These terms govern the use of the public website aioness.com , business applications and user orders for bookings, purchase of products and tickets. The Personal Data Processing Supplement governs the relationship between Aioness and the company when Aioness processes the data on its behalf.
Privacy and legal contact: privacy@aioness.com
1. Who these terms apply to
Aioness means the platform and its operator. A business is a legal entity or sole trader using a business plan for its activities. An end user is an individual using an account or public features to book, order or communicate with a business. An authorised staff member or collaborator uses the application within the permissions granted by the business.
Business plans are intended for businesses. Individuals may create customer accounts, book appointments and purchase products and tickets. Consumer status depends on the actual purpose of the transaction and mandatory law, not merely the label attached to an account.
These terms do not replace the terms of sale and privacy policy of the individual company. Before the transaction, it must be clear to the user with whom the contract is concluded, what price and rules apply and to whom they can make a complaint.
2. Acceptance and relationship of documents
Before registering or making a subscription, the user is given access to the applicable conditions. Acceptance must be clear and demonstrable; just browsing a public page does not constitute consent to marketing or any data processing.
A business package contract consists of an accepted order or offer, these terms and conditions and, where applicable, a supplement on data processing. In particular, contractual provisions shall take precedence over the matters which govern them, and a supplement on data processing shall take precedence in matters of entrusted processing. Compulsory regulations always take precedence.
The privacy policy explains the data processing and the technology cookie policy on the device. Their reading is not universal consent for processing; for each purpose there must be an appropriate legal basis.
3. Registration, authorisations and minors
Account information must be accurate and up to date. A person opening a business account confirms that they are authorised to represent the business or act on its instructions. The business manages access for its employees and collaborators and revokes it when no longer needed.
Opening an account and entering into contracts independently is intended for adults with legal capacity. A parent or authorised guardian must act for a minor or another person requiring representation in accordance with local law. The business is responsible for checking any specific age requirements for its services and products.
The age threshold for consent to certain online processing under privacy regulations is not the same as the ability to enter into a contract. Do not ask a minor to independently accept the processing of sensitive data or a purchase for which he does not have the necessary ability.
4. Account security and authorised access
Users should protect their login credentials, use a unique password and available additional safeguards, and immediately report suspected unauthorised access to privacy@aioness.com. Accounts must not be shared in a way that prevents identification of authorised access or exposes other people’s data.
The business should grant only the access necessary for each role. Support access to business data must be limited to resolving a request, security needs or a legal obligation, with appropriate authorisation and records. This does not release Aioness from responsibility for its own security or failures.
5. The role of the platform and the responsibility of the company
Aioness provides software features such as a public business profile, appointments, orders, tickets, communications and administration within the selected plan. Each business determines its own offering, availability, prices, taxes, delivery, professional requirements and cancellation rules.
When the user reserves or purchases at the company, the contract for that service, goods or event is concluded with the company marked in the offer, unless explicitly stated otherwise for the specific transaction. Aioness is not an automatic event organizer, health care provider, retailer or execution guarantor simply because it provides a technical flow.
This division does not exclude Aioness' legal obligations for its own service, data processing, handling of reports of illegal content, or other intermediary obligations where applicable.
6. Reservations, orders and tickets
The company must present the essential features of the offer, the total amount and additional costs, the conditions of execution, the identity of the provider, the rules of complaint and cancellation. The user should review the date, time, location, quantity and contact information before sending.
The message that the request has been received is not necessarily a final confirmation of the reservation or contract. The status and meaning of the certificate must be clearly marked in the specific stream. The company is responsible for checking availability, execution, delivery and notification of change or cancellation.
The rules on no-show, deposit, change of dates, ticket portability and refund must be displayed before the commitment is made. The Company may not impose an undisclosed cost subsequently or terminate the user’s mandatory right by a contractual rule.
The user must not make false reservations, abuse capacities, resell tickets contrary to legal conditions or use someone else’s identification and payment information.
7. Special consumer protection
Mandatory consumer rights under applicable law remain unaffected. A business selling to consumers must provide pre-contractual information, confirmation on a durable medium where required, a lawful payment process, complaint handling, remedies for lack of conformity and information about withdrawal.
