Customer Agreement

1. Parties, definitions, recitals and acceptance

1.1 Parties. This Agreement ("Agreement") is entered into between Virsion Sagl, with registered office in Canton Ticino, Switzerland, registered with the Commercial Register of Canton Ticino, UID CHE-452.458.064 ("Virsion" or "Provider"), and the legal entity creating an Organization on the Gameheim platform or subscribing to a Plan (the "Customer").

1.2 Electronic acceptance and authority. The Agreement is concluded by electronic (click-through) acceptance upon registration of the Organization or subscription to a Plan. The individual accepting represents and warrants that: (i) they are of legal age; (ii) they act on behalf of the Customer with the necessary authority to bind it; (iii) the Customer acts exclusively for professional/business purposes. The Service is not intended for consumers; consumer-protection regulations do not apply.

1.3 Definitions.

• Service: access to and use of the SaaS platform named Gameheim, including mobile applications and AI features.
• Organization: the space (tenant) created by the Customer on the platform, logically segregated from other organizations.
• User: an individual authorised by the Customer to access its Organization, identified by unique credentials.
• User Licence: a named, non-shareable access right assigned to a User, within the limits of the Plan.
• Plan: the combination of features, limits (including number of Users, number of projects and AI consumption quotas) and fees selected by the Customer (Free, Starter, Pro, Enterprise or other plans offered from time to time).
• Enterprise Order: a document (including electronic) signed by the Parties for the Enterprise plan, containing special conditions (Annex E).
• Agent: the "Gameheim Agent" software provided by Virsion and installed by the Customer on its own systems (on-premise) for local interaction with Perforce.
• Perforce: the Customer's Helix Core version-control system, hosted on the Customer's infrastructure or in any case infrastructure outside Virsion.
• Perforce Metadata: descriptive information on Perforce files and operations (file names, paths, states, locks, changelists, counts), excluding file content.
• Customer Data: any data, document, file, content or information uploaded or processed through the Service by the Customer or its Users, including any Personal Data.
• Personal Data: personal data as defined by applicable law (in particular the GDPR, where applicable, and/or the Swiss Federal Act on Data Protection, nFADP).
• AI Output: responses, summaries, texts or content generated by the Service's AI systems.
• RAG: Retrieval-Augmented Generation, a mechanism combining the retrieval of information from the Customer's document bases with AI generation.
• Sub-processor: a third party engaged by the Processor (Virsion) for specific activities (e.g. Microsoft), as listed in Annex 1.
• Beta Features: features marked as beta, preview, early access or experimental.

1.4 Recitals and annexes. The annexes form an integral and substantial part of the Agreement. In case of conflict, the following order prevails: (i) Enterprise Order/Annex E, where signed; (ii) Agreement; (iii) technical and privacy annexes (A–D and Annex 1).

2. Subject matter and description of the Service

2.1 Subject. Virsion grants the Customer the non-exclusive, non-transferable right, limited to the term of the Agreement, to access and use Gameheim as SaaS according to the selected Plan, and provides related services (hosting, ordinary maintenance, standard updates).

2.2 General features. Gameheim is a project-management platform for game development enabling, among other things: production management (kanban, pipelines, milestones); Perforce integration via the Agent; team collaboration (channels, messages, calendar, moodboards); knowledge base (wiki, documents, search) with AI assistance and RAG querying; voice-acting pipeline; access management per organization/project/role/user. The technical description is in Annex A.

2.3 Technical requirements and endpoint security. The Customer is solely responsible for having compatible internet connectivity, devices, browsers and systems (including the systems hosting the Agent and its own Perforce server) and for adopting adequate endpoint-security measures. Virsion does not verify or certify the Customer's technical requirements and provides no security advice. The Customer acknowledges that AI models may be subject to targeted attacks (e.g. malicious prompting) and that the operating environment used to access the platform must be adequately protected.

2.4 Geographic availability. Virsion may restrict the geographic availability of the Service (including through network restrictions) for technical, security or regulatory reasons.

3. Organizations, named accounts and absolute prohibition of sharing

3.1 Named licence. The Service is licensed per named User. Each User must be identified by unique, personal credentials.

3.2 Prohibition of sharing. Sharing credentials, using generic accounts or allowing access to unauthorised persons is strictly prohibited. Sharing constitutes a material breach of the Agreement and may compromise the security of Gameheim and of the Customer's systems.

