Legal Notice — Fabrik

Publisher: Fabrik. Site concerned: https://www.fabrik.so and its subdomains (in particular https://app.fabrik.so). Document no.: 1/10 of the Fabrik contractual corpus. Version: 2.0. Effective date: April 28, 2026. Last update: April 28, 2026. The French version is the authoritative one — translations into any other language are provided for information only and may not create any right or obligation for or against anyone.

DETAILED TABLE OF CONTENTS

Preamble

Article 1 — Definitions and glossary

Article 2 — Purpose and scope

Article 3 — Identification of the Publisher (LCEN article 6-III-1°)

Article 4 — Publication director

Article 5 — Technical hosting (LCEN article 6-III-2°)

Article 6 — Technical infrastructure and critical processors

Article 7 — Compliance with the LCEN

Article 8 — Compliance with the Digital Services Regulation (DSA — EU 2022/2065)

Article 9 — Compliance with the Digital Markets Regulation (DMA) — reserved mention

Article 10 — Compliance with the ePrivacy Directive and Article 82 of the French Data Protection Act

Article 11 — Intellectual property

Article 12 — Trademarks and distinctive signs

Article 13 — Database producer rights (Directive 96/9/EC)

Article 14 — Limited licence granted to the User

Article 15 — Hyperlinks

Article 16 — User-generated content

Article 17 — Procedure for reporting unlawful content

Article 18 — DMCA procedure applicable to Users subject to US law

Article 19 — Protection of minors

Article 20 — Personal data — reference

Article 21 — Cookies and trackers — reference

Article 22 — Digital accessibility

Article 23 — IT security and incident management

Article 24 — Consumer mediation

Article 25 — European Online Dispute Resolution platform (ODR)

Article 26 — Liability — exclusions and limitations

Article 27 — Warranties — "AS IS / AS AVAILABLE" exclusion

Article 28 — Force majeure

Article 29 — Export control and international sanctions

Article 30 — Anti-corruption

Article 31 — Unilateral modification of this Legal Notice

Article 32 — Severability, non-waiver, entire agreement, survival, assignment

Article 33 — Languages

Article 34 — Governing law

Article 35 — Competent jurisdiction and arbitration clauses

Article 36 — Notifications

Article 37 — Evidence, archiving, evidence agreement

Article 38 — Dual acceptance mechanism

Article 39 — Contact details

Article 40 — Version history

Annex A — Plain language summary

Annex B — Contact details by purpose

PREAMBLE

This Legal Notice (the "Legal Notice" or the "Present Document") is intended to bring to the attention of any internet user, visitor, prospect, user, customer, processor, supplier, journalist, investigator, administrative or judicial authority, or any other natural or legal person accessing, consulting, using or interacting in any way with the website accessible at the URLs https://www.fabrik.so, https://fabrik.so, https://app.fabrik.so, as well as all of their subdomains, paths, APIs, services, content, mobile applications and any associated software extension (hereinafter indifferently referred to as the "Site", "Platform" or "Service"), the information required by the combined provisions of articles 6-III and 19 of Law No. 2004-575 of 21 June 2004 for confidence in the digital economy, as amended (the "LCEN"), Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a single market for digital services (the "DSA"), Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (the "GDPR"), Law No. 78-17 of 6 January 1978 relating to information technology, files and freedoms (the "French Data Protection Act" or "loi IEL"), as well as any other applicable legislative, regulatory, normative, jurisprudential or doctrinal provision of French, European Union or international law (collectively the "Applicable Law").

Access to, consultation of or use of the Site, even in the absence of registration, login or subscription, automatically and without prior notice or formality entails full, unreserved, express and irrevocable acceptance of this Legal Notice, which the User is deemed to have read, understood and accepted prior to any interaction with the Site, in the version in force on the date of access. A User who does not accept this Legal Notice in whole or in part is invited to immediately cease all access to and use of the Site.

This Legal Notice is combined with, without being substituted for or deemed contradictory to, the other contractual documents of the Fabrik corpus, including but not limited to: the Terms of Service (ToS), the General Terms and Conditions of Sale (B2C and B2B), the Privacy Policy, the Cookies Policy, the Data Processing Agreement, the Service Level Agreement, the Acceptable Use Policy and the Security Policy.

ARTICLE 1 — DEFINITIONS AND GLOSSARY

For the interpretation and application of this Legal Notice, terms beginning with a capital letter, whether used in the singular or plural, shall have the meaning attributed to them below, without prejudice to additional definitions that may appear in other documents of the Fabrik contractual corpus:

"API": means any application programming interface exposed by the Publisher, allowing a third-party system to interact with the Service in a programmatic manner, including without limitation REST APIs, GraphQL, Webhooks, or any other form of machine-to-machine interface.

"Account": means the secure personal space created by the User or on their behalf, accessible via credentials, allowing them to access the features of the Service.

"Publisher Content": means all textual, graphic, iconographic, sound, audiovisual, software, structural, algorithmic, architectural, database, model, pictogram, or other elements of any nature, made available on the Site by the Publisher, its agents or its processors.

"User Content": means any content, data, information, plan, drawing, annotation, comment, opinion, illustration or file of any kind, uploaded, entered, transmitted, stored or generated by the User by means of the Service, including architect plans, evacuation plans, intervention plans and any information associated with an establishment.

"Personal Data": has the meaning given to it in Article 4(1) of the GDPR.

"DPO": means the Data Protection Officer, within the meaning of Articles 37 to 39 of the GDPR, whose designation by the Publisher is, as of the effective date of this document, not yet appointed. Dedicated point of contact: legal@fabrik.so.

"Applicable Law": has the meaning defined in the Preamble.

"DSA": means Regulation (EU) 2022/2065 of 19 October 2022, the "Digital Services Act".

"Publisher": means Fabrik, fully identified in Article 3 hereof.

"ERP" (Établissement Recevant du Public): means a Public Access Establishment within the meaning of Article R. 143-2 of the French Construction and Housing Code.

"Force majeure": has the meaning defined in Article 28 hereof.

"Host": means the natural or legal person who provides, even free of charge, for making available to the public through online public communication services, the storage of signals, writings, images, sounds or messages of any nature provided by the recipients of these services, within the meaning of Article 6-I-2 of the LCEN.

"ISO 7010": refers to the international standard relating to safety pictograms, and by extension any related standard applicable to safety plans, in particular ISO 23601 and NF X 08-070.

"LCEN": refers to Law No. 2004-575 of 21 June 2004 for confidence in the digital economy.

"Legal Notice" or "Present Document": refers to this document in its version in force.

"Platform": has the same meaning as the term "Site".

"GDPR": refers to Regulation (EU) 2016/679.

