Terms of Service - RegisterBench (DORA RoI Builder)

Version 1.0, in force from 2026-09-28

1. Who we are

The service is provided by NORMFORT SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ (in short: Normfort sp. z o.o.), registered office at ul. Dywizjonu 303 139/55, 01-470 Warszawa, Poland, entered in the register of entrepreneurs of the National Court Register (registry court: Sąd Rejonowy dla m.st. Warszawy, XII Wydział Gospodarczy KRS) under KRS number 0001256018, NIP 5223379795, REGON 545337418, share capital PLN 5,000.00 ("we", "us", the "Provider").

Legal Entity Identifier (LEI) of the Provider: 259400J1H3VYOMLHDY43, issued on 2026-09-04 by KDPW (LOU).

Contact address for matters under these Terms: support@registerbench.com.

2. What the service is

RegisterBench is a web tool for preparing and maintaining a DORA Register of Information. It provides: a guided builder for the register templates, Excel/CSV import and import of last year's package, a validation engine (the official EBA validation rules plus structural technical checks and LEI checks against GLEIF), a deterministic xBRL-CSV output package with draft and final export, immutable snapshots with a year-over-year diff, a rejection assistant, export-all of all organisation data, and an append-only audit log.

The service is a seasonal document-preparation tool. It is not positioned as a system supporting a critical or important function of the client.

3. What the service is not

We do not integrate with supervisory portals and we do not submit anything on your behalf: you file the package yourself. We do not perform automated legal interpretation - the product collects data and validates it formally, it does not advise. The output formats are limited to xBRL-CSV under the DORA taxonomy.

4. Business use only

These Terms are a business-to-business agreement. The service is addressed to financial entities and to advisory firms working for them. The service is provided exclusively to businesses and not to consumers. By accepting these Terms the client declares that it enters into the agreement in the course of its business activity and that the agreement is of a professional nature for it.

5. Accounts, organisations and roles

Registration is self-serve with e-mail confirmation. Work happens inside an organisation; members are invited by e-mail with a token valid for 7 days. Roles: OrgAdmin (members, settings, billing, purge, organisation deletion, final export), Editor (rows, import, validation, draft export), Viewer (read only). Our platform administrators do not have access to client register data in the user interface.

The closed beta of 11-12.2026 runs under a separate simplified beta agreement, not under these Terms.

6. Plans and prices

All prices are net, in EUR, per year. Plans are annual only; there is no monthly plan.

There is no overage billing.

7. Payment and Merchant of Record

The seller of the paid plans is Paddle, acting as Merchant of Record: Paddle takes the payment, settles EU VAT and issues the invoice. For buyers in the EU and the UK the selling entity is Paddle.com Market Limited, with its registered office in London. You buy a paid plan through the Paddle checkout and conclude that purchase with Paddle on the Paddle buyer terms (https://www.paddle.com/legal/buyer-terms), and we provide the service. Invoices for the service are issued by Paddle, not by us.

Paddle adds VAT or applies the reverse charge where a valid VAT ID is provided. You may pay by card or by bank transfer against a Paddle invoice (manual invoicing, 30-day term), with a purchase order number field at checkout. For a transfer, a new client's paid access starts once the payment is booked.

Subscription state in the application always comes from Paddle webhooks and the Paddle API; Paddle is the source of truth. Payment method updates and cancellation are available through the Paddle customer portal.

8. Trial and the paywall

The paywall applies only to the final export. Building the register, import, validation and draft export work without a subscription. The Trial plan requires no card and has no time limit.

9. Price-lock and renewals

Price-lock: the price of the day of purchase is frozen for as long as the subscription is renewed without interruption; an interruption means a return to the current list price.

Renewal falls on the anniversary of the purchase.

