Terms and conditions

Effective date: October 2026

These Terms and Conditions (“Terms”) govern your access and use of the C2 All-in-One Human Resource Information System (HRIS) Platform (“Platform”) provided by Agile Futurist (“C2,” “we,” “us,” or “our”), a sole proprietorship registered under the laws of the Netherlands with its principal place of business in Cuijk, the Netherlands. By accessing or using the Platform, you (“Client,” “you,” or “your”), a business entity operating in the European Union (“EU”) or processing personal data of EU data subjects, agree to be bound by these Terms. If you do not agree with these Terms, you may not use the Platform.

These Terms are designed with a primary focus on compliance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) to ensure the protection of personal data for our European clients.

1. Definitions

• Client Data: Any data, including personal data as defined by GDPR, entered into the Platform by you or your Authorised Users.
• Personal Data: Information relating to an identified or identifiable natural person (“data subject”), as defined by GDPR, processed via the Platform (e.g., employee names, contact details, payroll information).
• Platform: The C2 All-in-One HRIS Platform, including its software, features, and services, such as recruitment, onboarding, employee records, leave and absence management, performance management, learning management, the AI assistant, and reporting and analytics.
• Authorised Users: Your employees, contractors, or agents authorised to access the Platform on your behalf.
• Subscription Plan: The specific plan (e.g., Startup, SME, or Enterprise) selected by you, which determines the scope of access, features, and fees.
• Data Processing Agreement (DPA): The agreement governing the processing of Personal Data by C2 as data processor on your behalf, incorporated into these Terms and publicly available on the Trust Center at cognitis.cloud/trust-center/.
• AI Assistant: The AI-powered HR assistant feature of the Platform, described further in Section 4.5.

2. Access and Use of the Platform

2.1 Licence Grant

C2 grants you a non-exclusive, non-transferable, revocable licence to access and use the Platform for your internal business purposes during the term of your Subscription Plan, subject to these Terms, the DPA, and any applicable service agreement.

2.2 Authorised Use

• You may use the Platform to manage HR functions, including recruitment, onboarding, employee records, leave and absence, performance evaluations and learning, as described in your Subscription Plan.
• You are responsible for ensuring that Authorised Users comply with these Terms and GDPR requirements.

2.3 Restrictions

• You may not:
  • Copy, modify, reverse-engineer, decompile, or disassemble the Platform.
  • Distribute, sublicence, or resell access to the Platform.
  • Use the Platform for unlawful purposes or in violation of GDPR or other applicable laws.
  • Attempt to gain unauthorised access to the Platform or its systems.
• Any unauthorised use may result in immediate suspension or termination of your access and potential GDPR-related penalties.

2.4 Subscription Plan

• Access to the Platform is provided under the terms of your selected Subscription Plan (e.g., Startup, SME, or Enterprise).
• Features and usage limits (e.g., number of users, data storage) are determined by your plan, as outlined in your service agreement or order form.

3. Client Responsibilities

3.1 Account Management

• You are responsible for maintaining the security of your account credentials and for all activities conducted under your account.
• You must promptly notify C2 of any unauthorised access or security breaches, as required by GDPR Article 33.

3.2 Client Data and GDPR Compliance

• You are the data controller (as defined by GDPR) for Personal Data entered into the Platform and are responsible for:
  • Ensuring the accuracy, lawfulness, and appropriateness of Client Data.
  • Obtaining necessary consents or legal bases for processing Personal Data (e.g., employee consent or contract necessity).
  • Complying with data subject rights requests (e.g., access, rectification, erasure) under GDPR Articles 15 to 22.
• You represent and warrant that you have the necessary rights and lawful bases to upload and process Client Data in compliance with GDPR and other applicable data protection laws.

3.3 Technical Requirements

You must maintain compatible hardware, software, and internet connectivity as specified by C2 to access the Platform securely.

3.4 Compliance with Laws

• You agree to use the Platform in compliance with GDPR, EU employment laws, and other applicable regulations.
• You are responsible for ensuring that your use of the Platform aligns with your internal policies and any collective bargaining agreements.

4. C2 Responsibilities

4.1 Platform Availability

C2 will maintain the Platform’s availability at a minimum of 99.5% per calendar month, measured 24 hours a day, 7 days a week, excluding announced maintenance windows. Scheduled maintenance will be announced at least 48 hours in advance and conducted outside peak business hours (09:00 to 17:00 CET) where feasible. Current uptime history is available on request from support@cognitis.cloud.

