Terms of Service

These Terms of Service govern the use of services provided by Michał Fox, operating under the "VulCode" brand (hereinafter: "VulCode", "we", "us"), based in Kraków, Poland, email: hello@vulcode.com, including website development, web and mobile application development, bespoke software development, and related services.

These Terms are a standard form contract within the meaning of Article 384 of the Polish Civil Code and terms for services provided by electronic means within the meaning of Article 8 of the Polish Act of 18 July 2002 on Providing Services by Electronic Means. They form an integral part of every Agreement concluded with VulCode.

These Terms apply to Clients who are businesses, to Consumers and to Sole Traders with Consumer Rights. The special rules for Consumers and Sole Traders with Consumer Rights are set out in Section 16, and provisions that apply to only one of these groups are expressly marked as such.

By ordering a Service or using the Website or the Client Panel, the Client and the User accept these Terms in their entirety. A person who does not accept these Terms may not conclude an Agreement or use the Client Panel.

A separate agreement concluded by the Parties, including an agreement on the Client's template, a non-disclosure agreement or a personal data processing agreement, takes precedence over the Order and these Terms to the extent that it governs a given matter. The Order takes precedence over these Terms.

The Client's general terms of business, order forms and other standard contract terms do not bind VulCode unless the Parties conclude a separate agreement based on them (clause 1.5) or VulCode expressly accepts them in Documentary Form.

These Terms are available free of charge on the Website in a way that allows them to be downloaded as a PDF file, saved and printed. On request, VulCode sends these Terms by email.

A contract is formed upon written (including electronic) confirmation by VulCode of its acceptance of the Order, or upon payment of an advance by the Client.

The detailed scope of services, delivery timelines, and remuneration are agreed individually for each Order.

Any changes to the scope of an Order require the written consent of both parties and may result in an adjustment of the remuneration and delivery timeline.

A Quote is free of charge and does not oblige the Client to conclude an Agreement. VulCode is bound by a Quote for 30 days from sending it, unless the Quote states a different period. After that period the Quote may be updated.

We prepare a Quote on the basis of information provided by the Client. If that information proves incomplete or inaccurate, in particular as to the state of existing code, systems, data or Third-Party Services, VulCode may propose a change to the scope, remuneration or deadlines under clause 3.3.

The Order sets out in particular the scope of work, the billing model, the remuneration, the payment schedule and the deadlines and, where applicable, the Stages, the Acceptance procedure, the warranty period and the scope of Maintenance. Matters not governed by the Order are governed by these Terms.

Either Party may request a change of scope. VulCode presents the effect of the change on the remuneration and deadlines, and until the change is agreed under clause 3.3 the work continues within the existing scope.

Services from the Client Panel catalogue are ordered in the Client Panel by choosing a variant and a billing period. The Agreement is concluded when the order is placed, and the service starts once the payment for the invoice issued for the order is booked.

VulCode may decline an order without giving reasons, and always declines it where its subject would be contrary to the law or to good practice or would infringe the rights of third parties.

VulCode undertakes to carry out the Order in accordance with the agreed scope, with due care, and within the agreed timeframe.

The Client is obliged to provide, within the agreed time, all materials, content, access credentials, and information necessary for the execution of the Order. Delays attributable to the Client shall not be charged to VulCode.

VulCode reserves the right to engage subcontractors in the delivery of services. VulCode is responsible for the acts and omissions of its subcontractors as for its own, and names to the Client, before work starts, any subcontractor who would have access to personal data provided by the Client.

Indicative timelines are estimates only. Binding deadlines are set out in the Order.

VulCode chooses the methods, tools and technologies of delivery itself, guided by current technical knowledge, unless the Order specifies otherwise.

We carry out the work on a Test Version. Deployment to the production environment takes place after Acceptance or on the Client's express instruction given in Documentary Form.

VulCode keeps the Client informed of the progress of the work in the Project Channel and informs the Client of any risk of missing a binding deadline promptly after identifying it.

The Client cooperates with VulCode in performing the Agreement, in particular:

1. appoints a contact person authorised to make decisions and give Acceptance;
2. provides answers, approvals and Client Materials within the times arising from the schedule;
3. provides access to the accounts, systems and environments needed for the work;
4. informs VulCode of circumstances that may affect the work, including legal and industry requirements that apply to the Client's business.

