Version 1.0 — Effective 4 September 2026

These terms cover two things: browsing the Onion website, and using the Onion platform. They deliberately contain no fees, no deliverables and no service commitments — those live in the engagement agreement you sign with us, which overrides anything here.

Governing law: Spain. Applies to business users only.

1. Who we are

Onion is operated by The Coding Company, S.L., a Spanish sociedad limitada with company number (CIF) B-44697217 and EU VAT number ESB44697217, registered at c/ Pompeu Fabra 3, 17320 Tossa de Mar, Girona, Spain. We trade as Onion, and Datamorf is the same operation under its former name.

In these terms, "we", "us" and "our" mean that company. "You" means the business that has entered into an engagement agreement with us, and anyone using the platform through that business's workspace.

2. What these terms cover

This document has two operative parts. Part A governs the public website at onionos.io and applies to anyone who visits it. Part B governs the Onion platform — the web application, the browser extension, the booking pages and the APIs — and applies to businesses we have given access to.

Onion is a business tool sold to businesses. It is not offered to consumers, and nothing here is intended to affect consumer rights, because there are none in play. If you are using Onion as an individual outside a trade or profession, you should not be using it.

There is no self-service signup. Access to the platform is arranged by us under a signed agreement; you cannot create an account by yourself, and nobody acquires rights under Part B simply by visiting the website.

3. Your engagement agreement comes first

Everything commercial about our relationship — what we do for you, what it costs, how long it runs, what we commit to, and how much either of us can be liable for — is set out in the engagement agreement you sign with us. That is where the substance lives. These terms exist to cover the mechanics of using the software.

Order of precedence. Where your signed engagement agreement and these terms conflict, the engagement agreement prevails, in whole and for every purpose. Where it is silent, these terms fill the gap. Nothing in this document reduces a commitment we made to you in a signed agreement.

The same is true of continuing to use your workspace after an engagement ends. That arrangement, and its fee, is agreed with you directly and recorded in writing; it is not something these terms grant or price.

Part A — The website

4. Using onionos.io

You may read our website, and quote or link to it with attribution. You may not copy it wholesale, scrape it systematically, republish it as your own, or use it to train a machine learning model.

Everything on the site — text, design, the Onion name, the onion mark and the wordmark — belongs to us or is used with permission. Nothing on the site grants you a licence to any of it beyond ordinary reading and fair quotation.

Website content is provided for general information. It is not a contractual offer, not advice, and not a promise about what the platform does today. Product descriptions change as the product does. Where we link to another site, we do not control it and are not responsible for what it says.

Part B — The platform

5. Accounts and access

We create workspaces and issue access. Your administrator controls who inside your business gets an account and at what level, and is responsible for removing people who leave.

• Accounts are for named individuals. Do not share credentials between people.

• Keep credentials secure, and tell us promptly at privacy@onionos.io if you believe an account has been compromised.

• You are responsible for everything done through your workspace by the people you have given access to, as if you had done it yourself.

• Access rights are not transferable outside your business.

6. Your workspace and your data

The data in your workspace is yours. Your leads, contacts, pipeline records, notes, bookings and the configuration you build up remain your property throughout, and nothing here transfers ownership of them to us.

You grant us the limited licence we need to run the service: to host, process, transmit, back up and display your data so that Onion works, and to have our sub-processors do the same on our instructions. That licence exists for the purpose of providing the service and for no other, and it ends when your data is deleted.

You can export your data at any time while you have access, in a common machine-readable format. It is your data and we will not hold it hostage, make export conditional on settling a dispute, or charge you to get it out.

We may use aggregated, anonymised statistics about how the platform is used to operate and improve it. Such statistics never identify you, your workspace or any individual, and cannot be reverse-engineered to do so.

7. Acceptable use

Onion reaches real people on your behalf, so how you use it matters to us. You must not use the platform to:

• Send unsolicited communications in breach of applicable marketing or electronic communications law, or contact anyone who has asked you to stop.

• Upload special category data under Article 9 GDPR, criminal offence data, or personal data about people in a private rather than professional capacity.

• Deceive recipients about who you are, who you work for, or why you are contacting them.

• Upload malicious code, attempt to breach our security or another workspace's isolation, or probe, scan or load-test the platform without our written consent.

• Reverse engineer, decompile or attempt to derive the source code of the platform, or copy its functionality to build a competing product.

• Resell, sublicense or provide access to the platform as a service to a third party, unless your engagement agreement expressly permits it.

• Circumvent rate limits, usage restrictions or access controls.

We do not monitor the content of your campaigns as a matter of course, and we are not your compliance department. But where we become aware of use that breaches this section, we will act on it under section 13.

8. Your compliance warranties

This is the most important commitment you make to us, because the data you put into Onion is about people who did not sign up for anything. You warrant that, for all personal data you upload to or process through the platform:

• You have a valid lawful basis under Article 6 GDPR for the processing you are instructing us to carry out, and you have documented any legitimate interests assessment you rely on.

• You have met, or will meet, your transparency obligations under Articles 13 and 14 GDPR to the people concerned.