"Service": refers to all features, tools, algorithms, interfaces, artificial-intelligence models, pictogram libraries, plan templates, export capabilities and any other service made available by the Publisher via the Site, including in particular the creation, editing, exporting and storage of evacuation plans, intervention plans and SSI plans compliant with ISO 7010, ISO 23601 and NF X 08-070 standards.

"Site": has the meaning defined in the Preamble.

"Processor": within the meaning of Article 4(8) of the GDPR when the context concerns Personal Data; within the meaning of the Civil Code when the context concerns the performance of technical services on behalf of the Publisher.

"User": means any natural or legal person accessing, consulting or using the Site and/or the Service in any capacity, whether a simple visitor, prospect, customer, Account holder, free-trial user, guest attached to a third-party account, integrator, representative of a legal person or in any other capacity.

"Consumer User": means any User who is a natural person acting for purposes outside their commercial, industrial, craft, liberal or agricultural activity, within the meaning of the introductory article of the French Consumer Code.

"Professional User": means any User who is not a Consumer User, in particular any legal person or natural person acting for purposes within their commercial, industrial, craft, liberal or agricultural activity.

"Business Day": means any day of the week other than Saturday, Sunday or a legal public holiday in mainland France.

"Calendar Day": means any day of the Gregorian calendar, including Saturdays, Sundays and public holidays.

"Notification": means any communication carried out in accordance with the procedures provided for in Article 36 hereof.

"Writing": means, unless expressly otherwise stipulated, any durable medium, including electronic, allowing its recipient to retain the information addressed to them and access it later for an appropriate period, within the meaning of the introductory article of the French Consumer Code.

"Evacuation Plan": means any graphic plan intended to inform the occupants of a building of evacuation routes and the location of safety devices, compliant in particular with ISO 23601 and NF X 08-070 standards.

"Intervention Plan": means any graphic plan intended for emergency services allowing rapid location of safety devices, cut-off devices and access points.

"Pictogram": means any standardised graphic symbol compliant with ISO 7010 standards or equivalent, used to indicate instructions, prohibitions, warnings or safety equipment.

"TOM": means the technical and organisational security measures implemented by the Publisher and its processors, in accordance with Article 32 of the GDPR.

"Transfers outside the EU": means any transfer of Personal Data to a third country or an international organisation, within the meaning of Chapter V of the GDPR.

The titles of articles, paragraphs and sub-paragraphs are provided for ease of reading and may not in any way be used to interpret the provisions themselves.

ARTICLE 2 — PURPOSE AND SCOPE

2.1. The purpose of this Legal Notice is to inform any User of the identity of the Publisher, the Host and the Service's critical processors, as well as the main legal frameworks applicable to access to and use of the Site.

2.2. This Legal Notice applies:

a) to any consultation of the Site, including in unauthenticated mode;

b) to any use of the Service, in any manner whatsoever (free Discovery plan, paid subscription, business plan, invitation to a third-party account);

c) to any access via an API, connector, third-party integration or automated agent, provided that such access is attributable to direct or indirect human action;

d) to any interaction, including via contact forms, support messaging, sharing features, or any other communication feature;

e) notwithstanding any contrary provision, to any person accessing the Site from any country or territory, regardless of the User's residence or nationality.

2.3. The temporal scope of this Legal Notice extends, for each User, from first access to the Site until the expiry of the surviving obligations referred to in Article 32, notwithstanding any termination, deregistration or cessation of use.

2.4. This Legal Notice complements, without contradiction, the other documents of the Fabrik contractual corpus. In the event of divergence between this Legal Notice and a more specific document (ToS, GTCS, DPA, SLA), the provisions of the more specific document will prevail for matters within their own scope, with this Legal Notice continuing to apply for anything not regulated therein. In the event of unresolvable divergence, the provision most protective of the consumer prevails for Consumer Users, in accordance with Article L. 211-1 of the French Consumer Code.

ARTICLE 3 — IDENTIFICATION OF THE PUBLISHER (LCEN article 6-III-1°)

In accordance with the combined provisions of Articles 6-III-1° and 19 of the LCEN, the Site is published by:

Corporate name: Fabrik

Legal form: Sole proprietorship (micro-enterprise)

Share capital: Not applicable (sole proprietorship)

Registered office: 4 rue du Four, 55500 Cousances-lès-Triconville, France

RCS registration number: Not applicable (sole proprietorship not registered with the RCS)

SIRET number: 101 388 585 00016

Intra-Community VAT number: Not applicable — VAT-exempt under the basic franchise (Article 293 B of the French General Tax Code)

APE / NAF code: April 28, 2026

General contact email: contact@fabrik.so

Dedicated legal email: legal@fabrik.so

Dedicated data-protection email: legal@fabrik.so

Dedicated email for reporting unlawful content (DSA / LCEN): legal@fabrik.so

Telephone: April 28, 2026

⚠️ Warning: Failure to publish the above information is criminally sanctioned by Article 6-VI-1 of the LCEN with a one-year prison sentence and a €75,000 fine for natural persons (€375,000 for legal persons). Publication is mandatory before going online.

3.1. Professional status of the Publisher. The Publisher carries out a professional activity as its main occupation. As such, it declares it is subject to all reporting, fiscal, social and prudential obligations attached to its status and legal form.

3.2. Activities subject to authorisation — reserved mention. The Publisher does not carry out any activity subject to prior authorisation, accreditation or specific declaration within the meaning of Book VIII of the French Commercial Code or the Monetary and Financial Code, without prejudice to the evolution of the Service's scope. Any subsequent extension of the Service to a regulated activity would give rise to an update of this document.

3.3. Foreign representatives — reserved mention. The Publisher, established in France, has not designated a representative within the meaning of Article 27 of the GDPR, this obligation not being applicable due to its establishment within the European Union. Should the Publisher designate a representative in a third country — in particular in the United Kingdom under UK GDPR if the conditions of Article 27 of UK GDPR are met, in the People's Republic of China under PIPL, or in any other State imposing such designation — the contact details of that representative will be published in Annex B hereof.

ARTICLE 4 — PUBLICATION DIRECTOR

In accordance with the provisions of Article 93-2 of Law No. 82-652 of 29 July 1982 on audiovisual communication, as amended, and Article 6-III-1° of the LCEN, the following is specified:

Publication director: Théo ROUYER — Sole proprietor

Contact address of the publication director: 4 rue du Four, 55500 Cousances-lès-Triconville, France — with mandatory copy to contact@fabrik.so

4.1. The publication director is solely responsible, under the conditions provided for by Applicable Law, in particular Articles 93-2 and 93-3 of the aforementioned law and Article 42 of the Law of 29 July 1881 on freedom of the press, for the editorial content published on the Site at the Publisher's initiative, without prejudice to specific rules applicable to User Content under the hosting regime defined in Article 6-I-2 of the LCEN and Article 6 of the DSA.

