Terms & Conditions
Terms applicable to the CRAnotify subscription. For clients with a negotiated contract, the signed agreements prevail.
The clause that matters most of all
CRAnotify does not transmit communications to the authorities on the client’s behalf. Filing with the single reporting platform, the decision to notify and the content of the notification remain acts of the manufacturer, who retains full responsibility for them pursuant to articles 13 and 14 of Reg. (EU) 2024/2847.
1. Subject
These terms govern the access to and use of the CRAnotify application, provided as software as a service, and of the ancillary services described in the subscribed plan. Together with the order and the data processing agreement, they constitute the entire agreement between the parties.
2. Nature of the service and client’s responsibility
The application is an organisational and documentary support tool. It does not constitute legal advice and does not replace the client’s assessment of the existence of obligations. The client remains solely responsible for the qualification of events, the content entered, the filing of communications with the competent authorities and compliance with deadlines.
The company does not guarantee the client’s compliance with Reg. (EU) 2024/2847 or the outcome of any proceedings: it guarantees that the tool works as described and that the data entered is stored with demonstrable integrity.
3. Activation, trial and term
The free trial lasts fourteen days, requires no payment method and does not automatically convert into a subscription. The subscription starts from activation and renews tacitly for periods equal to the one subscribed, unless cancellation is communicated before the end of the current period.
4. Fees and billing
The fee depends on a single variable: the number of Managed Products active in the client's workspace at the time of subscription, according to the published price list, excluding VAT. A Managed Product is the product; SKUs, GTIN/EAN identifiers, regional variants, hardware revisions and firmware releases are managed within it and are not billed separately. Neither the number of user accounts, nor the number of reports, cases, SBOMs or vulnerabilities found affects the fee. Payment is made by card through the payment service provider; on request, bank transfer, invoice at thirty days, SEPA direct debit and orders by decree for public administration are available.
The fee applied is always the one computed by the provider from the client's declared perimeter: an amount transmitted by the client's browser is never accepted as the basis for billing. Above the threshold stated in the price list the fee is agreed in writing rather than listed.
Annual billing is charged as ten monthly instalments for twelve months of service.
Price changes are communicated with at least sixty days’ notice and apply from the following renewal; the client may withdraw at no cost within that period. A subscription in force keeps the version of the price list under which it was signed: publishing a new price list does not, by itself, change an existing subscription.
5. Change of perimeter
There are no plan caps: registering a Managed Product is never refused, and neither user accounts nor cases, reports or SBOMs are capped. Preventing the client from declaring its actual CRA perimeter would prevent precisely what the service is for.
When the number of active Managed Products changes, the application shows the effect on the fee before the change is confirmed. The effect on invoicing follows the terms of the subscription in force and the payment service provider's rules; no usage-based charge that has not been agreed is ever applied.
Archiving a Managed Product removes it from the active perimeter and from the billable count, but deletes nothing: history, evidence, cases, activity log, SBOM history and documents are retained under section 7. Archiving is not a means of erasing records.
Options agreed separately from the price list — enterprise identity federation (SSO/SAML, SCIM), white-label, dedicated service levels and dedicated support — are governed by the specific agreement signed with the client.
6. Permitted use
The client undertakes not to attempt unauthorised access, not to subject the infrastructure to security testing without written agreement, not to enter unlawful content and to keep credentials confidential. Sharing a user account among several individuals is not permitted; the number of user accounts is not capped and does not affect the fee.
7. Data ownership and portability
The data entered remains owned by the client. At any time during the relationship the client can export the activity log in CSV format and generate the defensive dossiers in PDF. Upon termination the data remains available for ninety days, then it is deleted; on written request we provide a complete export within ten business days.
8. Intellectual property
The application, its code, the interface, the documentation and the materials provided remain the property of the company. The client receives a non-exclusive, non-transferable right of use limited to the duration of the subscription. The content produced by the client through the tool, including communications and dossiers, belongs to the client.
9. Confidentiality
Each party treats as confidential the other’s information of which it becomes aware, for the entire duration of the relationship and for the five years thereafter. The obligation does not apply to information that is public or whose disclosure is required by law or by an authority.
10. Limitation of liability
Except in cases of wilful misconduct and gross negligence, the company’s total liability towards the client is limited to the fees paid in the twelve months preceding the event. Liability for indirect damages, loss of profit, administrative penalties imposed on the client and consequences of qualification or filing decisions made by the client is excluded.
11. Suspension and termination
The company may suspend access in the event of persistent non-payment after a reminder, use in breach of article 6 or a concrete risk to the security of the infrastructure. Suspension does not affect the client’s right to obtain the export of the data. Either party may terminate for serious breach not remedied within thirty days of the written notice.
12. Applicable law and jurisdiction
The contract is governed by Italian law. For disputes with parties acting within their professional activity, the court of Milan has exclusive jurisdiction; the mandatory protections provided for consumers remain unaffected. Before going to court, the parties undertake to attempt a settlement with a meeting, including remotely, within fifteen days of the written request.
Service levels
| Availability | 99.5% on a monthly basis, excluding scheduled maintenance communicated with 48 hours’ notice and carried out during the CET night-time window. |
|---|---|
| Response time | One business day. Where a dedicated service level has been agreed in writing, the times set out in that agreement apply. |
| Critical outages | If the unavailability prevents preparing a communication due within 24 hours, we activate the emergency channel and assist the client until they have the content of the communication in a form they can file manually on the single reporting platform. |
| Remedy | Below the monthly threshold, a credit equal to 10% of the month’s fee for each missing percentage point, up to 50%. |
| Backups | Daily, encrypted, with periodic restore testing. Recovery target: 4 hours. Maximum tolerated data loss: 1 hour. |
Intarmour® di Simone Nogara · Via Morazzone 4, 22100 Como (CO), Italia · PEC info@pec.intarmour.com. Previous versions available on request. See also Privacy Policy and AI Notes.