4.2 Support Services

C2 provides the following support tiers:

• Standard support: business hours (09:00 to 17:00 CET, Monday to Friday, excluding EU public holidays), available by email at support@cognitis.cloud and via the in-platform helpdesk portal.
• Critical issues (Platform wholly unavailable): 24/7, with initial acknowledgement within four (4) hours.

Response time targets for non-critical issues and any additional support commitments are set out in your service agreement.

4.3 GDPR Compliance

C2 acts as a data processor (as defined by GDPR) for Personal Data processed via the Platform and will:

• Process Personal Data only on your documented instructions, as set forth in these Terms and the DPA.
• Implement technical and organisational measures to ensure the security of Personal Data, per GDPR Article 32.
• Assist you in fulfilling data subject rights requests under GDPR Articles 15 to 22, and in conducting Data Protection Impact Assessments (DPIAs) as required by GDPR Articles 35 to 36.
• Notify you of any personal data breach without undue delay, and in any event within 24 hours of becoming aware of it, so that you can meet your own obligations under GDPR Articles 33 and 34.
• Engage sub-processors only with your prior written authorisation (general or specific, as set out in the DPA) and ensure sub-processors comply with GDPR via contractual agreements.

C2 is working towards ISO 27001 certification (internal gap assessment underway in 2026). Preparation for ISO/IEC 27701 starts in November 2026, with certification expected in Q2 2027. C2 has assessed its NIS 2 applicability: it is outside NIS 2 scope on size (September 2026), and the assessment is reviewed every year. Current technical and organisational security measures are described in full in Schedule 2 of the DPA, available at cognitis.cloud/trust-center/.

4.4 Updates

C2 will periodically update the Platform to enhance functionality, security, and GDPR compliance. Updates are provided at no additional cost, provided you comply with these Terms.

4.5 AI-Assisted Features

The Platform includes an AI HR Assistant (“AI Assistant”) on the Frontoffice and the Learning Portal, available on the SME and Enterprise plans to signed-in users only, and never on the Jobs Portal. You can switch it off. The AI Assistant has no access to HR records. The questions users type and the knowledge-base excerpts the AI Assistant answers from are sent to the language model provider, Mistral AI SAS (Paris, France); users are asked not to type personal or health details. The Platform sends every request to Mistral’s EU endpoint. Mistral does not use Client Data to train its models and keeps no copy of requests (Zero Data Retention). Knowledge retrieval is handled by a self-hosted vector database on EU (Ireland, eu-west-1) infrastructure. Conversations are kept on the Platform for 90 days. On request, SME and Enterprise customers can have the Frontoffice AI Assistant answer from their own AI host instead. The AI Assistant makes no decisions about people.

AI-generated outputs are indicative only. You remain solely responsible for verifying and acting on any content generated by the AI Assistant.

5. Fees and Payment

5.1 Subscription Fees

• You agree to pay the fees for your Subscription Plan as outlined in your service agreement or order form.
• 14-day money-back guarantee: if you cancel within 14 days of the start of your first Subscription Plan, C2 refunds the fees you paid for it, no questions asked.
• Otherwise, fees are non-refundable except as specified in your service agreement or these Terms.

5.2 Payment Terms

• Payments are due per the schedule in your service agreement (e.g., monthly, quarterly, or annually).
• Late payments incur interest at 1.5% per month or the maximum rate permitted by applicable law, plus reasonable collection costs.

5.3 Taxes

You are responsible for all applicable taxes (e.g., VAT) related to your use of the Platform, excluding taxes based on C2’s net income. C2 will provide VAT-compliant invoices for EU clients.

5.4 Fee Changes

C2 may adjust fees upon renewal of your Subscription Plan, with at least 60 days’ written notice prior to the renewal term.

6. Data Ownership and GDPR Obligations

6.1 Client Data Ownership

• You retain all rights, title, and interest in Client Data, including Personal Data.
• C2 claims no ownership over Client Data and processes it solely to provide the Platform’s services.

6.2 Data Processing Agreement (DPA)

The processing of Personal Data is governed by the DPA, incorporated into these Terms and publicly available at cognitis.cloud/trust-center/. The DPA outlines C2’s obligations as a data processor, including data security, sub-processor management, and breach notification. If your internal policy requires a countersigned copy, contact dpo@cognitis.cloud.

