Terms and conditions

CABLAN CRM TERMS AND CONDITIONS 1. Parties and purpose These terms govern the use of Cablan CRM, the management software for travel agencies provided by CABLAN CRM S.L., tax ID B05740691, registered at Avda. Maisonnave 41, 3º, 03003 Alicante (Spain) ("Cablan"), to the agency that subscribes ("the Agency"). By accepting them on signing up, or each new version, the Agency acts in the course of its business. 2. The service Cablan provides the software as a cloud service, with the modules, users and limits of the plan subscribed. A change that substantially reduces what was subscribed is announced at least 30 days ahead. 3. Term, cancellation and guarantee No minimum term: the plan renews every month and the Agency may cancel at any time, effective at the end of the paid period. Within 30 days of signing up, if the service does not suit it, Cablan refunds what was paid. The founder programme's conditions (40 % off for 12 months, onboarding at 50 % and list price frozen for 24 months) apply to agencies admitted to it, in exchange for a case study, a monthly feedback call and activation within 30 days. 4. Price, invoicing and non-payment The price is that of the plan and seats, plus taxes, invoiced monthly by Cablan's own VERI*FACTU system. If a payment fails, Cablan warns and retries; if it remains unpaid, the Agency's team becomes read-only and, later, the account may be suspended. The Agency's clients are never told and can keep paying it. 5. Data of the Agency's clients The Agency is the controller of its clients', travellers' and suppliers' personal data, and Cablan processes it on the Agency's behalf as processor under Annex I, which is part of these terms. 6. Cablan support's access Cablan's support only enters the Agency's account with its permission, which expires, and read-only unless the Agency allows otherwise. It cannot move money, send messages to clients or suppliers, change users, integrations or credentials, or export data. Every session is logged and the Agency is notified. 7. The Agency's collections from its clients Card and Bizum payments are taken by the Agency with its own Stripe account, contracted with Stripe, or with its bank's virtual POS on Redsys. Cablan never receives or holds that money nor stores card data. 8. The Agency's invoicing (VERI*FACTU) The Agency is the taxpayer of the invoices it issues from Cablan. Cablan is the producer of the invoicing system and publishes each version's responsible declaration at https://cablancrm.com/acerca. 9. Artificial intelligence The artificial intelligence features are off until the Agency turns them on. What they draft carries the mark "Generated with AI" and the Agency reviews it before using or sending it: AI sends nothing by itself. The model provider processes the data in the European Union and does not train on it. What it does, with what data and what falls to the Agency under articles 4 and 50 of Regulation (EU) 2024/1689 is explained at https://cablancrm.com/legal/ai. 10. Availability, backups and exit Cablan makes encrypted copies of each agency's data: a daily one, kept for 30 days, and a weekly one with a second provider, kept for 12 weeks. The Agency can download its data at any time from Settings › Backups and, after cancelling, for 30 days; then it is deleted, and its copies go as they expire. What the law requires to keep stays: the invoicing records, as Annex I says. 11. Liability Cablan's total liability for any cause is limited to what the Agency paid in the previous 12 months, save wilful misconduct or gross negligence. 12. Changes to these terms Terms are published by versions at https://cablancrm.com/legal/terms. Cablan tells the owner of a new version at least 30 days ahead; if the Agency does not agree, it may cancel at no cost before it comes into force, and using the service afterwards means accepting it. 13. Law and jurisdiction Spanish law; the courts of Alicante. ANNEX I — DATA PROCESSING AGREEMENT (art. 28 GDPR) Cablan processes, on the Agency's behalf and for as long as the service lasts, the data needed to provide the software. Data: identity and contact details; travel documents; trips, payments and invoices (never card data); preferences; and, when the Agency collects them, health data such as diets or allergies, with the reinforced measures of Annex II. Data subjects: clients, travellers, company and supplier contacts, and the Agency's users. Cablan acts only on the Agency's documented instructions, keeps confidentiality, applies Annex II's measures, helps with data subjects' rights (the software exports and erases a person's data) and impact assessments, notifies a breach without undue delay and if possible within 48 hours, deletes or returns the data at the end and provides evidence of compliance. Cablan's staff only enter with the Agency's permission and on the terms of clause 6; every session is logged and the Agency sees it in its activity log. Authorised sub-processors: OVHcloud (hosting of the data, including the copies of the emails the software keeps, and the weekly copy, EU); Cloudflare (network, protection and R2 storage with EU jurisdiction of the copies, the exports and the fiscal archive); Amazon Web Services EMEA (email with SES in Ireland and AI with Bedrock in the EU); Verifacti (sending invoicing records to the AEAT); Functional Software (Sentry, logging the software's technical errors in its EU region, Germany, without the data of clients or travellers: internal identifiers only); and, only if the Agency turns it on, Recall.ai (meeting recording and transcription). Changes are announced 30 days ahead and the Agency may object. Providers the Agency contracts directly (Stripe, its bank, Microsoft 365 or its mail server, CloudTalk, MailerLite) are not Cablan's sub-processors. No transfers outside the EEA without the safeguards of chapter V GDPR. End of the contract and fiscal archive: at the end, the Agency downloads its data, its fiscal archive included (invoices, PDF and XML), for 30 days; then Cablan deletes it and its copies go as they expire. Cablan keeps the Agency's ledger of invoicing records, encrypted and with no access, for six years from the end of the financial year of its last invoice, only to make it available to the Agency or the Administration, unless the Agency asks for it to be returned and deleted. Verifacti deletes the XML 30 days after the Agency leaves. ANNEX II — SECURITY MEASURES One database and one user per agency; encryption in transit and of sensitive data at rest; encrypted daily backups with a key not stored on the server; staff access with two-factor authentication and logging; support access only with the Agency's permission; per-agency activity log; and periodic security reviews.