Terms and Conditions of Service

Composer Fly and Signer Fly — DoConure products

Language versions. This document is drafted in Italian and is also published in English. The English version is a translation provided for convenience only: in the event of any conflict or doubt as to its interpretation, the Italian version shall prevail.

1. Definitions#

2. Subject matter and conclusion of the contract#

2.1 This contract governs the Client's use of the Service.

2.2 The contract is concluded when the Client completes registration at https://app.doconure.com/signup and accepts these Terms, together with the specific approval of the clauses listed at the end.

2.2.1 The Service is reserved for persons acting in the course of their business, commercial, craft or professional activity and is not offered to the Consumer, that is the natural person acting for purposes outside that activity (art. 3(1)(a) of Italian Legislative Decree 206/2005). Whoever registers declares that they act in that capacity and have the authority to bind the Client; the declaration is recorded together with the acceptance. The Client is invoiced to a VAT number.

2.2.2 The Provider may close, giving notice, an Account that turns out to be used by a Consumer, returning the Credits purchased and not spent. The mandatory provisions of law remain unaffected.

2.3 Whoever registers declares that they have the authority to bind the Client.

2.4 The following form an integral part of the contract: the SLA, the Privacy Notice, the Data Processing Agreement with its list of sub-processors, the Cookie Policy and, for those who buy a subscription, the Subscription conditions.

2.5 How acceptance is given. Acceptance is given by ticking two separate boxes that are not pre-ticked: the first for these Terms as a whole, the second for the specific approval of the clauses listed at the end under Articles 1341 and 1342 of the Italian Civil Code. Without both the Account is not created. For every acceptance the Provider records the date, time, IP address, User, version and cryptographic fingerprint of the text accepted, and makes it available to the Client in its console.

2.6 New versions. Once a new version is published under art. 18, access to the console requires a new acceptance. Use of the API with a key already issued is not interrupted: suspending an integration in production because of a contractual change would be a harm out of proportion to the notice that causes it.

3. Description of the Service#

3.1 The Service makes it possible to (a) generate documents in PDF format from templates and data supplied by the Client; (b) send those documents — or Documents Uploaded by the Client — to one or more Signers for signature with a simple electronic signature; (c) keep the evidence of the signing process and make it verifiable; (d) if the Client asks for it, apply the Seal and a qualified timestamp to the Sealed Document (art. 4.7).

3.2 The Service is provided as software as a service. No software is delivered to the Client.

3.2-bis The Signer signs on a secure public page hosted by the Provider, reached through the link they receive.

3.3 The Provider may modify, improve or replace components of the Service. Changes that substantially reduce functionality in use are notified with at least 30 days' notice.

4. Level of electronic signature — essential clause#

4.1 The signatures the Service collects from Signers are exclusively simple electronic signatures (SES) within the meaning of art. 3(10) of Regulation (EU) 910/2014 ("eIDAS"), as amended by Regulation (EU) 2024/1183.

4.2 The Service does not produce advanced electronic signatures (AES) or qualified electronic signatures (QES). Where the Client asks for those levels through the API, the Service refuses the request with an explicit error and never downgrades the signature to a level lower than the one requested.

4.3 Alongside each signature the Service produces and keeps: the record of the events of the process with date, time and IP address; the identity verification method actually applied to each Signer; a certificate of completion attached to the document; the SHA-256 cryptographic fingerprint of the Sealed Document; a public verification page that recomputes that fingerprint on an uploaded file.

4.4 The Client acknowledges that a simple electronic signature, under art. 25 eIDAS, shall not be denied legal effect and admissibility as evidence in legal proceedings solely on the ground that it is in electronic form, but that its evidential value is freely assessed by the court. If it is repudiated, the burden of proving that the signature belongs to its author lies with whoever intends to rely on it.

4.5 It is the Client's sole responsibility to check that the simple level of signature is adequate for the documents it intends to have signed. For acts for which the law requires written form ad substantiam or a digital or qualified signature, the simple signature is not suitable. The Provider does not advise on that suitability.

4.6 The Client owns the relationship with its own Signers and is responsible for informing them about the signing method and about the processing of their data.

4.7 Qualified seal and timestamp (optional). The Client may ask, for a signing request, that the Sealed Document bear the Seal and a qualified electronic timestamp. The Seal is applied by the Provider, a legal person, with a qualified certificate issued by a qualified trust service provider (Namirial S.p.A.) through an intermediary (Openapi S.p.A. Unipersonale): it attests the origin and integrity of the file (art. 35(2) eIDAS) and, with the timestamp, the date and time (art. 41(2)). It does not turn the Signer's signature into an advanced or qualified signature and does not mean that the Provider certifies the content of the document. To apply it the whole document is transmitted to the intermediary and to the provider (see the list of sub-processors): the Client, by asking for it, authorises this. If the Seal or the timestamp is not applied, the signature remains valid as a simple signature, the Sealed Document is delivered without them and the fee is returned (art. 8.9).