4.2. The publication director shall not be held liable for User Content, which only binds the User who uploaded, entered or transmitted it, subject to the reporting procedure provided for in Article 17 hereof.

ARTICLE 5 — TECHNICAL HOSTING (LCEN article 6-III-2°)

In accordance with Article 6-III-2° of the LCEN, the Publisher informs the User that the Site is mainly hosted by:

Corporate name: Vercel Inc.

Legal form: Delaware corporation (USA)

Address: 340 S Lemon Ave #4133, Walnut, California 91789, United States of America

Telephone: Not applicable — Company without a dedicated public phone line

Website: https://vercel.com

5.1. The use of Vercel Inc. as principal Host implies that certain technical data, including without limitation IP addresses, connection logs, HTTP metadata and content necessary for the delivery of the Service, transit through or are stored in infrastructures located outside the European Union, in particular in the United States. The legal framework for such transfers of Personal Data is detailed in the Publisher's Privacy Policy, in particular through the use of the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (the "2021 SCCs"), supplemented by a documented Transfer Impact Assessment in accordance with the Schrems II case law (CJEU, 16 July 2020, C-311/18).

5.2. Hosting of application databases. The Service's application databases, including Accounts, User Content and associated metadata, are hosted by Supabase Inc. (Delaware corporation, USA, address: 970 Toa Payoh North, #07-04, Singapore 318992 — registered office and operations; applicable US representation), in geographic regions selected by the Publisher, it being specified that the Publisher prioritises, to the extent technically possible, hosting in a European Union region (Frankfurt region, Germany, or equivalent). Details are provided in the Privacy Policy.

5.3. Other hosting or infrastructure processors. The complete list of subsequent processors used by the Publisher for the storage, processing or transmission of Personal Data appears in the Data Processing Agreement (DPA) of the Fabrik contractual corpus and, in summary form, in Article 6 hereof.

ARTICLE 6 — TECHNICAL INFRASTRUCTURE AND CRITICAL PROCESSORS

For transparency purposes, and notwithstanding the non-exhaustive nature of this list which is provided for indicative purposes, the Publisher informs the User of the list of main processors and critical providers involved in making the Service available:

Processor

Purpose

Main location

Framework for transfers outside the EU

Vercel Inc.

Front-end hosting and CDN

United States

2021 SCCs + DPF (if certified)

Supabase Inc.

Application database, authentication, storage

EU region (Frankfurt) preferred / US depending on configuration

2021 SCCs + TIA

Stripe Inc. / Stripe Payments Europe Ltd.

Card payment processing

Ireland (EU) and United States

Joint controller for certain processing + 2021 SCCs

Resend (Resend Inc.)

Sending of transactional emails

United States

2021 SCCs + DPF (if certified)

Sentry (Functional Software, Inc.)

Logging and monitoring of technical errors

United States

2021 SCCs + pseudonymisation

—

Audience measurement subject to consent

Ireland (EU) / United States

2021 SCCs + DPF + anonymised IP configuration

PostHog (PostHog Inc. / PostHog UK Ltd.)

Product analytics, session replay and feature flags subject to consent

EU region (Frankfurt) preferred / United States depending on configuration

2021 SCCs + UK Addendum + TIA

6.1. The above list is subject to change. Any material modification to this list will be reflected in an update to this Legal Notice, the Privacy Policy and, where applicable, a notification to Users in accordance with the conditions provided for in the DPA.

6.2. The Publisher has concluded with each of its processors the contractual agreements required by Article 28 of the GDPR and Applicable Law, including confidentiality undertakings, technical and organisational measures, and the frameworks for transfers outside the EU described in the table above.

6.3. The Publisher's liability for its processors is engaged under the conditions, strictly interpreted and exhaustively listed, provided for by Applicable Law, and within the limits set out in Article 26 hereof.

ARTICLE 7 — COMPLIANCE WITH THE LCEN

7.1. Status of the Publisher under the LCEN. The Publisher acts, depending on the features and content concerned, sometimes as a publisher of online public communication services within the meaning of Article 6-III of the LCEN for its own content, sometimes as a host within the meaning of Article 6-I-2 of the LCEN for User Content, it being specified that this qualification is assessed on a case-by-case basis, content by content, and data by data, in accordance with the case law of the CJEU (in particular CJEU, 23 March 2010, C-236/08 to C-238/08, Google France; CJEU, 12 July 2011, C-324/09, L'Oréal v. eBay; CJEU, 22 June 2021, C-682/18 and C-683/18, Frank Peterson and Elsevier Inc.).

7.2. No general monitoring obligation. In accordance with Article 6-I-7 of the LCEN and Article 8 of the DSA, the Publisher is not subject to any general obligation to monitor User Content stored or to actively seek out facts or circumstances revealing unlawful activities, without prejudice to specific targeted monitoring obligations that may result from a court or administrative decision.

7.3. Reporting of manifestly unlawful content. The reporting procedures provided for in Article 6-I-5 of the LCEN and Articles 16 et seq. of the DSA are detailed in Article 17 hereof.

7.4. Retention of identification data. In accordance with Article 6-II of the LCEN and its implementing decree, the Publisher retains, for each operation creating, modifying or deleting User Content, the data enabling the identification of the author of the operation, for the periods provided for by Applicable Law and detailed in the Privacy Policy.

7.5. Provision of information to authorities. The Publisher responds to judicial and administrative requests duly made by the competent French authorities, as well as to requests from foreign authorities duly transmitted via international cooperation channels (mutual legal assistance, MLAT, Cloud Act under the conditions provided for by Applicable Law). Direct requests from foreign authorities not relayed via official channels are not executed, without prejudice to the Publisher's right to refuse them and inform the data subject within the limits of any non-disclosure obligations (gag order) to which the Publisher is validly subject.

ARTICLE 8 — COMPLIANCE WITH THE DIGITAL SERVICES REGULATION (DSA — EU 2022/2065)

8.1. Qualification of the Site under the DSA. The Site constitutes an intermediary service within the meaning of Article 3(g) of the DSA, and more specifically a hosting service within the meaning of Article 3(g)(iii) of the DSA, in that it allows its Users to store User Content. The Site does not constitute, as of the effective date of this document, an online platform within the meaning of Article 3(i) of the DSA, given that it does not disseminate User Content to the public, such content being accessible only to the User who uploaded it and, where applicable, to the persons designated by them.

8.2. Single point of contact (Article 11 of the DSA). The Publisher designates as single point of contact for the authorities of Member States, the European Commission and the European Board for Digital Services:

Email address: legal@fabrik.so

Languages of communication accepted: French and English.