In the case of distance contracts in the EU, there is generally a 14-day withdrawal period, with legal exceptions and a different start date for goods and services. There is no universal rule that every reservation or every ticket can be cancelled within that time.
A statutory exception may cover certain leisure, accommodation or catering services for a specified date where the legal conditions are met. Starting a paid service during the withdrawal period, fully performing a service and supplying digital content are subject to specific requirements for an express request, consent, acknowledgement and information. Merely logging into an account does not waive any rights.
For health and other regulated services, special regimes may apply. The firm must assess its own activity; a pre-marked option or general sentence that a refund is not possible is not sufficient to legally exclude the right.
8. Business packages, prices and renewals
The plan features, currency, taxes, billing period, any trial period, payment method and renewal rules must be shown in the offer before acceptance. The confirmation must allow the agreed terms to be checked later.
Automatic renewal or conversion of a trial into a paid plan is permitted only if clearly agreed. It is not implied by opening an account. Cancellation methods and deadlines must be available before payment, and contractual and legally required notices must be given before renewal or a price change.
Cancellation of future renewal, as a rule, does not invalidate but the service provided. The right to reimbursement depends on the accepted offer, non-execution, mandatory regulations and other circumstances. These conditions do not introduce a general prohibition of returns.
In case of non-payment Aioness can send a warning and give a reasonable deadline for correction, and then limit the paid functions in accordance with the contract. The emergency security measure and the suspension due to abuse are regulated separately. The restriction must not prevent the exercise of legal rights to the data.
Package prices on the public Aioness website follow the selected language: Bosnian uses BAM (KM), Serbian uses RSD (din.), and Croatian, English, German, Italian, Spanish and French use EUR. The base currency of a business price list follows its country: Bosnia and Herzegovina uses BAM, Serbia uses RSD, and Croatia and Montenegro use EUR. Selecting a language does not change the business country. A Serbian business may show an EUR reference price; its domestic checkout on the platform remains in RSD.
Packages may have fixed prices in each currency. Published fixed EUR and RSD prices take precedence over automatic conversion and do not change with the exchange rate. For annual billing, the monthly amount on a package card represents one twelfth of the displayed annual amount; the annual amount is charged. If no specific fixed price has been set and automatic conversion is enabled, the base BAM price is converted at the fixed rate of EUR 1 = BAM 1.95583, while RSD conversion uses the latest verified official middle exchange rate published by the National Bank of Serbia. Offered EUR prices are rounded to the nearest whole euro, with half a euro rounded up. Taxes, discounts, deposits and final totals may have two decimal places. If a reliable exchange rate is unavailable, only the corresponding automatic offer may be temporarily unavailable. Changes to the price list or exchange rate do not change previously confirmed transactions.
The price and currency of a confirmed subscription are retained as part of the agreed billing terms. Subsequent changes to exchange rates or the price list do not by themselves change a completed transaction or permit amounts in different currencies to be added together. Changing the currency of a contractual obligation requires a newly disclosed calculation and acceptance, subject to mandatory law.
9. Payments and External Services
Payment and communication integrations are only available when contracted and activated. The specific provider and the terms of its service must be identifiable prior to use. The availability of a certain integration in the software does not mean that it is used in every transaction.
Each business is responsible for its selling prices, tax and fiscal obligations, invoices and refunds. Aioness is responsible for charging its own fees. An application-generated confirmation does not replace a fiscal receipt where one is legally required.
Do not send full card numbers, card security codes, or passwords through support, messages, or attachments. Report the dispute with the transaction identifier and the minimum information necessary for verification. Compulsory rights to a bank or payment service remain preserved.
A business may display additional prices and offer a choice of payment currency where legally permitted and supported by its bank account and payment provider. Displaying a reference price does not itself mean that payment in that currency is available. The final review must clearly state the total, taxes, fees and currency of the obligation and payment request. The business is responsible for lawful price display, currency acceptance, foreign exchange compliance and fiscal obligations in its country.
A business’s manually set prices take precedence over automatic conversion. Discounts, taxes, deposits and the remaining balance must be calculated in the currency of the order or booking. The customer’s bank or payment provider may convert the amount again if the card or account uses a different currency. They determine their own exchange rates and fees, which must be distinguished from the rate displayed on the platform. Aioness does not provide a standalone currency exchange service.