3.3 Consequences. In case of breach, Virsion may, at its discretion: immediately suspend the accounts involved; charge for additional User Licences actually used and not purchased; terminate the Agreement under art. 20 for material breach; claim compensation for documented direct damages.

3.4 User lifecycle. The Customer, through its Organization administrators, is responsible for the proper management of User lifecycle (onboarding/offboarding), including assignment, modification and revocation of credentials, roles and permissions, and undertakes to promptly revoke access upon termination of the relationship with a User or change of duties.

4. Plans, fees, billing and Free plan

4.1 Self-service commercial model. The Customer selects a Plan and, where applicable, the number of User Licences through the platform. Fees, limits and features of the selected Plan are shown on the subscription page at the time of purchase and in the Organization summary; they take the place of the Order. For the Enterprise plan, the terms may be set out in an Enterprise Order (Annex E).

4.2 Payments via Stripe. Payments are processed by the payment provider Stripe. Virsion does not store full payment-card data. The Customer is responsible for the accuracy and validity of the payment method and billing details.

4.3 What the fee includes. Unless otherwise indicated, the fee includes: access to the Service according to the Plan; hosting on Microsoft Azure and ordinary maintenance; standard updates and patching; basic support per the Plan.

4.4 AI consumption quotas. AI features are subject to the quotas (e.g. monthly tokens) of the Plan. Upon reaching the quota, AI features may be limited or suspended until period renewal or Plan upgrade. Unused quotas are neither carried over nor refundable.

4.5 Free plan. The Free plan is provided free of charge, "as is", with no commitment as to availability, support or data retention. Virsion may modify its limits and features, suspend or discontinue it at any time, including for a single Organization (e.g. prolonged inactivity), with reasonable notice where practicable.

4.6 Additional paid services. Subject to separate quotation, by way of example: dedicated resources or instances; backup/retention/disaster-recovery plans; custom SLAs; advanced support; third-party integrations; training; data migrations and custom development.

4.7 Price adjustments. Virsion may change prices with effect from the next renewal, with at least 60 days' notice before the end of the current period. The adjustment shall not exceed 10% of the previous period's fee, save for documented variations in cloud-provider infrastructure costs. If not accepted, the Customer may elect not to renew.

4.8 Non-payment. Failure to pay within the due terms entitles Virsion to: suspend the Service; charge default interest of at least 5% per annum; terminate the Agreement. The Customer acknowledges that a failed renewal payment through Stripe may result in the automatic downgrade of the Organization, with consequent limitation of features.

4.9 Excess User Licences and Plan reduction. If, following a change of Plan (including a downgrade for non-payment, the end of the subscription or the discontinuation of a Plan by Virsion), the number of active Users of the Organization exceeds the number of User Licences allowed by the new Plan, Virsion notifies the Organization's administrator and grants a period of 15 days to return within the limit, by deactivating Users or subscribing to a suitable Plan. Once that period has elapsed, Virsion automatically deactivates the excess Users, starting with those whose activity is least recent, always preserving the account of the most recently active administrator. Deactivated Users keep their data and may be reactivated within the limits of the Plan. Deactivation does not constitute a breach by Virsion and does not give rise to any refund.

4.10 Taxes. The fees shown are exclusive of VAT and other indirect taxes, which are borne by the Customer and applied where due under applicable law. For supplies subject to the reverse-charge mechanism, the Customer is responsible for accounting for the tax in its own State. The Customer warrants the accuracy of the tax details provided, including its VAT number, and holds Virsion harmless from the consequences of incorrect or incomplete details.

5. Term, renewal and termination

5.1 Term. The subscription period (monthly or annual) is the one selected at purchase.

5.2 Automatic renewal. Subscriptions renew automatically for equal successive periods, unless cancelled by the Customer through the platform's self-service functions before the end of the current period. Cancellation takes effect at the end of the paid period.

5.3 Refunds. Amounts already paid are non-refundable, save for legal obligations or as otherwise provided in an Enterprise Order.

