1 Introduction and scope

1.1 What these Terms cover

These Terms of Service (the "Terms") govern the day-to-day use of the management console (the "Console") and the public dealer-website (the "Website") that Forge Digital EOOD, trading as Cars by Forge Digital, provides to the Client under the Master Services and Subscription Agreement (the "MSA"). Capitalised terms used in these Terms and not defined here have the meaning given to them in the MSA.

1.2 Relationship to the MSA

These Terms sit under the MSA. Where these Terms conflict with the MSA, the MSA prevails. Where either these Terms or the MSA conflict with the Data Processing Agreement on matters of data protection, the Data Processing Agreement prevails.

1.3 Who these Terms apply to

These Terms apply to the Client (the business that accepted the MSA) and to every natural person who accesses the Console on the Client's behalf (each an "Authorised User"). The Client is responsible for the acts and omissions of every Authorised User to whom the Client grants access.

1.4 Business-to-business framing

The Platform is supplied to businesses only. These Terms are not consumer terms. Consumer-protection rules do not apply to the relationship between the Client and Forge Digital. The Client warrants that it enters into the MSA and accepts these Terms in the course of its trade, business, craft or profession.

2 Accounts and access

2.1 Passwordless authentication

Access to the Console is by a eight-digit code emailed to an address on the Client's allowlist. There is no password to steal and none is stored. Forge Digital's own super-admin account additionally requires an authenticator app.

2.2 Allowlist and team members

The Client manages the list of email addresses authorised to receive login codes through the team-members screen of the Console. The Client is solely responsible for keeping that list accurate, for removing former employees promptly, and for the security of the mailboxes on that list. Forge Digital does not verify that the individuals accessing the Console are entitled to do so on behalf of the Client.

2.3 Sharing prohibited

Authorised Users may not share their login codes, forward them to other people, or otherwise permit unauthorised access to the Console. Each Authorised User must access the Console only through the mailbox on the allowlist.

2.4 Suspected compromise

The Client shall notify Forge Digital without undue delay at info@forgedigital.io if it suspects that an Authorised User's mailbox or Console access has been compromised. Forge Digital may then revoke that access and require additional verification.

2.5 Access by Forge Digital

Forge Digital's support personnel may access the Console and the Website on the Client's behalf where necessary to provide support, to investigate an incident, or as required by law. Such access is logged and is limited to what is strictly necessary.

3 Use of the Console

3.1 What the Console does

The Console lets the Client manage vehicles and photographs, decode a VIN to pre-fill a listing (subject to the metered VIN allowance in the applicable plan), manage the sold-vehicles gallery, handle offers received through the "offer your car" form, edit site settings and opening hours, manage Authorised Users, see analytics, raise support and bespoke-work requests, and edit the Website's own legal texts.

3.2 Free editing by the Client

The Client may add, edit, replace or delete Client Content through the Console freely and without limit for the duration of the subscription. Such edits are included in the Subscription Fee. Bespoke design or development work beyond the standard Platform is quoted separately in advance in accordance with the MSA.

3.3 Support requests

Support requests are raised through the Console. Response commitments are set by the Client's Service Level tier and are described in the Service Level Agreement. Forge Digital is not obliged to answer support requests raised through any other channel.

3.4 Console availability

The Console is provided on a best-efforts basis. Availability commitments (if any) applicable to the Client are those of the Client's Service Level tier. Nothing in these Terms creates additional availability commitments beyond the Service Level Agreement.

4 The Website

4.1 Public catalogue

The Website presents the Client's vehicle inventory to the public together with contact, vehicle-enquiry and financing-enquiry forms. It also carries the sold-vehicles gallery and the "offer your car" form. The Website is not a webshop: no sale is concluded through the Website, and no online payment for a vehicle is taken through the Website.

4.2 Enquiries land in the Client's inbox

Contact, vehicle-enquiry and financing-enquiry submissions are forwarded by email to the Client's designated inquiry inbox and are not retained on the Platform database. The Client is solely responsible for reading, responding to and retaining those enquiries in accordance with applicable law and its own privacy policy.

4.3 "Offer your car" submissions

Submissions to the "offer your car" form are stored on the Platform because the Client needs to work with them over time. They are erased when the corresponding vehicle is sold, or, if no sale occurs, twenty-four (24) months after the last contact.

4.4 Multilingual content

The Client writes Website content in one language of its choice from among Dutch, French, English and German. The remaining three languages are produced by machine translation. The Client is responsible for reviewing translations before relying on them for any purpose (for example, a specific commitment to a specific customer) and for correcting any translation that misrepresents the Client's intent.

4.5 Automatic image generation and modification

The Website may display AI-generated homepage imagery and, optionally, vehicle photographs with a replaced background, as described in the MSA. Forge Digital's own processing does not modify the pixels depicting the vehicle itself. The Client may also publish imagery produced or modified by other means, including AI-generated or AI-interpolated imagery from third-party sources; such imagery is the Client's own and is labelled through the Platform's per-image AI labelling. The Client's transparency obligations under Article 50 of the EU AI Act are the Client's own, as set out in the MSA.