If the Client is late in providing materials, decisions, approvals or access, the delivery deadlines move by the length of the delay. Where resuming the work requires the team to be rescheduled, VulCode sets a new deadline, taking its prior commitments into account.

If a lack of cooperation by the Client makes the work impossible, VulCode may set the Client an appropriate deadline in Documentary Form, stating that once it passes without effect VulCode will terminate the Agreement with immediate effect, retaining the right to remuneration for the work performed up to the termination date (clause 15.4).

Redoing elements the Client has already approved, and work resulting from a change in the Client's decisions, is settled as a change of scope (clause 3.3).

After completing a Stage or the whole of the work, VulCode makes it available to the Client for checking, in particular on a Test Version, and notifies its readiness for Acceptance in the Project Channel or in the Client Panel.

The Client checks the work against the scope of the Order and, within 7 Business Days of the notice of readiness, either gives Acceptance or submits objections in Documentary Form identifying specific non-conformities with the scope, unless the Order provides for a different period.

VulCode remedies justified objections within an appropriate time and notifies its readiness for Acceptance again. The repeated check covers the elements the objections concerned and the elements the fixes may have affected.

Remarks on features or solutions not covered by the Order, preferences that do not follow from the Order and minor issues that do not prevent use of the Product for its intended purpose are not grounds for refusing Acceptance. Such remarks may be carried out as a change of scope (clause 3.3), and VulCode fixes minor issues under the warranty (Section 7).

Acceptance is deemed given if the Client neither gives Acceptance nor submits objections within the period in clause 4.13, and also at the moment the Client starts using the Product in its business or instructs its production deployment, whichever comes first.

Acceptance of a Stage does not replace Final Acceptance. Final Acceptance covers the Product as a whole, and Stages accepted earlier are checked in it only as regards their interaction with the other parts.

On the date of Final Acceptance the warranty period starts (clause 7.1), and VulCode may issue the invoice for the final payment set out in the Order or in clause 5.2.

The amount of remuneration for a service is determined individually in the offer or Order.

With a fixed price (clause 5.6), the Client chooses one of two payment schedules: (a) an advance payment of 50% of the Order value before work commences and the remaining 50% upon Final Acceptance, or (b) three equal parts: an advance payment before work commences, the second part upon Acceptance of a Stage and the third part upon Final Acceptance. The chosen schedule is written into the Order. If the Order does not state a schedule, schedule (a) applies.

Invoices are issued within the timeframe agreed by the parties. Overdue unpaid invoices may result in suspension of work or suspension of access to delivered products.

In the event that the Client withdraws from the Order after work has commenced, VulCode is entitled to retain the advance payment and any remuneration for work already performed.

An advance retained under clause 5.4 counts towards the remuneration for the work performed up to the date of withdrawal. The value of that work is determined by its degree of completion and the rates in the Order or the Quote, and if it exceeds the advance, the Client pays the difference. Clauses 5.4 and 5.5 do not limit the rights of Consumers and Sole Traders with Consumer Rights set out in Section 16.

The remuneration may be set as a fixed price for the scope of the Order, as time and materials at the rate in the Order, or as a fixed fee per billing period (subscription). The Order states the billing model, and changing it during the cooperation requires the consent of both Parties.

With a fixed price, the remuneration covers the scope of the Order. Work outside that scope is carried out once a change has been agreed under clause 3.3.

With time and materials, the remuneration depends on the time actually worked, and time estimates are indicative. Time is logged against specific tasks, and once a week VulCode sends the Client a summary of the work done and the time worked.

A subscription is payable in advance for each billing period and renews for the next period until the Client cancels it. The Client may cancel a subscription in the Client Panel at any time with effect from the end of the paid period and, where the service variant allows it, also with immediate effect. Remuneration for a billing period that has started is not refundable, subject to Section 16.

Amounts in the Quote and the Order are net amounts, to which VAT is added where applicable, unless they are stated as gross amounts. VulCode quotes prices to Consumers inclusive of taxes.

