Legal

KARSTATION Platform User Terms and Conditions

1. Agreement and scope

1.1 These Terms and Conditions (Terms) are entered into between KARSTATION (KARSTATION, we, us or our) and the person or organisation accepting them (Customer, User, you or your).

1.2 The Terms govern access to and use of the KARSTATION websites, web applications, mobile applications, application programming interfaces, demonstrations, training resources, communications tools, payment-enabled features and related services made available by us from time to time (together, the Platform).

1.3 If an order form, proposal, enterprise agreement, data processing agreement or other written agreement signed by both parties applies to the same Services, that document forms part of the Agreement. If there is a conflict, the signed document prevails for the subject it expressly addresses, followed by any applicable Service-specific terms, these Terms, and then operational guidance displayed within the Platform.

1.4 Our Privacy Statement and any applicable Cookie Notice explain how personal data is handled. They should be read with these Terms but do not reduce either party's obligations under applicable data protection law.

2. Definitions

Term	Meaning
Account	the registered account through which a User accesses the Platform.
Applicable Data Protection Law	every privacy, data protection, cybersecurity, breach-notification, electronic communications and direct-marketing law that applies to a party's processing, as amended or replaced from time to time.
Authorised User	an individual whom a Customer permits to use the Platform under its Account, including an owner, administrator, employee, technician, contractor or adviser.
Business Customer	a company, partnership, workshop, service provider, dealer, fleet operator, parts supplier, insurer, finance provider, educational institution or other organisation using the Platform for professional purposes.
Customer Data	information, records, documents, photographs, videos and other content submitted to, generated through or stored in the Platform by or for a Customer, excluding Usage Data and KARSTATION intellectual property.
Customer Cause	an act, omission, instruction, configuration, credential compromise, unlawful input, insecure device or network, unsupported integration, failure to update or failure to follow documented safeguards attributable to the Customer, an Authorised User or a person under the Customer's control.
External Event	an event outside KARSTATION's reasonable control, including an internet, telecommunications, hosting, cloud, utility or third-party service failure; malicious cyberattack; zero-day vulnerability; epidemic; natural disaster; labour disruption; governmental action; sanctions; war; civil disorder; or supply-chain interruption.
Confidential Information	non-public commercial, technical, operational, security or product information disclosed by or through KARSTATION, including Demonstrations, Restricted Materials, credentials, documentation, roadmaps, pricing logic and the existence or content of non-public discussions.
Demonstration	a live or recorded demonstration, webinar, presentation, trial environment or evaluation session relating to the Platform.
Fees	subscription charges, transaction charges and other amounts displayed at purchase or stated in an applicable order.
Payment Provider	a bank, card network, payment gateway or regulated third party that processes or facilitates a payment.
Restricted Materials	KARSTATION Confidential Information and proprietary processes, data structures, taxonomies, schemas, workflows, screen flows, business rules, prompts, models, outputs, benchmarking results, technical documentation, demonstrations and non-public datasets, whether observed, accessed, copied, inferred, reconstructed or derived.
Security Incident	a confirmed accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data processed under the Agreement.
Services	the functions, content, support and services provided through the Platform under the applicable plan or order.

3. Eligibility and authority

3.1 You must be at least eighteen years old, have legal capacity to enter into a binding agreement, and be permitted by applicable law to use the Services.

3.2 If you act for a Business Customer, you warrant that you have authority to accept the Agreement for that organisation. The Business Customer is responsible for its Authorised Users and for acts and omissions carried out through its Account.

3.3 You must provide accurate, current and complete registration, billing and business information and promptly update it when it changes. We may request reasonable evidence to verify identity, authority, business status or eligibility.

4. Accounts and security

4.1 Account credentials are personal to the relevant Authorised User and must not be shared. Each Authorised User must use an individual login unless we expressly provide another access method.

4.2 You must maintain appropriate device security, access controls, internet connectivity, malware protection and internal procedures. You are responsible for configuring user roles and promptly removing access when an individual no longer requires it.

4.3 You must notify us without undue delay through the contact or support facility made available on the Platform if you suspect unauthorised access, credential compromise, misuse or a security incident involving the Platform. We may suspend access, require credential changes or take other proportionate measures to protect the Platform, Customers or third parties.

4.4 Activity performed using valid credentials will be treated as authorised by the Customer unless the Customer had notified us of suspected compromise before the relevant activity and the activity was caused by circumstances within our reasonable control.

5. Services and service changes

5.1 The features available depend on the selected plan, country, device, integration and applicable order. Certain features may be labelled beta, pilot, preview or experimental and may be subject to additional limitations.

5.2 We may improve, replace or discontinue features. We will give reasonable notice before a material reduction to a paid core feature during a current subscription term, unless an urgent change is required for security, legal compliance, third-party dependency failure or prevention of harm.

5.3 We may conduct planned or emergency maintenance. Although we aim to maintain reliable access, uninterrupted or error-free availability is not guaranteed.

5.4 Support, response times, storage, usage limits and service levels are those stated in the relevant plan or order. A failure to meet a separately agreed service level gives rise only to the remedy stated in that agreement, subject to mandatory law.

6. Demonstrations, trials and training

6.1 Demonstrations and trial environments are provided for evaluation and training. They may use sample information, may not include all production functions and may be changed or withdrawn without notice.