5. Account, credentials and API keys#

5.1 The Client is responsible for keeping its credentials and API keys confidential. Every activity carried out through them is presumed to be carried out by the Client.

5.2 API keys are shown only once when issued and kept by the Provider exclusively in hashed form: they cannot be recovered, only revoked and reissued.

5.3 The Client reports any suspected compromise without delay, to the address stated in art. 17.

6. Client Content and templates#

6.1 The Client retains every right in the Client Content. The Provider acquires only the non-exclusive licence, limited to the term of the contract, to host, process and transmit it for the sole purpose of providing the Service.

6.2 The Client warrants that it holds all the necessary rights in the Content and that the Content does not infringe third-party rights or mandatory rules.

6.3 A template is executable code. The templates uploaded by the Client contain expressions that are evaluated by the Service. The Provider adopts isolation measures (a restricted execution environment, blocking of network and filesystem access from the rendered content). The Client refrains from uploading templates that attempt to circumvent those measures and acknowledges that such conduct is a serious breach.

6.3-bis Uploaded Documents. The Client may upload PDF files so that they are signed. The Service checks their format and size and keeps them encrypted, in the Client's Account and not visible to other clients. The Client warrants that it has the right to submit them for signature and to process the personal data they contain (art. 10). An Uploaded Document is kept for 30 days from upload (the Client may ask for a different period, up to 365 days), unless it has been signed in a signing process: in that case it is kept for as long as the evidence of that process is needed and art. 16.3 applies. The Service does not modify the content of the uploaded document; it does not check its content or its legal suitability.

6.4 The Provider does not use the Client Content for its own purposes, including the training of models, aggregate analyses resold to third parties or marketing.

7. Permitted use#

7.1 The Client refrains from: (a) using the Service for unlawful purposes or for documents with unlawful content; (b) attempting to access other clients' data; (c) subjecting the Service to security testing without prior written authorisation; (d) sending unsolicited communications to Signers; (e) reselling the Service to third parties without a written agreement; (f) circumventing usage limits and quotas.

7.2 The Provider may suspend the Account, with simultaneous notice, in the event of a breach that entails an imminent risk to security or to other clients. The suspension is limited to the time necessary.

7-bis. Inactivity, archiving and anonymisation#

7-bis.1 What counts as activity. Only the last successful production operation charged in Credits counts. Signing in to the console, use in test mode, a purchase, a change of settings, a failed call and an action of the Provider do not count. For an Account that has never carried one out, the count runs from its creation (or from its approval, if registration required one).

7-bis.2 Notices. The Provider writes to the Users of the Account after 12, 18 and 23 months of Inactivity, and again 7 days before archiving.

7-bis.3 Archiving (24 months). After 24 months of Inactivity the Account is archived. Archiving is reversible and takes nothing away: access, API keys, automatic notifications (callbacks) and all processing are suspended, but the data and the Credits remain unchanged. The Client may ask for reactivation from the sign-in page; the request is checked by the Provider. A reactivation does not reset the period of Inactivity: the Account is protected from a new archiving for 30 days.

7-bis.4 Anonymisation. An Account archived for 5 years (about 7 years of total Inactivity) is anonymised, after a further notice sent 30 days before; it is also anonymised, at any time, at the Client's verified request. Anonymisation is irreversible: the operational identity is removed, keys and secrets are destroyed, the remaining Credits are lost and are not refundable, and to use the Service again one has to register again. It is not carried out while a signing process is in progress or an order is awaiting payment. An Account with a negative Credit balance is not anonymised automatically: the Provider assesses the case and may proceed, waiving its remaining claim (write-off), or keep the Account archived; in either case the decision is recorded.

7-bis.5 What is kept after anonymisation. (a) Accounting and tax records — orders, invoices, statements, VAT adjustments, billing data and the record of the acceptance of the Terms — for 10 years from the end of the calendar year of the last record (art. 2220 of the Italian Civil Code), then deleted; (b) the evidence of signing processes, for 10 years, as in art. 16.3, then made anonymous; (c) the ledger of Credit movements, which contains numbers and identifiers and not people; (d) the audit trails, which in order to be tamper-evident are chained to one another and cannot be modified and may contain IP addresses; (e) statistics free of personal data. For the details see the Privacy Notice.

8. Fees, credits and invoicing#

8.1 The Service is measured in Credits according to the price list published at https://app.doconure.com/legal/prezzi, which forms an integral part of the contract.