8.3. Point of contact for service recipients (Article 12 of the DSA). The Publisher designates as point of contact for Users:

Email address: contact@fabrik.so

Languages of communication accepted: French and English.

8.4. Legal representative (Article 13 of the DSA) — reserved mention. The Publisher being established in the European Union, it is not required to designate a legal representative within the meaning of Article 13 of the DSA.

8.5. Reporting of illegal content (Article 16 of the DSA). The reporting procedure is detailed in Article 17 hereof.

8.6. Statement of reasons (Article 17 of the DSA). When the Publisher takes a restrictive measure against User Content (deletion, hiding, dereferencing, suspension or restriction of access), it provides the User concerned with a clear and specific statement of reasons for that measure, except where Applicable Law prohibits it, in particular due to investigation-secrecy obligations.

8.7. Internal complaint-handling mechanism (Article 20 of the DSA). The User whose Content has been subject to a restrictive measure, or who has been affected by a decision to suspend or terminate their Account, may file a complaint electronically at the address indicated in Article 8.2 within six (6) months of notification of the decision. The complaint is handled as soon as possible and within a maximum period consistent with the requirements of the DSA, in transparent, non-discriminatory and diligent conditions.

8.8. Out-of-court dispute resolution (Article 21 of the DSA). The User is informed of their right, after exhausting the internal complaint-handling mechanism, to refer the matter to an out-of-court dispute resolution body certified by the digital-services coordinator of the Member State in which the User is established. The list of certified bodies is available on the official websites of national coordinators.

8.9. Trusted flaggers (Article 22 of the DSA) — reserved mention. The Publisher gives priority to reports made by natural or legal persons benefiting from trusted-flagger status within the meaning of Article 22 of the DSA, without prejudice to the diligent processing of all reports received.

8.10. Measures against abuse (Article 23 of the DSA). The Publisher reserves the right to suspend, for a reasonable period and after issuing a prior warning, the provision of its services to Users who frequently provide manifestly illegal Content or who frequently submit manifestly unfounded reports or complaints.

8.11. Transparency (Article 15 of the DSA) — reserved mention. The Publisher publishes, under the conditions and at the frequency provided for in Article 15 of the DSA, a transparency report covering all of its moderation activities, accessible at https://www.fabrik.so/legal/transparence — page to be created later if applicable.

8.12. Deceptive interface, advertising, recommendation systems, commercial profiles, protection of minors (Articles 25, 26, 27, 28, 30 of the DSA) — reserved mention. The Service, in its current configuration, does not implement targeted advertising, does not use profiling for advertising purposes, does not use deceptive interfaces ("dark patterns"), is not intended for minors and does not fall under the special regime applicable to very large online platforms (VLOPs) or very large online search engines (VLOSEs).

ARTICLE 9 — COMPLIANCE WITH THE DIGITAL MARKETS REGULATION (DMA) — RESERVED MENTION

9.1. The Publisher does not constitute, as of the effective date of this Legal Notice, a gatekeeper within the meaning of Article 3 of Regulation (EU) 2022/1925 of 14 September 2022 (the "DMA"), as none of the quantitative thresholds are met. Consequently, the specific obligations provided for by the DMA are not applicable to it. This mention is nevertheless maintained for completeness and transparency.

ARTICLE 10 — COMPLIANCE WITH THE ePRIVACY DIRECTIVE AND ARTICLE 82 OF THE FRENCH DATA PROTECTION ACT

10.1. The Site implements, where necessary, operations of reading or writing information in the User's terminal equipment (cookies, trackers, pixels, SDK, local storage, etc.), in accordance with Article 5(3) of Directive 2002/58/EC (the "ePrivacy Directive") and Article 82 of the French Data Protection Act.

10.2. The procedures for prior information and the collection of consent, as well as the typology of cookies implemented, are specified in the Cookies and Trackers Policy of the Fabrik corpus.

ARTICLE 11 — INTELLECTUAL PROPERTY

11.1. Ownership of the Publisher's rights. All Publisher Content, including but not limited to the structure of the Site, the software architecture, source code and object code, user interfaces, algorithms, pictogram libraries selected, organised and maintained by the Publisher, plan templates, databases, illustrations, texts, trademarks, logos, domain names, know-how, trade secrets within the meaning of Directive (EU) 2016/943 and Articles L. 151-1 et seq. of the French Commercial Code, as well as any element that may be subject to appropriation under Book I (literary and artistic property) or Book VII (trademarks and other distinctive signs) of the French Intellectual Property Code, or under any other corpus of national, European or international intellectual property rights, is the exclusive property of the Publisher or its licensors, and is protected as such.

11.2. Prohibition of unauthorised reproduction and use. Any reproduction, representation, modification, publication, adaptation, translation, arrangement, decompilation, reverse engineering, disassembly, extraction, substantial reuse or repeated and systematic reuse of non-substantial parts, or any other form of exploitation, in whole or in part, of all or part of the Publisher Content, by any process whatsoever, known or future, without the prior written and express authorisation of the Publisher, is strictly prohibited and constitutes, as the case may be, an act of counterfeiting within the meaning of Articles L. 335-2 et seq. and L. 713-2 et seq. of the French Intellectual Property Code, an act of unfair or parasitic competition, or a violation of the database producer's sui generis right.

11.3. Exceptions. Legal exceptions to copyright, database rights and related rights, in particular those provided for in Articles L. 122-5, L. 211-3, L. 122-5-3, L. 342-3 et seq. of the French Intellectual Property Code, remain applicable within the strict limits provided for by law.

11.4. Pictograms and standards. Pictograms integrated into the Service's library are, as the case may be, compliant with ISO 7010, ISO 23601, NF X 08-070 or equivalent standards. The Publisher has acquired, developed or selected these pictograms in compliance with the rights of their authors and the rules applicable to the reproduction of standardised symbols. The standards themselves remain the intellectual property of their respective publishers (ISO, AFNOR, DIN, BSI, ANSI, etc.), and their use in a commercial context is subject to the rules set by these publishers.

11.5. Artificial intelligence and underlying models. When the Service uses AI technologies for the conversion, analysis or generation of plans, the Publisher reserves all intellectual property rights in the models, parameter sets, weights, prompts, architectures, as well as proprietary or licensed training data. The User acknowledges that use of these technologies confers no rights on the underlying models.

11.6. Compliance with the AI Act (Regulation (EU) 2024/1689). To the extent that the Service implements artificial-intelligence systems, the Publisher endeavours to comply with the applicable obligations of Regulation (EU) 2024/1689, including, depending on the classification of the AI system concerned, transparency obligations (Article 50), labelling of AI-generated or AI-modified content, and, where applicable, conformity assessment. The applicable classification is detailed in an annex to the Privacy Policy.