6.2 Unless we expressly approve otherwise, you must not enter live customer information, payment credentials, confidential information or sensitive personal data into a demonstration environment.

6.3 Demonstration recordings, materials and access links are confidential and licensed only to the registered recipient and personnel within the same evaluating organisation who have a genuine need to assess the Platform. They must not be shared with competitors, software developers engaged to reproduce the Platform, or the public without our written permission.

6.4 Participation in a Demonstration does not constitute certification, technical training or assurance that the participant has fully understood every feature. The User remains responsible for obtaining clarification and independently determining whether the Services are suitable.

7. Subscriptions, fees and taxes

7.1 Fees, billing frequency, plan limits, currency and applicable country pricing will be shown before purchase or stated in an order. Prices may differ by country, customer type, feature or transaction channel.

7.2 A recurring subscription renews for successive periods of the same duration only where the checkout page or order expressly states that it renews automatically. You may prevent renewal through the Account settings or by giving notice before the renewal date. Cancellation takes effect at the end of the paid billing period unless mandatory law requires otherwise.

7.3 We may change Fees for a future renewal period by giving reasonable prior notice. A price change will not retrospectively alter Fees already paid for a current fixed subscription period.

7.4 Fees are exclusive of taxes unless stated otherwise. You are responsible for applicable taxes, levies, duties, bank charges, foreign-exchange costs and telecommunications or data charges, except taxes imposed on our net income.

7.5 Unless the order, refund policy or mandatory law provides otherwise, paid subscription Fees are non-refundable once the relevant period begins. This does not limit remedies available for a material failure by us to provide paid Services or any non-excludable consumer right.

7.6 If an amount remains overdue, we may give notice and suspend affected paid features. Suspension does not waive the obligation to pay amounts properly due.

8. Payments through the Platform

8.1 Where enabled, the Platform may allow one User to request or receive a payment (Payee) and another User to make it (Payer). KARSTATION provides technical facilitation and is not a bank, card issuer, moneylender, insurer, escrow agent or payment institution unless expressly stated and lawfully authorised.

8.2 Payment processing is performed by the applicable Payment Provider and remains subject to its terms, authentication requirements, limits, availability and decisions. We do not control a bank's or Payment Provider's approval, decline, reversal, delay or additional charge.

8.3 Any KARSTATION transaction fee will be disclosed before confirmation. The party identified at checkout is responsible for it. A fee for a successfully processed transaction is non-refundable except where required by law or caused by an error attributable to us.

8.4 The Payer must confirm the Payee, invoice, amount and currency before authorising payment. The Payee is responsible for the accuracy and legality of its invoice and underlying goods or services. Except where the Platform or law expressly provides otherwise, disputes about workmanship, goods, refunds or invoice content must be resolved between the Payer and Payee.

8.5 We may delay, reject or refer a transaction for review where reasonably required for security, fraud prevention, sanctions screening, legal compliance or Payment Provider requirements. We may cooperate with lawful requests from competent authorities.

9. Customer responsibilities and vehicle records

9.1 The Platform supports automotive and business workflows but does not itself perform vehicle inspection, diagnosis, repair, valuation, insurance, finance, legal or professional services. The relevant workshop, technician, supplier or professional remains responsible for its work, advice, approvals, pricing, legal compliance and customer relationship.

9.2 Estimates, labour times, parts references, maintenance intervals, diagnostic suggestions and artificial-intelligence-assisted outputs are informational aids. They must be checked by a suitably qualified person against the actual vehicle, manufacturer information, market conditions and applicable law before reliance or customer approval.

9.3 A Business Customer must ensure that Vehicle Records and other Customer Data are accurate, proportionate, lawfully collected and entered by authorised persons.

9.4 A Vehicle Record may relate to successive owners or service providers. Access, transfer or disclosure must be based on appropriate authority and must respect privacy, confidentiality, consumer, evidentiary and other applicable requirements.

9.5 The Platform must not be used as the sole repository for any record that the Customer is legally required to retain independently unless a written agreement expressly states otherwise.

10. Customer Data

10.1 As between the parties, the Customer retains ownership of Customer Data and grants us a worldwide, non-exclusive licence to host, copy, transmit, display, adapt and otherwise process it only as necessary to provide, secure, support and improve the Services, comply with law and perform the Agreement.

10.2 The Customer represents that it has all rights, notices, consents and lawful grounds necessary for Customer Data and our permitted processing of it. Customer Data must not infringe intellectual property, privacy, confidentiality or other rights.

10.3 We may generate statistical or analytical information from use of the Platform. We may use and disclose such information only in aggregated or de-identified form that does not reasonably identify an individual Customer, User or vehicle owner.

10.4 During an active subscription, the Customer may access and export Customer Data using available features, subject to plan limits, security controls and the rights of other persons. Export formats may not reproduce every Platform feature or relational structure.

10.5 Following termination, Customer Data will be handled under Clause 19 and the Privacy Statement. The Customer should complete any required export before termination. We are not obliged to retain Customer Data indefinitely.

10.6 KARSTATION may collect and use Usage Data to operate, protect, measure, troubleshoot, develop and improve the Platform; detect fraud and abuse; allocate capacity; produce service analytics; and comply with law. Where Usage Data identifies a person, it will be processed under the Privacy Statement and Applicable Data Protection Law.

