Terms of Use

"Verca AB" — Verca AB, org. no. 559564-2629, with registered office in Malmö.

"The Platform" — Verca AB's digital service for CE-related documentation, classification, requirement management and regulatory monitoring, including all related functions, APIs and interfaces.

"The Customer" — the legal entity that has entered into an agreement with Verca AB for use of the Platform.

"User" — a natural person who has access to the Platform via the Customer's account.

"The Agreement" — these terms of use together with any appendices (DPA, SLA) and the pricing plan chosen by the Customer.

"Customer Data" — all information, documentation and technical files that the Customer or its Users upload to or create in the Platform.

Verca AB provides a digital platform for CE-related documentation, standard identification, product classification and support for the Customer's CE process. The Customer receives an account where products, documents and regulatory information can be stored, structured and administered.

The Platform includes a rule engine (Requirements Engine) that automates classification and requirement identification based on structured rule data. The Platform also offers decision support, analysis functions and documentation structure.

Verca AB does not perform product testing, certifying assessments or legal advice. Verca AB does not act as a Notified Body. Testing offered via the Platform is conducted through external accredited laboratories; responsibility for test results and statements lies with the respective laboratory.

Allocation of responsibility for regulations and CE decisions. The Requirements Engine is built on official sources (EUR-Lex, harmonised standards) and is updated continuously upon regulatory changes. The Customer's compliance officers carry out the final review and attest CE decisions — in accordance with the manufacturer's statutory responsibility under CE legislation.

The Customer is responsible for ensuring that:

• Uploaded information is correct, complete and lawfully managed
• CE processes are carried out in accordance with applicable EU legislation and industry practice
• Account and login credentials are handled securely and only authorised Users are granted access
• A compliance officer (person or team) is appointed who reviews the Platform's recommendations, verifies them against official regulations and attests final CE decisions
• Assessments, risk analyses and CE decisions are made by this compliance officer or equivalent qualified personnel
• Conclusions and data are verified before a product is placed on the market

The Customer is solely legally responsible for CE declarations, risk assessments and product decisions. The Platform's recommendations, analyses and guidance do not constitute legal advice and do not replace the Customer's own assessments or responsibility under applicable legislation. The Platform's automation does not replace technical review, testing or product evaluation.

Prohibited use. The Customer may not:

• Manipulate, falsify or misrepresent classification results or documentation from the Platform
• Use the Platform to provide CE classification or documentation services to third parties in competition with Verca AB without written approval
• Upload content that the Customer does not own or has not licensed from rights holders
• Use the Platform to circumvent supervision, market surveillance or notification requirements

Export and sanctions controls. The Customer is responsible for ensuring that products and technical documentation handled in the Platform are not subject to export controls, sanctions or other restrictions under EU or Swedish law. Verca AB cooperates with competent authorities upon well-founded suspicion of breach of these rules.

Use of the Platform requires an active subscription according to the applicable pricing plan. Subscriptions are invoiced in advance per agreed period and renew automatically unless cancelled at least 30 days before the end of the current period, unless otherwise agreed in writing.

In the event of non-payment, Verca AB sends a reminder after the first missed payment. After two missed payments, both access to the Platform and automatic invoicing are paused until the Customer has updated payment details and full payment has been received. No refund or credit is given for started subscription periods or unused service.

Verca AB provides the Platform with the aim of high availability. Planned maintenance is communicated in advance. Specific availability commitments are set out in the SLA appendix.

Verca AB is responsible for the Platform functioning in accordance with the Agreement. The service is provided as is, except as expressly stated in the Service Level Agreement (SLA). Verca AB gives no warranties beyond what is expressly stated in the Agreement.

Verca AB is not liable for indirect damages, including but not limited to:

• Production stoppages or operational disruptions
• Loss of data outside the Platform
• Financial consequences of incorrect CE marking
• Lost sales or business opportunities
• Consequences of decisions made based on the Customer's own data and documentation

Verca AB's aggregate liability under the Agreement is limited to the amount the Customer has paid in fees during the twelve (12) months preceding the event giving rise to the claim.

Exceptions to the limitation of liability. The limitations above do not apply to:

• Gross negligence or willful misconduct on the part of Verca AB
• Verca AB's liability under Article 82 GDPR (damage caused by Verca AB as data processor in breach of GDPR)
• Breach of material confidentiality or security undertakings in the DPA or SLA
• Damage resulting from Verca AB's failure to notify a personal data incident in breach of the DPA

Verca's primary platform data is stored within the EU. When the Customer expressly enables an AI capability, data submitted to that capability may be processed by approved AI sub-processors outside the EU/EEA in accordance with the Data Processing Agreement (DPA). The Platform protects Customer Data with industry-standard security measures, including:

• Encryption at rest and in transit
• Role-based access control
• Tenant isolation at database level
• Full audit logging

Verca AB treats Customer Data confidentially and uses it solely to provide the Platform. No access or distribution takes place without the Customer's instruction. Internal handling is limited to authorised personnel.

Personal data processing is governed by a separate data processing agreement (DPA). In the event of a suspected personal data incident, Verca AB will notify the Customer without undue delay and no later than within 36 hours, in accordance with the Data Processing Agreement (DPA).

All code, functionality, documentation, design, rule data and underlying technology in the Platform belong to Verca AB and are protected by copyright and intellectual property rights.

The Customer may not:

• Copy, distribute or modify the Platform or its components
• Decompile, reverse-engineer or reconstruct code
• Transfer access to a third party without written approval from Verca AB

Customer Data remains the property of the Customer.

The Agreement may be terminated by either party with at least 30 days' written notice before the end of the current subscription period, unless otherwise agreed.

Upon termination of the Agreement, the Customer is offered the opportunity to export Customer Data during a period of 30 days after the end date of the Agreement. After this period, Customer Data is permanently deleted within 30 days, in accordance with GDPR and Verca AB's internal policy.

Verca AB may terminate the Agreement with immediate effect in the event of material breach or non-payment despite reminder.

Verca AB is not responsible for failure to perform caused by extraordinary events beyond Verca AB's reasonable control, such as government actions, cyberattacks, natural disasters, pandemic, disruption of third-party services or other force majeure situations.

Verca AB reserves the right to amend these terms. Customers will be notified at least 30 days before new terms take effect. Enterprise agreements with individual terms require written approval by both parties for any amendment.

Previous versions of the terms of use are retained internally and may be provided upon request. The Customer's commitments are governed by the version that was in effect at the time of contract signing.

These terms are governed by Swedish law.

Disputes shall primarily be resolved through dialogue between the parties. If agreement cannot be reached within 30 days, the dispute shall be settled in the Swedish general courts with Malmö District Court as the court of first instance.

The following appendices are provided as part of the Agreement upon signing:

• DPA (Data Processing Agreement) — Governs personal data processing in accordance with GDPR
• SLA (Service Level Agreement) — Specifies availability commitments, support levels and incident handling