this, including as provider within the meaning of the AI Act.

Article 8 Intellectual property

All intellectual property rights in the Platform and everything connected with it vest exclusively in Provider or its licensors. This includes the software, methods and ways of working, models, algorithms, templates, configurations, designs, Documentation and all improvements and derivative works thereof, and the Anonymised Statistics.
Nothing in the Agreement transfers ownership or rights other than the right of use under article 5 to Customer.
Customer Data remains the property of Customer. Customer grants Provider a non-exclusive right to use Customer Data insofar as necessary to supply the Platform to Customer, and otherwise only in the manner permitted by the Data Processing Agreement and this article.
Customer and Users are not permitted, whether themselves or through third parties:
- a. to discover, reverse engineer, decompile or disassemble the source code, structure, operation, models or logic of the Platform, except insofar as the law mandatorily permits this;
- b. to scrape, automatically read out or otherwise systematically extract the Platform or Output on a large scale, other than through functions or exports that Provider makes available for that purpose;
- c. to circumvent or disable technical restrictions, security measures, limits or licence controls;
- d. to use the Platform to build, train, improve or benchmark a competing product or service, or to assist third parties in doing so;
- e. to publish or provide to third parties the results of benchmarks or performance comparisons of the Platform without Provider's prior written consent;
- f. to resell, rent, license or offer the Platform as a service to third parties, unless agreed in writing.
In the event of a breach of paragraph 4, Customer owes an immediately payable penalty of € 10,000 per breach, without prejudice to Provider's right to performance, full compensation and suspension or termination. The penalty is a determination of minimum damages and does not replace compensation.
If Customer or a User gives feedback, ideas or suggestions for improvement about the Platform, Customer grants Provider a worldwide, perpetual, irrevocable, royalty-free and transferable licence to use that feedback without restriction. Feedback does not contain Customer Data or confidential information of Customer.
Customer does not remove or alter any notices of intellectual property, trademarks or security measures.
This article continues to apply after the Agreement ends.
Output: Customer obtains a perpetual, worldwide, non-exclusive right to use Output for its own business operations, including using content Output internally and publishing it in its own communications. This right continues after the Agreement ends. The right does not include reselling Output as a stand-alone product, nor the rights under paragraph 1 in elements of the Platform that reappear in Output. Output may be identical or similar for different customers; Provider does not grant exclusivity.
Provider may compile and use Anonymised Statistics from the use of the Platform for product improvement and benchmarks. In doing so, Provider does not make Customer or data subjects identifiable and does not name any Customer.

Article 9 Confidentiality

The parties keep the other party's confidential information secret, use it only for the performance of the Agreement and share it only with employees and auxiliary persons who need to know the information and who are bound by equivalent confidentiality.
Provider's confidential information includes in any case the operation, methods, ways of working, models, templates and performance of the Platform, pricing information and the non-public Documentation. Customer Data is confidential information of Customer.
This obligation does not apply to information that is public without breach of this article, that the recipient already lawfully had or independently developed, or that must be disclosed by law or by a competent authority. In the latter case, the recipient informs the other party in advance, insofar as the law permits.
This obligation applies during the Agreement and continues until five years after it ends. For information that is a trade secret, it continues for as long as the information remains a trade secret.

Article 10 Prices and payment

The prices are stated in the order or quotation and are in euros, exclusive of VAT.
Provider invoices monthly in advance, unless the order provides otherwise. Customer pays within 14 days of the invoice date, without discount or set-off.
Customer objects to an invoice within 14 days of the invoice date. After that, the invoice is deemed to be accepted.
If Customer does not pay on time, Customer is in default without notice of default and owes: the statutory commercial interest (art. 6:119a of the Dutch Civil Code) and the reasonable costs of collection, judicial and extrajudicial (art. 6:96 of the Dutch Civil Code).
Provider may index the prices annually on 1 January by at most the percentage increase in the consumer price index (CPI, all households) published by Statistics Netherlands (CBS) over the preceding twelve months. Customer has no right of termination on indexation.
Provider announces other price changes at least two months before the effective date. Customer may then, until the effective date, terminate the Agreement in writing with effect from that date; otherwise the new price applies.