An approved refund is recorded in the currency of the original charge and may not exceed the amount actually charged, unless a different arrangement is expressly agreed and permitted by law. Any difference caused by the bank’s or payment provider’s exchange rate is addressed under the applicable rules. This provision does not exclude mandatory consumer rights.
10. Company Content and Intellectual Property
The business retains its rights in lawfully uploaded text, photographs, price lists and other content. It grants Aioness a limited, non-exclusive licence to store, process and display that content in accordance with its settings to provide the agreed service.
This authorization does not transfer ownership of the content nor does it allow the use of customers' personal data for unrelated advertising. After the termination of the contract, the authorization remains only to the extent necessary for legal export, preservation, settlement of the dispute or deletion.
The firm must have rights and permissions to the content it publishes and choose what is public. Aioness' programs, design, and labels are protected by the respective rights; the user receives the right to use the contracted functions, without transferring ownership of the software.
11. Unauthorized use and sensitive data
Illegal sale, deception, violation of the rights of others, threats, discriminatory harassment, unwanted mass messages, malicious code, unauthorized access and attempt to circumvent security or contractual restrictions are prohibited. Report the security vulnerability privately with minimal evidence, without spreading other people's information.
Do not enter data that is unnecessary for the service. Medical records, diagnoses, biometric data, criminal-conviction data and other specially protected information must not be entered in general free-text fields without a prior assessment and an appropriate written agreement covering the supported processing and safeguards.
The name of the health service or term itself can reveal health information. Therefore, the firm must assess sensitivity before activating such an offer, determine the appropriate legal basis, and meet sectoral obligations. Aioness is not a substitute for a regulated health information system or an emergency service.
12. Report illegal content and measures
Send a notice to privacy@aioness.com. Include the exact URL or content identifier, reasons why you consider the content unlawful, available evidence, a contact for a response and a statement that the notice is submitted in good faith. Identity or contact information is not required where applicable law provides an exception.
Notices are assessed carefully, proportionately and without arbitrary treatment. Measures may include removing content, restricting a feature, temporary suspension or termination where justified by severity, repetition, security risk or a legal obligation.
The affected user is given a reason and the possibility of contestation to the extent permitted by law. Information may be restricted if it reveals prohibited information, jeopardizes investigation or security. The objection may be referred to the privacy@aioness.com , and the decision is reconsidered with human assessment.
When a specific service is subject to the EU Digital Services Act, its mandatory procedures, notifications, contact points and legal remedies apply, with certain legal exceptions. The Terms do not create a general obligation to monitor all User Content.
13. Search, recommendations and business users of the EU
The results depend on the selected filters, matching the query and criteria of the specific function. The main parameters of the ranking and their relative significance must be explained with the appropriate function before its commercial use. The paid highlight and sponsored position must be clearly marked.
No number of views, bookings or sales is guaranteed. A business can access its own business data according to its permissions and agreed features; it is not entitled to the personal data of other businesses or their customers.
If the relationship falls under the EU Platform and Business User Relations Regulation, its rules on ranking transparency, access to data, different treatment, changing conditions and termination of service shall be respected. In such cases, the announcement of changes is usually at least 15 days, and the complete termination of the service by the platform is generally justified at least 30 days in advance, with legal exceptions and longer necessary deadlines for adaptation.
14. Availability, maintenance and changes to functions
Aioness should provide service with reasonable professional attention. Planned maintenance that significantly affects usage is announced when possible. Emergency security interventions may require immediate restraint.
No continuous work, recovery period or percentage of availability is specifically contracted by these general terms and conditions. If a certain level of service is required for the business, a separate SLA with measurable obligations is contracted. Legal liability for disorderly execution remains preserved.
The material change of the paid functions must have a valid reason and respect the contracted volume, the announcement and, if necessary, the right of termination or refund. The Company should export business data at reasonable intervals; this does not replace Aioness’s contractual and legal data protection obligations.
15. Termination of use, export and transfer to another service
The user can request the closure of the account, and the company can cancel the subscription according to the accepted offer. Closing a user account does not in itself cancel a reservation, purchase or a legal obligation for the company to keep certain records. Open transactions need to be specifically addressed.
Before deletion, the business should have a reasonable opportunity to obtain the data it is entitled to export. The scope, format, retrieval period and deletion date are confirmed during termination. Data subject to a lawful retention requirement is excluded from deletion, segregated and subject to restricted access.
