Terms of service

1.Who provides the service

Axperts Dariusz Zalewski, ul. Pelikana 1/3, 71-698 Szczecin, Poland, a sole proprietorship entered in the Polish CEIDG register, NIP 851 319 2109, REGON 363785540.

Email [email protected], telephone +48 789 072 764. Email is the channel for everything in these terms, including notices and complaints.

2.Definitions

Service

means the QuickISO application at quickiso.app and its regional addresses, the QuickISO apps for iPhone and Android, and the documentation and support provided with them.

Customer

means the organization that enters into the agreement, including a person conducting business activity who registers for that business.

User

means a natural person who has an account and uses a Workspace, whether they registered themselves or were invited by a Customer.

Workspace

means the separated area in which one Customer's management system data lives.

Customer Content

means everything the Customer or its Users put into a Workspace: the organization profile, the scope, assessment answers, risks, actions, evidence files, documents, comments and any other data they supply.

Trial

means the free initial period of a Workspace, described in section 8.

3.What the Service is, and what it is not

The Service helps an organization build, operate and evidence a management system based on a standard such as ISO/IEC 27001, and prepare for a certification audit conducted by an independent accredited certification body.

The Service is not a certification body, does not issue certificates, does not audit, and does not and cannot guarantee any audit result. Nothing in the Service or in its marketing is a promise that the Customer will be certified.

The readiness figure the Service calculates is an indication derived from answers and evidence the Customer supplies, shown together with its inputs, its coverage and its uncertainty. It is not an opinion on conformity and not a prediction.

The Service does not supply the text of any standard. See section 10.

4.Who may use the Service

The Service is provided to organizations for purposes connected with their business. It is not addressed to consumers. A User must be at least 18 years old.

Where the Customer is a natural person conducting business activity and the agreement is not of a professional character for them, mandatory provisions of Polish law protecting such a person apply regardless of these terms.

5.Technical requirements

A current version of a widely used web browser with JavaScript and cookies enabled, and an internet connection. The mobile application requires an iPhone with iOS 17 or later, or a device with Android 10 or later. Two factor authentication requires an authenticator application that supports TOTP.

6.Accounts and security

Registration. A person may create an account for use in their business, or for the organization they work for, with an email address and a password, or with a Google account. We decide when registration is open and may close it at any time. While it is closed, accounts are created only by invitation from a Customer, and signing in with Google works only for an existing account: one that already has that provider connected, or one whose address the provider is authoritative for, which is connected after that account's own two factor code, as the privacy policy describes. Creating an account, or accepting an invitation, means accepting these terms in the version shown, and we record which version that was.

One person, one account. An account belongs to one natural person and must not be shared. Every person who needs access gets their own account, through their own registration or an invitation from the Customer. The details given at registration must be true, and the email address must be one the person receives mail at.

Security. Two factor authentication is mandatory for every account and cannot be switched off. Signing in with Google replaces the password only: the Service still asks for its own code. The Customer and its Users are responsible for keeping credentials, authenticator devices and recovery codes secure, and must tell us at [email protected] without undue delay if they believe an account has been compromised.

Abuse. Accounts must not be created automatically or in bulk, with a disposable email address, or to get around a limit or a suspension. We may limit the number of new accounts, the number of Workspaces one person can create and the storage a Workspace uses, and we show the limits that apply in the Service. We may refuse a registration, or suspend an account, that breaks this paragraph, and section 9 applies to it as well.

Deletion. A User may delete their own account at any time, in the app or on the web, as the account deletion page describes. The account is deactivated at once and erased after 30 days, during which signing in offers to cancel the deletion. A User who is the only owner of a Workspace decides, before the account is deleted, whether that Workspace is deleted with it or whether someone else becomes an owner first. An owner may also delete a Workspace on its own, with the same 30 day period, during which the Workspace can only be read and its members are told.

Export. A User may download the data of their own account at any time. The owners of a Workspace may export all of its content, with its evidence files, for as long as the Workspace exists; each export stays available for 7 days.

The Customer decides which of its people have which role in its Workspace, and is responsible for those choices. Separation of duties is enforced by the Service in specific places: a person cannot approve their own document, their own scope, their own "not applicable" decision or their own evidence.

7.Conclusion and termination of the agreement

The agreement is concluded when a person authorized by the Customer accepts these terms and an account is created, or when a separate written agreement says so. A person who registers and creates a Workspace for their business does so on that business's behalf and confirms they may.

The agreement is concluded for an indefinite period. Either party may terminate it for convenience with 30 days' notice by email; the Customer may also end it by deleting its Workspaces, and a User by deleting their account, as section 6 describes. We may terminate with immediate effect if the Customer materially breaches these terms, in particular section 9 or section 10, and does not cure the breach within 14 days of being asked to.

For 30 days after termination the Customer may export its Workspace from within the Service, or ask us in writing for a copy, which we produce within that period. After it, we delete the Workspace, and backups containing it expire on the schedule stated in the privacy policy.

8.Trial and fees

Every new Workspace we set up starts with a Trial, so the Customer can judge the Service before paying for it.

