Terms of Service

Subscription Terms of Service

Last updated: 3 July 2026

These Terms of Service (the "Terms") govern the subscription and use of the OCIRIA Seguridad service (the "Service"), delivered through seguridad.ociria.com. The Service is intended exclusively for companies and professionals contracting in the course of their business or professional activity (B2B contracting); it is not intended for consumers. By completing the sign-up process, the Customer declares that it is acting as a business or professional and fully accepts these Terms.

1. Provider identification

The Service is provided by:

• Corporate name: Ibida Black Level S.L. (trading commercially as "OCIRIA")
• Tax ID (NIF): B93643807
• Registered office: Calle Escritora Gertrudis Gómez de Avellaneda, 28 · 29196 Málaga, Spain
• Commercial Registry: Registered at the Málaga Commercial Registry, Volume 5776, Sheet 84, Page MA-147578
• Sales and support email: [email protected]
• Legal and privacy email: [email protected]

2. Purpose and scope

These Terms constitute the agreement between Ibida Black Level S.L. and the Customer for the provision of the Service on a subscription basis. They apply to all plans described in section 3 and prevail over any of the Customer's general terms, unless expressly agreed otherwise in writing. Together with the Privacy Policy and the Legal Notice, they form the complete contractual framework of the relationship.

3. Description of the services and plans

OCIRIA Seguridad is a cybersecurity monitoring and assisted-remediation service powered by artificial intelligence with human oversight. It is offered in four plans:

• Free: initial analysis of the public exposure of the domain(s) the Customer registers, with indicative results and limited functionality. Does not include continuous monitoring or remediation.
• Monitoring — €99/month (+ VAT): exposure detection and continuous monitoring of the Customer's assets, with alerts and recommendations. Does not make changes to the Customer's systems.
• Monitoring + Fix — €249/month (+ VAT): all of the above plus remediation with the Customer's approval (human-in-the-loop model): OCIRIA proposes corrective actions and executes them only after the Customer's express authorisation for each action.
• Complete — €490/month (+ VAT): extended monitoring and assisted-remediation coverage, with broader asset scope and support priority.

All paid plans may be contracted on an annual basis with a 30% discount on the equivalent monthly price.

3.1. Nature and limits of "fix with approval"

In plans that include remediation, no corrective action is executed automatically without the Customer's prior, express approval. Remediation actions are designed to be reversible and include an immediate deactivation mechanism (kill-switch) that the Customer may trigger at any time. Where remediation requires connectivity to the Customer's infrastructure, it is performed via an optional outbound connection agent that only establishes connections from the Customer's systems to OCIRIA; under no circumstances does OCIRIA obtain inbound access or unsolicited remote control over the Customer's machine.

Remediation is a best-effort service based on available information and the authorisations granted by the Customer; it does not constitute a guarantee of invulnerability nor replace the Customer's own security and compliance obligations.

4. Contracting process (self-service)

Contracting is carried out autonomously through the website via the following steps:

1. Registration of an account with a valid email address.

2. Domain registration and verification: the Customer adds the domains or assets for which the Service is desired and demonstrates ownership or authorisation following the indicated procedure (e.g., verification via a DNS record).

3. Plan selection and billing cycle (monthly or annual).

4. Payment through Stripe checkout, our payment provider. The contract is formed when Stripe confirms payment of the first period and OCIRIA activates the subscription, at which point a confirmation is sent to the Customer.

5. Pricing, taxes and reverse charge

All prices are stated excluding VAT; Spanish VAT at the applicable statutory rate will be added where relevant. For business customers established in other EU Member States who provide a valid VIES VAT number, the transaction may be invoiced under the reverse-charge mechanism, without charging Spanish VAT, the Customer being responsible for self-assessing the tax in its own country. The Customer is responsible for the accuracy of the tax data it provides. Any taxes, duties or withholdings other than VAT that may apply are borne by the Customer.

6. Automatic billing

For each subscription period an invoice is issued automatically in the name of the tax data provided by the Customer, available in the customer portal and/or sent by email. Payment is charged recurrently to the registered payment method at the start of each period (monthly or annual), through automatic renewal in accordance with section 7.