10.7 KARSTATION may create and use aggregated, statistical, benchmarked or de-identified information for any lawful business purpose, including product development, research, industry insights and commercial analytics, provided it does not reasonably identify the Customer or an individual and is subject to the safeguards in Clause 11.16.

10.8 We may preserve Customer Data, logs and related evidence where reasonably necessary to investigate misuse, protect the Platform or Users, establish or defend legal claims, comply with a lawful hold or request, or meet legal obligations. Access will be limited to the relevant purpose and retention period.

11. Data protection and confidentiality

11.1 Each party must comply with Applicable Data Protection Law. This includes, where applicable, the Sri Lankan Personal Data Protection Act No. 9 of 2022, the EU General Data Protection Regulation, the UK General Data Protection Regulation and Data Protection Act 2018, the California Consumer Privacy Act as amended, and equivalent national or subnational laws. A mandatory local requirement prevails to the extent of an inconsistency.

11.2 Each party is independently responsible for identifying the laws, lawful bases, notices, consents, registrations, assessments and records applicable to its own processing. Neither party may instruct the other to process personal data unlawfully.

11.3 Where a Business Customer determines the purposes and means of processing personal data entered into the Platform, the Customer acts as controller, business or data fiduciary and KARSTATION acts as processor, service provider or data processor, as the applicable law describes those roles. For account administration, billing, security, fraud prevention, service analytics and compliance, KARSTATION may act as an independent controller to the extent stated in the Privacy Statement.

11.4 When KARSTATION acts as processor, it will process personal data only on documented instructions contained in the Agreement, the Customer's authorised configuration and support requests, unless law requires otherwise. If we reasonably believe an instruction violates Applicable Data Protection Law, we may suspend that processing and notify the Customer where lawful.

11.5 The Customer warrants that it has provided all required notices and has a valid lawful basis for collecting, uploading, linking, using and disclosing Customer Data, including vehicle-owner, employee, technician, supplier and payer data. The Customer must not upload special-category, sensitive, biometric, health, criminal-offence or children's data unless expressly supported by the Services and lawfully authorised.

11.6 Each party must apply appropriate technical and organisational measures proportionate to the nature, scope, context and risk of processing. Measures may include access controls, least privilege, authentication, encryption where appropriate, logging, secure development, vulnerability management, backups, recovery testing, staff confidentiality and incident-response procedures.

11.7 The Customer must configure permissions, train Authorised Users, keep credentials secure, collect only necessary information, maintain accuracy and implement its own retention schedule. The Platform must not be used as the sole statutory archive unless an applicable order expressly provides an archival service.

11.8 KARSTATION will ensure that personnel authorised to process personal data are subject to confidentiality obligations and receive access only as reasonably required for their functions.

11.9 KARSTATION may engage Subprocessors subject to written terms imposing materially equivalent data-protection and security obligations. Where required by law, we will provide notice of a new Subprocessor and a reasonable opportunity to object on substantiated data-protection grounds.

11.10 KARSTATION will provide reasonable assistance, taking into account the nature of processing and information available to us, with data-subject requests, security obligations, breach notifications, regulatory consultations and data-protection impact assessments. The Customer remains responsible for deciding and communicating the legally required response unless KARSTATION acts as independent controller.

11.11 KARSTATION will notify the affected Business Customer without undue delay after becoming aware of a Security Incident involving personal data processed for that Customer. The notice will include information reasonably available to us and may be provided in phases. Notification is not an admission of fault or liability. The Customer is responsible for notices to individuals and authorities unless law assigns that duty to KARSTATION.

11.12 Personal data may be processed in countries other than the place where it was collected. Each party must use a lawful transfer mechanism where required, which may include an adequacy decision, approved contractual clauses, a recognised certification or another permitted safeguard. The parties will reasonably cooperate on transfer assessments and supplementary measures required by law.

11.13 On termination or expiry, KARSTATION will delete or return personal data processed solely on behalf of the Customer after the applicable export and retention period, unless law requires retention. Residual copies in protected backups may remain until overwritten in the ordinary cycle and will remain protected and unavailable for ordinary use.

11.14 To the extent required by law, KARSTATION will make available information reasonably necessary to demonstrate compliance with its processor obligations. Audits must protect other customers, security and Confidential Information, avoid unreasonable disruption, and ordinarily rely first on current independent reports or questionnaires. On-site audits require reasonable notice and may be limited to once annually unless a regulator or material incident requires otherwise.

11.15 KARSTATION will not sell Customer personal data or share it for cross-context behavioural advertising as those terms are defined by applicable United States privacy law, except where a Customer expressly instructs a transaction that lawfully requires disclosure. KARSTATION will not retain, use or disclose processor data outside the permitted business purposes specified in the Agreement, except as allowed by law.

11.16 De-identified or aggregated information may be used to secure, analyse and improve the Services only where reasonable measures prevent re-identification, it is not used to make decisions about an identifiable person, and KARSTATION does not attempt to re-identify it except to test the effectiveness of de-identification where permitted by law.

11.17 Any artificial-intelligence-assisted function is subject to the feature notice, the Privacy Statement and Applicable Data Protection Law. Customer Data will not be used to train a generally available third-party model unless the Customer has been clearly informed and a valid legal basis and required choice have been provided. The Customer must ensure meaningful human review where an output may materially affect an individual.

