Terms and Conditions

International version — applicable law: Czech Republic — Effective: April 2026

Jurisdiction notice: These Terms apply to customers outside Germany and the Czech Republic. German customers: see German AGB. Czech customers: see Czech VOP.

1. Parties and Scope

(1) These Terms and Conditions (“Terms”) govern the use of the automated privacy and security analysis service operated under the brand Forensic Privacy by NLTS Global Analytics s.r.o., Malá 43/6, 301 00 Pilsen, Czech Republic, ID No. 09262024 (“Provider”, “we”, “us”).

(2) These Terms apply to all agreements concluded through the Provider's website or API. By completing a purchase, the customer (“Customer”) agrees to be bound by these Terms.

(3) The Service is primarily directed at business customers (data protection officers, lawyers, public authorities, e-commerce operators). Consumers (natural persons acting outside their trade or profession) may also use the Service; mandatory consumer protection provisions of their country of residence apply additionally pursuant to Art. 6(2) Rome I Regulation.

(4) Conflicting or deviating terms of the Customer shall not apply unless expressly accepted in writing by the Provider.

2. Description of Service

(1) The Provider offers an automated analysis of websites for privacy and security characteristics. Depending on the product selected, analysis may include:

(2) The exact scope of the service depends on the product tier selected. The product description on the website at the time of ordering is decisive.

3. Technical Limitations and Scope of Analysis

Important notice: The Service analyses only what is technically observable at the time of the scan. The following limitations are expressly acknowledged by the Customer:

(1) Point-in-time snapshot: The analysis represents a snapshot of the website at the exact time of scanning. Website content, scripts, cookie banners, third-party integrations, and privacy policies may change after the scan time. The report applies exclusively to the scan time.

(2) Technical observability: The scan detects only technically observable tracking mechanisms. Server-side tracking, pixel tracking without JavaScript, obfuscated loaders, and fingerprinting without network access may remain undetected.

(3) A/B testing and geolocation: Websites may deliver different content, cookie banners, or tracking configurations depending on User-Agent, IP location, or A/B test group. The scan represents the version presented to the scan server.

(4) Dynamic content: Scripts loaded after user interaction and complex consent state machines cannot be fully mapped.

(5) Access restrictions: If the analysed website blocks the scan server (rate limiting, IP bans, CAPTCHA), the scan may be incomplete. In such cases, the Provider may offer a refund or re-scan at its discretion.

4. AI-Generated Content Disclaimer

Material notice regarding AI-generated report sections:

(1) Portions of the report — in particular narrative expert opinion texts, overall assessments, action plans, and legal classifications — are automatically generated by an AI language model (Claude API, Anthropic PBC, 548 Market St, San Francisco, CA 94104, USA).

(2) AI-generated texts do not constitute legal advice. They represent technical assessments based on scan results and do not substitute individual legal review by a qualified legal professional.

(3) AI language models may produce factually inaccurate statements (“hallucinations”). Despite the AI Quality Gate applied prior to every report signature (automated review for false positive reduction and severity calibration), errors, misclassifications, or incomplete assessments cannot be fully excluded.

(4) AI-generated statutory references (GDPR articles, CJEU decisions, national norms) are assigned automatically and may be erroneous or outdated. The Customer must verify all statutory references before use in legal proceedings.

(5) AI processing uses the Claude API (Anthropic PBC, USA). The data transfer is carried out on the basis of EU Standard Contractual Clauses (SCCs) and/or the EU-US Data Privacy Framework (DPF). Only technical website data (scan results) is processed — no personal data of the Customer is transmitted.

(6) The Provider shall not be liable for damages arising from reliance on AI-generated text without independent professional verification.

5. Accuracy of Scan Results — No Warranty of Completeness

(1) False positives: Automated tracker detection may erroneously flag legitimate technical services (CDN providers, consent management platforms, own infrastructure) as privacy-relevant third parties. Each finding in the report must be assessed by the Customer for plausibility.

(2) False negatives: The scan cannot detect all tracking mechanisms. A report without findings is not evidence of full GDPR compliance.

(3) Compliance score and rating levels: The compliance score shown in the report is an algorithmic indicator. It does not constitute a legal determination of GDPR compliance and shall not be interpreted as an official regulatory or court decision.