8.2 The Service is prepaid: every operation uses the Credits available on the Account, and the Service refuses operations when the credit is exhausted, with no charge.

8.3 Fees are stated excluding VAT. Payment is due within 30 days of the invoice date, save for purchases of Credit packs under art. 8.6, which are paid at the time of purchase. In the event of late payment the interest of Italian Legislative Decree 231/2002 applies.

8.4 The Provider may change the price list with 60 days' notice. A Client that does not accept it may withdraw without charge within that period.

8.5 Some operations entail a cost for the Provider towards third parties (sending SMS, timestamps, seals). Their consumption is measured separately and stated in the price list. The Seal and the qualified timestamp are paid in Credits when the signing request is sent, together with the signature: the Service refuses the sending if the Credits are not enough to cover it all, and charges nothing afterwards.

8.6 Purchase of Credit packs. From the console the Client may buy Credit packs at the price stated in the price list at the time of the order. The order is paid at once through the payment provider stated on the payment page (Revolut); card details do not pass through the Provider's systems and the Provider does not keep them: they are typed into the payment provider's page or form, and the Provider receives and keeps only a reference (token) to the card, its expiry (month and year) and the last four digits, in order to make the payments the Client has asked for (renewals of a subscription) and to notify the Client before expiry. At the time of a payment the Client may use the saved card or add a new one, which replaces the previous one; the Client may delete the card at any time (automatic renewal of the subscription is switched off, the Client is informed and the prepaid service continues, but purchases will again require a card). Credits are added automatically when the payment succeeds and an invoice is issued. An unpaid order expires and credits nothing.

8.7 Credits do not expire merely through the passage of time, are not transferable to other Accounts and are not refundable in money, save as provided by art. 15.2, art. 8.9, art. 2.2.2 and the mandatory rules. The only exception to non-expiry is art. 7-bis.4: the remaining Credits are lost on the anonymisation of the Account, which takes place only after a long period of Inactivity and archiving and after the notices stated there. The Service is sold only to those acting for professional purposes: the right of withdrawal and the other protections reserved to the Consumer by the Italian Consumer Code (arts. 52 ff. of Legislative Decree 206/2005) do not apply. The Provider remains liable for Credits wrongly charged, which are returned to the same Account, and art. 8.9 remains unaffected.

8.8 The price of a pack is the one shown at the time of the order and stated on the order itself: a later change of the price list does not affect purchases already made.

8.9 When Credits come back. The Client pays first for what it uses; if a process does not succeed because of a fact of the Service, the unused part is credited back, and every re-credit leaves a trace in the ledger of movements and in the Service's error log. In particular: (a) an operation that does not succeed is not charged; (b) the fee for the Seal and the timestamp is returned, to the same Account and to the same batch of Credits, when it is not applied (for example because the provider does not respond), immediately and without request when the outcome of the request to the provider is uncertain (the response was lost: the risk is the Provider's), and when the signing request is withdrawn by the Client, expires or is declined by the Signer; (c) the fee for the signature is not returned in this last case, because the Service was rendered by the sending; (d) Credits wrongly charged are returned (art. 8.7). Credits are never refunded in money, save for the mandatory rules of law and as provided by art. 15.2 and by art. 6.3 of the DPA.

8.10 Promotional Credits. Free Credits (initial allowance, rewards and commercial gestures) are Credits in every respect: they may pay for any service, including pay-per-use ones such as the Seal and the qualified timestamp, according to the price list, and they are used after the purchased ones. They are not refundable or transferable, and do not give a right to an invoice. The Provider may change or withdraw the offer for the future, without touching the Credits already credited.

8.11 Subscriptions. The Client may buy a subscription plan, which is paid by card, has an allowance per term and renews on the terms of the Subscription conditions, which the Client accepts before every purchase. The prepaid service in Credits continues to exist alongside the subscription.

9. Service levels#

Governed by the SLA. The Client acknowledges that the Service is delivered from a non-redundant infrastructure and that the levels offered reflect that architectural choice, declared and not hidden.

10. Protection of personal data#

10.1 In providing the Service the Provider acts as processor under art. 28 GDPR for the data of Signers and for the personal data contained in documents; the Client is the controller.

10.2 The relationship is governed by the DPA, which is deemed signed at the same time as these Terms.

10.3 For the data relating to the Account and to invoicing the Provider is an independent controller: see the Privacy Notice.

10.4 The Client authorises the use of the sub-processors in the published list, including the transmission of the document to the intermediary and to the provider of the Seal when it asks for it (art. 4.7). The Provider notifies every change of the list with the notice of § 6.3 of the DPA.

11. Confidentiality#

11.1 Each party keeps confidential the information of the other that comes to its knowledge, for the term of the contract and for the 5 years that follow.