11.18 The Privacy Statement describes KARSTATION's independent-controller processing, categories of data, purposes, legal bases where required, disclosures, retention approach, international transfers, individual rights and complaint channels. These Terms do not replace a notice or consent that Applicable Data Protection Law requires to be separate, clear or specific.

11.19 Security is a shared responsibility. KARSTATION is responsible for safeguards within the Platform environment under its control. The Customer is responsible for its endpoints, local networks, identity administration, permissions, credentials, exports, integrations, personnel, backup copies and the lawfulness and accuracy of Customer Data. Security features assist risk management but do not guarantee compliance or prevent every incident.

11.20 No internet-connected service can be guaranteed immune from attack, vulnerability, interruption or data loss. Subject to Clauses 16 and 17, KARSTATION is not responsible for a Security Incident to the extent caused by a Customer Cause, an External Event, an unauthorised third-party service, or the Customer's failure to implement a safeguard that KARSTATION reasonably communicated.

11.21 Each party must promptly take reasonable steps to contain and mitigate a Security Incident within its control, preserve evidence, avoid misleading public statements and cooperate with lawful investigation and notification. Neither a notice, investigation, remedial action nor cooperation constitutes an admission of liability.

11.22 Unless mandatory law assigns responsibility otherwise, each party bears the costs of investigating, remediating and notifying an incident to the extent caused by its breach of the Agreement or law. The Customer bears costs arising from Customer Causes, including restoring its devices, records, credentials or third-party systems.

12. Acceptable use

12.1 You must use the Platform lawfully, professionally and only for legitimate business or personal automotive purposes. You must not, and must not permit another person to:

• introduce malware, harmful code or content intended to disrupt, damage, monitor or gain unauthorised access to systems or data;
• probe, scan, test or circumvent security, authentication, rate limits, access controls or technical restrictions without written authorisation;
• reverse engineer, decompile, disassemble, copy or attempt to derive source code, non-public architecture or underlying models except to the limited extent that applicable law prohibits restriction;
• scrape, harvest, index, data-mine or use automated means to extract Platform content or User information, except through an authorised interface and within documented limits;
• use the Platform to build, train or improve a competing product using protected KARSTATION materials, confidential information or unauthorised extraction of Platform content;
• impersonate another person, create a misleading identity, falsify records or conceal the origin of a communication or transaction;
• upload unlawful, defamatory, threatening, discriminatory, obscene, fraudulent, infringing or unnecessarily sensitive content;
• send spam, chain messages, pyramid schemes or unsolicited bulk communications;
• interfere with another User's access, privacy, legal rights or use of the Services;
• use the Platform for illegal goods, services, payments, surveillance or other prohibited activity; or
• exceed plan limits, share access outside the licensed organisation, resell the Services or provide bureau services without our written permission.

12.2 We may investigate suspected misuse, preserve relevant evidence, restrict content or access, and cooperate with lawful requests. Measures will be proportionate to the risk and subject to applicable law.

13. Communications and User content

13.1 Communication features must be used for proper purposes connected with the Services. Users are responsible for content they submit and for obtaining rights and consents for text, images, recordings, designs and other materials.

13.2 We do not ordinarily endorse User content. We may moderate, restrict or remove content that reasonably appears to breach the Agreement, law or another person's rights, or that creates a security or operational risk.

13.3 You consent to receiving contractual, billing, operational and security notices electronically at the registered email address or through the Platform. Marketing communications are governed by the Privacy Statement and applicable law and may be opted out of without affecting essential service notices.

14. Third party services and integrations

14.1 The Platform may interoperate with Payment Providers, maps, communications tools, technical-data providers, insurers, suppliers and other third-party services. A third party's service is governed by its own terms and privacy practices.

14.2 If you enable an integration, you authorise us to exchange the information reasonably necessary to operate it. You are responsible for confirming that the integration and data exchange are appropriate for your use.

14.3 We are not responsible for an independent third party's content, products, professional work, availability, security or decisions. We may suspend an integration if the provider changes or withdraws it, or if continued operation creates legal, security or technical risk.

15. Intellectual property

15.1 KARSTATION and its licensors own all rights in the Platform, including software, source and object code, workflows, architecture, interfaces, designs, databases, documentation, trademarks, training materials and improvements, excluding Customer Data and third-party materials.

15.2 Subject to payment of applicable Fees and compliance with the Agreement, we grant the Customer a limited, non-exclusive, non-transferable, non-sublicensable and revocable right during the subscription or authorised evaluation period to access and use the Services for its internal operations.

15.3 No ownership is transferred. Except as expressly permitted, you may not reproduce, publish, distribute, sell, licence, modify, create derivative works from, publicly display or commercially exploit protected Platform materials.

15.4 You may independently develop or use competing products, provided you do not misuse our intellectual property, confidential information, credentials, protected materials or Customer access. Nothing in these Terms prevents lawful competition or the use of general skills and knowledge retained without deliberate memorisation of confidential material.

15.5 If you provide feedback or suggestions, you grant us a perpetual, worldwide and royalty-free licence to use them without identifying you or disclosing your confidential information.

15.6 A Business Customer grants us permission to display its name and logo within the Platform to identify its account, branch or marketplace listing. External advertising or public promotional use requires separate permission unless already authorised in writing.

