Terms of use

These terms apply to all use of consented.eu: the dashboard, the public website, the programming interfaces and the consent script delivered on the websites of users. The contracting party is the operator named in the imprint.

Deviating, conflicting or supplementary terms of the user do not become part of the contract, even if they are not expressly objected to in an individual case. They apply only where the operator has agreed to them in text form.

The data processing agreement and the privacy notice apply in addition. For the processing of visitor data, the data processing agreement takes precedence over these terms.

The service is directed exclusively at entrepreneurs within the meaning of art. 43¹ of the Polish Civil Code (Kodeks cywilny, k.c.) and at legal persons and organisational units carrying on economic or professional activity. No contract is concluded with consumers (art. 22¹ k.c.).

The contract is of a professional character for the user. The provisions on abusive clauses (art. 385¹ to 385³ k.c.) therefore do not apply, nor do they apply by way of art. 385⁵ k.c.

By registering, the user confirms that they are acting in the course of their economic or professional activity and that the contract is of a professional character for them. If this turns out to be incorrect, the operator may close the account without notice.

Anyone running a website outside a business context can self-host the same software. The source code is available under the MIT licence and exists for exactly that purpose.

By submitting the registration, the user makes an offer to conclude a usage contract. The contract is concluded when the account is activated. There is no entitlement to conclusion; the operator may refuse a registration without giving reasons.

The details given on registration must be accurate and are kept up to date by the user. The e-mail address on file is the delivery channel for all notices under these terms; a notice is deemed received once it has been sent to that address and no delivery failure is returned.

Credentials are confidential and must not be passed on. Two-factor authentication is strongly recommended. The user is responsible for everything done through their account until they report a suspicion of misuse. Any such suspicion must be reported without delay.

consented.eu provides a consent management platform: a banner for obtaining consent, a dashboard for configuring it, a record for demonstrating it, a service catalogue as a research aid, a website scan and interfaces for integration.

The scope of the service is determined by the current documentation and by the functions actually available in the dashboard. No properties beyond that are owed; statements in marketing texts, screenshots or examples are descriptions, not an agreement on quality and not a guarantee.

The service is provided as available. No particular outcome is owed, and in particular no particular legal outcome.

Use is free of charge. There are no payment details, no trial period and no paid tier.

Because the operator receives no consideration, its liability is governed by the standard Polish law provides for gratuitous benefits: intent and gross negligence (art. 891 § 1 k.c., applied accordingly). Clause 12 implements this.

The operator is not obliged to offer the service free of charge indefinitely. A switch to a paid model will be announced in text form at least 90 days in advance; until it takes effect the user may terminate and export their data. No payment obligation arises without the express consent of the user.

The service is a technical tool. It does not create legal compliance and does not replace legal advice. The operator provides neither legal nor tax advice; it is not an advocate (adwokat), a legal adviser (radca prawny) or a tax adviser (doradca podatkowy).

In particular, it is neither assured nor warranted

• that using the service satisfies the requirements of the GDPR, the German TDDDG, the Polish Electronic Communications Law, the ePrivacy rules or any other provisions;
• that a specific configuration will be assessed as lawful by a supervisory authority or a court;
• that the service catalogue is complete, current or correct for the individual case — the entries are a research aid, not a legal classification;
• that a website scan finds every embedded service; a scan is a technical snapshot and can miss services and report services that are not relevant;
• that supplied categories, sample texts, templates and defaults — for example on purposes, legal bases or retention periods — are appropriate for the individual case. They are suggestions and become the decision of the user only once the user adopts them.

Which services require consent, on what legal basis they are processed, which texts are appropriate and how long records are kept is decided and answered for solely by the user as controller.

The user

• enters accurate and complete details on services, purposes, recipients and retention periods and keeps them up to date;
• warrants that they are authorised to dispose of the domains they enter;
• maintains their own privacy notice and their own imprint — the service replaces neither;
• integrates the script correctly and in particular ensures that no services requiring consent are loaded before consent has been given. The operator has no access to the website of the user and can neither check nor prevent this;
• tests the configuration on their own website before productive use and again after every change;
• exports the consent records at reasonable intervals and does not rely solely on storage by the operator for the purposes of Article 7(1) GDPR;
• does not use the service for unlawful content, to circumvent security measures, for automated bulk access beyond ordinary use, or to design misleading choice dialogues;
• reports apparent defects and security problems without delay.

