Customer Agreement

Provision. We will provide the Services identified in the Order, materially as described in the Service Description and Documentation, and in accordance with the SLA & Support Policy and Security Policy.

What the Services do. The Services (a) validate Payment Instructions against generic, bank-specific, and payment-type rules and report all issues found; (b) convert valid Payment Instructions into the applicable Bank's file format; (c) deliver converted files directly to the Bank over the Customer's active Bank Connection, subject to the Customer's approval workflows; (d) retrieve and normalise bank statements and payment status reports; and (e) provide the web portal, API, webhooks, journal, and audit trail described in the Service Description, and the ERP Add-ons enabled for the Customer.

What the Services do not do. The Services do not (a) hold, receive, or transmit funds; (b) execute payments (execution is performed exclusively by the Customer's Bank); (c) guarantee that a Bank will accept, process, or execute any payment file; or (d) provide legal, tax, regulatory, or compliance advice. Validation reduces, but cannot eliminate, the risk of rejection by a Bank.

Delivery to the Bank. Converted, signed payment files are delivered by us directly to the Bank. We do not return signed payment files to the Customer or any third party, unless the Documentation describes otherwise. A Payment Instruction addressed to a Bank without an active Bank Connection and an applicable approval policy will be rejected.

Approval workflows. Release of a payment file to a Bank requires prior approval under the Customer's configured approval policy. The Customer is responsible for configuring approval policies appropriate to its risk profile. Approval policies are versioned; changes are subject to the controls described in the Documentation.

Limited Releases. Limited Releases are provided as-is, without warranty, indemnity, SLA, or support commitments, may be modified or discontinued at any time, and may not be covered by the retention and security commitments applicable to production services, as stated in the Service Description. Sandbox environments are available for the Order term; other Limited Releases may be time-limited. Our total aggregate liability arising out of Limited Releases is capped at EUR 500.

Changes to the Services. We may improve or modify the Services. We will give at least 30 days' notice of any change that materially reduces the core functionality the Customer has purchased, except where a shorter period is required for security or legal reasons.

Registration. The Customer will provide accurate, current registration information and keep it updated. We may verify the Customer's identity and business information, including through third-party sources.

Users. The Customer provisions and manages its Users and their roles. The Customer is responsible for all Connection Activity performed through its User accounts and API keys, whether or not authorised, except to the extent caused by our breach of the Security Policy. The Customer will promptly disable access for departing personnel and will notify us without undue delay of any suspected credential compromise.

Security measures. Both parties will implement appropriate technical and organisational measures. Our commitments are stated in the Security Policy. The Customer will use the security controls provided (including multi-factor authentication for administrators and approvers, role separation, and approval policies) in a manner appropriate to its risk.

Partners. The Customer may choose a BankConnector partner (for example its ERP reseller or consultant) at signup or later in the Services, and may change or withdraw that choice at any time. By choosing a partner, the Customer authorises that partner's users to view the Customer's data in the Services and to administer its technical setup (bank connections, channels, certificates and keys, and related settings) as described in the Documentation for the partner role. A partner may not approve, sign or release a payment, or change the Customer's approval policies or its Users' approval rights. Actions taken by a partner are recorded in the Customer's audit log.

Partners are independent. A partner is an independent company bound to us by a Partner Agreement, not our agent. Any services the partner provides to the Customer (implementation, configuration, support) are provided under the Customer's own agreement with that partner; we are not responsible for them. We are not liable for the partner's acts or omissions; the Customer's remedies for them lie against the partner under the Customer's agreement with it. Under this Agreement, actions the partner takes through its access to the Customer's account count as actions of the Customer's Users (Section 3.2). The Customer remains our customer whether or not it has chosen a partner, and may always contact us directly.

Customer authorisation. The Customer authorises BankConnector to access and operate its Bank Connections and to perform Connection Activity on the Customer's behalf, solely as necessary to provide the Services and solely as instructed through the Services.

Customer authority. The Customer represents and warrants that it is legally authorised to access each bank account and Bank Connection it uses with the Services, to issue payment instructions against those accounts, and to receive the associated statements and reports, in each case under its own agreements and mandates with the relevant Bank.

Bank Requirements. The Customer is solely responsible for its own Banks, bank agreements, mandates, and for satisfying all Bank Requirements. A Bank's delay or failure to onboard, accept, or process files does not relieve the Customer of its payment or other obligations under this Agreement.