6.3 Data Security

C2 implements industry-standard measures to protect Personal Data, including encryption, access controls, and regular security audits, per GDPR Article 32. In case of a personal data breach, C2 will notify you without undue delay, and in any event within 24 hours of becoming aware of it, and cooperate with you to mitigate the impact.

6.4 Data Subject Rights

• C2 will assist you in responding to data subject requests (e.g., access, rectification, erasure) under GDPR Articles 15 to 22, subject to reasonable fees for requests that are manifestly unfounded or excessive within the meaning of GDPR Article 12(5).
• You must notify C2 promptly of any data subject requests to ensure timely compliance.

6.5 Data Export

Upon your request, C2 will provide an export of Client Data in a structured, commonly used, machine-readable format during the term or within 60 days of termination, in accordance with GDPR Article 20. One full data export per subscription year is included at no charge; additional exports may be subject to reasonable processing fees as set out in your service agreement.

6.6 Data Retention

C2 will retain Client Data during the term of your Subscription Plan. Upon termination, C2 will delete Client Data within 90 days, unless required to retain it by applicable EU law (e.g., for tax or regulatory purposes).

6.7 Encryption Keys and Custody

1. Your data at rest is encrypted with keys that belong to your tenancy.

Databases, uploaded files, backups and long-term archives are encrypted. The keys are created for your tenancy alone when the tenancy is set up, before any of your data exists, and they are not shared with another customer. Your uploaded files and your databases are protected by different keys, so that access to one does not give access to the other.

2. By default, we hold the keys on your behalf (“platform custody”).

Unless you choose otherwise, the key material is generated and stored in the cloud provider’s key service, in our account, and is rotated automatically once a year. In this mode we can operate, back up and restore your tenancy without your involvement. While the service is running, our staff can reach your data in order to provide the service, in the same way any processor acting on your instructions can. That is access through the running service. It is not a personal key, and we do not hold a standing right to open your keys from outside your tenancy. We do not read your data except to provide the service, to resolve a fault you have reported, or where the law requires it.

3. You may take custody of the keys for your databases and your files at any time (“tenant custody”).

On request, those two keys are re-created so that you generate the key material yourself, on your own computer, and you keep the only original copy. We give you a page you open from your own files, or a script. You install nothing, and the page does not connect to us. We receive a wrapped copy for the cloud key service that we cannot open. The service keeps a working copy that can be withdrawn. You may choose this at onboarding, or ask for it later. A later switch is carried out in one announced maintenance window within ten (10) business days of your ceremony, with no loss of data.

The keys for your sign-in secrets, and the keys for operational logs, stay with us in every mode. Taking custody does not move those.

4. What custody changes, and what it does not.

While your key material is loaded in the cloud key service, the service runs normally and our staff can reach your data as described in point 2. What custody adds is your control of the material. At rest, every copy of your databases and files, including every backup and archive we make of them, is unreadable without that material. You can withdraw the material yourself, without our cooperation, if you have nominated an account of your own under point 5. If you have not, you instruct us to withdraw it, and we cannot conceal having done so.

This is a statement about data at rest. It is not a statement that the running service is beyond our reach, and it is not a statement that the cloud provider cannot operate the key service while your material is loaded in it.

5. The stop switch.

In every mode you can require the keys protecting your databases and files to be made unusable. That stops the service and makes every stored copy of that data unreadable.

• Under platform custody, we disable the keys on your written instruction within twenty-four (24) hours. We can reverse that on your instruction until a deletion you have also requested becomes final. The waiting period for that deletion is between seven and thirty days. After it ends, the deletion is final for everyone.
• Under tenant custody, you withdraw your key material yourself if you have nominated an account, or you instruct us to and we cannot conceal having done so. Nobody, including us, can restore the keys without the copy that only you hold.

You may nominate an account of your own at the cloud provider. We then give it a role that can manage these two keys and pull this switch directly. That role cannot read your data. It can download the exit copies in point 6.

6. Copies only you can read.

Every backup and every long-term archive we make of your databases and files is also stored a second time, encrypted to a public key you give us at onboarding. The matching private key stays with you. These copies exist so that you can take that data and read it without us and without the cloud provider, using freely available tools. If you nominate an account under point 5, that account can download these exit copies itself. Otherwise we hand them over on request.

These copies are of the backups and archives we make. They are not a copy of a search index the assistant builds from your pages. That index, where you have switched it on, is rebuilt from those pages. It is not your exit copy.

