1. The agreement
These terms are an agreement between the company or organisation that creates a Baitwise workspace ("Customer", "you") and Odeta Kurti, Tirana, Albania, who operates Baitwise ("Baitwise", "we", "us").
By creating a workspace or using the service, you accept these terms and our data processing agreement (DPA), which forms part of them. The person who accepts confirms they are authorised to do so on the Customer's behalf.
2. The service
Baitwise provides security-awareness training, quizzes and simulated phishing messages, with reporting for administrators. We develop the service continuously and may add, change or remove features. If we remove a feature you rely on, we will tell you in advance where we reasonably can.
3. Accounts
You must give accurate information when you sign up, keep sign-in details confidential and make sure that only people you authorise use your workspace. You are responsible for what happens in your workspace, including the actions of the administrators and employees you invite. Tell us straight away at security@baitwise.al if you suspect unauthorised access.
4. Rules for simulations and acceptable use
Phishing simulations are only appropriate inside your own organisation and with its authority. You agree:
- to send simulations only to people in your organisation, on email domains you have verified that you own;
- to have the internal authority to run simulations, and to inform employees and consult employee representatives where the law or your agreements with them require it;
- not to use Baitwise to collect real passwords or other credentials, to deliver malware, or to target anyone outside your organisation;
- not to use simulation results to discipline or penalise an employee in a way that breaches employment or data protection law;
- not to probe, overload or reverse-engineer the service, get around its limits, or resell it without our written agreement.
We may suspend a workspace that breaks these rules or puts the service or other people at risk. Where possible, we will contact you first.
5. Your data
The data you and your employees put into Baitwise remains yours. You are the controller of your employees' personal data and are responsible for having a lawful basis to process it; we process it as your processor, only as set out in the DPA. How we handle our own customers' and visitors' data is described in our privacy policy.
6. Plans and fees
Plans and prices are listed on our pricing page. A paid plan starts only once we have confirmed it with you in writing, including the price and how you will be invoiced. We will tell you at least 30 days before any price change takes effect, and you may cancel before then. Prices exclude any taxes that apply.
7. Intellectual property
We own the Baitwise platform and the training content we provide. While your workspace is active, we grant you a non-exclusive, non-transferable right to use them for training your own organisation. Content generated for your workspace may be used internally by your organisation. Feedback you give us may be used to improve the service.
8. Availability and support
We work to keep Baitwise available and secure and to fix problems promptly, but we don't guarantee uninterrupted service unless we have agreed a service level with you in writing. Support is available at support@baitwise.al and through the contact form.
9. Ending the agreement
You can stop using Baitwise and ask us to close your workspace at any time. We may end the agreement with 30 days' notice, or immediately if you seriously breach these terms. After the agreement ends, you can export your results for 30 days; we then delete your workspace data as described in the DPA.
10. No guarantees beyond these terms
Training and simulations reduce the risk of successful attacks but cannot eliminate it. Apart from what these terms expressly say, the service is provided "as is", and we don't promise that it will prevent any particular security incident.
11. Liability
Neither party is liable for indirect or consequential losses, such as lost profits or lost business. Our total liability under these terms is limited to the fees you paid us in the 12 months before the event giving rise to the claim. These limits don't apply to liability that cannot be limited by law, including for intent or gross negligence.
12. Confidentiality
Each party will keep the other's non-public information confidential and use it only for the purposes of this agreement, unless disclosure is required by law.
13. Changes to these terms
We may update these terms. For changes that materially affect you, we will tell you by email at least 30 days before they take effect. If you don't agree, you can close your workspace before then.
14. Governing law
These terms are governed by the law of the Republic of Albania. Disputes will be settled by the competent courts in Tirana, unless mandatory law gives you the right to bring proceedings elsewhere.
15. Contact
Questions about these terms: privacy@baitwise.al.