• You comply with all applicable direct marketing and electronic communications law in every jurisdiction whose residents you contact — which is not one uniform rule across the EEA, and is your responsibility to get right in each.

• You honour objections, opt-out requests and erasure requests promptly, and maintain suppression so that a person who has opted out is not contacted again.

• You have the right to disclose to us any data you obtained from a third party, and that third party collected it lawfully.

• You will respond to data subject requests concerning data you control, including those we forward to you.

These warranties are continuing: they apply every time you upload, sync or process data, not only when you first sign up.

9. Our intellectual property

We own the Onion platform: its software, interfaces, extractor, scoring logic, scheduler, browser extension, documentation, and the Onion name and marks. Access to the platform is a licence to use it, not a transfer of any of it, and that licence lasts only as long as your access does.

Configuration you build inside Onion — your workflows, sequences, scoring criteria, segments and templates — is yours to use and export as part of your data. The underlying platform capability that makes them run remains ours.

We keep the skills, know-how, methods and generic techniques we develop while working, and may apply them for other clients. We will never use your confidential information or your data to do so.

If you send us feedback, ideas or feature requests, we may act on them freely and without owing you anything. We are not obliged to implement anything, and we will not treat your feedback as confidential unless you tell us it is before you send it.

10. Connected services

Onion connects to services you already use — Google and Microsoft calendars, your CRM, your email. Those accounts are yours, governed by your agreements with those providers, and subject to their terms rather than ours.

You are responsible for having the right to connect them and for maintaining them. If a provider changes its API, revokes an authorisation, suspends your account or goes down, the affected Onion features will stop working, and that is outside our control. We will tell you what we can see and help you reconnect, but we are not liable for a third party's decisions about its own service.

11. AI-assisted features

Parts of Onion use large language models to classify, enrich, summarise and draft. You should understand what that means in practice.

AI output can be wrong, and you are responsible for what you send. Enrichment can be inaccurate or out of date, a classification can be mistaken, and a drafted message can misstate a fact about a company or a person. Review AI-assisted output before it reaches a recipient or informs a decision. We do not warrant that any AI-generated output is accurate, complete or fit for a particular purpose.

We do not permit our AI vendors to train on your data, and our privacy policy names them. Where the EU AI Act's Article 50 transparency rules apply to a feature, we comply with them; where your own use of Onion's output triggers a disclosure obligation on you, meeting it is your responsibility.

12. Availability and changes

We aim to keep Onion available and will use reasonable efforts to do so, but these terms contain no uptime commitment and no service credits. If you need a service level, it belongs in your engagement agreement, and if one is agreed there it applies instead of this section.

The platform is provided as it is at the time you use it. We improve it continuously, which means features change, and occasionally one is retired. Where we plan to remove or materially degrade a feature you depend on, we will give you reasonable notice. Maintenance is scheduled outside European business hours where we can; urgent security work is not always something we can schedule.

13. Suspension

We may suspend access, in whole or in part, where:

• Use of the platform breaches section 7 or section 8, and the breach is serious or is not fixed after we ask.

• There is a security risk to the platform, to your data or to another client's data.

• We are required to by law, a court, or a regulator.

• Your engagement agreement provides for suspension and its conditions are met.

We will tell you why, and we will restore access once the cause is resolved. Where the risk allows it we will warn you first and give you a chance to fix the problem; where it does not — an active security incident, for instance — we will act first and explain immediately afterwards. Suspension is not termination, and your data is not deleted while suspended.

14. Ending access and what happens to your data

Your access lasts as long as your engagement agreement, or any continuation arrangement, provides. When it ends:

You have 30 days from the end date to export your data. We keep it available for that window, and we delete it afterwards, along with the backups on their normal cycle. We will not delete anything inside the 30 days, and we will not extend the window by default — so export early rather than on day 29.

If you ask us in writing before the window closes, we will delete your data sooner. We may keep what the law requires us to keep — invoices and accounting records above all — and aggregated statistics that identify nobody. Our privacy policy sets out the full retention schedule.

Sections that are meant to outlast the relationship do: intellectual property, confidentiality, your compliance warranties in respect of data processed while you had access, liability, indemnity, and law and jurisdiction.

Part C — Legal

15. Confidentiality

Each of us will receive information from the other that is not public — your pipeline, pricing and commercial plans on one side; our platform internals, roadmap and methods on the other. Each of us agrees to use the other's confidential information only to perform this relationship, to protect it as carefully as we protect our own, and not to disclose it except to people who need it and are under equivalent obligations.

This does not apply to information that is already public without anyone's fault, that the receiving party already had, that it develops independently, or that it must disclose by law — in which case it will tell the other party first, where it is lawful to do so.

These obligations continue for three years after access ends, and indefinitely for anything that is a trade secret.

16. Data protection

Our privacy policy explains how we handle personal data and when we act as controller rather than processor. It forms part of these terms.

For the client data you put into Onion, you are the controller and we are the processor. That relationship is governed by the data processing agreement between us, which sets out the scope, duration and purpose of our processing, our security obligations, our use of sub-processors, and how we assist you with data subject requests, breach notification and impact assessments as Article 28 GDPR requires. Where that agreement and these terms conflict on the handling of personal data, the data processing agreement prevails.