Key custody. We generate and store Bank Connection credentials and key material on the Customer's behalf, encrypted at rest as described in the Security Policy. Key material is used solely to operate the Customer's Bank Connections. On termination, key material is destroyed in accordance with Section 9.6, except where a Bank Requirement or law requires otherwise.

Instruction content. As between the parties, the Customer is solely responsible for the accuracy, completeness, lawfulness, and timeliness of its Payment Instructions and for any transaction it directs or enables through the Services, including any resulting loss, fraud, or reversal, except to the extent caused by our failure to convert or deliver a valid, approved Payment Instruction in accordance with this Agreement.

Ownership. The Customer retains all rights in Customer Data. We process Customer Data solely to provide the Services and support, as instructed under the Agreement, or as required by law.

Data protection. The Data Processing Agreement (DPA) governs processing of personal data in Customer Data, with BankConnector acting as processor. For security telemetry, service improvement, and fraud/abuse prevention we act as an independent controller in respect of Usage Data only.

Permitted data. The Services are designed for business payment data, including: party names, addresses, account identifiers (IBAN/BBAN), remittance information, and, where required for approval workflows, approver identity data including national identity numbers, which are protected as described in the Security Policy. The Customer must not submit special categories of personal data (Art. 9 GDPR), payment-card primary account numbers, or health data.

Usage Data. We may use Usage Data for operating, securing, and improving the Services, and may disclose it only in de-identified, aggregated form.

Export. The Customer may export its journal and documents at any time during the term using the export functions described in the Documentation.

Lawful use. The Customer will use the Services only for its own business purposes, in compliance with the Agreement, the Acceptable Use Policy, and all laws applicable to the Customer, including, without limitation, anti-money-laundering, counter-terrorist-financing, KYC, economic sanctions, and export control laws, and any payment scheme rules binding on the Customer.

Compliance allocation. The Services may flag payment parties resembling entries on public sanctions lists. Such flags are advisory only, may be incomplete or wrong, and are not a compliance service. BankConnector does not perform KYC/AML checks on counterparties and does not monitor transactions for financial-crime purposes. Responsibility for sanctions and financial-crime compliance rests with the Customer and its Banks.

Restrictions. The Customer will not (a) resell, sublicense, or provide the Services to third parties, or use them on behalf of third parties, except under a separate written agreement with us, such as a Platform Agreement; (b) develop or contribute to a competing product or service in breach of Section 14.5; (c) reverse engineer any part of the Services except as permitted by mandatory law; (d) circumvent usage limits or security controls; (e) perform security testing without our prior written consent; (f) publish benchmarks of the Services without our consent; or (g) use the Services other than in accordance with the Documentation.

Fees. Fees are stated in the Order. Fees are invoiced and are not deducted from payment flows. Invoices are payable within 14 days of the invoice date. Late amounts accrue interest in accordance with the Danish Interest Act (renteloven).

Taxes. Fees exclude VAT and similar taxes, which the Customer pays where applicable (other than taxes on our income).

Fee changes. Fee changes take effect from the first billing month that starts at least 30 days after we give notice.

No set-off against Bank failures. Fees are not reduced or excused by a Bank's unavailability, delay, or rejection of files (see Section 4.3 and the SLA & Support Policy's third-party exclusions).

The Agreement runs from the Order start date until it is terminated. There is no minimum term: the Agreement renews monthly, and either party may end it with effect from the end of the current billing month by giving notice before that month ends. The Customer may give that notice by cancelling the subscription in the billing portal.

Suspension events. We may suspend the Services (in whole or part) if: (a) the Customer materially breaches Sections 3, 4, 6 or the Acceptable Use Policy; (b) we reasonably believe continued provision creates a material security risk, legal or regulatory exposure, or material harm to the Services or other customers; (c) undisputed fees are more than 30 days overdue after written reminder; or (d) usage limits are materially exceeded. Except where the risk is material and imminent, we will give notice and a reasonable opportunity to cure before suspending. We will restore the Services promptly once the cause is resolved. Fees continue to accrue during suspension caused by the Customer.

Termination for cause. Either party may terminate: (a) for material breach not cured within 30 days of written notice; or (b) upon the other party's insolvency. We may additionally terminate if required by law or a governmental or bank-imposed requirement, or if the Customer becomes subject to sanctions.