The Client accepts electronic invoices made available in the Client Panel or sent by email and, where the law requires it, issued in the Polish National e-Invoicing System (KSeF).

Payments are made by bank transfer to the account stated on the invoice, through a payment provider or from the wallet balance in the Client Panel, within the term stated on the invoice. The date of payment is the date VulCode's account is credited or the payment is booked in the Client Panel.

In the event of late payment VulCode may charge statutory interest for late payment and, from Clients who are businesses in commercial transactions, statutory interest for late payment in commercial transactions and compensation for debt recovery costs under the Polish Act of 8 March 2013 on Counteracting Excessive Delays in Commercial Transactions.

A suspension of work or of access under clause 5.3 does not affect the Client's data, and the period of suspension does not count towards the delivery deadlines. We resume the work and access once the overdue payment is booked.

A Client who is a business, other than a Sole Trader with Consumer Rights, may not, without VulCode's consent given in Documentary Form, set off its claims against VulCode's claims or withhold payment for accepted Stages because of objections to other Stages.

The costs of Third-Party Services, in particular hosting, domains, paid Third-Party Components, developer accounts in app stores and API fees, are borne by the Client unless the Order states otherwise. If VulCode pays them on the Client's behalf at the Client's request, the Client reimburses their equivalent on the basis of an invoice.

Funds in the wallet in the Client Panel may be used only to pay for VulCode's Services and bear no interest. VulCode refunds unused funds paid in by the Client on the Client's request, in particular when the account is deleted, to the account they were paid from.

Referral programme commissions are credited to the wallet, cannot be withdrawn and may be used only to pay for VulCode's Services (clause 18.12).

Upon full settlement of remuneration, the Client acquires full economic rights to the code, graphics, and other materials created specifically for the Client within the scope of the Order.

VulCode retains the right to present completed work in its portfolio, unless the Client has required confidentiality.

Open-source libraries, frameworks, and tools used in the execution of an Order are subject to their own licences, which the Client accepts as part of the project.

Until full settlement of remuneration, all rights to the code and materials produced remain with VulCode.

The transfer of rights under clause 6.1 covers the following fields of exploitation:

1. for computer programs: permanent or temporary reproduction in whole or in part by any means and in any form, translation, adaptation, rearrangement and any other alteration, distribution, including lending and rental, and making available on a network, including as an online service;
2. for other works: recording and reproduction by any technique, placing on the market, lending, rental, entering into computer memory and into a network, public performance, exhibition, display, playback, broadcasting and rebroadcasting, and making available to the public in such a way that anyone can access them at a place and time of their choosing.

Together with the economic rights, VulCode transfers to the Client the exclusive right to authorise the exercise of derivative copyright in adaptations of the works and ownership of the media on which they were handed over.

Under Polish law, an agreement transferring economic copyright must be made in writing to be valid. At the Client's request, once the conditions of clause 6.1 are met, the Parties conclude an agreement transferring the rights in line with this Section, in writing or in electronic form bearing qualified electronic signatures.

VulCode undertakes not to exercise its moral rights in the Product against the Client and its legal successors in a way that would hinder the use of the Product, in particular the right of authorial supervision and the right to have the work marked with the author's name, without prejudice to the portfolio right (clause 6.2).

VulCode warrants that it holds the rights to the parts of the Product created by VulCode and its subcontractors to the extent needed to transfer them to the Client or to grant a licence under this Section.

Until the remuneration is settled in full, the Client may use the results of the work made available to it in order to check and accept them, and may use a Product deployed to production under a non-exclusive licence which VulCode may terminate with immediate effect in the event of late payment (clause 5.3).

The rights to the Base Code remain with VulCode. To the extent the Base Code is part of the Product, upon full settlement of the remuneration VulCode grants the Client a non-exclusive licence, unlimited in territory and for an indefinite period, in the fields of exploitation listed in clause 6.5, with the right to modify it, grant sublicences and transfer the licence together with the Product. The fee for the licence is included in the remuneration for the Order, and VulCode may not terminate it unless the Client materially breaches its terms. The licence does not include the right to extract the Base Code from the Product and distribute it as a separate product.