If the user breaches these duties, the operator may suspend the affected properties or the account under clause 10. Further claims remain unaffected.

The source code is available under the MIT licence. It may be copied, modified and self-hosted; the licence terms and the warranty and liability disclaimer contained in it apply unchanged.

The MIT licence does not cover the name, logo, word and figurative marks or the visual identity of consented.eu. Their use requires prior consent in text form; mere naming for reference remains permitted.

For use of the instance hosted by the operator, the user receives a simple, non-transferable and non-sublicensable right of use for the term of the contract. Reselling the hosted instance as a service of ones own is not covered; anyone wishing to make their own offering hosts the software themselves.

The operator acquires no rights in the data the user enters beyond what is necessary to operate the service.

No particular availability is assured for a service provided free of charge. There is no service level, no promised response time and no entitlement to support.

Maintenance is announced where possible and scheduled for low-traffic periods. Security-related interventions are carried out without prior notice where a delay would increase the risk.

The operator may develop the service further and change, replace or discontinue functions. Material reductions in functionality are announced in text form at least 30 days in advance. Complete discontinuation of the service is announced at least 90 days in advance; export and deletion remain possible until then.

Anyone who needs guaranteed availability runs the same software themselves — the installation guide is part of the offering.

There are no feature limits and no domain limits. The service is used to the ordinary extent.

The operator may throttle individual functions, deactivate properties or suspend an account where

• the use poses a risk to operations, to security or to the data of other users;
• a single instance noticeably impairs operations for others;
• there is a material breach of clause 7;
• unlawful content is being delivered, or there is reasonable suspicion of this;
• an official or judicial order requires it.

Before suspending, the operator makes contact and, where reasonable, sets a deadline for remedy. Where there is imminent danger, suspension comes first and notification second.

For the website visitor data captured through the banner, the user is the controller and the operator is the processor. The data processing agreement under Article 28 GDPR forms part of these terms and is concluded in electronic form on registration (Article 28(9) GDPR).

For the account data itself — registration, sign-in and operation of the dashboard — the operator is the controller. What is processed in that context is set out in the privacy notice.

The user must not have special categories of data under Article 9 GDPR or data under Article 10 GDPR processed through the service. The service is neither designed nor intended for that.

a) Standard. The service is provided free of charge. The operator is therefore liable only for intent and gross negligence. This matches the standard art. 891 § 1 k.c. lays down for gratuitous benefits and is validly agreed under art. 473 § 1 k.c.

b) Limit of the agreement. Under art. 473 § 2 k.c., excluding liability for damage caused intentionally is void; to that extent the operator is liable without limitation. Liability also remains unaffected for damage arising from injury to life, body or health, for a dangerous product (art. 449¹ et seq. k.c.) and under mandatory data protection law, in particular Article 82 GDPR.

c) Lost profit. Liability is limited to loss actually incurred (damnum emergens); there is no liability for lost profit (lucrum cessans, art. 361 § 2 k.c.). This does not apply in the cases under b).

d) Excluded heads of loss. Where no liability arises under a) to c), there is in particular no liability for savings not realised, business interruption, third-party claims, reputational harm, the costs of pursuing or defending claims, or fines and administrative penalties under Article 83 GDPR, section 28 TDDDG or comparable provisions, or the costs of competition-law warning letters concerning the design or integration of the banner.

e) Loss of data. There is no liability for loss of data to the extent the damage would not have occurred had the user maintained proper, risk-appropriate and regular backups. Otherwise liability is limited to the effort that restoration would have required had proper backups been maintained.

f) Contributory fault. art. 362 k.c. remains unaffected. Contributory fault includes in particular a failure to test the configuration, faulty technical integration and a failure to make backups.

g) Personal scope. The limitations of liability also apply in favour of the legal representatives, shareholders, employees and the persons the operator uses to perform its obligations (art. 474 k.c.), and to claims of any legal nature, in particular claims in tort (art. 415 et seq. k.c.) and claims arising from pre-contractual conduct.

h) Software licence. The warranty and liability disclaimer of the MIT licence additionally applies to obtaining and self-hosting the source code.

