GPU Bare Metal B2B Service Terms

GPU Server Hub — version 1.7 dated 19 October 2026 Editorial revision r1 — English translation EN-1

This document is an English translation provided for convenience. The Polish version 1.7 is binding. In the event of any discrepancy, the Polish version prevails, subject to the priority of an individually agreed Order and any mandatory provisions of law.

Public path on the Provider's website: Terms

These Terms apply to Agreements concluded from the date on which they are made available during the Order process. The Service is intended exclusively for businesses.

1. Provider and contact details

1. The Provider is Janusz Ciuruś, conducting business under the business name BESTCONNECT CIURUŚ JANUSZ, Królówka 261, 32-722 Królówka, Poland, Polish Tax Identification Number (NIP) 8681799622, National Business Registry Number (REGON) 120967456, entered in the Central Register and Information on Economic Activity (CEIDG), operating under the GPU Server Hub brand, hereinafter the “Provider”.
2. The common point of contact for sales, technical support, security, reports concerning illegal content and data protection is gpu@bestconnect.pl. This is also the Provider's point of contact for authorities and recipients of the Service within the meaning of Articles 11 and 12 of Regulation (EU) 2022/2065; contact does not rely solely on automated tools.
3. Contact is handled in Polish and English.

2. Definitions

1. Customer — a business with its registered office or fixed establishment in a country for which the Provider offers the Service when accepting the Order.
2. User — a person authorised by the Customer to use the Service.
3. Service — making a physical GPU server exclusively available to the Customer together with the elements specified in the Order, in particular power, cooling, connectivity and IP addressing. The Service is unmanaged unless the Order expressly states otherwise.
4. Order — a document or electronic summary accepted by the Parties which specifies the configuration, price, term, activation date and any special conditions.
5. Agreement — the Order, these Terms together with their annexes, and the documents expressly incorporated into the Order.
6. Customer Data — any data, files, databases, images, configurations and other content entered or generated by the Customer or Users on the Server.
7. Billing Period — the Service period specified in the accepted Order.
8. P1 Incident — a complete loss of the agreed power supply to the Server at its PDU/outlet, loss of connectivity to the Provider’s network port, or a confirmed hardware failure that prevents use of the Server.
9. Replacement Server — an operational Server made available to the Customer in place of the Server used to provide the Service, in particular following a hardware failure, under sections 6 and 13.

3. B2B scope and order of precedence

1. The Provider does not conclude consumer contracts under these Terms.
2. The offering is intended for professional purposes. Where an individual conducts business, the professional nature of the Agreement is assessed in accordance with the law, in particular on the basis of its content and the business activity disclosed in CEIDG. Where this is not clear from the Agreement, the Customer may submit a separate declaration, but the Provider does not make conclusion of the Agreement conditional upon its submission.
3. These Terms do not exclude or restrict any rights of an individual conducting business that arise from mandatory provisions of law, in particular Article 385⁵ of the Polish Civil Code.
4. A person accepting an Order on behalf of the Customer represents that they are authorised to represent the Customer. The Provider may request evidence of authority and verify a Polish Tax Identification Number (NIP), an EU VAT number, or an appropriate foreign tax or business registration identifier.
5. In the event of a conflict, an individually agreed Order takes precedence over these Terms in technical and commercial matters. The data processing annex takes precedence in data protection matters.
6. Marketing descriptions and public information from other entities do not expand the Provider's obligations unless incorporated into the Order or these Terms.
7. A Customer who is an individual meeting the conditions of Article 7aa of the Polish Consumer Rights Act retains statutory rights, including the right to withdraw from a distance agreement. The withdrawal notice, supplied with the Order, explains how to exercise that right and includes an optional model form. The absence of a separate declaration about the professional nature of the Agreement does not waive any rights.

4. Conclusion and activation of the Agreement

1. Before submitting an Order, the Customer receives these Terms in a form that enables them to be saved and reproduced.
2. The Customer submits an Order using a form, by email or in a signed document and accepts these Terms using a checkbox that has not been preselected or by an equivalent unambiguous declaration.
3. Before submitting the form, the Customer may review and correct the summary of the data, configuration and price. After submission, the Customer may report an obvious error to the contact address; correcting it may require renewed acceptance of the Order.
4. After the form is submitted, the system promptly displays in the portal and records an acknowledgement of receipt, the Order number, and the accepted document versions. An email acknowledgement is sent only if the Provider has enabled the mail integration or sends it manually. Acknowledgement of receipt does not yet constitute acceptance of an offer or conclusion of the Agreement.
5. The Agreement is concluded only after the Provider expressly accepts the Order, as recorded in the portal, in particular when issuing the pro forma, or as communicated in a separate confirmation, unless an individual document specifies another time.
6. The Provider records receipt and acceptance of the Order separately, together with its content, the document versions, and the date and method of acceptance. Documents are made available in the authenticated portal in a form that can be downloaded, stored, and reproduced unchanged; the Provider may also send them by email after enabling the mail integration or manually.
7. The official and binding version of these Terms together with their annexes and of the Register is the Polish version. The English version is a translation made available to facilitate understanding of the documents. In the event of a discrepancy or interpretative doubt, the Polish version prevails, subject to mandatory provisions of law and the priority of an individually agreed Order in accordance with section 3.5. The Provider does not apply any particular code of conduct unless it informs the Customer of that code before the Order.
8. The initial Service term begins at the first actual activation of the Service and assignment of the Server to the Customer, after the full payment required for the Order has been credited and the conditions of paragraph 10 have been met. The Provider hands over the Server without undue delay once those conditions are met. The selected term is expressed in months and runs from the date and time of activation in the Europe/Warsaw time zone. It ends on the corresponding day and at the same time after the selected number of months; if the final month has no corresponding day, it ends on that month’s last day. The activation confirmation states the start and end dates and times. Waiting until activation is permitted does not shorten the paid term.
9. The Customer should verify the configuration promptly after it is made available. Any deficiencies must be reported to the contact address no later than within 3 business days; this period does not limit liability for latent defects.
10. Where the Customer has a statutory right of withdrawal, starting the Service before the withdrawal period expires requires a separate express request and acknowledgement that the right is lost only upon full performance of the Service. Requesting an early start is optional and activating the Server alone does not remove the right of withdrawal. Statutory proportionate settlement rules apply if the Customer withdraws. Without a valid request for an early start, the Service starts after the withdrawal period expires and the other activation requirements have been met.