Article 11 Term and termination

The Agreement is entered into for an initial period of 12 months from the start date in the order.
After the initial period, the Agreement is tacitly renewed each time for 12 months. Either party may terminate in writing at the end of the current period with a notice period of 2 months.
Termination during a current period is not possible, except on the basis of article 10.6, 12, 16, 17 or 18.
Termination may be given by email to [email protected] or via the Platform.

Article 12 Switching and export of data (Regulation (EU) 2023/2854, chapter VI)

Customer has the right to switch to another provider of data processing services, or to its own ICT environment (on-premises). This article applies in addition to article 11 and prevails in the event of a conflict.
Notice period for switching. In order to switch, Customer may terminate the Agreement with a notice period of at most two months. The notice states the desired new provider or ICT environment or the intention to delete the data.
Transitional period. After the notice period ends, a mandatory transitional period of at most thirty calendar days applies, during which Provider continues to supply the Platform, reasonably assists Customer and ensures the continuity of the service and the security of the data. If switching within that period is technically not feasible, Provider will notify this within fourteen working days after the request, give reasons and state an alternative transitional period of at most seven months. Customer may extend the transitional period once by a period it considers appropriate.
Exportable data. Customer can export the following categories: (a) Customer Data; (b) Output; (c) settings, tasks, comments and decisions that Customer itself entered in the Workspace; (d) associated metadata that is needed to understand the data. The export takes place in a structured, commonly used and machine-readable format, for example CSV or JSON, and where reasonable via functions in the Platform. Provider supplies the information about the structure and format. Excluded are: Provider's intellectual property and trade secrets, including software, models, logic, templates, internal configuration, Documentation and Anonymised Statistics. Customer can request the current list of exportable data from Provider.
Retrieval period and deletion. After the transitional period ends, Customer has at least a further thirty calendar days to retrieve its exportable data. After that, Provider deletes the Customer Data and Output from the Platform and confirms this on request. Backups expire within ninety days thereafter, in accordance with the Data Processing Agreement.
End of the Agreement. The Agreement ends on successful completion of the switch, or as much earlier as Customer indicates. After the end, Provider may not charge any costs for the period after the transition.
Switching charges. From 12 January 2027, Provider does not charge Customer any switching charges. Until that date, at most costs that are not higher than the costs that Provider incurs directly for the switch (art. 29 Data Act). Provider states those costs in writing in advance.
Jurisdiction of the infrastructure. Information about the jurisdictions in which the ICT infrastructure for the service is located (art. 28 Data Act) is in the list of subprocessors attached to the Data Processing Agreement: https://phiflow.ai/legal/subverwerkers.
If Customer switches during the initial period of the Agreement, Customer pays a proportionate fee for the remaining period, at most the fees that would still be owed until the end of the initial period. This fee does not count as switching charges.

Article 13 Availability and maintenance

Availability, maintenance, support, recovery and backup are governed by the SLA. Provider may temporarily take the Platform out of use for planned or urgent maintenance, as described in the SLA.

Article 14 Security and privacy

Provider takes appropriate technical and organisational measures to secure Customer Data, as described in the Data Processing Agreement. Provider does not guarantee that the Platform is uninterrupted or free of errors or attacks.
For personal data in Customer Data, Provider is processor and Customer is controller. The Data Processing Agreement applies to this and prevails in the event of a conflict.
For Provider's own processing, such as accounts, security, customer relationship and support, Provider is controller. See the PhiFlow Platform Privacy Policy at https://phiflow.ai/legal/privacy-platform.

