Master Service Agreement

(Master Service Agreement — hereinafter the „MSA“)

The contracting parties

Provider: Jan Malatinský, company ID [to be filled in], with a registered seat at [to be filled in], doing business under the DataNostro brand (hereinafter „DataNostro“ or the „Provider“)

Client: [Name], Company ID [Company ID], Tax ID (VAT) [VAT ID], with a registered seat at [adresa], represented by [name and position] (hereinafter the „Client“)

Article 1 — Subject of the agreement

1. DataNostro undertakes to provide the Client with managed hosting of server-side Google Tag Manager (sGTM) services on EU infrastructure, including operation, monitoring, backups, and support (hereinafter the „Service“).
2. The Client undertakes to pay for the Service at the prices of the agreed plan set out in Annex A.
3. The detailed scope of the Service, the plan tariffs, and the definitions of technical parameters are in DataNostro's current Terms of Service (datanostro.com/cs/terms/), which are an integral part of this MSA, with the MSA text prevailing in the event of a conflict.

Article 2 — SLA and compensation

1. DataNostro garantuje měsíční dostupnost Služby ("Uptime") nejméně:

2. If the guaranteed availability isn't met in a calendar month, the Client is entitled to a discount on the monthly flat fee as follows:

3. The discount is applied as a credit note on the next invoice. The Client must request it in writing within 30 days of the end of the calendar month concerned.
4. Scheduled maintenance announced at least 7 days in advance isn't counted in the availability calculation, but no more than 4 hours per month.
5. Also not counted are outages caused by:
   • force majeure (a DDoS attack exceeding reasonable protection, a power outage at the data center provider, war, an embargo),
   • an error on the Client's side (an incorrectly configured GTM Web container, incorrectly set DNS),
   • an outage of third-party services beyond DataNostro's control (the Google Tag Manager API, ad platforms).

Article 3 — Data location and sub-processors

1. DataNostro guarantees that all of the Client's data (including the personal data of end users) will be processed exclusively on infrastructure in the European Economic Area (EEA).
2. The current list of sub-processors is maintained in the DPA (datanostro.com/cs/dpa/) and we'll deliver an updated copy to the Client at least 30 days before a new sub-processor begins its activity.
3. The Client has the right to raise a justified written objection to a new sub-processor within 30 days of the notice; if no agreement is reached, the Client has the right to terminate the MSA free of charge with immediate effect and will receive a free data export per Art. 6.
4. DataNostro will not transfer any of the Client's personal data outside the EEA without the Client's express prior written consent and without putting in place valid safeguards under Art. 46 GDPR (typically the Standard Contractual Clauses 2021).

Article 4 — Audit rights

1. DataNostro provides the Client with the following documents without the need for an audit (subscription audit substitution):
   • The Trust Center's complete compliance status (datanostro.com/cs/trust/)
   • The current Security Whitepaper (datanostro.com/cs/security-whitepaper/)
   • A redacted pen-test report — an external pen-test is planned for Q4 2026; once complete we'll make it available under NDA
   • ISO 27001 / SOC 2 reports once obtained (planned for Q4 2026 / 2027)
2. If the above isn't sufficient for the Client, it has the right to conduct an on-site audit of DataNostro once every 12 months upon prior written request with 60 days' notice, at its own cost, bound by an NDA, and to the extent necessary to verify performance of this MSA. The audit must not disrupt the normal operation of the Service for other customers.

Article 5 — Price and billing

1. The price for the Service is set out in Annex A.
2. Billing is monthly (or annually for an annual plan) with a 14-day due period.
3. The price is valid for 12 months from the signing of this MSA; thereafter it may be adjusted with 90 days' notice.

Article 6 — Term and termination

1. The MSA is concluded for a term of [12 / 24] months with automatic renewal for the same period unless either Party gives the other notice of termination at least 60 days before the agreed term expires.
2. The Client may terminate the MSA without giving a reason with a 30-day notice period in the event that DataNostro:
   • repeatedly fails to meet the guaranteed availability (3 months in a row),
   • introduces a material change to the Service reducing its functionality without 90 days' prior notice,
   • changes a sub-processor despite the Client's justified objection (Art. 3(3)).
3. After the MSA ends, the Client has 30 days to export its data via /dashboard/export/. After this period, DataNostro irreversibly deletes the data from all active systems (except for the statutory retention period for accounting documents).

Article 7 — Limitation of liability

1. DataNostro's maximum aggregate liability for damages caused to the Client in connection with this MSA will not exceed the amount corresponding to the 12 monthly flat fees preceding the occurrence of the damage.
2. This limit does not apply in the case of intentional breach of obligations, gross negligence, or breach of obligations relating to personal data protection (GDPR).

Article 8 — Final provisions

1. This MSA is governed by the law of the Czech Republic.
2. Disputes will be resolved by the materially and locally competent court based on DataNostro's registered seat.
3. Changes and amendments to this MSA require written form signed by both Parties.
4. If any provision of this MSA proves invalid, the others remain in force and the Parties undertake to replace the invalid provision with one that comes closest to it in content.
5. The following are an integral part of this MSA:
   • Annex A — Service specification and price
   • Annex B — DPA (datanostro.com/cs/dpa/)
   • Annex C — The current list of sub-processors

In [place], on [datum]