5. Nature of the Service and allocation of responsibilities

1. The Server is physically dedicated to one Customer. The Provider does not operate a shared virtualisation layer on it unless the Order states otherwise.
2. The Provider is responsible for:
   • a. making available the configuration specified in the Order;
   • b. colocation, power, cooling and physical security of the hardware;
   • c. operation of its own network up to the Server port and assignment of the specified addressing;
   • d. diagnosis and resolution of a hardware failure, including by providing an available Replacement Server in accordance with sections 6 and 13;
   • e. protection of its own management systems and restriction of staff access;
   • f. routing the default traffic of every active Service through a network filter focused on detecting and mitigating volumetric Layer 3 and Layer 4 attacks.
3. The Customer is responsible for:
   • a. selecting, configuring, updating and licensing the operating system, drivers, applications and models, and installing them unless installation has been requested from the Provider under sections 5.8 and 7;
   • b. accounts, passwords, keys, firewall, encryption, monitoring and vulnerability management;
   • c. the legality of Customer Data and Users' activities;
   • d. regular backups outside the Server, testing restoration from those backups, and independently restoring the operating system, applications and data, including after a Replacement Server is made available;
   • e. configuration of public services, domains, DNS and applications;
   • f. compliance of its use and onward provision of the Service with the law, including sanctions and export control rules applicable to the Provider, the Service or the relevant transaction, and with third-party rights.
4. The Provider does not back up Customer Data unless the Order expressly describes a separate backup service.
5. The Customer should encrypt data on the drives and keep the keys outside the Server. The Provider will not recover data or keys lost by the Customer.
6. To conclude the Agreement, the Customer needs a device with Internet access, an up-to-date browser that enables documents to be saved, and an active email address. To use the Server, the Customer needs its own compatible system and administration tools, in particular an SSH client or another protocol specified in the Order.
7. Typical risks include public exposure of services, intrusion, malware, misconfiguration, software vulnerabilities, component failure, loss of data without a backup, and changes to third-party licence terms.
8. The Provider may use device firmware, the baseboard management controller (BMC), and temporary diagnostic, recovery or installation environments to activate, test, repair and secure its infrastructure. The Customer may request installation of a selected operating system and available software options in the Order or through the portal. After completing the work, the Provider removes temporary diagnostic tools and service access; software covered by the Customer’s request remains installed. Installation and retention of NVIDIA Software are subject to section 7. Automated installation does not include ongoing administration of the Customer’s system.
9. Network filtering is included in the standard Service price. It analyses anomalies and may automatically apply targeted rules to suppress malicious traffic, in particular SYN, UDP and ICMP floods and amplification attacks. The Provider may change the technical implementation of the filter without reducing the agreed protection scope.
10. The filter is not a WAF, does not replace the Server firewall or the Customer's system and application security, and does not guarantee effectiveness against every attack. The effectiveness of attack mitigation depends, among other things, on the attack type and scale, whether it can be identified, and available network and link capacity. Protecting the remaining infrastructure may require limiting or temporarily disconnecting the attacked address in accordance with section 9.