ARTICLE 12 — TRADEMARKS AND DISTINCTIVE SIGNS

12.1. The "Fabrik" and "Fabrik Plan" trademarks, as well as associated logos and graphic charters, are distinctive signs of the Publisher, whether or not registered. Any use, reproduction, imitation, affixing, removal, modification, translation or exploitation of any of these trademarks, logos or names, without the prior written authorisation of the Publisher, constitutes counterfeiting and/or an act of unfair and/or parasitic competition, engaging the civil and criminal liability of its author.

12.2. Third-party trademarks, possibly cited on the Site for illustrative, informational or compatibility purposes (for example: "Supabase", "Stripe", "Vercel", "PostHog", "Sentry", "Resend"), remain the property of their respective owners. Their citation does not imply the existence of a partnership, sponsorship, affiliation, accreditation or recommendation, unless expressly stated otherwise.

ARTICLE 13 — DATABASE PRODUCER RIGHTS (Directive 96/9/EC)

13.1. The Publisher is producer, within the meaning of Article L. 341-1 of the French Intellectual Property Code transposing Directive 96/9/EC, of the databases constituting or underlying the Service (pictogram library, plan templates, regulatory metadata, normative correspondences, etc.). As such, the Publisher benefits from the sui generis right to prohibit the extraction and/or reuse of all or a qualitatively or quantitatively substantial part of the content of its databases, as well as any repeated and systematic extraction or reuse of non-substantial parts manifestly exceeding normal use conditions.

ARTICLE 14 — LIMITED LICENCE GRANTED TO THE USER

14.1. Subject to strict compliance with this Legal Notice, the ToS and all applicable documents of the Fabrik corpus, the Publisher grants the User a personal, limited, non-exclusive, non-transferable, non-assignable, non-sublicensable, revocable licence, territorially limited to the territory from which the User accesses the Service, and strictly limited to the duration of effective use of the Service, for the sole purpose of using the Service in accordance with its intended purpose.

14.2. Any use not in compliance with the licence above constitutes a violation of these terms and exposes the User to immediate termination of access, without prejudice to any civil or criminal action that the Publisher reserves the right to bring.

14.3. The licence terminates automatically, without prior notice and without formality, upon cessation, for any reason whatsoever, of the User's access to the Service.

ARTICLE 15 — HYPERLINKS

15.1. Inbound links. Setting up a hyperlink pointing to the Site does not require the prior authorisation of the Publisher when the link points to the home page, does not operate in a context detrimental to the Publisher's interests, does not lead to integrating the Site into a frame masking its origin (framing without attribution), does not associate the Site with unlawful, abusive or harmful content, and does not mislead the public about the origin, nature or content of the Site. The Publisher reserves the right to demand the immediate removal of any link that does not comply with these conditions.

15.2. Outbound links. The Site may contain hyperlinks to third-party sites or resources. The Publisher exercises no editorial control over the content of such third-party sites and shall not be held liable, directly or indirectly, for the content of such sites, their practices, their privacy policies, or any damage or harm resulting from their consultation or use, to the fullest extent permitted by Applicable Law.

ARTICLE 16 — USER-GENERATED CONTENT

16.1. User responsibility. Each User is and remains solely responsible for the User Content they upload, enter, transmit, share, store or distribute through the Service. The User warrants that they hold all necessary rights, authorisations and consents over such User Content, that it does not infringe any third-party rights (in particular intellectual property rights, personality rights, trade secrets, personal-data rights) and that it does not contravene any provision of Applicable Law.

16.2. Processing licence granted to the Publisher. The User grants the Publisher, for the duration necessary for the provision of the Service and for the performance of the Publisher's legal obligations, a worldwide, non-exclusive, free, limited licence, restricted to the technical purposes of the Service, to use, host, store, reproduce, technically translate (file formats), technically adapt and transmit User Content, for the sole purpose of providing the Service to the User. This licence excludes any right for the Publisher to commercially exploit User Content outside the Service, subject to its possible anonymisation for the purposes of improving the Service, under the conditions specified in the Privacy Policy.

16.3. Hosting status. With respect to User Content, the Publisher acts as a host within the meaning of Article 6-I-2 of the LCEN and as a host of digital services within the meaning of Article 3(g)(iii) of the DSA.

ARTICLE 17 — PROCEDURE FOR REPORTING UNLAWFUL CONTENT

17.1. Reporting channel. Any person wishing to report content they consider manifestly unlawful, whether editorial content or User Content, may do so by sending an electronic notification to the following address: legal@fabrik.so.

17.2. Form of notification (Article 6-I-5 LCEN and Article 16 DSA). To be admissible, the notification must include:

a) a sufficiently substantiated explanation of the reasons why the person alleges that the content is unlawful;

b) a clear indication of the exact electronic location of the content, in particular the URL(s) concerned;

c) the name and email address of the person making the notification, except for notifications relating to offences referred to in Articles 3 to 7 of Directive 2011/93/EU (sexual offences against children);

d) a declaration in which the person affirms, in good faith, that the information and allegations contained in their notification are accurate and complete.

17.3. Acknowledgement of receipt. The Publisher sends an electronic acknowledgement of receipt without undue delay to the person who made the notification, where the latter contains contact information.

17.4. Diligent processing. The Publisher processes notifications diligently, in a non-arbitrary and objective manner, and takes such measures as it deems appropriate, ranging from maintaining the content to its removal, hiding, dereferencing or temporary suspension, depending on the seriousness of the alleged infringement and its manifest nature.

17.5. Statement of reasons. When the Publisher takes a measure against User Content following a notification, it informs the User concerned in accordance with Article 17 of the DSA.

17.6. Preservation of evidence and transmission to authorities. The Publisher preserves evidence of notifications and measures taken under the conditions provided for by Applicable Law, and makes them available to the competent authorities upon duly formed requests.

17.7. Abusive reports. A person who knowingly makes a manifestly unfounded notification incurs civil and, where applicable, criminal liability, in particular under Article 6-I-4 of the LCEN (punishing abusive denunciation with one year of imprisonment and a €15,000 fine), without prejudice to the technical measures the Publisher may take against the authors of repeated and manifestly unfounded reports (Article 23 of the DSA).

ARTICLE 18 — DMCA PROCEDURE APPLICABLE TO USERS SUBJECT TO US LAW

18.1. In accordance with the Digital Millennium Copyright Act (17 U.S.C. § 512), any person who believes that content on the Site infringes their copyright under US law may send a notification ("DMCA notice") to the following designated agent:

DMCA designated agent: Théo ROUYER

Address: 4 rue du Four, 55500 Cousances-lès-Triconville, France

Email: legal@fabrik.so

18.2. The notification must include the elements required by 17 U.S.C. § 512(c)(3), in particular: identification of the protected work, identification of the allegedly infringing content, complainant's contact details, declaration of good faith, declaration of accuracy under penalty of perjury, physical or electronic signature.

