Terms of Service

Version 1.0 · Last updated: 1 October 2026

1. Who we are and who these terms are for

1.1 Brova Cloud is provided by Joaquín Martínez Herrera (CEO), trading as Brova Digital Group
("Brova", "we"). Our addresses are listed in the imprint.

1.2 Brova Cloud is available to clients of Brova Digital ("Client", "you"), whether
businesses or private individuals. "Consumer" means a person who contracts mainly for
purposes outside their trade, business or profession; "business client" means
everyone else. Rules marked for consumers apply only to consumers. Nothing in these terms
limits rights that consumers have under mandatory law.

1.3 These terms apply to every Brova Cloud service. Your own terms don't apply unless we
agree to them in writing.

2. Documents that make up the contract

If documents conflict, this order applies:

1. the offer you accepted (plan, price, term, anything agreed individually);
2. these Terms of Service;
3. the Support & Incident Policy;
4. the Acceptable Use Policy;
5. the data processing agreement (section 14), which prevails on data protection.

The plan descriptions on brova.cloud/plans at the date of the offer describe
the service, as far as the offer refers to them.

3. How the contract is made

3.1 We send you an offer by email or another written channel, such as WhatsApp. The
contract is made when you accept it in writing or in text form (an email or message is
enough), or when we start the service at your request.

3.2 There is no online checkout. Offers are based on a review of your site.

3.3 Before you accept, we send you the final price by email, including any taxes that
apply to you. That is the price you pay.

3.4 Consumers: right of withdrawal. If you are a consumer and the contract is made by
email, WhatsApp or other distance means, you can withdraw from it within 14 days without
giving reasons, as explained in our withdrawal information. If you
ask us to start the service before the withdrawal period ends and then withdraw, you pay
a proportionate amount for the service provided until you told us.

4. The services

4.1 What you get. The plan in your offer: hosting on servers we manage, TLS
certificates, backups, server security updates and support, plus any add-ons you
ordered. Resource limits (storage, PHP workers, CPU, memory) are stated in the plan.
Visit numbers in plan descriptions are guidance, not limits.

4.2 Features marked "rolling out". Some plan features are marked as being rolled
out. They are not part of what we owe until we confirm in writing that they are active
for your site. We tell you when each one goes live.

4.3 WordPress and WordPress Commerce. Each site runs under its own system user and
PHP pool. With WordPress Care (an add-on on WordPress, included in WordPress
Commerce) we apply WordPress core, plugin and theme updates and check the site
afterwards. We may postpone or skip an update that breaks the site, and tell you.
Updating premium plugins or themes requires a valid licence from you. Fixing
incompatibilities caused by custom code is development work, quoted separately.

4.4 Application hosting. Applications run as containers, deployed from the
repository you give us access to. You are responsible for the application code, its
dependencies and its configuration. We run the platform, the database, the certificates
and the backups described in your plan.

4.5 Dedicated VM. A virtual machine with the resources stated in the offer, reserved
for you on hardware shared with other virtual machines. We manage the operating system
unless the offer says otherwise.

4.6 Static hosting. Hosting of static files and front ends.

4.7 One-time services (setup, moving an existing site, cleaning a compromised site)
are described and priced in the offer.

4.8 Subcontractors. We may use subcontractors to provide the services. We remain
responsible to you for their work.

4.9 Changes to the service. We may change technology, providers or procedures as long
as the service you ordered stays at least equivalent. We tell you in advance about any
change that affects how you use the service. Changes that reduce the service need your
agreement.

5. Backups

5.1 We back up each site as stated in your plan.

5.2 We restore from the most recent suitable backup on request. A backup reflects the
state at the time it was taken; changes made after it are not included. We can't
guarantee that every backup can be restored in every case, and we don't guarantee
recovery of data that was never captured by a backup.

5.3 If you create content you can't recreate, we recommend that you also keep your own
copy. On request we provide an export (section 15).

6. Availability and maintenance

6.1 We publish an uptime target in the Support & Incident Policy. It
is a target, not a guarantee, and not a service level agreement. There is no SLA
unless your offer contains one.

6.2 We announce planned maintenance in advance. Urgent security work can't always wait;
we tell you as soon as we can.

6.3 Interruptions caused by events outside our reasonable control (section 18), by your
application or content, or by third parties you engaged, are not failures of our service.