5.4 End of the paid subscription. Upon the end of the paid subscription (cancellation, non-renewal or non-payment) the Agreement continues: the Organization moves to the Free plan under arts. 4.5, 4.8 and 4.9, and Customer Data remains available within the limits of that plan.

5.5 Effects of termination of the Agreement. Upon termination of the Agreement (deletion of the Organization by the Customer, termination by Virsion, discontinuation of the Free plan under art. 4.5) access to the Service is disabled. Except where the Customer has requested the deletion, the Customer has 30 days to request the export of its Data; after that period, Customer Data is deleted. The Customer remains responsible for exporting its Data before termination or within that period.

6. Nature of the AI Service, AI Output and limitations (hallucinations)

6.1 Probabilistic nature. The Customer acknowledges that the AI systems used in the Service, including generative and RAG models, operate on statistical-probabilistic bases and may produce inaccurate, incomplete, outdated or factually unfounded output ("hallucinations"), and may reflect biases in the underlying models' training data.

6.2 No warranty, no advice. Virsion gives no warranty — express, implied or statutory — as to accuracy, completeness, truthfulness, fitness for a particular purpose, regulatory compliance or professional usability of AI Outputs, which are decision-support tools and not advice of any kind.

6.3 Verification obligation. The Customer shall subject each AI Output to qualified human verification before any operational use, business decision, communication to third parties or inclusion in products. The Customer is solely responsible for the use of AI Outputs and holds Virsion harmless from any third-party claim arising from unverified or improper use. Virsion's liability for damages directly attributable to the probabilistic nature of AI systems is excluded, subject to the mandatory limits of art. 100 of the Swiss Code of Obligations.

6.4 RAG and retrieval limits. The RAG mechanism depends on the quality and currency of the uploaded content, access configurations and indexing settings. Virsion does not warrant that AI Output includes all relevant sources or correctly interprets complex content. User prompting can decisively affect the accuracy and quality of AI Outputs.

7. Permitted use, prohibited use and Customer responsibility

7.1 Permitted use. The Customer may use Gameheim exclusively for legitimate professional purposes, internal to its Organization and compliant with applicable law.

7.2 Prohibited content. It is prohibited to upload or process: unlawful content; material infringing third-party rights (copyright, trade secrets, trademarks); malware or malicious code; data obtained or processed in breach of law. The Customer is fully responsible for its Data and holds Virsion harmless from any dispute.

7.3 Third-party confidential information and NDA obligations. Content typically handled in game development (builds, assets, design documents, publisher or platform-holder material) may be subject to confidentiality obligations towards third parties (NDAs, development/publishing agreements, platform-holder terms). The Customer is solely responsible for verifying that uploading such content to the Service is compatible with its contractual and legal constraints; entering confidential information may constitute a breach of such obligations. Unless agreed in writing, Gameheim is not provided as a "certified solution" for special categories of data or materials subject to special regimes.

7.4 Voice-acting content and third-party rights. For voice-acting features, the Customer is solely responsible for having an adequate legal basis and all necessary rights and releases (including personality, copyright and related rights) for voice recordings of actors or other individuals uploaded to the Service, and for fulfilling the related information obligations.

7.5 Presence telemetry and employer obligations. Certain features detect Users' presence/activity status (e.g. application heartbeats and, through the Agent, inactivity indicators based on the timestamp of the last OS-level input). The Customer, as Controller and, where applicable, employer, is solely responsible for: (i) verifying the lawfulness of such features under the law applicable to its Users (including employee-monitoring rules such as art. 26 of Swiss Ordinance 3 to the Employment Act or art. 4 of the Italian Workers' Statute); (ii) adequately informing Users; (iii) obtaining any required authorisations or completing required procedures. The Customer indemnifies Virsion in this respect.

7.6 High-risk / regulated contexts. The Customer shall not use the Service as an automated decision-making system in high-risk contexts or contexts affecting fundamental rights of individuals (e.g. automated evaluation of workers, scoring) without adequate legal assessment and human oversight. See also art. 16.

7.7 Roles and permissions. The Customer is solely responsible for the correct configuration of roles, permissions and access policies within its Organization. Internal unauthorised access due to misconfiguration or user mismanagement is the Customer's responsibility.