6. Hardware, data centre and access

1. The Server is located at the 4DataCenter data centre in Katowice, Poland, operated by Quicktel Sp. z o.o. The Provider may, at its own cost, change the particular room within Katowice by giving the Customer at least 7 days' prior notice and specifying the necessary maintenance window. Shorter notice is permitted in the event of a failure or for security reasons. The change must not materially reduce security or the agreed parameters; otherwise, the Customer may terminate the Agreement for that Service and receive a refund for the unused period.
2. Public statements made by 4DataCenter concerning infrastructure or historical availability do not constitute a separate warranty by the Provider. The binding Service level arises exclusively from the Agreement.
3. The hardware remains owned or legally controlled by the Provider. The Agreement does not transfer ownership of the Server, GPU, drives or IP addresses.
4. The Customer has full administrative (root) privileges over its operating system; access arrangements are set out in the configuration or activation confirmation. The Customer receives no access to BMC/IPMI or the management network and no physical access to the hardware. The Provider operates these components. Power, installation and erasure commands available in the portal are executed by the Provider’s infrastructure; this does not give the Customer BMC/IPMI access.
5. Without the Provider's written consent, the following are prohibited in particular:
   • a. interference with the hardware, cabling, firmware, BIOS or BMC;
   • b. permanent modification of power, voltage or clock limits, and overclocking;
   • c. disabling thermal, power or security safeguards;
   • d. attempts to gain access to the management network or the hardware of other customers.
6. The Replacement Server’s specifications, including its CPU, RAM, drives, network port and GPU, must meet or exceed those specified in the Order. It must support the functions and uses agreed in the Order. A different GPU model requires the Customer’s prior consent; its VRAM capacity must be no lower than that specified in the Order.
7. In the event of a confirmed hardware failure, the Provider may make a Replacement Server available, subject to its availability at that time. The Replacement Server meets the requirements of section 6.6. The Provider does not reserve a particular Replacement Server for the Customer or guarantee when it will be made available unless the Order provides otherwise. Section 13 also applies, including the Customer’s right under section 13.10.
8. The Provider does not transfer drives to another Server, migrate Customer Data or restore the Customer’s operating system, applications or data. The Customer restores its environment independently using its own backups. Following confirmation of a hardware failure requiring replacement of the Server, the Provider takes the faulty Server out of use and deletes the Customer Data stored on its drives as soon as technically feasible, including before a Replacement Server is made available or the Customer has restored its environment. Deletion is not conditional on the availability of a Replacement Server or completion of the Customer’s restoration. Acceptance of the Agreement constitutes a documented instruction to perform these operations; no separate confirmation is required, subject to erasure holds under sections 12.7 and 12.11 and mandatory provisions of law. Storage media remain secured until the data has been effectively deleted. A defective storage medium is effectively erased or destroyed; handing it over to a warranty service provider requires prior data removal or equivalent contractual and organisational safeguards.
9. A static IP address means an address assigned for the duration of the Service. It does not become the Customer's property and is not transferable upon termination of the Agreement. The Provider may change it only for an important legal, security or technical reason, giving the Customer advance notice whenever possible.

7. NVIDIA and other software

1. The GPU model, quantity and specifications, including memory capacity and type, are stated in the Order. These Terms do not specify a single GPU model for all Services.
2. The Provider makes hardware available. As standard, the Service does not include installation of NVIDIA drivers, NVIDIA CUDA Toolkit, NVIDIA AI Enterprise, NVIDIA vGPU or other NVIDIA software in the Customer’s operating system, collectively “NVIDIA Software”. The Customer may separately request installation of an available profile under paragraph 7. Making hardware available or performing an installation does not constitute a grant by the Provider of a licence or sublicense to NVIDIA Software.
3. The Customer selects NVIDIA Software appropriate for its use and reviews the current terms of the applicable licence. Where required, it accepts those terms directly with NVIDIA or another relevant licensor. It may independently download the software from a lawful source and install it, or request an available installation service from the Provider under paragraph 7. The Customer is responsible for subsequent configuration, updates and use in accordance with the licence.
4. The Customer is responsible for obtaining rights appropriate to its manner of use, especially in the case of virtualisation, MIG or another division of the GPU, vGPU, making functionality available to third parties, further distribution or resale of NVIDIA Software, providing commercial hosting services using it, or using products that require a paid licence or subscription.
5. The Provider is not a party to a licence agreement concluded between the Customer and NVIDIA and does not warrant that a standard driver licence permits the Customer's particular business model. Upon a justified request, the Customer will confirm that it holds the required licences, subscriptions or other rights without disclosing confidential information.
6. The mere technical availability of MIG or another GPU partitioning mechanism does not mean that the Service includes NVIDIA vGPU software or a licence, or that the Customer is entitled to offer NVIDIA Software as a service.
7. Installation of NVIDIA Software by the Provider requires a separate Customer request, which may be submitted through the portal, and prior, documented verification of the licensing rights of both the Provider and the Customer appropriate to the requested scope. The request identifies the selected profile and intended use; its content, the Customer’s acknowledgements and the verification outcome are recorded in the Service documentation. Selecting “AI-ready” alone does not define the installation scope or replace this verification. The Provider does not begin installing NVIDIA Software until verification is complete. No implied sublicense arises.
8. The absence, expiry, suspension or restriction of the Customer's licence, subscription or account for reasons beyond the Provider's control does not constitute unavailability or a defect of the Service where the hardware and connectivity operate in accordance with the Agreement.
9. NVIDIA names and marks are used solely to identify the hardware. NVIDIA is not a party to the Agreement or a sponsor of the Service.