15.7 Restricted purpose. Access to the Platform, a Demonstration or Restricted Materials is granted only to evaluate, procure, configure or use authorised KARSTATION Services. You must not access them for competitive intelligence, product replication, model training, benchmarking for publication, or development or commercialisation of a competing offering.

15.8 Prohibited competitive exploitation. You must not directly or indirectly use, adapt, translate, analyse, map, compare, reconstruct, derive from or combine any Restricted Materials to design, develop, train, validate, test, improve, source, procure, operate, maintain, licence, sell, resell, trade, distribute, finance, advise on, support, advertise or promote a product or service that competes with any material function of the Platform.

15.9 No third-party enablement. You must not disclose, transmit, demonstrate, describe or make Restricted Materials available to any third party for software development, data-product development, resale, competitive analysis, investment diligence concerning a competing offering, or any other purpose reasonably likely to harm KARSTATION or enable competitive exploitation.

15.10 Competitor access. A person accessing the Platform for, employed by, advising, financing or otherwise acting on behalf of a current or prospective competitor must disclose that relationship before receiving non-public access and must obtain KARSTATION's written permission. No person may create an Account, attend a Demonstration or use another party as an intermediary to conceal competitive purpose or identity.

15.11 Organisational responsibility. A Business Customer must restrict Restricted Materials to Authorised Users with a genuine need to know, inform them of these restrictions and remain responsible for their compliance. It must not appoint a developer, consultant, contractor or vendor to access Restricted Materials where the engagement includes creation or support of a competing offering unless KARSTATION gives prior written consent.

15.12 No extraction or circumvention. Prohibited conduct includes screenshots or recordings made for replication, systematic observation, scraping, data mining, prompt extraction, traffic interception, schema inference, synthetic reconstruction, clean-room arrangements designed to evade these Terms, and combining small disclosures to reproduce a protected process or dataset.

15.13 Confidentiality standard. You must protect Confidential Information using at least reasonable care and no less care than you use for comparable information of your own. Disclosure is limited to personnel and professional advisers who need it for the authorised purpose and are bound by enforceable confidentiality duties at least as protective as these Terms.

15.14 Exclusions and compelled disclosure. Restrictions do not apply to information the recipient proves was lawfully public without breach, already lawfully known without restriction, independently developed without use of Restricted Materials, or lawfully received from an authorised third party. A legally compelled disclosure must be limited to what is required, with advance notice to KARSTATION where lawful and reasonably practicable.

15.15 Lawful competition and mandatory rights. These Terms do not prohibit a person from accepting employment, carrying on a lawful profession, using general skills and experience, reporting wrongdoing, making a protected regulatory disclosure, exercising a non-available right, or independently developing a competing product without use or disclosure of Restricted Materials. Any restraint will apply only to the maximum lawful scope necessary to protect KARSTATION's legitimate interests.

15.16 Survival and remedies. Clauses 15.7 to 15.15 survive termination for five years, except obligations concerning trade secrets survive for so long as the information remains a trade secret under applicable law. Unauthorised use or disclosure may cause harm not adequately remedied by damages; KARSTATION may seek injunctive or equitable relief, preservation of evidence, termination, damages and any other lawful remedy without limiting mandatory procedural protections.

15.17 Reservation of rights. The Platform, its content and all copies, adaptations, updates, configurations and derivative materials are protected by intellectual-property and unfair-competition laws. Copyright © KARSTATION. All rights reserved. KARSTATION and its licensors reserve every right not expressly granted under the Agreement.

16. Warranties and disclaimers

16.1 Each party warrants that it has authority to enter into the Agreement. We warrant that we will provide paid Services with reasonable skill and care and substantially in accordance with applicable published documentation.

16.2 If we breach the warranty in Clause 16.1, you must notify us with sufficient detail within a reasonable period. We will use reasonable efforts to correct or reperform the affected Service. If we cannot remedy a material breach, you may terminate the affected paid Service and receive a pro-rated refund for the unused prepaid period.

16.3 Except for the express warranty above and any right that cannot lawfully be excluded, the Platform, Demonstrations, beta features, content and third-party integrations are provided as available. We do not warrant that they will be uninterrupted, entirely secure, error-free, compatible with every system, or suitable for every vehicle, jurisdiction or business purpose.

16.4 You are responsible for evaluating the suitability and accuracy of outputs and for maintaining appropriate professional judgment, approvals, backups, insurance and business-continuity arrangements.

16.5 KARSTATION does not warrant that Customer Data will never be lost, altered or accessed without authority, that every vulnerability will be detected before exploitation, or that recovery will restore every record or relationship. The Customer must maintain independent, tested backups of business-critical and legally required records.

16.6 To the fullest extent permitted by law, the correction, performance or pro-rated refund described in Clause 16.2 is the Customer's exclusive contractual remedy for a breach of the express service warranty. Beta, trial, free and Demonstration Services are provided without service warranty.

17. Limitation of liability and allocation of risk

17.1 Non-excludable liability. Nothing in the Agreement excludes or limits liability for fraud or fraudulent misrepresentation, wilful misconduct, death or personal injury caused by negligence, or any liability or remedy that applicable law does not permit to be excluded or limited. Any liability for intellectual-property infringement, confidentiality or data protection is excluded or limited only to the maximum extent lawfully permitted.