(4) GDPR Article mapping: The mapping of findings to GDPR articles (Arts. 5, 6, 7, 13, 14, 22, 25, etc.) is automated and may be erroneous, incomplete, or not tailored to the specific case. The enumeration is non-exhaustive.

(5) Scope of the Ed25519 signature: The cryptographic Ed25519 signature confirms exclusively the integrity of the report — i.e., that the document has not been altered since its creation. It does not confirm the factual accuracy, completeness, or legal validity of the findings contained therein.

(6) Reject-Leak test environment: The headless browser environment used for testing may differ from the experience of real end-users (different browser fingerprint, no cookies from prior visits, no geolocation from a real end-user location). Results reflect the test environment.

6. Third-Party Databases — Disclaimer for External Sources

The Service uses the following external data sources. The Provider has no influence over their content or accuracy:

(1) EasyPrivacy / Disconnect.me: Community-maintained filter lists for tracker identification. These lists may contain outdated entries, erroneous classifications, or missing current tracking services. The Provider accepts no liability for errors in these lists.

(2) ICIJ Offshore Leaks Database: Publicly available database of the International Consortium of Investigative Journalists. Matches in this database are expressly not to be interpreted as evidence of legal violations or criminal conduct. Name similarity alone does not establish suspicion. Manual cross-checking is recommended before any use.

(3) GeoIP databases (MaxMind): Third-country transfer analysis is based on statistical IP location data. Country-level accuracy is typically above 99 %; city-level accuracy is approximately 80 %. Individual IP addresses may be incorrectly assigned. GeoIP data does not constitute legal evidence of third-country data transfers.

(4) Company registry / business data: Public registry data (company name, directors, address) is queried at scan time. Changes after the scan time are not reflected.

(5) Blacklists / fake shop databases: Aggregated from multiple sources. False positive classification is possible. Blacklist entries do not replace independent legal review.

7. Use of Reports in Legal Proceedings

(1) The Provider's report is designed as technical documentation that may serve as a basis for the Customer's own legal actions. It is not a court-appointed expert opinion within the meaning of any applicable civil procedure rules.

(2) The use of the report as an exhibit to cease-and-desist letters, injunction applications, complaints to supervisory authorities (in particular pursuant to Art. 77 GDPR), or criminal complaints is exclusively the Customer's responsibility. The Provider gives no warranty that courts, authorities, or opposing counsel will accept the report as evidence or attribute any particular probative value to it.

(3) The Provider will not appear as a party or witness in legal proceedings conducted on the basis of reports, unless otherwise agreed in writing.

(4) For professional users (lawyers, DPOs): The Provider recommends that AI-generated opinion texts be validated by a qualified professional before submission in legal proceedings.

8. Dark Pattern Analysis — Subjectivity Notice

(1) The dark pattern analysis is based on published academic categorisations (Mathur et al. 2019, Gray et al. 2018) and EDPB Guidelines 05/2022 on dark patterns. These categorisations involve discretionary elements and are non-exhaustive.

(2) Whether a UX element constitutes a dark pattern is in part context-dependent and not always objectively determinable. The Service's findings represent technical assessments, not binding legal interpretations of applicable consumer protection, competition, or data protection law.

(3) The Dark Pattern Check does not substitute independent legal assessment by a qualified competition law or data protection attorney.

9. Monitoring — Latency and Availability

(1) For monitoring subscriptions, analysis is performed at periodic intervals according to the selected tier (daily/weekly). A time lag (latency) of up to 24 hours (Starter) or until the next scheduled scan interval may exist between an actual website change and its detection by the Service.

(2) KO-Alerts (critical violations) are dispatched as quickly as technically possible; real-time detection is not guaranteed.

(3) The Provider targets 99 % monitoring infrastructure uptime. The Provider shall not be liable for damages caused by monitoring outages beyond the limitations set out in Section 13.

10. Contract Formation

(1) The contract is concluded upon completion of the ordering process (product selection, entry of email address, payment via PayPal, or selection of invoice payment via Billogram).

(2) By completing the ordering process, the Customer declares having read and accepted these Terms.