8. Acceptable use rules

1. The Customer may use the Service for lawful computing, AI, rendering, data analysis, hosting its own applications and other professional purposes consistent with the Agreement.
2. It is prohibited to use the Service for:
   • a. unlawful content or activities, including child sexual abuse material;
   • b. malware, ransomware, botnets, phishing, credential theft or circumvention of security measures;
   • c. DDoS attacks, intrusion, scanning or testing systems without their owner's consent;
   • d. unsolicited bulk communications, forged headers or maintaining resources that support spam;
   • e. infringement of copyright, trademarks, trade secrets, privacy or other third-party rights;
   • f. infringing or circumventing applicable sanctions, export controls or licensing restrictions, including directly or indirectly making the Service or computing capacity available to recipients, in territories or for uses for which that provision is prohibited; this restriction also covers computing services provided through an API, intermediaries or downstream recipients, irrespective of their name or technical implementation;
   • g. uses whose failure may directly cause death, injury or catastrophic damage, without a separate written agreement;
   • h. cryptocurrency mining, resale, subleasing, further rental, or making all or part of the Service available for independent use by a third party without the Provider’s written consent. The consent specifies the permitted scope, recipients and countries of onward provision and does not override paragraph f. Making the functionality of the Customer’s own application available does not, by itself, constitute subleasing where it does not involve making Service resources available for independent use; it remains subject to paragraph f and the other provisions of the Agreement.
3. The Customer is responsible for Users and entities to which it makes the Service available in respect of acts and omissions connected with its use. It ensures that downstream recipients are bound by restrictions appropriate to the scope made available, particularly those in paragraph 2(f) and (h). It maintains an up-to-date 24-hour abuse contact and, upon a justified request, provides the Provider with information necessary to verify that onward provision complies with the Agreement.
4. The Provider does not generally monitor Customer Data. It may analyse metadata and information necessary for security, billing, performance of the Agreement or handling a specific credible report.
5. A report concerning unlawful use must be submitted using the mechanism available at Report Abuse on the Provider's website or to the contact address. It should precisely identify the IP address, URL or other location, time, description and reasons for illegality, the reporting person's name or business name and email address, and include a statement of accuracy and good faith. Identification details are not required for a report concerning suspected sexual offences against children to the extent provided for by the DSA. The Provider may request supplementary information.
6. The Provider processes reports in a timely, diligent, objective, non-arbitrary and proportionate manner, with due regard to the Customer's rights and the obligations under Regulation (EU) 2022/2065, to the extent that it applies.
7. Where electronic contact details have been provided, the Provider acknowledges receipt of the report without undue delay, including where the report requires supplementary information, and following assessment provides information about its decision and available means of redress. The Provider reports a suspected criminal offence involving a threat to life or safety to the competent authorities where required by law.

9. Security and suspension

1. The Customer must immediately report account compromise, key leakage, a vulnerability or abuse and cooperate in mitigating its effects.
2. The Provider may, to the minimum extent necessary, block a port, apply a filter, disconnect an IP address or suspend the Service where:
   • a. required by law, a court or a competent authority;
   • b. there is an immediate threat to people, data, hardware, the network or other customers;
   • c. an attack, malware, spam or another serious infringement is ongoing;
   • d. the Customer has failed to remedy an ordinary breach within a specified reasonable period;
   • e. the arrears described in section 10 exist.
3. In an urgent situation, suspension may take place without prior notice. No later than when the restriction is imposed, the Provider provides the statement of reasons described in paragraph 6 unless a specific provision of law or binding order prohibits notification or a temporary withholding of information is necessary to protect an investigation or immediate security; in that event, it provides the statement when the impediment ceases.
4. The Provider will restore the Service when the cause has ceased and the required actions have been completed. Charges continue to accrue during a suspension caused by the Customer; this rule does not apply to a period of suspension caused exclusively by the Provider.
5. Automated signals, such as traffic or IP reputation alerts, may initiate an analysis or urgent isolation, but a human reviews any decision to impose a longer restriction.
6. The statement of reasons for a restriction specifies:
   • a. the specific facts and circumstances and whether the action resulted from a report, the Provider's own detection or an authority's order;
   • b. whether and how automated detection or automated measures were used;
   • c. the precise legal basis or specific provision of these Terms;
   • d. why the activity or information was considered unlawful or inconsistent with the Agreement;
   • e. the type, territorial scope and duration of the restriction;
   • f. the ability to request manual reconsideration at the contact address and to apply to the competent court or authority.

10. Prices and payments

1. Net prices, currency and Billing Period are specified in the Order. The currency selected at registration is the fixed billing currency of the company account: PLN in the Polish version of the service, or EUR or USD in the international version. An existing account retains its assigned currency. Prices in each currency are set separately. Standard Server setup is free of installation and activation fees. VAT is accounted for in accordance with applicable law, taking into account the Customer’s status and the place of supply of the Service.
2. Payment is made by bank transfer to the account indicated on the pro forma or another payment document relating to the Order, in advance for the full selected term, within 7 days after that document is made available to the Customer, unless the Order states otherwise. The full payment for an extension must be credited before the current term ends in accordance with section 11.2.
3. A pro forma is a payment document, not a VAT invoice. After receiving payment, the Provider issues an invoice in accordance with the law and makes it available for download in the authenticated portal. Invoices are submitted to the Polish National e-Invoice System (KSeF) to the extent required by law. Every Customer can download the invoice from the portal; a foreign Customer does not need to use KSeF to receive it. The Customer consents to invoices in electronic form. The Provider may additionally send the invoice or a notification by email.
4. In the event of delay, the Provider may charge interest and compensation provided for commercial transactions.
5. Where amounts are overdue under an ongoing Agreement, the Provider may grant an additional payment period of at least 3 business days. If payment is still not made, the Provider may suspend the Service. Immediate action is permitted in the event of fraud or serious risk. Failure to validly extend the Service before the paid term ends results in termination of the Service under sections 11 and 12, rather than an automatic additional period of use.
6. Objections to part of an invoice do not release the Customer from timely payment of the undisputed part.
7. A fee paid in advance for a Billing Period that has already commenced is not subject to a pro-rata refund if the Customer chooses to cancel the Service or commits a material breach that justifies termination of the Agreement. This does not apply to a refund due because of the Provider's fault, under an SLA or under mandatory law.
8. Additional work, storage media, shipping, non-standard remote hands and traffic above the agreed limit require prior agreement of the price.