5 Client Content and responsibility

5.1 Client owns and is responsible for its Content

The Client owns Client Content and is solely responsible for it, including its accuracy, its lawfulness in every market in which the Website is targeted, and the rights of any third party depicted or referred to in it. The Client warrants that it holds all rights, licences and permissions necessary to publish Client Content through the Platform.

5.2 Second-hand vehicle sales law

The Client is solely responsible for complying with all laws applicable to the sale of second-hand vehicles in the Client's market, including without limitation vehicle-condition disclosure, mileage warranty, statutory warranty for latent defects, cooling-off rights (where applicable), pre-contractual information duties, and any registration or licensing requirements applicable to the Client's activity.

5.3 The Website's own legal texts (seed drafts, owned by the Client from delivery)

The privacy policy, cookie policy, terms of use and legal notice displayed on the Website are supplied by Forge Digital at onboarding as a one-off seed draft in the language in which the Website launches, and are loaded into the Console at that moment with the Client's own details already substituted. From delivery onwards, these texts are the Client's own stored text in the Console. The Platform publishes what is currently in the Console. Forge Digital does not automatically update, replace, refresh or overwrite the Client's stored texts after delivery. Any change to those texts must be made by the Client through the Console. The Client accepted this arrangement expressly during onboarding through a separate acceptance tick, and reaffirms here that: (a) the seed drafts are templates provided as-is, without warranty of accuracy, completeness, currency, lawfulness or fitness for the Client's circumstances; (b) the Client is solely responsible for having the seed drafts reviewed by its own legal adviser before relying on them; (c) the Client is solely responsible for correcting anything that does not describe the Client's business, for keeping the texts current as its own practices, enabled Platform features, sub-processors or the applicable law change, and for publishing them or not publishing them as it sees fit; (d) the Client is solely responsible for ensuring the Website complies with any mandatory legal-notice requirements applicable in the Client's country (for example, the Belgian wettelijke vermeldingen, the French mentions légales, or the German Impressum); and (e) Forge Digital is not the publisher of the Client's website legal texts, is not the Client's data-protection officer, legal adviser or compliance function, and assumes no duty of care with respect to the accuracy, completeness, currency or lawfulness of the Client's published legal texts. Where Forge Digital in the future publishes a revised seed draft (for example, to reflect a change in law or the addition of a sub-processor), the decision whether to adopt it, and the responsibility for making any change to the published texts, rest entirely with the Client.

5.4 Data-subject requests from Website visitors

Where a Website visitor exercises rights under the GDPR (access, rectification, erasure, restriction, portability or objection), those requests are the responsibility of the Client as the controller of visitor personal data. Forge Digital, as processor, forwards any such request received by Forge Digital to the Client without undue delay in accordance with the Data Processing Agreement, and does not respond to the request itself unless the Client has instructed it to do so under a separate written arrangement.

6 Acceptable Use Policy

This section sets out the Acceptable Use rules (the "AUP") that bind the Client and every Authorised User. Breach of the AUP entitles Forge Digital to suspend or terminate access in accordance with the MSA.

6.1 Prohibited content

The Client shall not upload, publish, transmit or otherwise make available through the Console or the Website any content that:

• is unlawful in any market in which the Website is targeted, including content that infringes intellectual-property, personality, privacy or data-protection rights of a third party;
• is misleading, deceptive, or contains a materially inaccurate description of a vehicle offered for sale (including but not limited to false or manipulated odometer readings, undisclosed material accident damage, or misrepresented year of manufacture);
• promotes hatred, violence or discrimination against any person or group on grounds of race, ethnic origin, nationality, religion, gender, sexual orientation, disability, age or any other protected characteristic;
• is defamatory, threatening, harassing, obscene, or otherwise offensive;
• depicts or offers stolen vehicles, or vehicles the Client is not lawfully entitled to sell;
• encourages or facilitates the circumvention of vehicle-safety, emissions, or type-approval regulations;
• constitutes an advertisement for a vehicle whose sale would breach an embargo, sanctions regime or export control applicable to the Client or to Forge Digital;
• contains personal data of third parties (for example, the previous owner's name) other than the Client's own contact details or those explicitly required by the sale;
• contains malware, exploits, or code intended to compromise the Platform or any user's device.