17.2 Excluded loss. Subject to Clause 17.1, KARSTATION is not liable for indirect, incidental, special, punitive, exemplary or consequential loss; loss of profit, revenue, business, contracts, opportunity, anticipated savings, goodwill or reputation; business interruption; cost of substitute services; loss, corruption, reconstruction or restoration of data; or regulatory fines, compensation or third-party liabilities imposed on the Customer because of the Customer's conduct, whether the claim is in contract, tort (including negligence), statute, misrepresentation, restitution or otherwise.

17.3 Ordinary aggregate cap. Subject to Clause 17.1, KARSTATION's total aggregate liability arising out of or relating to the Agreement, all Services and all connected events in any rolling twelve-month period will not exceed the Fees paid or payable for the affected Services during the twelve months immediately preceding the first event giving rise to the claim.

17.4 Security and data protection cap. Where liability for a breach of confidentiality, security or data protection may lawfully be capped, KARSTATION's total aggregate liability for all such claims in any rolling twelve-month period will not exceed two times the amount calculated under Clause 17.3. This is an aggregate cap, not an additional amount. For free, trial or Demonstration Services, KARSTATION's aggregate liability under Clauses 17.3 and 17.4 will not exceed LKR 25,000 or the minimum amount required by mandatory law, whichever is greater.

17.5 Excluded causes. Subject to Clause 17.1, KARSTATION has no liability to the extent loss results from a Customer Cause; inaccurate, excessive or unlawful Customer Data; a User's professional work or reliance on unverified output; failure to maintain independent backups or continuity arrangements; an External Event; a third-party integration or Payment Provider; use contrary to documentation; or continued use after KARSTATION advised suspension, mitigation or an update.

17.6 Causation and mitigation. A claimant must prove that KARSTATION's breach directly caused recoverable loss and must take reasonable steps to avoid or reduce it. KARSTATION is not liable for loss that reasonable mitigation, restoration from backup, timely credential revocation or installation of an available security update would have prevented.

17.7 Single recovery. The caps apply collectively to KARSTATION, its affiliates, licensors, suppliers, Subprocessors, officers and personnel. Connected acts, omissions and claims are treated as one event. No party may recover more than once for the same loss, and service credits, refunds, insurance proceeds and third-party recoveries reduce the amount otherwise recoverable.

17.8 Claim period. To the extent permitted by law, a Business Customer must commence a claim within twelve months after it knew or reasonably should have known of the facts giving rise to it. This contractual period does not shorten a non-available limitation period or mandatory consumer right.

17.9 Basis of bargain. The exclusions, caps and remedies apply even if a remedy fails of its essential purpose or a party was advised that loss was possible. They reflect the Fees, allocation of responsibility and availability of insurance and apply to the fullest extent permitted by law.

18. Indemnity

18.1 A Business Customer will defend, indemnify and hold harmless KARSTATION, its affiliates, licensors, suppliers, officers, employees and contractors from third-party claims, investigations, demands, damages, judgments, settlements, penalties and reasonable professional costs arising from: (a) Customer Data or the Customer's failure to obtain a lawful basis, notice, consent or authority; (b) the Customer's goods, services, diagnosis, repair, advice, invoice, transaction or regulatory duties; (c) a Customer Cause or compromise of Customer-controlled systems or credentials; (d) infringement, unlawful content, fraud or misuse by the Customer or an Authorised User; or (e) material breach of Clauses 4, 9, 10, 11, 12, 13 or 15.

18.2 The indemnity is reduced to the extent a final determination establishes that the claim was directly caused by KARSTATION's breach, negligence or wilful misconduct. It does not require indemnification for liability that law prohibits a party from transferring.

18.3 KARSTATION will give reasonably prompt notice of an indemnified claim, permit the Customer to control its defence using competent counsel and provide reasonable cooperation at the Customer's cost. The Customer may not settle a claim in a manner that admits fault by, imposes obligations on, or fails unconditionally to release an indemnified party without KARSTATION's prior written consent, not to be unreasonably withheld.

19. Suspension, termination and data after termination

19.1 The Agreement begins when accepted and continues until all Accounts, subscriptions and applicable orders have ended.

19.2 You may terminate a free Account at any time and may cancel a paid subscription in accordance with Clause 7. Cancellation does not retrospectively reverse completed transactions or Fees properly due.

19.3 Either party may terminate for a material breach that is not remedied within fourteen days after written notice. A party may terminate immediately if the breach cannot be remedied, the other party becomes insolvent, or continued performance would be unlawful.

19.4 We may suspend access immediately where reasonably necessary to address a security threat, suspected fraud, illegal activity, material acceptable-use violation, risk to another User, overdue payment after notice, or a binding request from a competent authority. Where lawful and practicable, we will notify the Customer and restore access when the reason is resolved.

19.5 On termination, the licence ends and the Customer must stop using protected Platform materials. Provisions concerning payment, confidentiality, intellectual property, liability, indemnity, dispute resolution and any provision intended by its nature to survive will continue.

19.6 Unless law, security or an applicable order requires otherwise, we will allow a reasonable export period of thirty days after termination of a paid Account. We may then delete or de-identify Customer Data according to our retention practices. The Customer remains responsible for exporting required records before the period ends.