10. Late payment: what is blocked and what is not

Late payment blocks the final xBRL export - never editing, never your data. Export-all works in every account state. The ladder measured from the first failed payment: full functionality until day 14; from day 14 the final export returns a paywall error; from day 30 the account is read only (reading, draft and export-all still work); from day 45 sign-in gives access to billing and export-all only. Successful payment at any step restores full functionality automatically, as soon as Paddle reports the payment to the service, with an operational target of 5 minutes. For renewals paid by transfer there is a 30-day grace period of full functionality after the anniversary.

After cancellation the account stays in the export-blocked state with no end date: building the register, import, validation, draft export and export-all keep working, a final export requires a new subscription, and data retention follows section 12 of these Terms and the Privacy Policy.

11. Refunds

Refunds are governed by the Refund Policy, which forms part of these Terms and is linked from checkout. The core rule: 14 days on the first purchase, provided that no final export has been performed.

12. Your data, export and exit

Export-all returns the complete data of your organisation in open formats (CSV/JSON/ZIP) and works in every account state, including a suspended account. An OrgAdmin can hard delete the organisation: the deletion removes all data of the organisation and its stored files. The append-only audit log of the service is kept, and the deletion adds to it a record of who deleted the organisation and when.

Working data and import files are deleted automatically a configured number of days after a final export (purge_after_days per organisation, default 30, which an OrgAdmin can change to another positive number of days), or immediately at the request of an OrgAdmin. Snapshots, generated packages and the audit log are not affected by this purge.

Before an automatic purge we queue a warning e-mail. We do not promise delivery of that message: the internal marker certifies that the warning was QUEUED, not that it was delivered, and an SMTP outage longer than 12 hours means data is deleted with the warning undelivered.

Where we process personal data contained in your register data on your behalf, we act as your processor under the Data Processing Agreement, which forms an integral part of these Terms and applies from the moment such processing starts. Personal data for which we are the controller are described in the Privacy Policy.

13. Security of your data

Register data and backups stay in the EU. Transport is encrypted; backups are encrypted before they leave our infrastructure. Authentication uses bearer access and refresh tokens with a minimum password length of 12 characters and lockout; TOTP two-factor authentication is available and an organisation can require it from all its members. Every mutation is written to an append-only audit log with actor, organisation and column diff. Tenant isolation is enforced by the application and covered by automated tests.

14. Availability, support and incident assistance

Availability is an operational target of 99.5 per cent, communicated as a target and not as a contractual service level with penalties in version 1. Support runs 9:00-17:00 CET on business days. Assistance with an ICT incident related to the service is included at no additional charge (0 EUR).

A public status page is in preparation and is not live on the date of this version of the Terms. Once it is live, its address will be given in the Support and Availability Policy.

15. Content, validation results and AI

The rule encyclopedia, the fix-it pages, field help and validation messages are information about the formal expression of the published rules. They are not legal advice and they are not a guarantee that any supervisory authority will accept your filing. You remain responsible for the content of your register and for the filing itself.

Support is AI-assisted with human oversight. The support assistant never gives legal advice and never quotes the values of your register data in the support channel.

The first paragraph of this section is the content disclaimer of the service and applies to all the content it lists, wherever that content is published.

16. Your obligations

You provide accurate data - the output package is built from it. You do not enter transactional data or personal data of your own end customers: the service is designed to hold only the ICT contract metadata required by the register templates plus user accounts. You keep your credentials confidential and you do not attempt to circumvent the technical limits (among others: 50 000 rows per register, 20 MB per upload, and the API rate limits).

17. Intellectual property

For the term of the agreement we grant you a non-exclusive, non-transferable licence to use the service within the scope of your plan.

The licence does not include the right to resell access to the service, to make the service available to third parties as a stand-alone service, or to interfere with its operation, in particular by decompiling it or by reverse engineering, except where mandatory law permits it.

The intellectual property rights in the service, in its software and documentation and in the content we write for it, such as the rule encyclopedia, the fix-it pages and the field help, belong to us or to our licensors. We claim no rights in the official templates, taxonomy and validation rules published by the European Supervisory Authorities, which the service implements.