11.2 The obligation does not apply to information that is public, already known, lawfully obtained from third parties, or whose disclosure is required by law — in that last case with notice to the other party, where permitted.

12. Intellectual property#

12.1 The Service, the software, the documentation and the trademarks Composer Fly, Signer Fly, Document Fly and Limepeak remain the exclusive property of the Provider.

12.2 No provision transfers to the Client any right other than the right to use the Service for the term of the contract.

12.3 The Provider does not name the Client as a reference without written consent.

13. Warranties and exclusions#

13.1 The Provider warrants that it provides the Service with the professional diligence required and in accordance with the published documentation.

13.2 The Provider does not warrant that the Service is free of interruptions or errors, nor that the documents produced are suitable for the legal purposes the Client pursues, nor the outcome of any dispute concerning the signatures collected.

13.3 In particular, and without this limiting the liabilities provided by law, the Provider is not liable for the failure to deliver email messages or SMS attributable to third-party operators, to spam filters or to wrong addresses and numbers supplied by the Client. The Service shows the delivery status it has.

14. Limitation of liability#

14.1 The Provider's total liability, on any ground, is limited to the fees actually paid by the Client in the 12 months preceding the event giving rise to it.

14.2 The Provider is not liable for indirect damage, loss of profit, loss of opportunity or reputational damage.

14.3 The limitations do not apply in the event of wilful misconduct or gross negligence, nor in the cases where the law does not allow them to be limited, nor to the penalties arising from breaches of the GDPR attributable to the Provider, which are governed by the DPA.

14.4 The Client holds the Provider harmless from third-party claims, Signers included, arising from the Client Content or from use of the Service in breach of these Terms.

15. Term, withdrawal, termination#

15.1 The contract is for an indefinite term unless otherwise agreed.

15.2 The Client may withdraw at any time with effect from the end of the current invoicing period. The remaining prepaid credit is not refundable unless the law provides otherwise, and is lost in the cases of art. 7-bis.4.

15.3 The Provider may withdraw with 90 days' notice.

15.4 Each party may terminate under art. 1456 of the Italian Civil Code in the event of a serious breach not remedied within 15 days of a formal notice.

16. Consequences of termination — return and deletion#

16.1 For 30 days from termination the Client may export its documents and the signing evidence through the functions of the Service.

16.2 Once that period has passed the Provider deletes the Client Content, save as follows.

16.3 The evidence of completed signing processes is kept for 10 years from the closing of the matter, also after the termination of the contract, as it is necessary to prove the validity of the signatures collected. Once that period has passed the personal data it contains is deleted or made anonymous, keeping only the elements that make it possible to verify the existence and integrity of the document. The period is stated in art. 4 of the DPA and is the subject of a specific instruction of the Client as controller.

17. Notices#

17.1 Notices to the Provider are sent to doconure@limepeak.it and, for formal ones, to the certified email (PEC) sdlgroup@legalmail.it; technical support and ordinary requests to doconure@limepeak.it.

17.2 Notices to the Client are sent to the address stated in the Account. It is the Client's responsibility to keep it up to date.

17.3 Security reports: doconure@limepeak.it.

18. Changes to the Terms#

18.1 The Provider may change these Terms giving 30 days' notice.

18.2 A Client that does not accept may withdraw without charge within that period; use of the Service after the entry into force counts as acceptance.

19. Assignment#

The Client may not assign the contract without written consent. The Provider may assign it to group companies or in the event of extraordinary transactions, giving notice. The Client acknowledges that a change of the Provider's company name is in progress, which does not affect the continuity of the contract.

20. Governing law and jurisdiction#

20.1 The contract is governed by Italian law.

20.2 For every dispute with the Client the Court of Catania has exclusive jurisdiction.

21. Final provisions#

21.1 The invalidity of a clause does not affect the remaining ones.

21.2 Tolerating a breach does not amount to a waiver.

21.3 The contract, with its annexes, supersedes every prior understanding.

Specific approval under Articles 1341 and 1342 of the Italian Civil Code#

The Service collects the approval with a second box, separate and not pre-ticked, beside the one for the Terms as a whole (art. 2.5).

Under and for the purposes of Articles 1341 and 1342 of the Italian Civil Code, the Client specifically approves the clauses:

4 (level of signature, Seal and evidential value) · 7.2 (suspension) · 7-bis (inactivity, archiving and anonymisation with the loss of Credits) · 8.7 (Credits not refundable) · 13 (exclusions of warranty) · 14 (limitation of liability) · 15.3 (withdrawal by the Provider) · 15.4 (express termination clause) · 16.3 (ten-year retention of the evidence) · 18 (unilateral changes) · 19 (assignment) · 20.2 (exclusive jurisdiction).