8. Gameheim Agent (on-premise software) and Perforce integration

8.1 Agent licence. Virsion grants the Customer a non-exclusive, non-transferable licence, limited to the term of the Agreement, to install and run the Agent on its own systems solely to use the Service. The restrictions of art. 15.7 apply to the Agent.

8.2 Automatic updates. The Agent may automatically download and install updates signed by Virsion. Use of outdated versions may compromise functionality and security.

8.3 Perforce data perimeter. The Agent executes Perforce commands locally on the Customer's systems. The content of files versioned in Perforce is not transmitted to Virsion nor uploaded to the Service cloud: only Perforce Metadata and status information necessary for the features (dashboards, locks, automatic tasks) flow to the Service.

8.4 Customer systems. The Perforce server, the machines hosting the Agent and related connectivity remain under the Customer's exclusive control and responsibility. Virsion is not liable for malfunctions, data loss or damage originating from or on the Customer's systems, including Perforce misconfigurations, nor for commands executed by the Agent on the instruction of the Customer or its Users.

9. Information security

9.1 Adequate measures. Virsion undertakes to adopt, to the extent possible and adequate, technical and organisational measures proportionate to the nature of the Service and consistent with industry best practice, to protect the data processed against unauthorised access, loss, destruction, alteration or undue disclosure.

9.2 Included measures. Where technically applicable and compatible with the Service architecture: logical segregation of Organizations (multi-tenant); encryption in transit (TLS) and at rest, with per-organization keys where available; multi-factor authentication (MFA) available to Users; Web Application Firewall (WAF); role-based access controls; audit logs; technical logging for security and monitoring. Details in Annex C.

9.3 Periodic review. Security measures are periodically reviewed in light of technological and regulatory developments.

9.4 No absolute guarantee. No IT system can be considered fully immune from security risks; Virsion does not guarantee invulnerability, like any commercial SaaS.

9.5 Customer obligations. The Customer is responsible for the correct configuration of access, credential management, the security of its own systems (including those hosting the Agent and Perforce) and its Users' compliant use of the Service.

10. Backup, retention and storage responsibility

10.1 Not a primary data repository. Gameheim is not designed as a primary data repository or long-term archiving system. In particular, the primary repository for project files remains the Customer's Perforce system.

10.2 Backups not included by default. Unless additional services are agreed, Virsion does not guarantee versioning or disaster recovery.

10.3 Customer responsibility. The Customer is responsible for retaining original content and adopting its own backup and retention policies, with processes ensuring that data uploaded to and/or produced by the Service is also available on external systems separate from Gameheim.

10.4 Optional services. Backup, retention, disaster recovery and related metrics (RPO/RTO) may be provided as additional services under specific terms and costs.

11. Subcontractors and reliance on third-party infrastructure

11.1 Applicable third-party terms. To provide the Service, Virsion relies on third-party providers and subcontractors (e.g. Microsoft, Stripe, Google, Apple). Their terms and conditions, which Virsion cannot negotiate, apply directly to the services they provide and are referenced in Annex 1, whose online version is updated according to the mechanism set out therein. The Customer acknowledges and accepts the applicability of such terms and undertakes to use the Service in compliance with them.

11.2 Data residency. The platform is configured to use data-center regions located in Europe and/or Switzerland for storage and processing of Customer Data, in line with the providers' data-residency policies and as set out in Annex 1. The Customer remains responsible for performing its own periodic assessments.

12. Data processing and roles

12.1 Roles. Unless otherwise qualified in specific cases: for Customer Data and Users' Personal Data processed within the Organization, the Customer is the Controller and Virsion is the Processor (Sub-processor list in Annex 1). For data necessary to manage the contractual relationship (Organization registration data, billing, commercial and administrative communications), Virsion acts as an independent Controller.

12.2 Applicable law. Processing of Personal Data is governed by applicable data-protection law, in particular the GDPR where mandatorily applicable, and in any case the Swiss nFADP and its ordinance. Processing terms are detailed in Annexes B and 1, which serve as the data-processing agreement (art. 28 GDPR / art. 9 nFADP).

12.3 Sub-provider logs and retention. Unless specifically configured and where available, the sub-providers' "Zero Data Retention" mode for AI services is not enabled, and their technical-log policies apply; see Annex 1.