Third-Party Components are not covered by the transfer of rights under clause 6.1. The Client uses them on the terms of their licences (clause 6.3), and at the Client's request VulCode provides a list of the significant Third-Party Components with their licences. Without informing the Client first, VulCode does not use components under licences that would oblige the Client to disclose the Product's source code.

Licences for paid Third-Party Components, in particular fonts, photos, plugins and templates, are acquired by the Client or by VulCode on the Client's account (clause 5.16).

The Client grants VulCode a free, non-exclusive licence to use the Client Materials to the extent and for the time needed to perform the Agreement and to present the project in the portfolio under clause 6.2.

Upon full settlement of the remuneration, VulCode hands over the source code of the Product to the Client, in particular in a private repository with its change history or in an archive, together with the Documentation to the extent set out in the Order.

A portfolio presentation may include the Client's name and logo, a description of the scope of work and screenshots that do not disclose confidential information. The Client may reserve confidentiality in the Order or later in Documentary Form, and once VulCode receives it, VulCode removes the presentation within a reasonable time.

VulCode may submit to open source projects fixes for bugs in Third-Party Components that are general in nature and contain neither confidential information nor solutions prepared specifically for the Client.

VulCode provides a warranty for delivered software in accordance with the scope specified in the Order (typically 90 days from final acceptance, unless the Order states otherwise).

The warranty covers the rectification of defects arising from VulCode's execution of the Order. It does not cover functional changes, defects resulting from modifications made by the Client, or issues attributable to hosting or infrastructure.

After the expiry of the warranty period, technical support may be provided on a paid basis under a separate agreement.

The warranty also does not cover:

1. the effects of changes in Third-Party Services, browsers, operating systems and app store rules made after Final Acceptance;
2. the effects of using the Product contrary to the Documentation or to its intended purpose;
3. defects in Client Materials, and defects in Third-Party Components whose removal requires changes by their authors;
4. updates, adaptation to new software versions and further development of the Product, which are the subject of Maintenance or a separate Order.

Defects are reported during the warranty period in the Client Panel, in the Support section, or in the Project Channel, with a description that allows them to be reproduced: what happened, which steps led to it, the expected result, the device and the browser and, where possible, a screenshot.

VulCode reproduces the reported Defect, fixes it within a time appropriate to its severity and makes the fix available on a Test Version, and production deployment follows the Client's approval. If a report does not concern a Defect, VulCode informs the Client and may offer a Quote or Maintenance.

Fixing Defects during the warranty period requires no additional remuneration. The warranty period is not extended by the time taken to fix a Defect unless the Order states otherwise.

The scope of support and monitoring after deployment during the warranty period is set out in the Order.

Towards Clients who are neither Consumers nor Sole Traders with Consumer Rights, VulCode's liability under the statutory warranty for defects (rękojmia) in the Product is excluded (Article 558(1) of the Polish Civil Code). The rights of such Clients in respect of defects in the Product are set out exclusively in this Section.

Consumers and Sole Traders with Consumer Rights have the rights arising from a lack of conformity of the Product or the Service with the Agreement under the Polish Consumer Rights Act (clause 16.7). The warranty neither excludes, limits nor suspends them.

VulCode shall not be liable for indirect damages, lost profits, or damages resulting from delays caused by circumstances beyond VulCode's control.

VulCode's total liability for non-performance or improper performance of an Order is limited to the amount of remuneration paid by the Client for that Order.

The Client bears sole responsibility for the content, data, and materials provided to VulCode in the course of executing the Order.

For Services provided periodically, in particular Maintenance and subscriptions, the remuneration for that Order within the meaning of clause 8.2 is the remuneration paid for the billing period in which the event causing the damage occurred.

VulCode is not liable in particular for:

1. damage resulting from Client Materials or from the acts of the Client and of persons to whom the Client made the Product or access available;
2. interruptions and damage caused by Third-Party Services (Section 12);
3. loss of data where backups were not covered by the Agreement (clause 13.3);
4. the effects of changes to the Product made by the Client or third parties;
5. the compliance of the Product with laws governing the Client's business, in particular consumer, tax and industry regulations, or for the content of terms, policies and consents published in the Product, unless the Order covers their preparation or implementation;
6. decisions made on the basis of data or answers generated by the Product, including by features based on artificial intelligence, where the Product works in accordance with the Order.