17. Warranties and disclaimers

We warrant that we will provide the platform with reasonable skill and care, and that we have the right to grant the access we are granting.

Beyond that, and to the fullest extent the law permits, the platform is provided as is. We give no other warranties, express or implied, and specifically do not warrant that it will be uninterrupted or error-free, that defects will be corrected, that it will meet any particular requirement of yours, or that enrichment, scoring or any other output will be accurate, complete or produce a commercial result. Any implied warranty or condition not expressly stated here is excluded so far as the law allows.

18. Liability

These terms grant access to software; they set no fees and promise no service level. Liability for the commercial relationship belongs in the agreement that creates it.

Where you have a signed engagement agreement with us, its liability provisions apply instead of this section and prevail over it. Where there is no such agreement, or it is silent on liability, our liability arising under or in connection with these terms is excluded to the fullest extent permitted by law.

Neither of us is liable to the other for indirect or consequential loss, or for loss of profits, revenue, business, goodwill, anticipated savings, or data — in each case however caused.

What cannot be excluded

Nothing in these terms excludes or limits either party's liability for:

• Wilful misconduct — under Article 1102 of the Spanish Civil Code, liability arising from dolo cannot be waived in advance, and we do not attempt to.

• Gross negligence.

• Death or personal injury caused by negligence.

• Fraud or fraudulent misrepresentation.

• Liability to a data subject under Article 82 GDPR, which cannot be contracted away.

• Anything else that applicable law does not permit to be excluded or limited.

This section applies whatever the basis of the claim — contract, tort, negligence, statutory duty or otherwise.

19. Indemnity

You will indemnify us against all claims, proceedings, regulatory fines, damages and reasonable costs — including legal fees — arising from your breach of section 7 or section 8, or from any claim by a person whose data you processed through Onion that the processing you instructed was unlawful.

This is narrow by design. It does not cover claims arising from our own breach, our own negligence, or a failure of the platform itself. It covers the situation where a regulator or an individual comes to us because of what you chose to do with your data, and it exists because we cannot see or control the lawful basis behind the contacts you upload.

We will tell you promptly about any claim covered by this section, let you control the defence of it if you wish, and not settle it without your consent, which you will not unreasonably withhold.

20. Changes to these terms

We may update these terms as the product and the law change. Every version carries a number and an effective date. For changes that materially affect your rights or obligations, we will give at least 30 days' notice by email to your workspace administrator before the new version takes effect. Continuing to use the platform after that date means the new version applies.

We cannot change your engagement agreement this way. That is a signed contract and changes to it need your agreement.

21. Transfer to Onion, S.L.

We are incorporating Onion, S.L., a Spanish sociedad limitada to be registered in Barcelona, and the business will transfer to it. You agree that we may assign these terms, your engagement agreement and the related data processing agreement to that company as part of that transfer, without needing further consent from you.

The transfer changes nothing else. Onion, S.L. will assume every obligation owed to you, both companies are Spanish so your legal position and supervisory authority are unaffected, and we will tell you in writing when it takes effect. Neither party may otherwise assign this agreement without the other's written consent, except that either may assign it to a group company or an acquirer of substantially all of its business.

22. General

Notices

Formal notices to us go to The Coding Company, S.L., c/ Pompeu Fabra 3, 17320 Tossa de Mar, Girona, Spain, or by email to the contact address we have given you. Notices to you go to your workspace administrator and to the contacts named in your engagement agreement.

Events outside our control

Neither party is liable for a failure caused by something genuinely beyond its reasonable control — infrastructure or network failure, a third-party provider outage, government action, natural disaster or armed conflict. Whichever party is affected will tell the other promptly and work to resume. This does not excuse a failure to pay.

Severability, waiver and the whole agreement

If a court finds any part of these terms unenforceable, that part is modified to the minimum extent needed to make it enforceable, or removed if it cannot be, and the rest continues. Not enforcing something once does not waive the right to enforce it later. Together with your engagement agreement, the data processing agreement and the privacy policy, these terms are the whole agreement between us on this subject, and replace anything said or written beforehand.

Relationship and language

Nothing here creates a partnership, joint venture, employment or agency relationship between us. These terms confer no rights on anyone who is not a party to them. The English version governs; any translation is provided for convenience only.

23. Law and jurisdiction

These terms, and any dispute or claim arising out of or in connection with them — including non-contractual ones — are governed by Spanish law.

The courts of the city in which our registered office is located at the time proceedings are commenced have exclusive jurisdiction, and both parties waive any other forum to which they might otherwise be entitled. That is Girona today; it will be Barcelona once the transfer described in section 21 completes.

Before starting proceedings, both of us agree to raise the issue in writing and give the other 30 days to resolve it. This does not stop either party seeking urgent injunctive relief, or applying to protect its intellectual property or confidential information, at any time.

Contact: privacy@onionos.io The Coding Company, S.L., trading as Onion — c/ Pompeu Fabra 3, 17320 Tossa de Mar, Girona, Spain — CIF B-44697217

Related documents: Privacy Policy; your engagement agreement and data processing agreement, as signed.