7. Support and incidents

7.1 Channels, hours, response targets and priorities are set out in the
Support & Incident Policy. Response targets describe how quickly a
person first replies; they are not resolution times and not guarantees.

7.2 Incident response (a site that is down, compromised or under attack) includes a
first response, the containment steps we consider appropriate (for example blocking
traffic, isolating a site or taking a component offline), restoring from backup where
needed, and a written summary of what we found and changed. Cleaning a compromised site
is included only where your plan says so; otherwise we quote it.

7.3 Incident response does not include forensic investigation to an evidentiary
standard, recovering data that was never backed up, or dealing with authorities or
attackers on your behalf. We preserve logs and evidence where we reasonably can, and tell
you if a step we need to take (such as restoring a backup) will overwrite evidence.

7.4 We may need your cooperation: contact within reasonable time, access to accounts or
repositories you control, and decisions on containment steps. Never send credentials
through the incident form; we agree a safe way.

7.5 We don't control and are not responsible for infrastructure we don't operate, such
as your domain registrar, your own Cloudflare account, third-party APIs, payment
providers or plugins.

8. Your responsibilities

You are responsible for:

• the content, data and software you or your users put on the service, and their
  legality, including third-party rights and licences;
• keeping the passwords of your application, control panel and user accounts safe, and
  telling us straight away if you suspect they have been compromised;
• your application code and its dependencies, unless we build it for you under a
  separate development contract;
• valid licences for premium plugins, themes and other paid software;
• your domain names: registration, renewal, and authority to point them to us;
• keeping a contact person reachable, especially during incidents;
• following the Acceptable Use Policy;
• telling us before you store special categories of personal data (such as health data)
  or data subject to specific rules (such as payment card data outside a payment
  provider), so we can agree suitable measures.

Our own responsibilities are set out in the "Who does what" table on the
plans page and in these terms. A task that is ours stays ours even if you
could technically do it yourself.

9. Domains, DNS and email

9.1 Your domain stays registered in your name with your registrar. We point it to
Cloudflare or to our name servers, as agreed at onboarding.

9.2 Whether a site uses Cloudflare is agreed per site, based on its needs and your
preference.

9.3 Email mailboxes are not part of Brova Cloud plans unless your offer includes them.
Email sent by your website or domain may be relayed through our email provider, as listed
on our sub-processors page.

10. Third-party and open-source software

The service uses open-source and third-party software (for example Linux, Nginx, PHP,
MariaDB and WordPress), provided under its own licences. Nothing in these terms limits
your rights under those licences. New versions may change behaviour; we apply them as
described in section 4.

11. Prices and payment

11.1 Prices are in US dollars. The final price, with any taxes that apply to you, is in
the offer email you accept (section 3.3), and your invoice matches it.

11.2 Paying in Argentine pesos. Clients in Argentina may pay in Argentine pesos. The
US-dollar price is converted at the official selling rate of Banco de la Nación Argentina
on the business day before payment. The amount in pesos can therefore differ from one
payment to the next; the US-dollar price doesn't change.

11.3 Monthly plans are invoiced monthly in advance, annual plans yearly in advance.
Invoices are due within 14 days, by the payment methods stated on the invoice.

11.4 If an invoice is overdue, we remind you. If it remains unpaid 14 days after the
reminder, we may suspend the service after giving you at least 7 days' notice (section
13). Statutory default interest applies.

11.5 We may change prices for business clients with at least 60 days' notice in text
form, effective from the start of the next billing period. If you don't agree, you may
terminate the contract effective on the date the new price would apply. For consumers, a
price change applies only if you agree to it; if you don't, either party may end the
contract with the normal notice period.

12. Term, renewal and termination

12.1 Monthly plans run for one month and renew monthly. Either party may terminate
with 30 days' notice to the end of a calendar month.

12.2 Annual plans run for 12 months. For business clients they renew for another 12
months unless terminated with 30 days' notice before the end of the term. For
consumers, after the first 12 months an annual plan continues for an indefinite period
and can be ended at any time with one month's notice; we remind you before the first term
ends.

12.3 Fees for a running annual term are not refunded, except where we terminate without
cause, you terminate for a reason we are responsible for, or you withdraw as a consumer
(section 3.4).

12.4 Either party may terminate for good cause without notice. Good cause for us includes
serious or repeated breaches of the Acceptable Use Policy and payment default of more than
two months' fees.