Effects of termination. Access ceases at the effective date, except as set out in Section 9.4. Accrued fees survive. Sections intended to survive (including 4.5, 5, 7, 10–14, 16) survive.

Wind-down and export. For 30 days after termination (other than termination for the Customer's material breach or unlawful use), we will keep the portal available in read-only mode so the Customer can export its journal, documents, and configuration. No new Payment Instructions may be submitted during wind-down. In-flight payment files at the termination date will be completed or cancelled per the Customer's instruction where technically possible.

Data deletion. After wind-down, Customer Data is deleted or anonymised in accordance with the DPA and the retention schedule in the Service Description, subject to legal holds and statutory retention duties.

Key destruction. Bank Connection key material is destroyed on completion of wind-down. The Customer is responsible for notifying its Banks of the termination and revoking bank-side authorisations.

Mutual. Each party warrants it is validly existing and has the authority to enter into the Agreement.

Our warranties. We warrant that (a) the production Services will operate materially as described in the Service Description and Documentation; and (b) we will provide the Services with reasonable skill and care, using appropriately qualified personnel.

Bank integrations (efforts only). We will use commercially reasonable efforts to maintain the availability and correctness of the Bank integrations used by the Customer. We do not warrant that any Bank will accept or process files, nor that a Bank will not change its requirements. Bank-side changes are addressed as maintenance under the SLA & Support Policy.

Third-Party Services. Banks, network providers, and other third-party services are outside our control. We are not liable for their acts, omissions, unavailability, or data handling. Bank unavailability does not count as downtime under the SLA & Support Policy.

Warranty remedy. For breach of Section 10.2: we will re-perform or repair within 30 days of notice; failing that, the Customer may terminate the affected Order and receive a pro-rata refund of prepaid unused fees. This is the exclusive remedy for warranty breach, without limiting Section 11.

Disclaimer. Except as stated in this Agreement, the Services are provided without further warranties; we do not warrant uninterrupted or error-free operation.

Exclusions. Neither party is liable for indirect or consequential loss, loss of profits, revenue, goodwill, or data.

Cap. Each party's total aggregate liability under the Agreement is limited to the fees paid or payable by the Customer in the 12 months preceding the first event giving rise to liability.

Carve-outs. The exclusions and cap do not apply to: (a) liability that cannot be excluded under mandatory law; (b) fraud, gross negligence, or wilful misconduct; (c) the Customer's breach of Section 6.3 (Restrictions) or the Acceptable Use Policy; (d) the Customer's indemnity obligations; (e) the Customer's fee obligations; or (f) agreed penalties under Section 14.6, and the Customer's breach of Section 14.4 or 14.5. Our liability under Section 12.2 is limited to twice the amount in Section 11.2.

No funds liability. We do not hold funds and are not liable for funds in transit between the Customer and its Banks. Our responsibility relates to the conversion, validation, delivery, and reporting of payment files as described in Section 2.

Claims bar. A claim under the Agreement must be brought within 12 months of the date the claiming party became aware, or ought reasonably to have become aware, of the facts giving rise to it.

By the Customer. The Customer will defend and indemnify BankConnector against third-party claims arising from (a) Customer Data or Payment Instructions; (b) the Customer's breach of Sections 4, 6, or the Acceptable Use Policy; or (c) the Customer's business and its relationships with its Banks and counterparties.

By BankConnector. We will defend and indemnify the Customer against third-party claims that the Services, as provided by us and used in accordance with the Documentation, infringe a patent, copyright, trademark, or trade secret enforceable in the EEA or the United Kingdom. Remedies: we may procure the right to continue, modify or replace the infringing element, or terminate the affected Order with a pro-rata refund of prepaid unused fees. This states the exclusive remedy for infringement. Exclusions: modifications not made by us, combination with items not provided by us, use in breach of the Agreement, and Limited Releases.

Procedure. The indemnified party gives prompt notice; the indemnifying party controls the defence; the indemnified party cooperates reasonably. Late notice relieves the indemnifying party only to the extent of actual prejudice.

Ownership. We retain all rights in the Services (including ERP Add-ons, the conversion engine, bank profiles, formats and validation rules) and in the Documentation. The Services, including ERP Add-ons, are licensed to the Customer, not sold. The Customer receives a non-exclusive, non-transferable right to use the Services during the term for its own business; for ERP Add-ons, that right is subject to Section 14.4.