If a third party brings a claim against VulCode concerning the materials or content referred to in clause 8.3, the Client indemnifies VulCode and covers the reasonable costs of defence, including legal costs, provided that VulCode promptly notifies the Client of the claim and allows the Client to take part in the defence.

The limitations and exclusions of liability in this Section and in clause 7.9 do not apply to damage caused intentionally, to personal injury, or to cases in which the law does not allow them to be excluded or limited. Towards Consumers and Sole Traders with Consumer Rights VulCode is liable under the general rules, and clauses 8.1, 8.2 and 8.4 do not apply to them.

Both parties undertake to maintain the confidentiality of all confidential information obtained in connection with the execution of the Order.

The confidentiality obligation does not apply to information that is publicly available, required to be disclosed by law, or was known to a party prior to the conclusion of the contract.

Confidential information includes in particular access credentials, source code, Documentation, personal data, information on the Parties' business, clients, finances and plans, and the terms of the cooperation, including the content of the Quote.

A Party may use confidential information only to perform the Agreement and disclose it only to persons who need to know it for that purpose, including subcontractors (clause 4.3), provided they are bound by a confidentiality obligation no weaker than that in this Section.

Where the law or a decision of a competent authority requires confidential information to be disclosed, a Party discloses it to the extent necessary and, where permitted, notifies the other Party beforehand.

The confidentiality obligation continues after the end of the Agreement, without time limit, until the information becomes information referred to in clause 9.2.

At the Client's request the Parties may conclude a separate non-disclosure agreement (NDA), also before an order is placed. Within its subject matter it takes precedence over this Section.

After the end of the Agreement, at a Party's request, the other Party returns or deletes the confidential information received, except for information it must keep under the law or to protect its claims, and copies in backup systems that are deleted in their normal rotation cycle.

After the end of the cooperation, at the Client's request, VulCode removes its access to the Client's accounts and systems or confirms that the Client has removed it.

VulCode is the controller of the personal data of Clients, Users and persons acting on their behalf processed in connection with the conclusion and performance of the Agreement and the use of the Website and the Client Panel. The rules of this processing and the rights of data subjects are set out in the Privacy Policy.

If performing a Service requires VulCode to process personal data for which the Client is the controller, in particular data of the Client's customers in a maintained website, store or system or during a data migration, the Parties conclude a personal data processing agreement compliant with Article 28 GDPR before such processing starts.

If the processing referred to in clause 10.2 starts before a processing agreement is concluded, VulCode processes the data only to the extent needed to perform the Agreement, on the Client's documented instructions, which the Order constitutes, and in compliance with the processor's obligations under Article 28(3) GDPR.

VulCode names further processors, in particular hosting and email providers and subcontractors, to the Client before the processing starts.

VulCode applies technical and organisational measures appropriate to the risk (Section 13) and informs the Client without undue delay of any personal data breach it identifies concerning data the Client has entrusted to VulCode.

As the controller, the Client is responsible for the lawfulness of the processing of data in the Product, including the legal bases, the information duties towards data subjects and the content of the privacy policy and consents, unless the Order covers their preparation.

The Client does not provide VulCode with personal data that is not needed to perform the Service, and where possible provides test data in anonymised form.

We provide Maintenance where it has been ordered in an Order, a maintenance plan or the Client Panel. Its scope, in particular hosting, monitoring, updates, backups and the allowance for minor changes, is set out in the Order or in the description of the service variant ordered.

Service level parameters (SLA), such as availability, response time and time to resolve an outage, bind VulCode only where they are expressly set out in the Order or in the description of the service variant ordered, together with the way they are measured and the consequences of missing them. Otherwise VulCode acts with due care, without guaranteed times.

Downtime counted under an SLA does not include planned work notified to the Client in advance, interruptions caused by Third-Party Services, force majeure (Section 14), the Client's actions or large-scale attacks on network infrastructure.

We accept Maintenance requests in the Client Panel, and urgent matters also in the Project Channel.