18.3. The User whose content has been removed following a DMCA notice may file a counter-notification ("counter-notice") under the conditions provided for in 17 U.S.C. § 512(g).

18.4. The Publisher applies a "repeat infringer policy" under the conditions provided for in 17 U.S.C. § 512(i).

ARTICLE 19 — PROTECTION OF MINORS

19.1. The Service is designed and intended for Professional Users, in particular ERP managers, establishment heads, fire-safety officers, design offices and security companies. The Service is not intended for minors, neither directly nor indirectly.

19.2. The Publisher has neither the intention nor the practice of knowingly collecting Personal Data concerning persons under 16 years of age (threshold lowered to 15 for France pursuant to Article 7-1 of the French Data Protection Act), and a fortiori under 13 years of age within the meaning of the US Children's Online Privacy Protection Act (COPPA, 15 U.S.C. § 6501 et seq.).

19.3. Any parent or guardian who becomes aware of the unintentional collection of such data is invited to inform the Publisher without delay at legal@fabrik.so, who will proceed with deletion as soon as possible.

ARTICLE 20 — PERSONAL DATA — REFERENCE

20.1. The processing of Personal Data by the Publisher is governed by the Privacy Policy of the Fabrik corpus, to which express reference is made. The Privacy Policy covers, in particular, the purposes, legal bases, retention periods, recipients, transfers outside the EU, rights of data subjects, and the procedures for exercising those rights.

ARTICLE 21 — COOKIES AND TRACKERS — REFERENCE

21.1. The use of cookies and other trackers on the Site is governed by the Cookies and Trackers Policy of the Fabrik corpus, to which express reference is made.

ARTICLE 22 — DIGITAL ACCESSIBILITY

22.1. The Publisher endeavours, within the limits of its means and given the size of its structure, to make the Site accessible to people with disabilities, in accordance with the applicable frameworks, in particular the General Accessibility Improvement Framework (RGAA) in its version in force and the Web Content Accessibility Guidelines (WCAG) 2.1 AA level, as well as the obligations resulting from Directive (EU) 2019/882 on the accessibility requirements for products and services (European Accessibility Act).

22.2. Any report of an accessibility defect may be sent to contact@fabrik.so. The Publisher undertakes to examine any report as soon as possible and, where appropriate, to implement reasonable corrective measures.

ARTICLE 23 — IT SECURITY AND INCIDENT MANAGEMENT

23.1. The Publisher implements appropriate technical and organisational security measures, in accordance with Article 32 of the GDPR and applicable best practices (encryption in transit via TLS 1.2+, encryption at rest, logging, strong authentication, encrypted backups, etc.). The details of these measures are specified in the Security and Incident-Management Policy of the Fabrik corpus.

23.2. In the event of a Personal Data breach, the Publisher notifies the CNIL under the conditions provided for in Article 33 of the GDPR (within 72 hours of becoming aware of it where feasible), and informs data subjects in accordance with Article 34 of the GDPR when the breach is likely to give rise to a high risk to their rights and freedoms.

ARTICLE 24 — CONSUMER MEDIATION

24.1. Legal obligation (Articles L. 611-1 and L. 616-1 of the French Consumer Code). In accordance with Articles L. 611-1 et seq. and L. 616-1 of the French Consumer Code, the Publisher informs any Consumer User of the possibility of having recourse, free of charge, to a consumer mediator in the event of a dispute arising from the performance of a contract concluded with the Publisher, after first attempting to resolve the dispute directly with the Publisher by means of a written complaint sent to contact@fabrik.so.

24.2. Designated mediator. The Publisher has designated as competent mediator: Not applicable — Service intended exclusively for professionals (B2B). Recourse to mediation does not preclude subsequent referral to the courts.

⚠️ Warning: If Fabrik sells to Consumer Users (B2C), membership of a consumer mediation scheme is mandatory. Failure is sanctioned by Article L. 641-1 of the French Consumer Code with an administrative fine (up to €3,000 for a natural person, €15,000 for a legal person). If Fabrik is exclusively B2B, this obligation does not apply.

ARTICLE 25 — EUROPEAN ONLINE DISPUTE RESOLUTION PLATFORM (ODR)

25.1. In accordance with Regulation (EU) No 524/2013 of 21 May 2013 on online dispute resolution for consumer disputes, the European Commission makes available to consumers an online dispute resolution platform, accessible at the following address: https://ec.europa.eu/consumers/odr.

25.2. The mention in this article does not constitute a commitment by the Publisher to accept recourse to this platform for the resolution of a dispute, without prejudice to its mediation commitment referred to in Article 24.

ARTICLE 26 — LIABILITY — EXCLUSIONS AND LIMITATIONS

26.1. Best-efforts obligations. Unless expressly stated otherwise, the Publisher's obligations under this Legal Notice and more broadly under the Service are characterised as best-efforts obligations, to the exclusion of any obligation of result.

26.2. Independence of the User's professional liability. The Publisher expressly draws the User's attention to the fact that the Service is a tool for assisting the design of safety plans and may not replace the professional liability of the User, the establishment head, the ERP operator, the SSI coordinator, the design office, the inspection body or any other person bound by a legal or regulatory obligation to design, display, verify or update an evacuation plan, intervention plan or any safety device. It is the User's responsibility to verify that the plans produced or exported from the Service comply with the regulations applicable to their ERP and category, and where appropriate to have them validated by the competent safety commissions.

26.3. Exclusion of indirect damages. To the fullest extent permitted by Applicable Law, the Publisher shall not be held liable for indirect damages, including but not limited to: data loss or alteration, loss of business, loss of opportunity, loss of market, loss of customers, loss of turnover, loss of expected profits, moral damage, harm to image or reputation, consequences of decisions taken on the basis of generated plans, consequences of an unsatisfactory inspection by a safety commission, consequences of an incident occurring in a building for which a plan was generated through the Service.

26.4. Overall cap. To the fullest extent permitted by Applicable Law, the Publisher's total cumulative liability, all damages combined, all causes combined and all Users combined, for any dispute, claim or action relating to access to the Site or use of the Service, is capped, per calendar year, at the higher of:

a) the total excluding tax actually paid by the User concerned to the Publisher for the Service during the twelve (12) months preceding the event giving rise to the damage;

b) a fixed amount of five hundred euros (€500).

26.5. Legal exclusions. The caps and exclusions above do not apply to cases where the law prohibits such limitation, in particular in the event of fraud, gross negligence, bodily injury, or breach of an essential contractual obligation depriving the contract of its substance.