Where the service falls within the EU Data Act rules on switching between data processing services, those mandatory rules prevail. No contractual or technical barriers contrary to those rules may be imposed. Export scope, assistance, time limits, continuity and permitted charges must comply with the applicable regime. Third-party rights and data protection remain safeguarded.
16. Liability and Damage
Each party is responsible for its obligations and actions under applicable law. The company is responsible for its offer and execution, and Aioness for the contracted platform service and its own data processing. Participation in an external service does not in itself exclude the legal liability of the party that engaged it.
These terms do not exclude or limit liability that cannot lawfully be excluded, including mandatory consumer rights and rights to compensation for unlawful processing of personal data. They do not impose a general compensation cap at a nominal amount or the price of a single subscription.
The party who learns of the damage should act reasonably to reduce it and preserve the relevant evidence. Any specific allocation of business risks must be clearly agreed and lawful; it cannot override the rights of the data subject.
17. Objections, applicable law and changes to conditions
Send questions or complaints to privacy@aioness.com with a description, date and account or transaction identifier. Do not include unnecessary sensitive information. Complaints about goods, appointments or events should first be directed to the identified business, with the option of also reporting a problem to the platform.
Applicable law and jurisdiction are determined according to the applicable conflict-of-law rules and mandatory regulations. These conditions do not confer exclusive jurisdiction on the court nor do they limit the mandatory rules of jurisdiction. The subsequent choice of rights shall not deprive the consumer of the protection or jurisdiction guaranteed by the mandatory regulations.
Mandatory rights to court, supervisory authority and available legal alternative dispute resolution remain preserved. Addressing support is not a mandatory prerequisite for these rights. A specific alternative dispute resolution body shall be indicated where there is an obligation or an accepted competence to do so.
Each published version of the terms should have an application date. Significant changes are announced in a permanent medium or other lawful manner prior to use, with the right of the user to terminate when prescribed. The amendment does not retroactively affect the completed transaction without a valid basis.
18. Data Processing Appendix: Roles and Subject
This addendum forms the basis of the data processing agreement between the company as controller and Aioness as processor, within the meaning of Article 28 GDPR where applicable and the relevant domestic regulations. It shall become a contractual part only with the identified contracting parties, acceptance and completion of the applicable Annexes; the public disclosure of this Appendix itself shall not replace the identification of the contracting parties and acceptance.
The subject is technical data processing for business functions that the company chooses: organization of appointments, records of clients and associates, orders, tickets, communications and reports. The processing takes place during the provision of the service and a limited final period of export or deletion, except for the mandatory retention by law.
Processing operations include reception, registration, organization, storage, display to authorized persons, modification, search, transmission through selected integrations, export and deletion. The scope is determined by documented instructions, active modules and company settings.
Data subjects may include customers, prospective customers, purchasers, event attendees, employees, collaborators and contact persons. Data may include identity and contact details, account information, appointments, purchased services or products, messages, attendance records, delivery information, payment status and technical data needed for performance.
This addendum does not generally authorise special-category or criminal-conviction data. Where a planned feature reveals such data, including through healthcare appointments, the data, purpose, legal basis, permissions and enhanced safeguards must be separately defined before processing. The privacy policy applies to Aioness’s independent purposes, such as administering its own accounts and charging its subscription fees.
19. Instructions, confidentiality and legality
The company determines legitimate purposes, informs persons, establishes legal bases and provides only the necessary information. It can give documented instructions through contract, configuration and authorized requests. Aioness may not use the entrusted data for its own unrelated purposes or sell them.
Aioness processes data only on documented instructions, including transfers to other countries, except when processing is required by mandatory law. It shall inform the firm of such obligation in advance, unless prohibited by law. If it considers that the instruction violates data protection regulations, it warns the company without delay and asks for legal clarification before the disputed processing.
The persons authorised to process must have an obligation of confidentiality or an appropriate legal obligation. Access is limited to the work they perform, checked, and terminated when no longer required. The obligation of confidentiality continues even after the termination of the engagement.
20. Security measures and pre-activation checks
Aioness and the company apply technical and organizational measures appropriate to the risk, nature, scope and purpose of processing, state of the art and cost. Prior to activation, actual applied measures must be documented; this list is a contractual requirement for verification, not a claim of completed certification.