11. Term and termination of the Agreement

1. The Agreement is concluded for the fixed term selected by the Customer from the options available when placing the Order and specified in the accepted Order. The initial term starts as provided in section 4.8. The Agreement expires at the end of the paid term unless it is validly extended before expiry in accordance with paragraph 2 or mandatory provisions of law apply.
2. An extension requires agreement on the next term and receipt of the full required payment before the current term ends. The extended term starts immediately after the current term ends, irrespective of an earlier payment date. The Agreement does not automatically renew for an indefinite term. A payment credited after expiry does not automatically restore the Service or deleted data. Any charge or compensation for early termination must be specified in the Order, either as an amount or under an unambiguous formula, before it is accepted.
3. A Party may terminate the Agreement if a material breach has not been remedied within 7 days after notice to remedy it.
4. The Provider may terminate the Agreement with immediate effect in the event of serious or repeated unlawful use, an intentional threat to infrastructure, infringement of sanctions prohibitions, export controls or licensing restrictions, including through prohibited onward provision of the Service, provision of false information, or arrears despite the additional payment period.
5. The Agreement may end before expiry only in circumstances expressly provided for in the Agreement or by law. A Party may rely only on a ground for termination that gives that Party the relevant right.
6. The Service and the Agreement for the relevant Order end upon expiry of the agreed term, unless validly renewed or terminated earlier. Provisions concerning settlement, liability arising from the Agreement, confidentiality, data and intellectual property rights, and dispute resolution remain effective to the extent necessary. Data protection, return and deletion obligations continue until fulfilled, subject to statutory requirements. These continuing obligations do not extend access to the Server or create charges for an additional term that has not been ordered.

12. Data export, end of access and data deletion

1. This section and the Data Export, Formats and Jurisdiction Register, published at Data Export, Formats and Jurisdiction Register on the Provider’s website, set out the rules for data export and deletion. The Register forms part of the Agreement in the version made available before the Order is submitted. The Order documentation allows the Customer to download and retain that version of the Register.
2. During the active Service, the Customer independently exports Customer Data using tools and protocols of its choice. The Customer should complete export and verify its backups before the Service ends, or request return or switching under paragraph 11. The Provider does not provide managed migration or restoration of the operating system, applications or data as standard; it performs assistance obligations that cannot be excluded.
3. The Provider supplies Service metadata available to it within the scope and in the formats specified in the Register. The Customer selects application data formats. Additional work beyond obligations under the Agreement or law requires prior agreement on scope and price; this does not limit obligations which must be performed without a separate charge under the law.
4. At the end of the paid term without an effective extension, the Provider disables access and erases Customer Data without undue delay as soon as technically feasible. The Customer chooses this method of ending processing when entering into the Agreement and may change that choice before the Service ends under paragraph 11. Erasure shall not begin while a hold under paragraph 7 or 11 applies. The same rules apply to early termination.
5. There is no additional general data-retention or retrieval period after the Service ends. The time technically needed for erasure does not provide access or guarantee retrieval. This does not affect an agreed return of data or the periods required for switching providers under paragraph 7.
6. The Provider deletes all copies of Customer Data under its control in a manner appropriate to the technology and confirms completion upon request. It does not delete billing, evidential or security data that it retains in its own capacity as controller on a legal basis.
7. Mandatory provisions on data return, switching providers and retention take precedence over the standard erasure process. Where Chapter VI of Regulation (EU) 2023/2854 (Data Act) applies to the Service, switching providers or moving to on-premises infrastructure is subject to a notice period of no more than 2 months, an agreed transitional period normally not exceeding 30 days, and at least 30 days for retrieval after that period ends. The Provider suspends erasure, maintains the required continuity and assistance, and erases data following successful switching and expiry of the retrieval period or a later agreed date. If 30 days is technically unfeasible, the Provider gives reasons within 14 working days of the request and specifies an alternative period not exceeding 7 months. The Customer may extend the transitional period once in accordance with Article 25(5) of the Data Act. A separate choice to erase data without switching does not establish a migration period or a general 30-day retention period. The choice to return personal data is also governed by Annex 1. Assistance obligations do not constitute managed application migration or require the Provider to create backups beyond the scope required by law or separately agreed.
8. The Service is not a backup. A physical drive failure may prevent export of data that the Customer has not previously copied. A confirmed hardware failure requiring replacement of the Server is subject to the separate deletion instruction in section 6.8, including before the Service term ends.
9. The location of individual elements of the Service, the applicable jurisdiction, and measures to prevent unlawful international access by public authorities are specified and updated in the Data Export and Jurisdiction Register.
10. During an active Service, the Customer may separately confirm in the portal the irreversible erasure of data from all drives assigned to the Server. The Provider starts erasure without undue delay unless a hold requires prior resolution. Successfully erased data is not retained for later retrieval. Erasure alone does not shorten the paid Service term.
11. Before the Service ends, the Customer may request return of data or notify the Provider of a switch through the portal form or at gpu@bestconnect.pl. Acceptance through the form is confirmed in the portal and immediately suspends automatic erasure pending review and completion of the agreed procedure. Emails are handled by the Provider and are not automatically processed by the erasure mechanism. Upon receiving an effective instruction, the Provider ensures that erasure is suspended, acknowledges receipt and promptly specifies how and when export will be performed. The portal form is recommended for urgent requests.

13. Infrastructure SLA and hardware failures

1. Every active Service is covered by a Standard SLA of 99.9% monthly availability together with the service credits below, unless an individually agreed Order specifies a more favourable level.