7. Your responsibilities under tenant custody.

You hold two secrets: your key material, and the private key for your exit copies. Keep at least two offline copies of each. If you lose one of them, we can help you recover through the other. If you lose both, your data, including archives you may be legally required to retain, cannot be recovered by anyone. We do not keep a copy of either secret unless you ask us to in writing. If you do, your custody is recorded as assisted rather than exclusive. You may deposit a copy with a third party of your choice. We do not ask you to.

8. Hold your own keys. Not yet offered.

If you operate your own key-management system, the intended arrangement is that the keys protecting your databases and files are held only in that system, so that neither we nor the cloud provider can decrypt your data at any time, at rest or while the service runs. In that arrangement the availability of your service would depend on the availability of your key system: if it were unreachable, your service would stop until it returned. This option is not yet offered. When it is, it will be set up per customer, on request, after a joint rehearsal. Until then, points 2 to 7 are the arrangements we provide.

9. What we do not promise.

The copies this Section 6.7 covers are stored in the European Union. The cloud provider that operates the key service remains a sub-processor. Except under point 8, and point 8 is not yet offered, we do not represent that your data is beyond the reach of legal process in countries outside the European Union. We will notify you of any such request where the law permits. This Section 6.7 does not describe the AI Assistant. Where you have switched the assistant on, what leaves your tenancy and to whom is stated in Section 4.5.

10. Changes of plan.

Changing your subscription plan never changes your keys. Moving your tenancy to another environment or another region creates new keys, and your data is transferred to them in encrypted form.

7. Intellectual Property

7.1 C2 Intellectual Property

• The Platform, including all software, code, designs, documentation, and trademarks, is owned by C2 or its licensors.
• You are granted no ownership or intellectual property rights beyond the licence in Section 2.1.

7.2 Client Intellectual Property

C2 claims no rights to intellectual property you create or upload to the Platform, except as necessary to provide the Platform’s services.

7.3 Feedback

Feedback you provide about the Platform may be used by C2 to improve its services, without obligation or compensation to you.

8. Confidentiality

8.1 Definition

“Confidential Information” includes non-public information disclosed by either party in connection with these Terms, such as Client Data, business plans, pricing, and Platform specifications.

8.2 Obligations

Each party will:

• Use Confidential Information only to fulfil its obligations under these Terms.
• Not disclose Confidential Information to third parties without prior written consent, except as required by law.
• Protect Confidential Information using measures at least as protective as those used for its own confidential information, and in any event no less than reasonable care consistent with GDPR and industry standards.

8.3 Exceptions

Confidential Information excludes information that: (a) is or becomes publicly available through no fault of the receiving party; (b) was independently developed by the receiving party without reference to the Confidential Information; or (c) was rightfully received from a third party without restriction.

9. Term and Termination

9.1 Term

These Terms remain in effect for the duration of your Subscription Plan, as specified in your service agreement.

9.2 Termination by Client

You may cancel your Subscription Plan at any time. The cancellation takes effect at the end of your current contract term: the end of the month for a monthly contract, or the end of the year for a yearly contract.

9.3 Termination by C2

C2 may suspend or terminate your access if you:

• Fail to pay fees when due and do not remedy the failure within 14 days of written notice.
• Materially breach these Terms or the DPA and fail to cure within 30 days of written notice.
• Use the Platform unlawfully or in violation of GDPR.

C2 may also terminate these Terms on reasonable notice if required by applicable law or if the Platform is discontinued.

9.4 Effect of Termination

• Upon termination, your right to access the Platform ceases and you must stop using it immediately.
• You remain liable for all outstanding fees accrued up to the date of termination.
• C2 will assist with data export per Section 6.5, subject to the timelines set out in Section 6.6.

10. Warranties and Disclaimers

10.1 C2 Warranties

• C2 warrants that the Platform will perform substantially as described in its documentation and will be available at least 99.5% uptime per calendar month, as set out in Section 4.1.
• C2 will provide services in compliance with GDPR and applicable industry standards.

10.2 Client Warranties

You warrant that you have full authority to enter into these Terms and that your use of the Platform complies with GDPR and all other applicable laws.

10.3 Disclaimers

Except as expressly stated in these Terms, the Platform is provided on an “as is” basis. C2 makes no further warranties, express or implied, including any implied warranties of satisfactory quality or fitness for a particular purpose. C2 does not warrant that the Platform will be error-free or uninterrupted at all times.

11. Limitation of Liability

11.1 Liability Cap

Subject to Section 11.3, C2’s total aggregate liability to you under or in connection with these Terms shall not exceed the total fees paid by you in the 12 months immediately preceding the event giving rise to the claim.