20. Changes to these Terms

20.1 General reference and current version. This document is a general reference version of the Terms and Conditions. The most current version applicable to you, including its effective date and any applicable service-specific or country-specific terms, is available within your personal Account. You are responsible for reviewing the version displayed in your Account. If this general document differs from the version displayed in your Account, the version displayed in your Account will apply to your access to and use of the Platform, subject to any signed agreement and applicable law.

20.2 Right to amend. KARSTATION reserves the right to change, add, remove, replace or update any provision, operational requirement, feature description, policy, schedule or other detail in the Agreement at any time for legal, regulatory, security, technical, operational or commercial reasons. Each revised version will identify its effective date and will be made available through the Platform, subject to mandatory law.

20.3 Login notification. When changes take place, KARSTATION will present a notice at or following the User's next login, or through another prominent notice within the Account. Where appropriate, the notice may include a summary of the changes and a link to the revised Terms. The Platform may record display, acknowledgement and acceptance of the notice as part of the Account audit record.

20.4 Material changes. Where applicable law requires advance, express or separate notice or consent, KARSTATION will provide it in the required manner. We will provide reasonable advance notice of a material change that adversely affects a current paid subscription unless an urgent change is required by law, a competent authority, security risk or prevention of harm.

20.5 Effect of continued use. To the extent permitted by law, continued access or use on or after the stated effective date constitutes acceptance of the revised Terms. If you do not accept a material adverse change, you must stop using the affected Services and may cancel before the change takes effect.

21. Governing law and dispute resolution

21.1 The Agreement is governed by the laws of the Democratic Socialist Republic of Sri Lanka, without regard to conflict-of-law rules.

21.2 Before commencing formal proceedings, a party must give written notice describing the dispute and allow the parties at least thirty days to attempt resolution through good-faith discussions. This does not prevent either party from seeking urgent interim relief or using a statutory complaint process.

21.3 Subject to any mandatory consumer jurisdiction or exclusive statutory forum, the courts of Sri Lanka will have exclusive jurisdiction over disputes arising from the Agreement.

22. General provisions

22.1 Independent parties. The Agreement does not create a partnership, employment, agency, fiduciary or franchise relationship. Neither party may bind the other unless expressly authorised in writing.

22.2 Assignment. You may not assign the Agreement without our prior written consent, not to be unreasonably withheld in connection with a genuine transfer of your business. We may assign it to an affiliate or as part of a merger, reorganisation or sale of the relevant business, provided this does not materially reduce your rights.

22.3 Force majeure. Neither party is liable for delay, interruption, degradation, data unavailability or failure caused by an External Event, excluding accrued payment obligations. External Events include malicious cyberattacks and zero-day vulnerabilities that could not reasonably have been prevented by safeguards required under the Agreement. The affected party must take reasonable steps to reduce the impact and resume performance, but is not required to incur disproportionate cost.

22.4 Severability. If a provision is held invalid or unenforceable, it will be limited or removed only to the minimum extent necessary, and the remaining provisions will continue.

22.5 Waiver. A failure or delay in exercising a right is not a waiver. A waiver is effective only if made in writing by the party granting it.

22.6 Entire agreement. The Agreement constitutes the entire agreement concerning its subject and replaces earlier representations or understandings, but does not exclude liability for fraud or fraudulent misrepresentation.

22.7 Third-party rights. A person who is not a party has no right to enforce the Agreement, except an affiliate or indemnified person to the extent expressly stated.

22.8 Interpretation. Headings assist navigation and do not affect interpretation. Words including 'including' are illustrative and not limiting. A reference to law includes amendments and replacements.

23. Notices

23.1 We may send notices to the registered email address, the Account administrator or through a prominent Platform notice. You must keep contact details current.

23.2 Legal notices to KARSTATION must be submitted through the legal-notice or contact facility made available on the Platform. A notice is treated as received when the Platform records successful submission, subject to proof of transmission.

23.3 Privacy requests should be made using the contact details in the KARSTATION Privacy Statement. Support requests should be submitted through the Platform or the published support channel.

Schedule 1 — Data processing details

This Schedule applies where KARSTATION processes personal data on behalf of a Business Customer. It supplements Clause 11 and is intended to supply the processing particulars commonly required by controller-processor laws. A signed data processing agreement or order may replace or supplement it.

Processing item	Description
Subject matter	Provision, hosting, support, security and authorised operation of the KARSTATION Platform and its automotive and business workflows.
Duration	For the Agreement term and the limited export, backup, legal-retention and deletion periods described in the Agreement.
Nature of processing	Collection, recording, organisation, structuring, hosting, storage, retrieval, consultation, transmission, support access, security monitoring, correction, export, restriction, deletion and other operations initiated by authorised Platform use.
Purposes	Providing configured Services; processing authorised vehicle, workshop, parts, invoice, customer and transaction workflows; support; security; continuity; and compliance with documented Customer instructions and law.
Data subjects	Authorised Users, account administrators, employees, technicians, contractors, vehicle owners or custodians, customers, suppliers, payers, payees and business contacts whose data is lawfully entered into the Platform.
Personal data	Identity and contact details; account and authentication data; role and employment information; vehicle identifiers and records; service, repair, inspection and transaction records; communications; invoices and limited payment references; device, log, audit and security data.
Sensitive data	Not intended unless a supported feature and applicable order expressly permit it. Customers must not upload payment-card authentication data, government identity documents, health, biometric, criminal-offence or children's data merely because a free-text field permits entry.
Customer obligations	Lawful basis, transparency, data minimisation, accuracy, permissions, response to rights requests, retention instructions, local-sector requirements and legality of each instruction.
Deletion or return	Export through available functionality followed by deletion or de-identification under Clause 11.13 and Clause 19, subject to legal retention and protected backup cycles.