13. Incident Management and Data Breach

13.1 Notification. Virsion will notify the Customer of any security breach involving the Customer's Personal Data without undue delay and in any case within 24 hours of gaining actual knowledge. The initial notification will be followed, as soon as information is reasonably available, by a supplementary report describing: (i) nature of the breach, categories and approximate number of data subjects and records; (ii) likely consequences; (iii) measures taken or proposed; (iv) Virsion's contact point; (v) detailed timeline.

13.2 Assistance to the Controller. Virsion will provide the Customer with prompt, reasonable assistance to fulfil its notification obligations to the supervisory authority (art. 33 GDPR, art. 24 nFADP) and communication to data subjects (art. 34 GDPR), including necessary forensic analyses and documentary evidence.

13.3 Exclusions. Virsion is not liable for incidents arising from: misuse of the Service; misconfigured roles/permissions; compromised credentials; insecure Customer devices or systems (including those hosting the Agent and Perforce); events attributable to third-party providers (including cloud), save as mandatorily provided by applicable law; any circumstance external to Gameheim or originating in the Customer's systems.

13.4 Incident Response Plan. Virsion confirms it has implemented and maintains a formally documented Incident Response plan, exercised at least every six months, evidence of which will be made available in audits under art. 21.

14. Service availability and service levels

14.1 Provider dependency. Virsion depends on its infrastructure providers for Service availability; see Annex 1. Scheduled maintenance and the exclusions of art. 14.5 are excluded.

14.2 Cloud-infrastructure alignment. The Service runs on Microsoft Azure; availability also depends on the cloud provider's services. Absent agreed application SLAs, the availability levels of the underlying infrastructure are those provided by the cloud provider under its terms. Cloud-provider SLAs do not constitute a direct, autonomous commitment of Virsion to the Customer, save as expressly set out in an Enterprise Order.

14.3 Maintenance. Virsion may perform ordinary and extraordinary maintenance, including security updates. Where reasonably possible, scheduled maintenance will be notified at least 48 hours in advance and planned in low-impact windows.

14.4 Application SLAs and premium services. Application SLAs with higher guarantees (uptime, support response times, service credits) may be agreed exclusively by separate written agreement (Enterprise Order or addendum).

14.5 Exclusions. Save as mandatorily provided by law, Virsion is not liable for unavailability, degradation or interruptions due to: unavailability or limitations of Microsoft Azure or other third-party services; scheduled maintenance; force majeure; network incidents or attacks (including DDoS) not attributable to Virsion; malfunctions, misconfigurations, systems, devices or connectivity of the Customer; use of the Service in breach of the Agreement.

15. Intellectual property, restrictions and prohibitions

15.1 Ownership of Gameheim. Gameheim, the Agent, source and object code, software architecture, documentation, trademarks and all know-how remain the exclusive property of Virsion or its licensors. The Customer receives only a non-exclusive, non-transferable licence limited to the term of the Agreement and the limits of the Plan.

15.2 Ownership of Customer Data and prompts. The Customer retains full and exclusive ownership of Customer Data, uploaded content, Users' prompts and any content provided to the Service. Virsion acquires only a licence strictly functional to providing the Service, limited to the duration necessary, non-assignable, non-sublicensable except to authorised Sub-processors, to be exercised exclusively in accordance with the Agreement.

15.3 AI Output. As between the Parties, and to the maximum extent permitted by applicable law, the Customer owns the AI Outputs generated in response to its prompts. Given the probabilistic nature of generative models, similar outputs may be generated for other users, and Virsion cannot guarantee novelty or originality of AI Output under the Swiss Copyright Act or equivalent laws.

15.4 No training. Virsion will not use Customer Data, prompts or AI Outputs to train, retrain or fine-tune any AI model, its own or third parties', nor for purposes other than providing the Service. Any exception requires the Customer's specific written consent.

15.5 Derived and aggregated data. Virsion may process technical and telemetry data in fully anonymised and aggregated form (irreversibly, within the meaning of Recital 26 GDPR) for security, operational monitoring and Service improvement. Such data constitutes neither Personal Data nor Customer Data.