2. The Standard SLA measures separately:

   • a. power availability — the presence of the agreed power at the Server's PDU/outlet and cooling that permits normal operation;
   • b. network availability — the ability to exchange packets between the Server's network interface card and the Bestconnect network demarcation point specified in the Order.

3. Unavailability of either element listed in paragraph 2 constitutes infrastructure unavailability. Total downtime includes every period in which power/cooling or the network was unavailable. Time during which both were unavailable is counted only once. For example, a 40-minute power outage and a 30-minute network outage overlapping for 10 minutes amount to 60 minutes of total downtime. This calculation is used to determine monthly availability and the SLA service credit.

4. Availability is calculated as: (measurement period time minus confirmed downtime) / measurement period time × 100%. Once an event's eligibility is subsequently confirmed, time is counted from the earlier of the Provider's monitoring alert or registration of a valid P1 Incident report. It ends when the faulty component is restored.

5. The SLA does not cover:

   • a. the Customer's system, applications, firewall, drivers or configuration;
   • b. a hardware failure, to which paragraph 9 applies;
   • c. the Internet beyond the Provider's network demarcation point;
   • d. planned work notified at least 48 hours in advance together with its scope and anticipated duration;
   • e. emergency security maintenance notified without undue delay and only for the objectively necessary duration;
   • f. attacks only to the extent that their type or scale exceeds the filter scope described in section 5 or available network or link capacity, and any period when isolating the attacked address is necessary to protect the remaining infrastructure;
   • g. Customer actions, suspension consistent with the Agreement, force majeure and events beyond the Provider's reasonable control.

6. A failure of the data centre, power or cooling selected by the Provider is not automatically force majeure or an event beyond its control. The Standard SLA is the single service level offered to the Customer, accounts for dependency on the data centre, and is neither added to nor increased by its operator's public statements.

7. Service credits under the Standard SLA of 99.9% are:

   Monthly availability	Credit against the monthly net fee for the Server experiencing the unavailability
   99.9% or above	0%
   below 99.9% but at least 99.0%	5%
   below 99.0% but at least 95.0%	10%
   below 95.0%	25%

8. The total credit does not exceed 25% of the monthly net fee for the Server experiencing the unavailability. The Customer submits a claim within 14 days after the end of the month, stating the Order number and event times. The credit is applied to the next invoice or refunded after termination of the Agreement and constitutes the contractual remedy for the SLA breach itself, without restricting rights that cannot be excluded.

9. The Provider diagnoses and remedies a confirmed hardware failure using reasonable efforts and spare hardware subject to current availability. Unless stated in the Order, no response or replacement time is guaranteed. Diagnosis and replacement of the Provider's defective hardware are included in the price; only additional work ordered by the Customer may be chargeable.

10. If a Replacement Server meeting the requirements of section 6.6 cannot be made available within 7 calendar days after confirmation of the failure, the Customer may terminate the Agreement for that Service and receive a pro-rata refund for the unused period.

11. A guaranteed replacement time specified in the Order runs from completion of diagnosis and confirmation of a hardware failure until a Replacement Server is made available. It does not include restoration of the operating system or Customer Data.

14. Support and complaints

1. Reports may be sent to the contact address at any time. The mere acceptance of email outside service hours does not imply a guaranteed response time unless one is specified in the Order.
2. A report should include the Order number, IP address, description, time of occurrence, tests performed and secure return contact details. Passwords and private keys must not be sent by email.
3. A complaint should additionally specify the Customer's requested remedy. The Provider normally responds within 14 days and, in a complex matter, provides an anticipated response date.
4. Standard support concerns the hardware and network layer. Administration of the Customer's system requires a separate Order.

15. Confidentiality, data and intellectual property rights

1. Each Party protects the other Party's non-public technical, commercial and security information with at least the same care as it protects its own information of that kind.
2. Confidentiality does not cover information that has become public without breach of the Agreement, was lawfully known beforehand or was independently developed. The confidentiality obligation does not prevent disclosure required by law. To the extent possible, a Party disclosing information at an authority’s request will notify the other Party in advance.
3. The Customer retains its rights in Customer Data. It grants the Provider only the limited right to perform operations necessary to perform the Agreement, maintain security, assist with export and comply with legal obligations.
4. The Provider retains its rights in its own network, automation, documentation, brand and infrastructure configuration. The Agreement does not transfer any licence beyond the right to use the Service during its term.

16. Liability

1. Each Party is liable for proven direct loss that is the normal consequence of its breach of the Agreement.
2. To the extent permitted by law, the Provider is not liable for loss of profits, revenue, reputation or contracts, indirect downtime, or loss of Customer Data which could have been avoided by a proper backup, unless the loss results from the Provider's wilful misconduct or gross negligence.
3. The Provider is not liable for the actions of Users, the content of Customer Data, errors in the Customer's system or software, loss of the Customer's keys, or third-party licensing restrictions.
4. The Provider’s aggregate liability for damages arising from all events relating to a given Service is limited to the lower of: one monthly net fee for that Service as specified in the Order, including any discounts, or the total net fees actually paid for that Service. Where a fee covers several months, the monthly amount is calculated by dividing the net fee for the complete agreed term by the number of months in that term. This limit is not a guaranteed amount of compensation and does not restrict refunds of overpayments or fees for an unused period that are due to the Customer. The exceptions in paragraph 5 apply.
5. The limitations do not apply to loss caused intentionally or through gross negligence, personal injury, or liability that may not be limited by law. Nor do they limit the rights of a business benefiting from the protection of Article 385⁵ of the Polish Civil Code to the extent that a provision would not bind that business under the law. Liability for data protection is also subject to the mandatory provisions of the GDPR.
6. The Customer covers reasonable and documented costs of third-party claims arising from unlawful Customer Data or Users' actions to the extent that the Customer is responsible for their cause and had an opportunity to participate in the defence.