Feedback. The Customer grants us a non-exclusive, perpetual, royalty-free licence to use feedback and suggestions; feedback is not assigned.

Publicity. We may tell others that the Customer is a BankConnector customer, and use its name and logo for that purpose in any of our marketing, including our website, customer lists, presentations and social media, until the Customer revokes this in writing. We will not attribute quotes or statements to the Customer without its consent. The Customer needs our consent for press releases and other public announcements about the relationship.

ERP Add-ons. The Customer may use an ERP Add-on only during the term, only in the companies in its ERP system for which we have enabled that ERP Add-on, and only together with the Services. The Customer must not, and must not help or allow anyone else to: (a) copy an ERP Add-on, except to install it as the Documentation or we instruct; (b) modify, decompile, disassemble or reverse engineer an ERP Add-on, or derive its source code, structure, formats, bank profiles or workflows; or (c) sell, rent, lend, sublicense, distribute or otherwise make an ERP Add-on available to anyone other than its Users and, for installation and support, its partner under Section 3.4; in each case except to the extent mandatory law permits it. When the Agreement ends, the Customer stops using ERP Add-ons and deletes any copies of them that it holds.

No competing development. The Customer must not, and must not help or allow anyone else to, use the Services, the Documentation or our Confidential Information to develop, have developed or contribute to a product or service offering bank connectivity, payment-file conversion or bank reconciliation similar to the Services. This applies while the Agreement is in force and for 2 years after it ends. It does not restrict the Customer's use of general skills and experience, of public standards and banks' own published documentation, or of anything the Customer can show it developed independently without using the Services, the Documentation or our Confidential Information. Building and offering integrations that use the Services through our published API is not competing development.

Agreed penalty. For each breach of Section 14.4 or 14.5, the Customer pays us an agreed penalty (konventionalbod) of DKK 250,000, without our having to prove any loss. Acts done on the same occasion or arising from the same error count as one breach; each further occasion, and each product or service developed in breach of Section 14.5, is a separate breach. If a breach continues more than 30 days after our written notice to end it, a further penalty is payable for each started month it continues after that. A breach has ended when the act or use concerned has stopped and the Customer has deleted or returned the copies, derived material and Confidential Information involved. Paying a penalty does not end the breach, and we may also claim damages for loss exceeding it and seek an injunction. Agreed penalties are not limited by Section 11 (see Section 11.3(f)).

Changes to the Agreement. We may change this Agreement and the Policies on 30 days' notice, or on shorter notice where a change is required by law or for security. A Customer that does not accept a change may terminate under Section 8 before it takes effect; continued use after the effective date is acceptance.

Documentation. The Documentation describes the Services as they evolve and may be updated at any time.

Versioning. Superseded versions of this Agreement and the Policies remain available at bankconnector.com/legal.

Precedence. In case of conflict: the DPA (for its subject matter), then the Order (where it expressly overrides), then this Agreement, then the Policies, then the Documentation. Terms on a Customer purchase order have no effect.

Governing law and venue. The Agreement is governed by Danish law, excluding its conflict-of-law rules and the United Nations Convention on Contracts for the International Sale of Goods (CISG). Exclusive venue: the City Court of Copenhagen (Københavns Byret).

Escalation. Before commencing proceedings (except for interim relief), the parties will escalate a dispute to senior management for 30 days of good-faith discussion. This does not apply to the collection of undisputed fees.

Notices. Operational and legal notices are given by email (to BankConnector at legal@bankconnector.com, and to the Customer at its registered administrator email) and may additionally be given by in-product notice. Notices are deemed received on the next business day.

Assignment. The Customer may not assign the Agreement without our consent. We may assign it on notice to an affiliate or to an acquirer of the business or assets concerned. The Customer notes that Banks may require re-onboarding of an assignee under Bank Requirements.

Force majeure. Neither party is liable for failure caused by events beyond its reasonable control; fee obligations are not excused.

Miscellaneous. The Agreement is the entire agreement between the parties regarding its subject matter and supersedes prior discussions. If a provision is held unenforceable, it will be modified to the minimum extent necessary and the remainder stays in force. A failure to enforce is not a waiver. The parties are independent contractors. The Agreement is drawn up in English, and the English text controls.

Subcontracting. We may use subcontractors and affiliates in providing the Services (data subprocessors are governed by the DPA); we remain responsible for our overall performance.