We update Third-Party Components and the environment after making a backup, and apply changes that may affect how the Product works after checking them on a Test Version, where the scope of Maintenance includes one.

Either Party may terminate Maintenance concluded for an indefinite period in Documentary Form with the notice period set out in the Order or, where the Order sets none, with effect from the end of the calendar month following the month in which notice was given. Maintenance ordered in the Client Panel as a subscription ends under clause 5.9.

In connection with the end of Maintenance, at the Client's request made before it ends, VulCode hands over a current copy of the Product and its data and the access credentials to the accounts that belong to the Client, and then removes its own access. Migration assistance beyond handing over the copy and the access is paid.

The Product may use Third-Party Services. They are provided by their providers on their own terms, which the Client accepts by using those services.

Where possible we create accounts in Third-Party Services in the Client's name or transfer them to the Client when the Product is handed over. The Client remains the party to the agreements with the providers and is responsible for timely payments and renewals, including of domains and certificates, unless Maintenance covers handling them.

VulCode is not responsible for the availability, changes, prices or decisions of providers of Third-Party Services, in particular for the withdrawal or change of an API, changes to limits, the blocking of an account or the rejection of an application by an app store operator. Adapting the Product to such changes after Final Acceptance is covered by Maintenance or a separate Quote.

If the Order covers publishing an application in an app store, VulCode prepares it and submits it from the Client's developer account, and the decision to approve it rests with the store operator. Reasons for rejection that lie in the part of the Product created by VulCode are remedied under the Agreement, while a rejection for other reasons, in particular because of the business model, the content or the operator's rules, does not hold up Acceptance.

Features that use artificial intelligence models of third-party providers work on the terms of those providers, and their answers may be inaccurate. The Client decides how these features are used and is responsible for the information duties towards the users of the Product.

Hosting on VulCode's infrastructure or with a provider chosen by VulCode is provided as part of Maintenance under Section 11.

VulCode applies security measures appropriate to the nature of the Service and to current technical knowledge, in particular encrypted connections, access control and the principle of least privilege.

The Parties exchange access credentials through a secure channel and, where possible, not in the plain text of a message. The Client is responsible for the security of the access under its control and for the accounts it has made available to third parties.

VulCode makes backups where Maintenance or the Order covers them, to the extent and at the frequency set out there. Otherwise the Client is responsible for backups of the Product and the data.

Before work starts on an existing system of the Client, in particular a migration, an update or a project takeover, the Client provides a current backup or commissions VulCode to make one.

We carry out penetration tests and security audits of the Product where the Order covers them. Without such an Order VulCode does not warrant that the Product is resistant to every type of attack. The Client does not run security tests or load tests against VulCode's infrastructure without prior agreement.

The Parties inform each other promptly of any suspected breach of the security of the Product, accounts or access credentials. Vulnerabilities in the Website and the Client Panel can be reported to hello@vulcode.com under the rules described on the Vulnerability disclosure page.

A Party is not liable for non-performance or improper performance of the Agreement to the extent that it results from force majeure, meaning an external event that could not be foreseen or prevented with due care, in particular a natural disaster, war, acts of terrorism, an epidemic, decisions of public authorities, a widespread failure of the power or telecommunications network or a large-scale attack on the infrastructure of providers.

A Party affected by force majeure promptly notifies the other Party, stating its expected duration. The deadlines for performing obligations move by the duration of the force majeure and its direct effects.

If force majeure lasts longer than 30 days, either Party may terminate the Agreement with immediate effect. The Client then pays the remuneration for the work performed up to the termination date.

The Client may withdraw from an Order at any time by giving notice in Documentary Form. The effects of withdrawal after work has started are set out in clauses 5.4 and 5.5.

VulCode may terminate the Agreement with immediate effect if the Client:

1. remains in default of payment despite a reminder and an additional deadline;
2. despite a reminder fails to cooperate in a way that makes the work impossible (clause 4.10);
3. uses the Product or the Service unlawfully or otherwise materially breaches these Terms;
4. requests work that is unlawful or infringes the rights of third parties.

The Client may terminate the Agreement with immediate effect if VulCode materially breaches the Agreement and, despite a reminder, fails to remedy the breach within an appropriate deadline set for that purpose.