26.6. Unfair clauses. For Consumer Users, it is recalled that the clauses provided for in this article cannot have the effect of creating a significant imbalance between the rights and obligations of the parties to the detriment of the consumer, within the meaning of Article L. 212-1 of the French Consumer Code. In the event of an unfair clause, the relevant provision is deemed unwritten, without invalidating the contract.

ARTICLE 27 — WARRANTIES — "AS IS / AS AVAILABLE" EXCLUSION

27.1. To the fullest extent permitted by Applicable Law, the Service is provided "AS IS" and "AS AVAILABLE", without express or implied warranty, including but not limited to any implied warranty of merchantability, fitness for a particular purpose, non-infringement, error-free operation, virus or malware-free operation, continuous availability, or compliance with any subjective expectation of the User.

27.2. The exclusion provided for above shall not undermine the legal warranty of conformity of Articles L. 217-3 et seq. of the French Consumer Code, the warranty against hidden defects of Articles 1641 et seq. of the French Civil Code, or any mandatory legal warranty for the benefit of the Consumer User.

ARTICLE 28 — FORCE MAJEURE

28.1. Broad definition. In addition to cases of force majeure recognised by French case law in application of Article 1218 of the French Civil Code, the parties expressly agree that the following constitute, in particular, cases of force majeure, without this list being limitative: acts of declared or undeclared war, terrorism, insurrection, riot, civil unrest; natural disasters (earthquakes, floods, storms, volcanic eruptions, major fires); epidemics, pandemics and associated governmental measures (lockdowns, health restrictions); cyberattacks, distributed denial-of-service (DDoS) attacks, ransomware attacks, software supply-chain compromises affecting a critical component; major and prolonged failures of cloud providers, internet service providers, energy providers or telecommunications service providers; widespread network outages; international sanctions or embargoes affecting the supply or receipt of services; strikes, lockouts and labour disputes; decisions or acts of public authorities prohibiting, restricting or making impossible the performance of an obligation; sustained shortages of energy resources or essential IT components.

28.2. Effects. The occurrence of a case of force majeure suspends the performance of the affected obligations for the duration of the event and its direct consequences. Neither party may be held liable for the consequences of a case of force majeure, provided that it has used all reasonable efforts to limit its effects and to inform the other party as soon as possible. If the case of force majeure continues beyond sixty (60) calendar days, either party may terminate the contractual relationship by written notification, without such termination giving rise to any compensation.

ARTICLE 29 — EXPORT CONTROL AND INTERNATIONAL SANCTIONS

29.1. User's compliance commitment. The User undertakes to comply with all applicable regulations on export control and international sanctions, in particular Regulation (EU) 2021/821, the sanctions regimes adopted by the European Union, the US Export Administration Regulations (EAR), the International Traffic in Arms Regulations (ITAR), sanctions administered by the Office of Foreign Assets Control (OFAC), as well as sanctions adopted by the United Kingdom and the United Nations.

29.2. The User warrants that they are not (i) located in a country subject to a comprehensive embargo by the aforementioned authorities; (ii) listed on any sanctions list (OFAC Consolidated Sanctions List, EU Consolidated Financial Sanctions List, UK Sanctions List, etc.); (iii) owned 50% or more by one or more such listed persons.

29.3. The Publisher reserves the right, without notice or compensation, to suspend or terminate the access of any User whom it has serious reason to believe is in breach of the above commitments.

ARTICLE 30 — ANTI-CORRUPTION

30.1. The Publisher and the User reciprocally undertake to comply with all applicable provisions on the fight against corruption and influence peddling, in particular French Law No. 2016-1691 of 9 December 2016 on transparency, the fight against corruption and the modernisation of economic life ("Sapin II"), the US Foreign Corrupt Practices Act (FCPA), the UK Bribery Act 2010, as well as any applicable international convention (1997 OECD Convention, 2003 UN Convention against Corruption).

30.2. Neither party may, directly or indirectly, offer, promise, give, authorise, solicit or accept any undue advantage of any nature whatsoever, to or from any public or private agent, in connection with the relationship covered by these terms.

ARTICLE 31 — UNILATERAL MODIFICATION OF THIS LEGAL NOTICE

31.1. The Publisher reserves the right to modify, at any time, in whole or in part, this Legal Notice, to take account of changes in legislation, case law, practice, the Service, its processors, or any other legitimate consideration.

31.2. Modifications take effect upon their publication on the Site. The version in force is timestamped by the "Last update" mention. A User who continues to use the Site after the publication of a new version is deemed to have accepted such new version. A User holding an Account will be informed by email of material modifications, with reasonable notice which, except in the event of urgency related to a legislative or security development, may not be less than fifteen (15) calendar days.

31.3. A User who refuses a new version is invited to cease using the Site.

ARTICLE 32 — SEVERABILITY, NON-WAIVER, ENTIRE AGREEMENT, SURVIVAL, ASSIGNMENT

32.1. Severability. If one or more provisions hereof are declared null, unenforceable or inapplicable, in whole or in part, by a final decision of a competent court or by application of a legal provision, the other provisions shall retain their full force and effect. The parties agree to negotiate in good faith, as soon as possible, a substitute provision whose economic and legal effect would be as close as possible to the invalidated provision.

32.2. Non-waiver. The failure of one of the parties to invoke at any time a breach by the other party of any of the provisions hereof shall not be construed as a waiver of the right to invoke it later.

32.3. Entire agreement. This Legal Notice, together with the other documents of the Fabrik contractual corpus applicable to the User, expresses the entire agreement of the parties on its subject matter and supersedes any prior agreement, written or verbal, on the same subject matter.

32.4. Survival. Provisions which, by their nature, are intended to survive the termination of the relationship (in particular: intellectual property, liability, confidentiality, governing law, jurisdiction, notifications, evidence) continue to take effect after termination, for the period necessary for their performance.

32.5. Assignment. The User may not assign, transfer or delegate all or part of their rights or obligations hereunder without the prior written consent of the Publisher. The Publisher may freely assign all or part of its rights and obligations, in particular in the context of a restructuring operation, merger, demerger, partial contribution of assets, transfer of a business, or change of control.

ARTICLE 33 — LANGUAGES

33.1. This Legal Notice is drafted in French. Any translation into another language is provided for information only and may not be invoked to call into question or modify the meaning of the provisions in French, which alone are authentic and authoritative.

ARTICLE 34 — GOVERNING LAW

34.1. This Legal Notice is governed by and interpreted in accordance with French law, to the exclusion of its conflict-of-laws rules to the extent that they would lead to the application of a law other than French law.

