Terms and conditions of service

1. Who we are

The service is provided by Clisec Internet Ltda. ("Clisec"), tax ID (RUT) 77.772.204-2, with registered address at Los Maquis 14, San Miguel, Ñuble Region, Chile. Contact: contacto@clisec.cl.

These terms, together with the Privacy policy and, where applicable, the Data processing agreement, form the contract between Clisec and whoever purchases the service ("the Customer").

2. Definitions

• Service: the inbound email protection for cPanel/WHM servers provided by Clisec, including the agent or plugin installed on the server, cloud analysis, quarantine, logs and the control panel.
• Customer: the individual or legal entity that purchases the Service.
• End users: the people who own the email accounts hosted on the Customer's servers.
• Email data: incoming messages and their metadata (headers, sender, recipients, subject, links, attachments, source IP address and SMTP transcript) analyzed by the Service on the Customer's behalf.
• Threat indicators: technical data identifying malicious infrastructure or content, such as IP addresses, domains, URLs, file hashes and email addresses used in attacks.
• Threat intelligence: information about threats, campaigns and malicious actors obtained from the sources described in section 11.

3. Acceptance and intended users

By purchasing, installing or using the Service, the Customer confirms having read and accepted these terms. Anyone accepting on behalf of an organization represents that they have authority to bind it.

The Service is aimed at businesses, organizations and professionals who manage email servers. If the Customer is a consumer, or a micro or small business under Chilean Law 20.416, the non-waivable rights of Law 19.496 on Consumer Protection apply and prevail over any clause in these terms that limits them.

4. Description of the Service

Clisec analyzes the inbound email of the Customer's servers at the SMTP layer, before delivery, to detect and block spam, phishing, business email compromise (BEC), malware and other threats, without requiring changes to MX records. The Service does not filter outbound email.

To do so, an agent installed on the server sends Clisec's platform the Email data needed for analysis. Depending on its risk level, each message is delivered, flagged, held in quarantine or rejected, and the decision is logged with its reason.

5. Account and credentials

The Customer must provide accurate information and keep it up to date, keep its credentials confidential and notify Clisec immediately of any unauthorized use of its account. The Customer is responsible for activity performed with its credentials, unless caused by a security failure attributable to Clisec.

6. Customer obligations

• Install the Service only on servers and domains it manages or is authorized to protect.
• Have a lawful basis for its End users' email to be analyzed by a security provider, and inform them as required by applicable law. For that data, the Customer is the controller and Clisec acts as processor (see section 10).
• Keep backups of its information and properly configure filtering and quarantine policies.
• Periodically review the quarantine and available logs, especially during the first weeks of use.

7. License and acceptable use

Subject to payment and compliance with these terms, Clisec grants the Customer a limited, non-exclusive, non-transferable and revocable license to use the Service while the purchased plan is active. Resale or use by third parties requires a written partner or reseller agreement.

The Customer agrees not to:

• Interfere with the operation, security or integrity of the Service or of Clisec's infrastructure.
• Reverse engineer, decompile or attempt to extract the source code, except as expressly permitted by law.
• Use the Service to protect servers dedicated to distributing spam, phishing, malware or unlawful content.
• Circumvent plan limits, access controls or billing mechanisms.
• Use the Service in breach of the law, third-party rights or personal data protection rules.

8. Plans, prices and payment

Current plans and prices are published at clisec.cl/pricing. Prices are in Chilean pesos and include VAT. Payments are processed through Webpay (Transbank); Clisec does not store card details. An electronic tax document is issued for each payment.

Plans renew automatically at the end of each period (monthly or annual) unless the Customer cancels before renewal. Clisec will send an email reminder before each annual renewal.

Clisec may change its prices with at least 30 days' notice by email. The new price applies from the next renewal, and the Customer may cancel beforehand at no cost if it disagrees.

9. Immediate activation and right of withdrawal

Protection is activated as soon as payment is approved. For that reason, and in accordance with article 3 bis (b) of Law 19.496, Clisec expressly excludes the right of withdrawal for services purchased remotely, which is clearly disclosed before payment. This does not affect other consumer rights or the legal warranty for services not provided or provided deficiently.

10. Personal data protection

Clisec complies with Chilean Law 19.628 on the Protection of Private Life, as amended by Law 21.719 from its entry into force, and, where applicable, the EU General Data Protection Regulation (GDPR). In particular:

• Email data: Clisec processes it as processor, only on the Customer's behalf and to provide the Service, under the Data processing agreement, which forms part of these terms.
• Account, billing, support and website data: Clisec processes it as controller, as described in the Privacy policy.
• No artificial intelligence training: Clisec does not use email content or the personal data of the Customer or its End users to train artificial intelligence models, its own or third parties', nor to build commercial profiles.
• No sale of data: Clisec does not sell or rent personal data.
• Derived indicators: Clisec may use Threat indicators observed while providing the Service (for example, the IP or domain sending a phishing campaign) to protect all its customers, to the extent strictly necessary and proportionate for network and email security. These indicators describe malicious infrastructure, not the content of the Customer's legitimate correspondence.