(3) The Provider does not store the contract text individually. The Customer should archive these Terms and their order confirmation.

11. Prices and Payment

(1) All prices are net prices, exclusive of applicable VAT.

(2) Single reports are activated upon receipt of payment. Monitoring subscriptions are billed monthly in advance.

(3) Payment processing for PayPal and other online payment methods is handled by PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg. B2B and government customers may select invoice payment via Billogram (Billogram AB, Sweden).

(4) Failed scans caused by technical errors on the Provider's side are automatically refunded or credited.

12. Right of Withdrawal (Consumers)

(1) Consumers within the EU have a statutory right of withdrawal within 14 days of contract conclusion, subject to applicable national consumer protection law and the Rome I Regulation.

(2) Waiver for digital content: The right of withdrawal lapses upon delivery of the completed report by email to the email address provided at the time of order, pursuant to applicable EU consumer law (Directive 2011/83/EU, Art. 16(m), as implemented in each EU Member State).

(3) How to withdraw: If you have not yet received the report, you may withdraw from the contract via the withdrawal form at forensicprivacy.io/widerruf or in writing to [email protected].

(4) Confirmation of commencement of performance: By completing the order, you expressly consent to the immediate commencement of performance and acknowledge that your right of withdrawal lapses upon delivery of the completed report by email, pursuant to Directive 2011/83/EU, Art. 16(m).

13. Limitation of Liability

(1) The Provider is liable without limitation for damages caused by intent or gross negligence, and for damages arising from injury to life, body, or health.

(2) For slight negligence, the Provider is liable only for breach of material contractual obligations (cardinal obligations), limited to foreseeable, contract-typical damage.

(3) Special disclaimer for scan results: The Provider is not liable for damages arising from:

(4) The Provider's liability for indirect loss, loss of profit, or consequential damage is excluded to the maximum extent permitted by applicable law.

(5) The limitations of liability in this Section also apply to the personal liability of the Provider's legal representatives and agents.

14. Licence and Restrictions

(1) The Customer receives a non-exclusive, non-transferable right to use the Service for the duration of the contractual relationship.

(2) Generated reports may be used by the Customer for lawful purposes, including as exhibits in authority or court proceedings.

(3) Prohibited: automated mass-scanning without a legitimate audit purpose; reverse engineering of the Service; use to harm third parties; reselling analytical capacity without written consent of the Provider.

15. Term and Termination

(1) Single-scan contracts terminate upon delivery of the report.

(2) Monitoring subscriptions run for an indefinite period and may be cancelled by the Customer at any time with effect at the end of the current billing period.

(3) The Provider may terminate monitoring subscriptions with 30 days' notice. Pro-rata credits will be refunded.

16. Data Protection

The processing of the Customer's personal data and data relating to analysed websites is governed by the Provider's Privacy Policy, which forms an integral part of these Terms.

17. Governing Law, Jurisdiction, and Dispute Resolution

(1) Governing law: These Terms are governed by the laws of the Czech Republic, excluding the UN Convention on Contracts for the International Sale of Goods (CISG). For consumers with habitual residence in an EU Member State, the mandatory consumer protection provisions of that Member State apply additionally pursuant to Art. 6(2) Rome I Regulation.

(2) Jurisdiction: For disputes with business customers, the courts of Pilsen, Czech Republic, shall have exclusive jurisdiction, or at the Provider's election, the courts at the Customer's registered seat. For consumers, the mandatory provisions of Regulation (EU) 1215/2012 (Brussels Ia) apply, in particular Art. 18(1): the courts of the consumer's domicile have jurisdiction.

(3) Online dispute resolution: The European Commission provides an online dispute resolution platform at: https://ec.europa.eu/consumers/odr. The Provider is neither obliged nor willing to participate in dispute resolution proceedings before a consumer arbitration board. For international disputes outside the EU, the Provider and Customer agree to endeavour to resolve disputes amicably before initiating formal proceedings.

(4) If individual provisions of these Terms are or become invalid, the remaining provisions remain in full force and effect.

(5) Amendments to these Terms will be notified to the Customer by email at least 30 days in advance. Amended Terms are deemed accepted unless the Customer objects within that period; the notification will expressly draw attention to this right of objection.