The user indemnifies the operator and its legal representatives, shareholders, employees and vicarious agents against all third-party claims brought against them because

• the user has breached these terms or the data processing agreement,
• details, texts or configurations entered by the user are incorrect, incomplete or unlawful,
• the script is incorrectly integrated on the website of the user, or services requiring consent are loaded there before consent,
• the user gave an instruction the following of which triggered the claim, or
• the user was not authorised to dispose of a domain they entered.

The indemnity covers the reasonable costs of legal defence. Fines are covered to the extent that assuming them is legally permissible.

The operator informs the user without delay of any claim asserted, makes no admission without their consent, and gives them the opportunity to help shape the defence. The indemnity does not apply to the extent the claim rests on intent or gross negligence on the part of the operator.

The statutory limitation periods apply to claims under this contract. For claims connected with the operation of a business these are three years under art. 118 k.c.; the period ends on the last day of the calendar year.

Shortening these periods by agreement would be void under art. 119 k.c. and is therefore not attempted here.

The user reports apparent defects and disruptions in text form without delay after discovering them. Where such a report is omitted and the damage grows as a result, this is taken into account under art. 362 k.c.

The contract runs for an indefinite period. The user may terminate at any time without notice by deleting their account. The operator may terminate on 30 days notice to the end of a month. The right to terminate for cause remains unaffected on both sides.

On termination, access to the dashboard ends and the banner is no longer delivered. The integration on the website must be removed or replaced beforehand — without a delivered banner, no consent is obtained on the website any more. No transition period beyond the notice period is owed.

Consent records already captured are retained until the configured retention period expires, because they serve as evidence under Article 7(1) GDPR. The user may demand immediate deletion at any time; after that the consent can no longer be demonstrated. Export remains possible until deletion; clause 11 of the data processing agreement sets out the details.

The operator may amend these terms where this is necessary because of a change in the law, because of requirements set by the highest courts or by authorities, because of further development of the service, or to close a gap in the provisions. The amendment must not materially shift the balance of the contract to the detriment of the user.

Amendments are announced in text form to the address on file and in the dashboard at least 30 days before they take effect. If the user continues to use the service after they take effect, the amended terms apply to further use; otherwise the user may terminate before that date. The operator points out both in the announcement.

The version published at this address applies in each case. The operator provides earlier versions on request.

Governing law. Polish law applies, excluding the UN Convention on Contracts for the International Sale of Goods and the conflict-of-laws rules of private international law. Mandatory provisions of the state in which the user is established remain unaffected.

Place of jurisdiction. Disputes under this contract fall within the exclusive jurisdiction of the Polish court for the seat of the operator (art. 46 § 1 k.p.c.). The operator may also sue the user at their general place of jurisdiction. The place of performance is the seat of the operator.

Set-off and retention. The user may set off only against claims that are undisputed or have been established by final judgment. A right of retention is available to them only in respect of claims arising from this contractual relationship.

Assignment. The user may transfer rights and obligations under this contract only with the consent of the operator in text form (art. 509 § 1 k.c.). The operator may transfer the contract as part of a legal succession or to an affiliated company; in that case the user may terminate within 30 days.

Text form. Where these terms require text form, a declaration in documentary form within the meaning of art. 77² k.c. is sufficient; an e-mail to the address on file will do. There are no oral side agreements.

Dispute resolution. Because the service is not directed at consumers under clause 2, there is no obligation to take part in out-of-court consumer dispute resolution. The operator is also unwilling to do so.

Severability. If a provision is invalid, the remaining provisions stay in force (art. 58 § 3 k.c.). The statutory rule takes the place of the invalid provision.

Language. The German version of these terms is authoritative; translations serve comprehension.