If the Agreement is terminated, the Client pays the remuneration for the work performed up to the termination date and reimburses the costs of Third-Party Services incurred by VulCode on its behalf. If the Agreement is terminated for reasons attributable to the Client, clauses 5.4 and 5.5 also apply.

Once the remuneration due for the work performed up to the termination of the Agreement is paid, the Client acquires the rights to its results under Section 6, and VulCode hands over those results and the Client Materials in its possession.

After handing over the results of the work and the Client Materials to the Client, or after the Client fails to collect them despite a reminder, VulCode may delete them from its systems, subject to its obligations under the law and the Privacy Policy.

Termination of the Agreement does not affect the provisions that by their nature continue after it ends, in particular Sections 6, 8, 9 and 10 and clauses 20.1 and 20.2.

This Section does not limit the right of withdrawal from the Agreement available to Consumers and Sole Traders with Consumer Rights (Section 16).

These Terms neither exclude nor limit the rights that Consumers have under mandatory provisions of law, in particular the Polish Consumer Rights Act of 30 May 2014 and the Polish Civil Code. A provision contrary to those laws does not bind the Consumer, and the provisions of law apply in its place.

A Sole Trader with Consumer Rights enjoys protection against unfair contract terms, the right to withdraw from an agreement concluded at a distance or off premises, and the rights arising from a lack of conformity with the agreement, to the extent that the law grants them to such traders.

A Consumer who has concluded an Agreement at a distance, in particular by email, in the Project Channel or in the Client Panel, may withdraw from it without giving reasons within 14 days of the date it was concluded. It is enough to send a statement of withdrawal before that period ends, for example by email to hello@vulcode.com. The Consumer may use the model form at the end of these Terms but does not have to.

If the Consumer requested that the Service start before the withdrawal period ends and then withdraws from the Agreement, the Consumer pays for the performance provided up to the moment of withdrawal, in proportion to the scope of the performance.

The right of withdrawal does not apply in the cases listed in Article 38 of the Polish Consumer Rights Act, in particular:

1. after the Service has been fully performed, where VulCode performed it with the express consent of the Consumer, who was informed before the performance started that they would lose the right of withdrawal once it was completed and acknowledged this;
2. for the supply of digital content not supplied on a tangible medium for which the Consumer pays, where VulCode began the performance with the express prior consent of the Consumer, who was informed that they would lose the right of withdrawal once the performance was completed, acknowledged this and received a confirmation.

If the Consumer withdraws, VulCode refunds the payments received, less the amount due under clause 16.4, without undue delay and no later than 14 days after receiving the statement of withdrawal, using the same means of payment as the Consumer used, unless the Consumer agrees to another means that involves no cost for them.

VulCode is liable to the Consumer for the conformity of the Product and the Service with the Agreement under the Polish Consumer Rights Act, including its provisions on digital content and digital services. In the event of a lack of conformity the Consumer may demand that conformity be restored and, in the cases provided for in the Act, declare a price reduction or withdraw from the Agreement.

The Consumer may use out-of-court complaint and redress procedures, in particular mediation or a permanent consumer arbitration court run by entities authorised under the Polish Act of 23 September 2016 on Out-of-Court Resolution of Consumer Disputes, as well as the free assistance of a municipal or district consumer ombudsman. The register of authorised entities is kept by the President of the Polish Office of Competition and Consumer Protection (UOKiK). VulCode's participation in out-of-court proceedings is voluntary.

Complaints concerning the Services, the Website and the Client Panel can be submitted by email to hello@vulcode.com, in the Client Panel in the Support section or in the Project Channel.

A complaint should include details that identify the Client or the User, a description of the problem and, where possible, the expected way of resolving it. Missing details do not cause a complaint to be left unconsidered.

VulCode responds to a complaint within 14 days of receiving it, in the form in which it was submitted or in another form indicated by the person submitting it. If VulCode does not respond to a Consumer's complaint within that period, the complaint is deemed accepted.

Defect reports during the warranty period are handled under clauses 7.5 and 7.6.