12.5 Termination must be in text form (an email is enough). We confirm every termination
in text form.

13. Suspension

13.1 We may suspend all or part of a service, as far as necessary, if:

• it is used in breach of the Acceptable Use Policy or the law;
• it poses a security risk to our systems, other clients or third parties, for example a
  compromised site sending spam or attacking others;
• we are required to by law or by an order of an authority or court;
• an invoice is overdue as described in section 11.4.

13.2 We choose the least disruptive step that deals with the problem, tell you beforehand
where possible and otherwise without delay, give our reasons, and lift the suspension once
the reason has gone. Where we restrict content because it is illegal or breaches our
policies, we give you a statement of reasons as required by Article 17 of the EU Digital
Services Act, and you can contest the decision by replying to it.

14. Data protection

For personal data we process on your behalf, our data processing agreement applies. It is
part of the contract, and we send it with your offer. Our Privacy Policy
explains how we handle the personal data of your contacts.

15. When the contract ends: your data

15.1 Until the contract ends you can ask for an export. After it ends, we keep your data
available for export for 30 days and provide, on request, the site files and a database
dump in standard formats. For applications: the database dump and the deployed
configuration; the code is in your repository.

15.2 After that period we delete your data from our live systems. Copies in backups are
deleted as the backups rotate. We keep data longer only where the law requires it, and
then only for that purpose.

15.3 Exports in other formats, or help moving to another provider, are quoted separately.

16. Liability

16.1 We are liable without limitation for damage caused intentionally or through gross
negligence, for injury to life, body or health, under the Product Liability Act, and where
we have given a guarantee.

16.2 For slight negligence we are liable only if we breach an obligation that is essential
for achieving the purpose of the contract and on which you may regularly rely. In that
case our liability is limited to the damage that is typical and foreseeable for this type
of contract.

16.3 For loss of data, we are liable only for the effort of restoring the data from the
most recent backup we were required to keep under the contract.

16.4 Otherwise our liability is excluded. These limits also apply to the people we work
with.

16.5 For business clients, strict liability for defects that existed when the contract was
made (§ 536a(1) German Civil Code) is excluded. For consumers, sections 16.2 to 16.5 apply
only as far as the law allows, and statutory rights for defects are unaffected.

17. Indemnity

This section applies to business clients. If a third party makes a claim against us
because content or software you are responsible for infringes its rights or the law, you
indemnify us against that claim, including reasonable legal costs, unless you are not at
fault. We tell you about such a claim without delay and let you take part in defending it.

18. Events outside our control

Neither party is liable for failures caused by events outside its reasonable control, such
as power or network failures at data-centre or network providers, large-scale attacks
despite reasonable protection, natural events, strikes or orders of authorities. The
affected party tells the other and takes reasonable steps to limit the effects.

19. Confidentiality

Both parties keep confidential any non-public information about the other's business they
receive in connection with the contract, during and after it, unless the information is
public or the law requires disclosure.

20. Intellectual property

You keep all rights in your content and software. You grant us the rights we need to host,
copy (including in backups), transmit and process it to provide the service. Our
configurations, scripts, documentation and the Brova names remain ours; you may use them
within the service. Third-party names and logos on our website belong to their owners.

21. Changes to these terms

We may change these terms for the future, for example because of legal changes or changes
to the service. We tell you at least 6 weeks in advance in text form.

• Business clients: if you object, you may terminate the contract effective on the date
  the change would apply; otherwise the change applies from that date. We point out this
  consequence in our notice.
• Consumers: a change applies only if you agree to it. If you don't, the contract
  continues on the current terms, and either party may end it with the normal notice
  period.

Changes to prices follow section 11.5.

22. Governing law and courts

22.1 German law applies, excluding the UN Convention on Contracts for the International
Sale of Goods. For consumers, this choice of law doesn't take away the protection of the
mandatory rules of the country where they live.

22.2 If you are a merchant, a legal person under public law, or have no general place of
jurisdiction in Germany, the courts at Leipzig have jurisdiction, as far as the law allows
such an agreement. We may also sue you at your place of business.

22.3 These terms are written in English. Translations are for convenience; for business
clients, the English version prevails.

23. Consumer dispute resolution

We are not obliged and not willing to take part in dispute-resolution proceedings before a
consumer arbitration board.

24. Contact

contact@brova.cloud · Incidents:
underattack@brova.cloud