17. Force majeure

1. A Party is not liable for delay caused by an extraordinary event beyond its reasonable control whose effects it could not prevent, including a disaster, war, widespread failure of external networks or binding action by an authority.
2. The Party experiencing the event notifies the other Party and mitigates the effects. Force majeure does not release the Customer from payment for Service already performed or release the Parties from data protection and confidentiality obligations to the extent they can be performed.
3. If the event prevents a material part of the Service for more than 30 days, either Party may terminate the Agreement for that Service without a penalty for a future period.

18. Amendments to the Terms

1. The Provider may amend the Terms only for an objective reason:
   • a. entry into force of, or a binding interpretation of, law requiring a specific change;
   • b. remediation of an identified vulnerability or adaptation to a documented threat;
   • c. discontinuation of support for a technology by its manufacturer or subcontractor where retaining the existing solution is not reasonably possible;
   • d. addition of an optional feature that does not impair a Service already ordered;
   • e. a documented change in a tax or an external energy, colocation or connectivity cost — solely with respect to a proportionate change in prices for further terms presented to the Customer for acceptance, without changing the price of a term already paid for.
2. The Provider will notify the Customer by email of an amendment affecting an ongoing Agreement at least 30 days in advance, supplying the complete new text on a durable medium and describing its impact. The Customer may terminate the Agreement to which the amendment applies before an adverse amendment takes effect.
3. Shorter notice is permitted where required by law or urgent security needs; the Provider will explain the reason.
4. An amendment does not have retroactive effect. The price and guaranteed parameters of a fixed-term Agreement do not change during its term unless the Order expressly provides for a lawful adjustment mechanism.
5. The Provider archives versions of the Terms and makes them available for download.

19. Governing law and final provisions

1. The Agreement is governed by Polish law and directly applicable European Union law.
2. The Parties will attempt to settle a dispute amicably for 30 days. Thereafter, jurisdiction lies with the court of general jurisdiction having territorial jurisdiction over the Provider's principal place of business, unless mandatory provisions of law provide otherwise.
3. The Customer may not assign the Agreement without the Provider's written consent, which the Provider will not withhold without a justified reason. The Provider may assign the Agreement together with its business or an organised part thereof after prior notice and without diminishing the Customer's rights; if the change materially worsens the Customer's position, it may terminate the Service to which the assignment relates before the assignment takes place.
4. The invalidity of an individual provision does not affect the remaining provisions. The Parties will replace it with a solution as close as possible to its lawful purpose.
5. Operational and contractual notices are given to the email addresses specified in the Order. The Customer is responsible for keeping them up to date.
6. Annex 1 — Data Processing Agreement and Annex 2 — Shared Security Model below form an integral part of these Terms.

Annex 1 — Data Processing Agreement

A. Application and roles

1. This Annex applies automatically where, in connection with the Service, the Provider processes personal data on behalf of the Customer.
2. The Customer is a controller or processor and the Provider is, respectively, a processor or subprocessor. The Customer ensures that it has the right to issue instructions and — where it acts as a processor — the consent of its controller.
3. Documented instructions arise from the Agreement, the Customer’s technical settings and requests consistent with the Agreement. They include deletion in the circumstances and at the times specified in sections 6.8 and 12 of the Terms, taking account of Part F of this Annex. An additional instruction requiring non-standard costs is subject to prior agreement unless the law requires it to be performed without charge.
4. The Provider acts as a separate controller with respect to data required for the account, conclusion and billing of the Agreement, protection of its own network, prevention of abuse, handling reports, its own telemetry and legal obligations. It acts as a processor with respect to content and application data stored by the Customer and service operations performed on the Customer's instructions. The nature of a particular log is assessed according to its purpose and actual control, rather than its name alone.

B. Subject matter, duration and scope

1. The subject matter is the provision of physical infrastructure, storage, transmission, availability, security and limited servicing operations.
2. Processing continues for the duration of the Service and for the time necessary to carry out instructions for return or deletion consistent with the Agreement and obligations under mandatory provisions of law.
3. The nature of the operations includes storage and transmission within the infrastructure provided, making data available to the Customer, safeguarding, limited diagnosis of the hardware and network layer, and carrying out instructions for return or deletion within the scope controlled by the Provider. It does not include management of the Customer’s applications or restoration of its environment.
4. The purpose is performance of the Service in accordance with the Agreement. The Provider does not use entrusted data for its own marketing or model training.
5. The Order or an attached processing schedule specifies, for the relevant Customer, the actual categories of data, data subjects, purpose and any planned special categories of data. If those fields are left blank, the scope may include ordinary identification, contact, network and application data relating to employees, contractors, customers and end users which the Customer enters for its own computing or application hosting purposes.
6. Special categories of data, criminal conviction data, professional secrets or high-risk data must be identified in the Order and require a joint assessment of whether both Parties' measures are appropriate. This does not transfer the Provider's own obligation under Article 32 GDPR in the layer it controls.