VulCode provides the following electronic services free of charge: access to the content of the Website, contact forms, the newsletter, the tools available on the Website and an account in the Client Panel. Services ordered in the Client Panel are paid as stated in their description.

To use the Website and the Client Panel you need a device with internet access and an up-to-date web browser with JavaScript enabled, and to use the Client Panel also an active email address.

An agreement for a service provided by electronic means is concluded when the use of the service starts and, for the Client Panel, when the account is created. The User may terminate it at any time, in particular by ceasing to use the Website, unsubscribing from the newsletter or deleting the account in the Client Panel.

The User may not provide unlawful content, disrupt the operation of the Website or the Client Panel, attempt unauthorised access or use the Website and the Client Panel to send unsolicited commercial communications.

Using services provided by electronic means involves the typical risks of the internet, such as malware, phishing for login details or interception of transmissions. The User should use up-to-date software and protect their login details.

VulCode makes efforts to keep the Website and the Client Panel running without interruption but may introduce technical breaks needed for maintenance, updates and security.

The User creates an account in the Client Panel themselves, providing true details. The User is responsible for keeping the password confidential and for actions taken from their account, and the Client is also responsible for the persons to whom it gives access to the Client Panel or whom it adds to tickets and projects.

VulCode may block an account used in a way that breaches these Terms or the security of the Client Panel, informing the User unless the law or security considerations prevent it.

The User may delete the account in the Client Panel settings at any time. Deleting the account does not terminate Agreements already concluded or release the Client from paying the remuneration due, and we keep the data needed for settlements and the protection of claims in line with the Privacy Policy.

The Parties communicate electronically: by email, in the Project Channel and in the Client Panel. Statements made this way bind the Parties and meet the requirement of Documentary Form, but notice of termination of the Agreement and withdrawal from it are given by email or in writing.

The Client informs VulCode of any change of email address and contact persons. A message sent to the last email address provided by a Client who is a business is deemed delivered.

The rules of the referral programme, in particular the commission rate, the period over which it is earned and the exclusions, are set out in the Referral programme tab of the Client Panel and on the Referral programme page. VulCode may pause the programme, which does not affect commissions already earned.

We send the newsletter only with the User's consent confirmed by email, and the User can unsubscribe at any time with the link in each message.

VulCode reserves the right to amend these Terms of Service. Clients will be notified of material changes at least 14 days in advance.

Continued use of the services after amendments take effect constitutes acceptance of those amendments.

These Terms may be amended for important reasons, in particular a change in the law, decisions of competent authorities, a change in the scope, manner or technical conditions of providing the Services, or security considerations.

We send information about amendments by email or in the Client Panel and publish it on the Website. A Client who does not accept the amendments may, before they take effect, terminate an Agreement concluded for an indefinite period, in particular Maintenance or a subscription, at no additional cost.

Orders accepted before the amendments take effect remain governed by these Terms as worded on the date the Agreement was concluded, unless the Parties decide otherwise. For Services provided periodically the amendments apply from the first billing period that starts after they take effect.

We make previous versions of these Terms available on request sent to hello@vulcode.com.

Matters not regulated by these Terms shall be governed by Polish law, in particular the Polish Civil Code.

Both parties shall endeavour to resolve any disputes arising from the provision of services amicably. In the absence of agreement, disputes shall be submitted to the court competent for the registered place of business of VulCode, and disputes with Consumers and Sole Traders with Consumer Rights to the court competent under the general rules.

Contact: hello@vulcode.com

The choice of Polish law does not deprive a Consumer of the protection afforded by the mandatory provisions of the law of the country of their habitual residence.

If any provision of these Terms proves invalid or ineffective, the remaining provisions remain in force, subject to clause 16.1.

A Client who is a business, other than a Sole Trader with Consumer Rights, may not transfer rights or obligations under the Agreement to a third party without VulCode's consent given in Documentary Form.

A Party's failure to exercise a right does not constitute a waiver of it.

These Terms are available in Polish and English. In the event of any discrepancy between the versions, the Polish version prevails.

This version of the Terms is effective from 24 October 2026. Agreements concluded before that date remain governed by the version in force on the day they were concluded, unless the Parties decide otherwise.