34.2. Consumer Users residing outside France but in another EU Member State. The application of French law is made without prejudice to the protection granted to the Consumer User by the mandatory provisions of the law of their habitual residence, in accordance with Article 6 of Regulation (EC) No 593/2008 of 17 June 2008 ("Rome I").

34.3. Consumer Users residing outside the EU. Subject to the rules of international public order and the mandatory provisions applicable to consumer protection in the country of residence, French law applies.

ARTICLE 35 — COMPETENT JURISDICTION AND ARBITRATION CLAUSES

35.1. Attempt at amicable resolution. Prior to any contentious action, the parties undertake to attempt to resolve their dispute amicably, by exchanging a written complaint sent to contact@fabrik.so, to which the other party undertakes to respond within thirty (30) calendar days.

35.2. Default jurisdiction for Professional Users. Failing amicable resolution, any dispute relating to this Legal Notice or the use of the Site by a Professional User shall be subject to the exclusive jurisdiction of the Judicial Court of Nancy, notwithstanding multiple defendants or guarantee proceedings, including for emergency or precautionary procedures, summary proceedings or applications.

35.3. Arbitration option for international B2B disputes. For disputes involving a Professional User established outside France and concerning a financial issue exceeding fifty thousand euros (€50,000), the parties may agree, by written agreement subsequent to the dispute, to submit their dispute to arbitration before the International Court of Arbitration of the International Chamber of Commerce (ICC), in accordance with its rules. The seat of arbitration will be Paris, the language of the proceedings will be French or English by agreement of the parties, and the arbitral tribunal will be composed of three arbitrators or a sole arbitrator by agreement of the parties.

35.4. Consumer Users. The jurisdiction provisions provided for in this article apply to Consumer Users without prejudice to the jurisdiction they enjoy, as consumers, under Articles 17 to 19 of Regulation (EU) No 1215/2012 of 12 December 2012 ("Brussels I bis") and, for French consumers, Articles R. 631-3 and R. 631-4 of the French Consumer Code allowing them to bring proceedings, at their choice, before the court of the place where they resided when the contract was concluded or when the harmful event occurred, or the court of the place where the service was performed.

ARTICLE 36 — NOTIFICATIONS

36.1. Unless otherwise stipulated, any notification, communication, formal notice or notice required or permitted by this Legal Notice must be sent in writing, by one of the following means:

a) by email, to contact@fabrik.so for the Publisher, and to the address provided by the User in their Account for the User;

b) by registered letter with acknowledgement of receipt, to the registered office address of the Publisher for the Publisher, and to the last postal address provided by the User for the User.

36.2. Notifications are deemed received on the same day as their dispatch by email if sent on a Business Day before 6:00 PM (Paris time), and on the following Business Day in other cases. Notifications sent by registered letter are deemed received on the date of their first presentation.

ARTICLE 37 — EVIDENCE, ARCHIVING, EVIDENCE AGREEMENT

37.1. Evidence agreement. The User expressly acknowledges and accepts that:

a) computer records kept by the Publisher, including connection logs, traces of acceptance of the Legal Notice (timestamp, IP address, user agent, version accepted), error logs, emails exchanged, browsing traces and any other computer trace, constitute admissible, valid and enforceable means of proof between the parties, in the same way as a signed writing;

b) the evidence agreements thus established prevail over any common-law evidentiary rule, within the limits permitted by Applicable Law.

37.2. Archiving. The Publisher archives the successive versions of this Legal Notice as well as the traces of acceptance for a period corresponding to the limitation period applicable to actions based on this document, i.e. five (5) years from the User's last use of the Service, without prejudice to longer retention periods when prescribed by law.

ARTICLE 38 — DUAL ACCEPTANCE MECHANISM

38.1. Browsewrap. Use of the Site entails, by virtue of such use alone, acceptance of this Legal Notice in its version in force on the day of use.

38.2. Clickwrap. For features requiring the creation of an Account or subscription to a paid offer, the User is invited to expressly accept the Legal Notice, the ToS and, where applicable, the GTCS, by ticking a checkbox prior to validating their registration or order. Each acceptance is recorded with a timestamp including the version of the documents accepted, the IP address, the user agent and, where applicable, the Account identifier.

38.3. Cumulation. The two mechanisms are cumulative, not substituted for one another.

ARTICLE 39 — CONTACT DETAILS

Purpose

Address

General contact

contact@fabrik.so

Legal questions

legal@fabrik.so

Data protection

legal@fabrik.so

Reporting unlawful content (LCEN / DSA)

legal@fabrik.so

DMCA notifications

legal@fabrik.so

Postal address

Fabrik — 4 rue du Four, 55500 Cousances-lès-Triconville, France

ARTICLE 40 — VERSION HISTORY

Version

Date

Nature of the modification

1.0

March 20, 2026

Initial version published on fabrik.so

2.0

April 28, 2026

Comprehensive overhaul — defensive maximalist corpus, compliance with LCEN + DSA + ePrivacy + GDPR + DMCA + international sanctions + AI Act + accessibility

ANNEX A — PLAIN LANGUAGE SUMMARY

This summary is provided for informational and educational purposes. It does not replace the detailed provisions above, which alone are authoritative in the event of divergent interpretation. It is drafted in accordance with the principle of transparency set out in Article 12 of the GDPR.

Who publishes the site? Fabrik, a business based in Cousances-lès-Triconville (4 rue du Four, 55500). Contact: contact@fabrik.so.

Who hosts the site? Vercel Inc. (USA, California). The application database is hosted by Supabase, in an EU region (Frankfurt) wherever possible. All transfers outside the EU are contractually framed (2021 SCCs) and assessed (Transfer Impact Assessment).

Main processors: Vercel (hosting), Supabase (database), Stripe (payment), Resend (emails), Sentry (technical errors), PostHog (product analytics with consent).

What does the site do? Fabrik allows the creation of evacuation plans, intervention plans and SSI plans compliant with ISO 7010, ISO 23601 and NF X 08-070 standards, primarily intended for ERPs.

Your rights: you can access, rectify, delete, restrict, port or object to the processing of your personal data at any time by writing to contact@fabrik.so. You may lodge a complaint with the CNIL in case of dispute (www.cnil.fr).

Intellectual property: the content of the site (texts, logos, code, templates, pictogram libraries) belongs to Fabrik. You may not reproduce it without written agreement.

Professional responsibility: Fabrik is an aid tool. The regulatory compliance of your evacuation plans remains under your responsibility (ERP manager, SSI coordinator, design office).

Reporting unlawful content: legal@fabrik.so (to be created if not yet active).

Governing law: French law. Jurisdiction: Judicial Court of Nancy for B2B disputes; courts of the consumer's choice for B2C disputes under applicable protective rules.

Modifications: this Legal Notice may evolve. You will be informed of material modifications by email if you have an Account.