11. Threat intelligence and external sources

To detect threats, the Service uses threat intelligence from:

• Commercial cyber threat intelligence providers.
• National and international threat information sharing communities based on MISP.
• Public cybersecurity sources about threats, vulnerabilities, campaigns and malicious actors.

Clisec respects each source's terms of use, including Traffic Light Protocol (TLP) levels. Threat intelligence is used exclusively to detect and block attacks. Clisec does not guarantee the accuracy of third-party sources, and anyone can request a review of an indicator that affects them under the Privacy policy.

Clisec only queries these sources: it does not contribute observed indicators to them or share its customers' Email data with them. When it checks the reputation of a technical indicator, such as a URL or a hash, it sends only that indicator, never the email content.

12. Security and incidents

Clisec applies technical and organizational measures proportionate to the risk to protect the information it processes, such as encryption in transit, least-privilege access control, audit logs and separation of data between customers.

If Clisec becomes aware of a security incident affecting Customer data, it will notify the Customer without undue delay and cooperate so that the Customer can meet its own notification duties, including, if the Customer is a regulated operator, those under Law 21.663 (Cybersecurity Framework Law) before the ANCI and the National CSIRT.

13. Nature of filtering

No filtering system can guarantee detection of 100% of threats or a total absence of false positives, that is, legitimate emails flagged or held by mistake. Attack techniques change constantly.

Clisec makes reasonable, state-of-the-art efforts to maintain and improve the Service's accuracy, and provides quarantine and logs so the Customer and its users can review and release messages. We recommend keeping other security measures as part of a defense-in-depth strategy.

14. Intellectual property

The Service, its software, documentation and trademarks belong to Clisec Internet Ltda. or its licensors. The Customer's Email data and other content remain the property of the Customer or its End users.

15. Confidentiality

Each party will keep confidential the non-public information it receives from the other, use it only to perform this contract and protect it with the same care it uses for its own. This obligation survives for 3 years after the contract ends and, for personal data and trade secrets, for as long as they keep that nature.

16. Warranties and limitation of liability

Clisec provides the Service with the diligence of a professional provider, but does not guarantee that it will be uninterrupted or detect every threat (section 13).

To the extent permitted by law, Clisec is not liable for indirect damages or loss of profits, and its total liability for events related to the Service will not exceed the amount paid by the Customer in the 12 months before the event giving rise to the claim.

These limitations do not apply in cases of willful misconduct or gross negligence, under articles 44 and 1465 of the Chilean Civil Code, nor to damages arising from data protection breaches attributable to Clisec. Nor do they apply to consumers or to micro and small businesses to the extent they conflict with Law 19.496.

17. Indemnity

The Customer will hold Clisec harmless from third-party claims arising from installing the Service on servers it was not authorized to protect, or from breaching its obligations as controller of its End users' data.

18. Suspension, cancellation and termination

The Customer may cancel at any time from its panel or by writing to contacto@clisec.cl. Cancellation takes effect at the end of the paid period, without refunds for unused time, unless the law provides otherwise.

Clisec may suspend the Service for non-payment, with prior notice, or immediately in case of serious risk to the security of the Service or other customers. It may terminate it for a material breach not remedied within 15 days of notice.

The Customer can remove its servers from its customer area at any time. Since quarantine and logs are kept for only 15 days, the Customer's Email data is deleted no later than 15 days after removal or termination, unless the law requires keeping it, under the Data processing agreement.

19. Changes to these terms

Clisec may update these terms. Material changes will be announced by email at least 30 days in advance. If the Customer disagrees, it may cancel before they take effect at no cost. For consumers, changes require their acceptance.

20. Governing law and disputes

These terms are governed by the laws of the Republic of Chile. Disputes will be submitted to the ordinary courts of Chillán, without prejudice to consumers' right to sue before the competent local police court under Law 19.496, and to actions before the Chilean Personal Data Protection Agency.

21. General provisions

• If a clause is declared invalid, the rest remain in force.
• Neither party is liable for failures caused by force majeure.
• The Customer may not assign the contract without Clisec's written consent. Clisec may assign it in a merger, acquisition or sale of assets, notifying the Customer.
• Notices will be sent by email to the registered addresses.
• The Spanish version of these terms prevails.