11.2 Exclusions

Subject to Section 11.3, neither party shall be liable to the other for any indirect, incidental, consequential, or punitive damages arising out of or in connection with these Terms, including loss of profits, loss of revenue, or loss of data, even if that party has been advised of the possibility of such damages.

11.3 Exceptions

The limitations and exclusions in Sections 11.1 and 11.2 do not apply to liability arising from: (a) gross negligence or wilful misconduct; (b) GDPR violations or breach of the DPA; (c) breach of confidentiality obligations under Section 8; or (d) any liability that cannot be excluded or limited by applicable Dutch law.

12. Indemnification

12.1 C2 Indemnity

C2 will defend and indemnify you against third-party claims alleging that the Platform, as provided by C2 and used in accordance with these Terms, infringes any third-party intellectual property rights, provided you: (a) notify C2 promptly in writing of such claim; (b) grant C2 sole control of the defence and settlement; and (c) reasonably cooperate with C2 in the defence.

12.2 Client Indemnity

You will defend and indemnify C2 against third-party claims arising from: (a) your misuse of the Platform in breach of these Terms; (b) your violation of GDPR or other applicable data protection laws; or (c) any intellectual property infringement arising from Client Data you have uploaded to the Platform.

13. Governing Law and Dispute Resolution

13.1 Governing Law

These Terms and any dispute or claim arising out of or in connection with them (including non-contractual disputes or claims) are governed by and construed in accordance with the laws of the Netherlands, subject to GDPR.

13.2 Dispute Resolution

In the event of a dispute, the parties will first attempt to resolve the matter through good-faith negotiations for a period of at least 30 days from the date one party notifies the other in writing of the dispute. If the dispute is not resolved through negotiation, it shall be referred to and finally resolved by binding arbitration under the rules of the Netherlands Arbitration Institute (NAI), with the seat of arbitration in Amsterdam, the Netherlands, conducted in English. The arbitral award is final and binding on both parties. Nothing in this Section prevents either party from seeking urgent interim or injunctive relief from a court of competent jurisdiction.

14. Miscellaneous

14.1 Entire Agreement

These Terms, together with your service agreement and the DPA, constitute the entire agreement between the parties with respect to the subject matter hereof, and supersede all prior and contemporaneous agreements, representations, and understandings.

14.2 Amendments

C2 may update these Terms at any time. For material changes, C2 will give at least 30 days’ written notice before the change takes effect, either by email to the address associated with your account or by posting a prominent notice at www.cognitis.cloud. If you object to a material change, you may terminate your Subscription Plan within the notice period in accordance with Section 9.2. Continued use of the Platform after the effective date of any change constitutes your acceptance of the updated Terms.

14.3 Assignment

• You may not assign or transfer these Terms or any rights or obligations under them without C2’s prior written consent, except in connection with a merger, acquisition, or sale of all or substantially all of your assets.
• C2 may assign these Terms to a successor entity without your consent, provided the successor assumes all of C2’s obligations under these Terms.

14.4 Force Majeure

Neither party will be liable for any delay or failure to perform its obligations under these Terms to the extent caused by circumstances beyond its reasonable control, including natural disasters, acts of government, internet or telecommunications outages, or pandemics, provided the affected party notifies the other promptly and takes reasonable steps to mitigate the impact.

14.5 Notices

All notices required or permitted under these Terms must be in writing and delivered by email. Notices to C2 should be sent to c2.hris@cognitis.cloud. Notices to you will be sent to the email address associated with your account. Notices are effective upon confirmed receipt.

14.6 Severability

If any provision of these Terms is held to be invalid, illegal, or unenforceable, that provision will be modified to the minimum extent necessary to make it enforceable, and the remaining provisions will continue in full force and effect.

14.7 No Waiver

Failure by either party to enforce any provision of these Terms on one occasion shall not be construed as a waiver of that party’s right to enforce that provision on any future occasion.

15. Contact Information

For questions about these Terms or your service agreement:

C2 HRIS Platform
Email: c2.hris@cognitis.cloud
Website: www.cognitis.cloud

For GDPR compliance, DPA questions, data subject rights requests, or DSAR submissions:

Data Protection Officer (DPO)
Email: dpo@cognitis.cloud

For security issues and suspected personal data breaches:

Security
Email: security@cognitis.cloud

For platform support and technical assistance:

Support
Email: support@cognitis.cloud
Contact form