7. Term, automatic renewal and cancellation

The subscription lasts for the contracted cycle (monthly or annual) and renews automatically for equal periods, unless cancelled. There is no minimum commitment.

The Customer may cancel at any time from the customer portal. Cancellation takes effect at the end of the current, already-paid period: the Service remains active until that date and does not renew thereafter. Unless applicable law provides otherwise, the current period already started is not refunded. Likewise, OCIRIA may decline to renew or terminate the contract for the Customer's breach, notifying by electronic means.

8. Plan changes and proration

The Customer may change plan (up or down) from the customer portal. Upgrades apply immediately and the amount corresponding to the current period is prorated through Stripe. Downgrades generally take effect at the start of the next billing period, with the conditions and scope of the current plan maintained until then.

9. Customer obligations

The Customer undertakes to:

• Provide truthful, complete and up-to-date data during registration, domain verification and billing.
• Register only domains and assets it owns or for which it holds the owner's express, valid authorisation for analysis and, where applicable, remediation.
• Safeguard its access credentials and promptly report any unauthorised use of its account.
• Use the Service lawfully, legitimately and in accordance with these Terms, refraining from using it against third-party systems without authorisation or for any unlawful purpose.
• Maintain its own security, backup and compliance obligations; the Service complements but does not replace the Customer's diligence.

10. Express authorisation for scanning and remediation

By registering a domain or asset and contracting the Service, the Customer expressly authorises OCIRIA to carry out on those assets the technical activities inherent to the contracted plan: exposure analysis and monitoring and, in plans that include it, remediation actions previously approved by the Customer. The Customer represents and warrants that it owns those assets or holds sufficient authorisation from the owner, and shall hold harmless Ibida Black Level S.L., its directors and employees against any claim, damage, loss or penalty arising from the absence of such authorisation or from unlawful use of the Service. OCIRIA may suspend the Service upon reasonable indications of unauthorised use.

11. Limitation of liability

The Service is provided with the professional diligence required, but does not guarantee the total absence of incidents, breaches or vulnerabilities, nor the uninterrupted availability of the Customer's systems. To the maximum extent permitted by law and given the B2B nature of the relationship, OCIRIA's total liability for any damages arising from the contract shall be limited to the amount actually paid by the Customer in the twelve (12) months preceding the event giving rise to the claim. OCIRIA shall not be liable for indirect damages, loss of profit, loss of data, business or opportunity. No limitation in this clause excludes liability that the law does not permit to be limited (wilful misconduct or gross negligence).

12. Availability and support

OCIRIA will make reasonable efforts to keep the Service continuously available, without prejudice to interruptions due to maintenance, force majeure or third-party dependencies. Support is provided electronically through [email protected], with attention priority according to the contracted plan. Response times are indicative unless a specific service-level agreement (SLA) is agreed in writing.

13. Data protection

In providing the Service, OCIRIA processes personal data as controller with respect to the Customer's contact and billing data, and as processor with respect to any personal data it may process on the Customer's behalf within the monitoring and remediation activities, acting under the Customer's instructions and pursuant to Art. 28 GDPR. Data is hosted on infrastructure located in the European Union. Details of purposes, legal bases, retention periods and rights are set out in the Privacy Policy. Where applicable, the parties shall enter into the corresponding data processing agreement.

14. Changes to the Terms

OCIRIA may amend these Terms for legal, technical or Service-evolution reasons. Material changes will be communicated to the Customer by electronic means with reasonable notice before they take effect and, where applicable, before the next renewal. If the Customer does not accept the new Terms, it may cancel the subscription in accordance with section 7; continued use of the Service after entry into force implies acceptance.

15. Governing law and jurisdiction

These Terms are governed by Spanish law. For the resolution of any dispute arising from their interpretation or performance, and this being a relationship between businesses, the parties submit to the Courts and Tribunals of the city of Málaga (Spain), waiving any other jurisdiction that might apply.

For any query regarding these Terms, please contact [email protected].