Schedule 2 — Global data protection framework

The following framework identifies major privacy regimes that may apply depending on where individuals are located, where processing occurs and which Customer uses the Services. It does not state that every law applies to every transaction. Applicable Data Protection Law and mandatory local rights always control.

Region	Contractual application
Sri Lanka	Personal Data Protection Act No. 9 of 2022 and operative amendments, regulations and directives. Controller and processor responsibilities, lawful processing, transparency, rights, security, impact assessment, breach and cross-border requirements apply as brought into force.
European Economic Area	EU GDPR and Member State law. GDPR principles, lawful bases, transparency, data-subject rights, Article 28 processor terms, data protection by design and default, security, breach notification, impact assessments and Chapter V transfer safeguards apply where within scope.
United Kingdom	UK GDPR, Data Protection Act 2018 and applicable electronic-marketing law. Restricted transfers require an adequacy route, approved contractual mechanism or another lawful safeguard and any required transfer-risk assessment.
United States	Applicable federal and state privacy, consumer, security and breach laws, including the California Consumer Privacy Act as amended where within scope. Required notices, consumer requests, opt-outs, sensitive-data rules, service-provider or contractor restrictions and universal opt-out mechanisms must be honoured where applicable.
Brazil	Lei Geral de Proteção de Dados Pessoais. Applicable principles, legal bases, data-subject rights, security, incident, processor and international-transfer obligations apply where within scope.
Canada	PIPEDA and applicable provincial private-sector laws. Accountability, identified purposes, valid consent where required, limiting collection, use, disclosure and retention, safeguards, access and breach obligations apply.
Australia and New Zealand	The Australian Privacy Act and Australian Privacy Principles, and the New Zealand Privacy Act, including collection notices, use and disclosure limits, security, access and correction, cross-border accountability and notifiable-breach duties where applicable.
India	Digital Personal Data Protection Act 2023 and rules as brought into force. Applicable notice, consent or legitimate-use, data-principal rights, security, breach, processor-contract, retention and children's-data requirements apply.
People's Republic of China	Personal Information Protection Law, Data Security Law, Cybersecurity Law and implementing measures where within scope. Separate or specific consent, localisation, security assessment, standard-contract or certification requirements may apply to sensitive information and outbound transfers.
Singapore, Malaysia and wider Asia	Applicable national laws including Singapore's Personal Data Protection Act, Malaysia's Personal Data Protection Act, Japan's APPI and South Korea's PIPA. Consent or another lawful basis, notification, access and correction, security, retention, breach and transfer obligations apply as required locally.
Africa and Middle East	Applicable laws including South Africa's POPIA and national privacy laws in relevant Gulf and African jurisdictions. Lawful processing, transparency, security, rights, processor and transfer requirements apply according to local scope and sector rules.

Schedule 3 — Protected process and data controls

For clarity, the restrictions in Clause 15 apply whether Restricted Materials are obtained through authorised access, an evaluation, observation of another User, screenshots, recordings, exports, support communications, application programming interfaces, network traffic, metadata, derived analysis or an unauthorised method.

• KARSTATION workflow sequences, decision rules, vehicle-record structures, repair and service process logic, taxonomies, identifiers and data relationships;
• non-public database structures, field mappings, application programming interfaces, integration patterns, architecture, security controls and performance characteristics;
• demonstration scripts, training materials, interface behaviour, product roadmaps, pricing logic, conversion methods and operational playbooks;
• proprietary datasets, curated information, validation methods, model inputs and outputs, prompts, evaluations, benchmarks and derived insights; and
• any selection, arrangement, combination, transformation or inference that reveals a protected process even if individual elements are publicly known.

The Customer must promptly notify KARSTATION through the Platform if it becomes aware of suspected acquisition, disclosure or competitive use of Restricted Materials, preserve relevant records, prevent further access and reasonably cooperate with investigation and lawful enforcement.

Schedule 4 — Shared security and continuity responsibilities

This Schedule records the operational allocation supporting Clauses 4, 11, 16 and 17. A signed enterprise security schedule may supplement or replace it for the Services it expressly covers.

Responsibility	Minimum allocation
KARSTATION	Apply proportionate safeguards to the Platform environment under its control; manage Platform access by its personnel; maintain security monitoring, vulnerability and incident-response processes; protect processor data; and notify affected Business Customers as required by Clause 11.
Customer	Secure devices, networks, browsers, email and identity systems; configure roles and permissions; use strong authentication; revoke access promptly; train Users; verify exports and integrations; maintain lawful and accurate data; and keep tested independent backups and continuity plans.
Shared	Exchange necessary incident information; preserve evidence; mitigate harm; coordinate legally required notices; review material changes; and avoid actions that compromise investigation, security or the rights of affected persons.
Third parties	Payment Providers, telecommunications, hosting, cloud and enabled integration providers remain responsible for their independent services under their own terms and applicable law. Each party remains responsible for selecting and authorising third parties within its control.