15.6 IP indemnity for AI Output. Virsion will hold the Customer harmless from third-party claims based on infringement of intellectual-property rights attributable to the operation of the AI models underlying the Service, provided that: (i) the contested Output was generated through compliant use of the Service; (ii) the Customer promptly notifies the claim; (iii) the Customer allows Virsion to manage the defence. The indemnity is capped under art. 17 and does not apply to prompts manifestly aimed at reproducing protected works.

15.7 Restrictions. The Customer shall not: (a) reverse engineer, decompile or disassemble the Service or the Agent, save as mandatorily permitted by law; (b) use the Service to develop competing products; (c) remove copyright notices; (d) use AI Outputs to train competing third-party AI models; (e) resell, sublicense or make the Service or the Agent available to third parties outside its Organization.

16. Automated decision-making, profiling and AI governance

16.1 No automated decision-making. Gameheim is not designed to make automated decisions with legal or similarly significant effects on data subjects.

16.2 Human oversight. The Customer shall ensure adequate human oversight in the use of AI Outputs.

16.3 Profiling. The Customer shall not use Gameheim for automated profiling or scoring of individuals (including performance evaluation of workers based on presence or activity data) without a legal basis and adequate measures.

16.4 AI Act readiness. The Customer declares awareness of Regulation (EU) 2024/1689 ("AI Act") and undertakes, where and to the extent applicable to it as deployer or provider, to comply fully with its obligations, in particular: ensuring adequate AI literacy of its personnel (art. 4); using the system in accordance with the instructions for use and intended purpose, ensuring human oversight and quality of input data under its control; refraining from prohibited uses under art. 5 and complying with obligations for high-risk and transparency-subject systems, where applicable; independently fulfilling information obligations towards data subjects. The Customer indemnifies Virsion against any consequence of breach of these obligations. Virsion provides no compliance advice or assistance and performs no control or monitoring role.

17. Limitation of liability

17.1 Overall cap. Save for wilful misconduct or gross negligence, Virsion's aggregate liability for any claim connected with the Agreement is limited to the fees actually paid by the Customer in the 12 months preceding the event. For the Free plan, since no fee is due, any liability of Virsion is excluded to the maximum extent permitted by law, save for wilful misconduct or gross negligence.

17.2 Exclusion of indirect damages. Excluded: indirect and consequential damages, loss of profit, loss of chance, reputational damage, loss or corruption of data (save for wilful misconduct/gross negligence or mandatory legal obligations).

17.3 AI Output. Virsion is not liable for damages arising from the use of AI Outputs not verified by the Customer.

17.4 Limitation period. Save for longer mandatory statutory terms, any claim must be made in writing within 12 months of discovery of the event and in any case within two years of it; mandatory limitation periods remain reserved.

17.5 Any act falling under art. 18 remains the Customer's exclusive responsibility.

18. Indemnity

The Customer indemnifies and holds Virsion harmless from any claim, damage, penalty or cost (including legal fees) arising from: content uploaded by the Customer or its Users; infringement of third-party rights (including NDA obligations and rights in voice recordings); unlawful or non-compliant use; lack of a legal basis for processing Personal Data (including the presence-telemetry features under art. 7.5); misconfigured access; the Customer's breach of sector or regulatory requirements.

19. Portability, export and data deletion

19.1 Export. Upon request and where technically available, Virsion may support the export of Customer Data under communicated terms and costs; self-service export functions may be made available in the platform.

19.2 Deletion. Upon termination of the Agreement, Virsion will delete Customer Data within the timeframe of art. 5.5.

20. Suspension and termination

20.1 Suspension. Virsion may suspend the Service (in whole or in part) in case of: non-payment; unlawful or prohibited use; security violations (account sharing, compromised credentials); technical or security risk to the system; legitimate requests from competent authorities.

20.2 Termination for breach. In case of material breach not cured within 15 days of written notice, Virsion may terminate the Agreement.

20.3 Immediate termination. Virsion may terminate with immediate effect in case of: systematic account sharing; unlawful use; intentional breach of the restrictions in art. 15; serious security violations.

20.4 Exclusion of damages claims. In case of termination by Virsion under this article, any damages claim by the Customer is excluded, within the limits of mandatory law.