1. The Trial is free of charge and lasts 30 days unless we agree a different period. We state its end in the invitation to the Workspace and remind the Workspace's owners a week and a day before it.
2. After the Trial the Service is paid, on the plan and at the price agreed with the Customer in writing or by email before any fee becomes due. Without such an agreement we charge nothing, and the Customer is under no obligation to continue using the Service.
3. When a Trial ends without an agreed plan, the Workspace keeps working for 3 more days and then becomes read only: nothing is deleted, the Customer and its Users still see everything in it, and its owners can still take a full export (section 6). Agreeing a plan or extending the Trial restores full use.
4. There is no service level agreement and no availability commitment unless the parties agree one in a separate written agreement. We aim to keep the Service available and we do not promise a figure we do not yet measure.
5. Features may change or be withdrawn. A withdrawal that removes something the Customer relies on will be announced at least 30 days in advance, except where it must be removed for security or legal reasons.
6. The Customer is responsible for keeping its own copies of information it cannot afford to lose; a full export of a Workspace is available in the Service for as long as the Workspace exists (section 6).

9.What the Customer may not do

The Customer and its Users must not:

1. supply unlawful content, which is prohibited by article 8(3)(2)(b) of the Act on providing services by electronic means;
2. upload content they have no right to upload, including copies of standards they are not licensed to store on a third party platform (see section 10);
3. attempt to reach another organization's Workspace, to circumvent access controls, or to probe, scan or test the Service's security without our written permission, except as our vulnerability disclosure policy allows;
4. use the Service to build a competing product, or extract its content systematically;
5. upload malware, or use the Service to distribute it;
6. present output of the Service as a certificate, an audit opinion or a statement of conformity.

We may suspend access without notice where necessary to protect the Service or other customers, and we will explain why as soon as we can.

10.Standards and licensed content

The Service references standards by identifier and supplies QuickISO's own original guidance. It does not supply, reproduce or make available the normative text of any standard.

The Customer must hold its own licence for any standard it works with, obtained from ISO, IEC, the Polish Committee for Standardization (PKN) or an authorized distributor.

The Customer must not upload a copy of a standard unless its licence permits storage on a third party platform, and must attest to that when asked. We may refuse, quarantine or delete an upload that appears to be a copy of a standard, and we will tell the Customer why.

11.Artificial intelligence and drafts

Where the Service generates a document, the result is a draft. It is marked as a draft, it records what it was generated from, and it becomes a document of the Customer's management system only when a competent person authorized by the Customer approves it. We do not warrant that a draft is correct, complete or suitable, and approving it is the Customer's decision and responsibility.

Today drafts are produced from deterministic templates. Before any language model is used we will update the privacy policy and these terms, state which provider receives what, and meet the transparency obligations of article 50 of Regulation (EU) 2024/1689.

12.Customer Content

The Customer keeps all rights in Customer Content. The Customer grants us the limited licence needed to host, process, display, back up and transmit it in order to provide the Service, and for no other purpose. We do not use Customer Content to train models, and we do not sell it or share it with anyone except the sub-processors named in the privacy policy.

The Customer is responsible for having a lawful basis for the personal data it puts into its Workspace and for informing the people concerned.

13.Personal data

Where we process personal data as controller, the privacy policy applies. Where we process personal data on the Customer's instructions, as processor, the data processing agreement applies and forms part of this agreement.

14.Confidentiality

Each party will keep the other's confidential information confidential, use it only to perform this agreement, and protect it with at least the care it applies to its own. This does not apply to information that is public without breach, was already lawfully known, is independently developed, or must be disclosed by law, in which case the disclosing party will be told unless the law forbids it.

15.Availability, maintenance and support

We may carry out planned maintenance, and will announce it at least 48 hours in advance where it will interrupt the Service, except for urgent security work.

Support is by email at [email protected]. We aim to answer within two business days; a committed response time requires a separate written agreement.

16.Liability

We are liable for damage we cause by failing to perform this agreement with due care, on the terms of the Polish Civil Code.

To the extent Polish law allows, we are not liable for lost profit, lost business, lost data where the Customer had a reasonable means of keeping its own copy, or indirect damage.

Nothing in these terms limits liability for damage caused intentionally, which article 473 § 2 of the Polish Civil Code does not allow to be excluded, for personal injury, or for anything else that cannot be limited by law.

The Customer is liable to us for damage arising from content it supplies in breach of section 9 or section 10, including third party claims.

17.Complaints

A complaint may be made by email to [email protected] and should describe the problem, when it happened and what the Customer expects. We confirm receipt and answer within 14 days. If a complaint needs longer, we say so within those 14 days and give a date.

This procedure is required by article 8(3)(4) of the Act on providing services by electronic means and does not affect any other remedy.

18.Changes to these terms

We may change these terms for a valid reason, including a change in law, a change in the Service, or a security requirement. We will publish the new version and notify the Customer by email at least 30 days before it takes effect, except where a change must take effect sooner by law. The Customer may terminate before the change takes effect, and continuing to use the Service after it takes effect means accepting it. The Service also asks each User once to accept the new version, and records the answer.

19.Governing law and disputes

Polish law governs this agreement. Disputes go to the court having jurisdiction over the seat of the service provider, unless a mandatory provision says otherwise.

20.Miscellaneous

If a provision is invalid, the rest stands and the invalid provision is replaced by the lawful provision closest to its purpose. The Customer may not assign this agreement without our written consent; we may assign it to a successor of the business, and will tell the Customer.

These terms, the privacy policy and the data processing agreement are the whole agreement between the parties on their subject matter.

Version history