6.2 Prohibited use of the Platform

The Client shall not, and shall not permit any Authorised User to:

• interfere with, disrupt, or degrade the operation, security or availability of the Platform;
• attempt to gain unauthorised access to the Platform, to another Client's data, or to any underlying infrastructure;
• reverse-engineer, decompile, disassemble, or otherwise attempt to derive the source code of the Platform, save to the extent that such action cannot lawfully be prohibited by contract;
• use the Platform to send unsolicited commercial communications (spam) to any recipient, or to scrape, harvest or otherwise mass-collect personal data;
• use the Platform to operate a service in competition with Forge Digital, or to develop a competing platform;
• circumvent the metered VIN allowance, or otherwise attempt to obtain more service than the applicable plan provides;
• resell, sublicense, or otherwise make available the Platform (or any part of it) to any third party as a service.
• deploy automated scraping, crawling, bulk-indexing or data-harvesting scripts against the Platform or its infrastructure; any third-party inventory syndication must use the API endpoints Forge Digital provides for that purpose;
• inject third-party tracking scripts, style overrides or embedded frames that Forge Digital has not approved, where these degrade or destabilise the Website's performance for visitors;

6.3 Forge Digital's response to AUP breaches

Where Forge Digital reasonably believes that the Client has breached the AUP, Forge Digital may (a) remove or make inaccessible the offending Client Content; (b) restrict the Client's use of specific Platform features; (c) suspend the Client's access in whole or in part; or (d) terminate the MSA for material breach in accordance with Section 3.6 of the MSA. Where feasible, Forge Digital notifies the Client of the action taken and the reason for it. Where the action is required by law or is necessary to prevent serious harm, Forge Digital may act without prior notice and notify the Client as soon as reasonably practicable afterwards.

Where a breach of this Acceptable Use Policy causes a site outage, a security flag, performance degradation or any other operational failure, that event is excluded from the uptime calculation in the Service Level Agreement, the availability commitments in that Schedule are void for the Measurement Period in which it occurred, and any resulting repair is carried out at Forge Digital's then-current published hourly rate, notified to the Client in writing before any chargeable work begins.

7 Content moderation and notice-and-takedown

7.1 No general obligation to monitor

Forge Digital does not review or moderate Client Content in the ordinary course of business and is under no general obligation to monitor Client Content. This is consistent with Article 8 of Regulation (EU) 2022/2065 (the "Digital Services Act" or "DSA").

7.2 Notice mechanism

Forge Digital operates a notice-and-takedown mechanism through which any person may submit a notice concerning specific content on a Website that they consider to be illegal. That mechanism is set out in the Notice-and-Takedown Annex to these Terms, which is written to comply with Article 16 of the DSA. Notices are handled in accordance with that annex.

7.3 Statement of reasons

Where Forge Digital removes or restricts access to Client Content, or suspends the Client's account, Forge Digital provides the Client with a clear and specific statement of reasons for that decision in accordance with Article 17 of the DSA, unless the law prohibits it or unless providing the statement would obstruct the detection or prevention of illegal content.

7.4 Internal complaint mechanism

The Client may challenge a moderation decision by Forge Digital by submitting a written objection to info@forgedigital.io within six (6) months of the decision. Forge Digital reviews the objection in good faith, without undue delay, and communicates its reasoned decision to the Client. This mechanism is provided in accordance with Article 20 of the DSA to the extent that provision applies to Forge Digital.

8 Reporting security issues

If any person (including the Client, an Authorised User, a Website visitor or an independent security researcher) discovers a vulnerability in the Platform, they are asked to report it responsibly to Forge Digital at info@forgedigital.io. Forge Digital undertakes to (a) acknowledge receipt of the report without undue delay; (b) assess the report in good faith; and (c) not to pursue legal action against a reporter who acted in good faith, did not exfiltrate personal data of others beyond what was strictly necessary to demonstrate the vulnerability, and gave Forge Digital a reasonable opportunity to remediate before public disclosure.

9 Communications

9.1 Service communications

Forge Digital sends the Client operational communications (such as password codes, invoices, service notices, incident notifications and legally required notices) to the administrator email addresses on file. These are not marketing communications and the Client cannot opt out of them without cancelling the subscription.

9.2 Marketing communications

Forge Digital sends the Client marketing communications only where the Client (or a designated recipient) has opted in through a specific consent mechanism. The Client may unsubscribe from marketing communications at any time by clicking the unsubscribe link in any such message or by emailing info@forgedigital.io. Unsubscribing from marketing does not affect the delivery of service communications.

10 Changes to these Terms

Forge Digital may amend these Terms in accordance with the amendment mechanism set out in Section 19 of the MSA. Amendments are notified to the Client at least thirty (30) days before they take effect, save where a shorter notice is required by law or is favourable to the Client. If the Client does not wish to accept an amendment, the Client may cancel the subscription in accordance with Section 3.2 of the MSA before the amendment takes effect. Continued use of the Platform after the amendment takes effect constitutes acceptance of it.

11 Governing law and jurisdiction

These Terms are governed by the substantive law of the Republic of Bulgaria, consistent with Section 22 of the MSA. Any dispute arising out of or in connection with these Terms falls within the exclusive jurisdiction of the competent courts of Stara Zagora, Bulgaria, subject to the one-way carve-out for Forge Digital set out in Section 22.3 of the MSA.

12 Acceptance

These Terms are accepted electronically at the same time as the MSA, through the two-tick acceptance flow at onboarding. Forge Digital records the acceptance, the identifier and version of this document, the exact date and time, a hashed IP address, and the language in which this document was displayed.

End of Terms of Service.