- Control of access by roles, management of administrative powers, protection of authentication and isolation of data of different companies.
- Data protection in transmission, management of secrets and keys, assessment of the need for encryption of stored data and pseudonymization.
- Security updates, vulnerability management, access restriction and monitoring, and records of relevant security events.
- Controlled backups, documented retention periods, restore checks, and the procedure of deleting or restricting data in copies.
- Training of authorized persons, incident procedure, business continuity and regular examination of the effectiveness of protection.
The company is responsible for its devices, authorizations, lawful entry and export. The compliance or certification of one infrastructure provider does not automatically constitute certification of the entire platform.
21. Sub-processors and international transfers
The business must give specific or general written authorisation before a subprocessor is engaged. If general authorisation is agreed, a list of legal entities, functions and processing countries must be available in advance, and intended changes must be notified with a reasonable period for a reasoned objection.
The time limit and the objection channel are agreed in the completed annex before processing begins. If the justified risk cannot be resolved by alternative or additional measures, it shall be possible to terminate the affected service with a safe return or deletion. This add-on does not grant unlimited approval to unknown providers.
Aioness contractually transfers to the sub-processor the same relevant data protection obligations and remains responsible to the company for its execution. A service that a firm contracts on its own may have another role; this must be determined according to actual processing.
A transfer from the EEA, including remote access from another country when it constitutes a transfer, may only be carried out with an appropriate legal mechanism and assessment. The processing contract is not in itself a mechanism of international transmission. When standard contractual clauses are required, the appropriate valid module and attachments are selected, with an assessment of the transfer and additional measures required; exceptions are not a substitute for a permanent lawful solution.
22. Rights of persons, incidents and cooperation
Aioness helps the company, taking into account the nature of the processing and the information available, in responding to the person’s requests, safety, reporting of violations, impact assessment and prior consultation with the competent authority. A request relating to company-controlled data is forwarded without undue delay; Aioness does not reject it simply because it is a processor.
Aioness informs the company about the breach of the entrusted personal data without undue delay after learning. The initial notification does not await the completion of the investigation and contains the facts then available: the nature of the events, the categories affected and the approximate scope, the contact, the likely consequences, the measures taken and the plan for supplementing the information.
The business, as controller, decides on notification to the supervisory authority and affected individuals, with assistance from Aioness. The GDPR’s 72-hour period concerns the controller’s reporting obligation where the relevant conditions are met; it is not a permitted waiting period for the processor to notify the business. Each party separately fulfils its own legal obligations.
23. Proofing, auditing and completion of processing
Aioness makes available to the firm the information necessary to demonstrate the obligations of the processor and enables a reasonable audit or inspection by the firm or its authorized independent auditor. The organization of the check can protect the security and other people's data, but it must not abolish the legal right to an effective check.
Upon termination of the Aioness service, according to the choice of the company, it returns or deletes the entrusted data and deletes existing copies, except when the law requires retention. The format of return, the final deadline, the method of confirmation and the handling of backups shall be agreed. Data that must be retained temporarily is protected and not used for other purposes.
The Company retains control and responsibility for its own imported or exported copies. If Aioness ceases to act solely on instructions and determines the new purpose and means of processing itself, its role and responsibility shall be assessed according to the law and not according to the name in this Appendix.
24. Mandatory attachments before completion of the add-on
Before entrusting data, the following attachments must be agreed and available. They form part of a specific contract and cannot be replaced by a general claim that the service is GDPR compliant.
- Identity and contacts of the contracting parties, authorized persons for instructions, privacy and incident reporting and date of commencement of processing.
- Active modules, purposes, categories of persons and data, sensitive processing if approved, frequency and duration of processing.
- A list of sub-processors with legal names, functions and countries of processing and access, approval procedure and deadline for objection.
- Actual technical and organizational measures, the backup regime, export and deletion deadlines and the method of confirmation of execution.
- Applicable international transmission mechanisms, filled-in clauses when needed, assessments and additional measures.
For the preparation and contracting of the supplement , contact is privacy@aioness.com . Until these annexes are completed, the draft is not a confirmation that unknown sub-processors, processing countries or sensitive data have been approved.