You may use the packages and exports generated with the service for your own business, including filing them, also after the end of the agreement. You may not use them or our content to build a service that competes with this one, and you may not resell them commercially as such.

18. Liability

Our aggregate liability is capped at the fees paid for the service in the 12 months preceding the event. Availability is a target, without contractual penalties, in version 1.

The limitation of liability does not apply to damage caused intentionally, nor in any other case in which the exclusion or limitation of liability is not permitted by mandatory law.

19. Term, termination and notice

Plans are annual. Cancellation does not refund the paid year: the subscription runs to the end of the paid period, and in the following season a final export again requires an active subscription.

You may terminate the agreement at any time by cancelling the subscription, with effect at the end of the paid period.

We may terminate the agreement only:

1. for good cause, where you materially breach these Terms and do not remedy the breach within 30 days of our written request to do so, with effect at the end of that period,
2. for non-payment, under the ladder of section 10,
3. if we discontinue the service as a whole, with at least 90 days notice, during which export-all remains available.

20. Cooperation with competent authorities

We cooperate with the competent authorities of the client in matters concerning the service. At the request of such an authority, made to us directly or through the client, we provide the information about the service that the authority is entitled to receive under the law.

21. Participation in your awareness and resilience programmes

On request we take part asynchronously in the client's security awareness programmes and digital operational resilience training, by supplying materials and written answers.

22. Changes to these Terms

These Terms and the Privacy Policy are versioned documents. Acceptance is recorded at registration (who, when, which version), and a version bump forces every existing user to accept again before continuing.

We give 30 days notice before a change of these Terms takes effect, and you may terminate before that date.

23. Governing law and disputes

These Terms and the agreement concluded under them are governed by Polish law. Disputes are resolved by the common court having jurisdiction over the Capital City of Warsaw, subject to the provisions on exclusive jurisdiction. Before bringing a dispute to court, the parties will attempt to resolve it amicably.

24. Article 30(3) regime

The extended contractual regime for ICT services supporting critical or important functions is deliberately outside the standard offer. A request for such an annex is decided by a human on a case-by-case basis; the default answer is that we do not offer it.

Annex A - Service description

This annex is the informational "Service description" attachment to these Terms. Items (a) to (f) below are the service commitments of the Article 30(2) mapping kept by the Provider. That mapping also carries letters (g), (h) and (i), which sit in the body of these Terms - section 20, section 19 and section 21 respectively.

(a) Description of the functions and services. We provide the functions listed in section 2 of these Terms: guided builder, import, validation, deterministic xBRL-CSV package with draft and final export, snapshots and year-over-year diff, rejection assistant, export-all and audit log. Filing with a supervisory authority is done by the client (section 3).

(b) Locations of service provision and data processing, and notification of change. Register data and backups are processed in the European Union. We notify clients of a change of subprocessor or of a processing location 30 days in advance. The current subprocessor list is published with the vendor due diligence pack. Subprocessors: OVH (hosting of the application, the database and the operations host, in the EU), Scaleway (transactional e-mail, TEM, region PAR), Cloudflare (DNS, Pages for the public website, Email Routing for kontakt@, transitional analytics beacon).

(c) Availability, authenticity, integrity and confidentiality of data. The measures are described in section 13 of these Terms and in the Architecture and Security Whitepaper of the vendor due diligence pack.

(d) Access to, recovery and return of data on insolvency, resolution or termination. Export-all is self-serve, works in every account state and returns the data in the open formats of the ESA templates; the client can continue the work outside the service at any time.

(e) Service levels. Described in the Support and Availability Policy: business hours, severity classes and seasonal targets.

(f) Assistance with an ICT incident related to the service, at a cost fixed in advance. Incident assistance is included in the subscription at no additional charge (0 EUR).

Note carried from the source of this mapping: the paraphrases used in the internal mapping table are not contractual wording.