Article 15 Liability

Provider is liable only for direct damage that is the direct result of an attributable failure in the performance of the Agreement. Direct damage is only: (a) reasonable costs of establishing the failure; (b) reasonable costs of bringing Provider's performance into conformity with the Agreement; (c) reasonable costs of preventing or limiting damage, insofar as Customer demonstrates that those costs limited the direct damage.
Provider's liability is limited, per event or series of related events, to the amount that Customer paid to Provider in the twelve months before the event (exclusive of VAT), with a minimum of € 5,000. Total liability in each contract year is limited to € 50,000. This cap also applies to damage arising from the Data Processing Agreement.
Provider is not liable for indirect damage, including consequential loss, lost profits, missed savings, reputational damage, damage due to business interruption and damage due to decisions that Customer bases on Output.
Provider is not liable for loss or damage of Customer Data insofar as it cannot be restored from the most recent backup. Customer remains itself responsible for the source of its data.
Provider is not liable for damage caused by acts or omissions of third parties, including third-party platforms and services that Customer connects, and by use of the Platform in breach of the Agreement or the AUP.
The limitations in this article do not apply in the event of intent or deliberate recklessness on the part of Provider or its managers, or insofar as the law mandatorily does not permit liability to be limited.
Customer reports damage to Provider as soon as possible, at the latest within twelve months of discovery, in writing and with reasons. Otherwise the right to compensation lapses.
Employees and third parties engaged by Provider may invoke the limitations in this article.
The limitations in this article also apply to claims in tort.

Article 16 Force majeure

Provider is not liable for a failure that is not attributable to it, including failures at hosting and other suppliers, failures of the internet, energy or telecommunications, failures of third-party platforms, cyberattacks despite appropriate measures, government measures and strikes.
If the force majeure lasts longer than two months, either party may terminate the Agreement in writing, without either party being obliged to pay damages. Customer pays for what Provider has already delivered.

Article 17 Suspension and termination

Provider may suspend its obligations or (partly) block access to the Platform if Customer fails to perform an obligation, if a payment is more than 14 days overdue after a written reminder, or if this is necessary to prevent damage or abuse. Provider informs Customer of this, insofar as reasonably possible. Suspension does not release Customer from its payment obligation.
Either party may dissolve the Agreement in writing with immediate effect if the other party, despite a written notice of default with a reasonable period of 14 days, fails to perform a material obligation. A notice of default is not required if performance is permanently impossible.
Either party may dissolve the Agreement in writing with immediate effect in the event of bankruptcy, suspension of payments, application of the statutory debt restructuring scheme, or dissolution or liquidation of the other party.
On termination the right of use lapses. Article 12 (export and deletion) continues to apply. Provisions that by their nature are intended to remain in force, including articles 8, 9, 15 and 20, remain in force.

Article 18 Amendment of the terms and conditions

Provider may amend these terms and conditions, the SLA and the AUP. Provider announces an amendment at least thirty days before the effective date by email or via the Platform.
If the amendment is material and to Customer's disadvantage, Customer may, until the effective date, terminate the Agreement in writing with effect from that date. If Customer does not terminate, the amendment applies from the effective date.
Amendments that the law or a competent authority makes mandatory, and amendments that do not disadvantage Customer, apply without a right of termination and without the period in paragraph 1.

Article 19 Assignment

Customer may not transfer rights and obligations under the Agreement without Provider's prior written consent. This consent may not be unreasonably withheld.
Provider may transfer the Agreement to a group company or to a legal successor on transfer of the business, and will notify Customer of this. Customer hereby gives its cooperation in advance to such a transfer of the contract. Customer then retains its rights under article 12.

Article 20 Governing law and competent court

The Agreement and all disputes arising from it are governed by Dutch law. The Vienna Sales Convention (CISG) is excluded.
The parties first try to resolve a dispute by mutual consultation. If that does not succeed, they first submit the dispute to an independent mediator.
If mediation does not lead to a resolution, the dispute is submitted exclusively to the Gelderland District Court, unless mandatory law provides otherwise. If Customer is established outside the European Union, the parties may instead agree in the order on arbitration under the Arbitration Rules of the Netherlands Arbitration Institute, with Arnhem as the place of arbitration.
These terms and conditions may be available in several languages. In the event of a difference, the Dutch text prevails.

Article 21 Sanctions and export restrictions

Customer declares that Customer, its owners and Users do not appear on a sanctions list of the European Union, the United Nations, the United Kingdom or the United States, and that Customer does not use the Platform in or from a country to which such sanctions apply.
Provider may terminate the Agreement with immediate effect if Customer acts in breach of paragraph 1.