C. Provider's obligations

1. The Provider:
   • a. processes data only on the Customer's documented instructions, including with regard to transfers, unless otherwise required by law;
   • b. informs the Customer of a legal obligation to process before carrying it out, unless the law prohibits such information;
   • c. ensures that authorised persons are subject to confidentiality;
   • d. implements the measures set out in Annex 2 and Article 32 GDPR that are appropriate to the risk in the layer controlled by the Provider;
   • e. forwards to the Customer without undue delay a data subject request concerning entrusted data and, without instructions, does not provide a substantive response unless required by law;
   • f. taking into account the nature of processing, assists the Customer with data subject rights, impact assessments, consultations and obligations under Articles 32–36 GDPR;
   • g. notifies the Customer of a personal data breach without undue delay, where possible within 48 hours after becoming aware of it, providing available information in stages;
   • h. makes available information necessary to demonstrate compliance and promptly informs the Customer if, in its opinion, an instruction infringes data protection law.
2. Assistance does not include administering an application or identifying data within the Customer's encrypted space.

D. Subprocessors

1. The Customer grants general authorisation for the engagement of subprocessors necessary for the Service.
2. Quicktel Sp. z o.o., KRS 0000297311, Poland, the operator of 4DataCenter, is an infrastructure subcontractor with respect to colocation, power, cooling and physical security. It is a subprocessor only to the extent that, on an individually documented instruction or a previously defined emergency instruction, it performs operations on personal data after being bound by an agreement meeting Article 28(4) GDPR.
3. The Provider imposes on a subprocessor the same data protection obligations arising from this Annex to the appropriate extent and remains fully liable to the Customer for the subprocessor's performance of those obligations.
4. The Provider will give at least 30 days' advance notice of an intended addition or replacement of a subprocessor. The Customer may raise a reasoned objection concerning data protection. If the Parties cannot find a solution, the Customer may terminate the Service to which the change relates before it takes effect without a penalty for a future period.

E. Location and authority requests

1. Entrusted Customer Data on the Server is stored in Katowice, Poland. Ancillary Service infrastructure and logs are maintained at the locations specified in the Data Export and Jurisdiction Register. Adding a location in another EEA state is subject to the subprocessor rules, and a transfer outside the EEA requires the Customer's instruction and a legal basis compliant with Chapter V GDPR.
2. The Provider verifies authority access requests, discloses the minimum data required, documents its response and — where permitted — informs the Customer and challenges manifestly unlawful requests.
3. Where the Customer is established or the Service is accessed outside the EEA, the actual data flows must be considered. Making personal data remotely available to the Customer or another recipient outside the EEA may constitute a transfer subject to Chapter V GDPR even where the Server remains in Poland. Before such transfers begin, the Parties identify and document the appropriate legal mechanism and implement the required safeguards. The Customer provides information about recipients and planned access necessary for that assessment. Acceptance of the Agreement or approval of the account does not, by itself, replace required safeguards or release either Party from its own obligations.

F. Return, deletion and audit

1. After the Service ends, the Provider, according to the Customer’s choice, returns entrusted data and then deletes it together with all existing copies, or deletes the data and copies, subject to section 12 of the Terms. When entering into the Agreement, the Customer chooses deletion after the Service ends; before that time, it may change its choice and request return through the channel specified in section 12.11. Standard return consists of enabling independent export from the Server, without managed application migration or a separate storage environment created by the Provider. Following an effective request for return, erasure is suspended until the applicable procedure is completed. Holds under sections 12.7 and 12.11 also apply to the failure described in section 6.8, subject to the technical feasibility of recovering data from a defective drive. No additional general retention period is established after the Service ends. Legally required retention and applicable provider-switching periods take precedence. Upon request, the Provider confirms completed deletion.
2. The Customer may normally request documents or a remote audit of reasonable scope once per year. The limit does not apply following a personal data breach, where there is a justified suspicion of non-compliance, following a material change in processing or at the request of an authority. An on-site audit requires prior scheduling and protection of other customers and confidentiality.
3. The Customer bears the reasonable cost of a non-standard audit unless the audit results from a breach or demonstrates material non-compliance; in that event, the Provider bears the reasonable cost. A charge or organisational conditions may not in practice prevent an audit required under Article 28 GDPR.

Annex 2 — Shared Security Model

The Provider implements at least the following measures in the layer it controls:

1. physical access to rooms and hardware is restricted and logged by the data centre, and remote hands are performed on documented instructions;
2. staff use individual permissions assigned according to the principle of least privilege, are subject to confidentiality, and their permissions are periodically reviewed;
3. BMC and the management network are separated from ordinary traffic, protected by unique access credentials and source restrictions, and MFA is used where supported by the relevant solution;
4. administrative channels controlled by the Provider use encrypted protocols such as SSH, TLS or VPN; unsecured remote services are disabled;
5. administrative, security and physical intervention events are logged and protected against unauthorised modification; standard retention is up to 12 months unless an incident or law requires a longer period;
6. the Provider updates controlled routers, BMC and tools, monitors availability and maintains vulnerability and incident-handling procedures;
7. configurations of the Provider's own network and management systems are protected for continuity purposes; this does not constitute a backup of Customer Data;
8. before reuse, a storage medium is securely erased using a method appropriate for HDD/SSD/NVMe and, where effective erasure is not possible, is physically destroyed or protected through an equivalent servicing procedure;
9. the effectiveness of the measures is periodically reviewed and material deficiencies are documented and remediated.

The scope does not imply possession of a certification not expressly specified in the Order. The Customer remains responsible in parallel for the measures assigned to it in the table.