21. Audit

21.1 Conditions. Audits requested by the Customer must be: justified; agreed with at least 30 days' notice; limited to relevant data-processing and security aspects; conducted without interfering with Service operations.

21.2 Costs. Audits are at the Customer's expense, unless otherwise agreed.

22. Export control and sanctions

The Customer declares that it is not subject to international sanctions or restrictions and undertakes not to use the Service in breach of export-control or economic-sanctions regulations.

23. Changes to the Service and to the Agreement

23.1 Service updates. Virsion may update the Service for technical, security or regulatory reasons and undertakes not to materially reduce the security level without valid technical or regulatory reason.

23.2 Material feature changes. In case of changes materially reducing the features of the subscribed Plan, Virsion will give at least 30 days' notice; the Customer may withdraw within that term without penalty.

23.3 Changes to the Agreement. As a self-service offering, Virsion may amend this Agreement by notice to the Customer (email to the Organization administrator and/or in-platform notice) with at least 30 days' notice. If the change is materially detrimental, the Customer may terminate with effect from the change's effective date, with pro-rata refund of prepaid unused fees as sole remedy. Continued use after the effective date constitutes acceptance. For Customers with an Enterprise Order, unilateral changes do not apply to terms expressly agreed in the Order.

23.4 Beta Features. Beta Features are provided "as is", without warranties or commitments of availability or continuity, may be changed or withdrawn at any time and may be excluded from service levels.

24. Confidentiality

The Parties shall keep confidential the confidential information exchanged in performing the Agreement, for its duration and for 18 months after termination. Information already public, lawfully obtained from third parties without confidentiality obligations, or independently developed is not confidential.

25. Notices

Formal notices (cancellations, default notices, data-breach notifications, audit requests) must be made in writing by email to the Organization administrator's address (for the Customer) or to info@virsion-studio.com (for Virsion), or by registered mail with return receipt or other means providing proof of receipt. Operational and support communications may occur through the channels indicated in the Service documentation.

26. Severability

Should one or more clauses be invalid, void or unenforceable, the remaining clauses remain fully valid and effective. The Parties will replace the invalid clause with a valid provision coming as close as possible to the economic and legal purpose of the original.

27. Force majeure

Neither Party is liable for non-performance or delays due to causes beyond reasonable control, including natural events, pandemics, acts of war or terrorism, government measures, telecommunications or power outages, large-scale cyberattacks, prolonged unavailability of the cloud provider's infrastructure. The affected Party shall promptly notify the other. If the event lasts more than 90 days, either Party may withdraw without penalty.

28. Entire agreement

This Agreement, together with the Annexes and any Enterprise Order, constitutes the entire agreement between the Parties on its subject matter and supersedes any prior understanding, proposal or communication. Amendments are valid only if made under art. 23.3 or agreed in writing.

29. Governing law and jurisdiction

29.1 This Agreement is governed exclusively by Swiss substantive law, expressly excluding conflict-of-law rules leading to a different law, and expressly excluding the CISG.

29.2 Where the Customer is established in an EU Member State, and exclusively for disputes concerning the processing of Personal Data of data subjects established in the EU, the mandatory provisions of applicable EU law remain reserved, including the GDPR and, upon its application, Regulation (EU) 2024/1689 ("AI Act"), to the extent applicable to Virsion under Swiss law and international administrative-assistance rules, foreign authorities not being permitted to exercise sovereign acts directly against Swiss companies except through the competent Swiss authorities.

29.3 Any dispute arising from or connected with this Agreement, including as to its validity, interpretation, performance and termination, is subject to the exclusive jurisdiction of the Pretura di Lugano.

29.4 By way of derogation, the Parties may agree in writing to submit a specific dispute to arbitration under the Swiss Rules of International Arbitration, seat in Lugano, Italian language, one arbitrator.

Disclaimer

The Customer acknowledges and accepts that, although Virsion constantly implements security measures and deeply cares about its customers' security, uploading to any cloud solution materials subject to confidentiality obligations towards third parties (including NDAs with publishers, platform holders or other partners) or to professional, legal or contractual obligations may result in a breach of such obligations. The Customer therefore bears the burden of verifying precisely which constraints it is subject to and how they affect the usability of Gameheim.