AEGYS Terms of Service

Operator: A & S INFORMATION SOLUTIONS OPC (“A & S”, “we”, “us”) Product: AEGYS Corporate website: https://www.aandssolutions.com Product: https://aandssolutions.com/aegys Support: hello@aandssolutions.com Privacy / DPO: dpo@aandssolutions.com · Atty. Janine Rose G. Lumanag Effective: 19 August 2026 Version: terms-2026-08-19-v1 NPC / Seal: This document does not claim NPC registration, a Certificate of Registration, or an NPC Seal.

These Terms apply to use of AEGYS by the subscribing law firm (“Customer”, “you”). AEGYS is the full commercial production system. These Terms describe and protect that product. They do not authorize A & S to disable ordinary included functionality in order to avoid a legal or compliance obligation.

The Data Processing Addendum (“DPA”) forms part of the AEGYS contractual arrangement when applicable. The Data Processing Addendum is published with these Terms. The Privacy Notice describes how A & S processes personal data and is provided for transparency; it does not, by describing processing, create additional contractual warranties.

1. Definitions

AEGYS means the hosted legal-practice-management platform operated by A & S, including the authenticated firm workspace and the limited client-facing functions described in these Terms.

Authorized User means a natural person who is personnel of the Customer (lawyer, associate, partner, employee, or other person expressly authorized by the Customer) and who is permitted to sign in to the Customer’s authenticated AEGYS workspace.

Client or data subject (workspace) means a client of the Customer or another person whose information the Customer processes in AEGYS. Clients are not AEGYS customers and are not Authorized Users.

Portal / Link Recipient means a person permitted by the Customer to use a limited client-facing function (for example a Client Portal page, document-request upload, payment link, or consultation link) without receiving an AEGYS workspace login.

Customer Personal Data means personal data in the Customer’s tenant workspace that A & S processes as Personal Information Processor (“PIP”).

Platform Records means records for which A & S acts as Personal Information Controller (“PIC”), including subscription/account administration, licensing/payment, legal-acceptance evidence when enabled, A & S operator audit, security, support, and regulatory records.

Material Subprocessor has the meaning in the DPA.

Platform Admin means A & S’s internal operator functionality for administering AEGYS. It is not a Customer product entitlement.

2. The service

AEGYS is a hosted cloud workspace for law-firm practice management. Depending on the Customer’s then-current commercial plan and paid add-ons, AEGYS may include Clients, Matters, Tasks, Calendar, Events, Hearings, Filings, Billing, Ledger, Payments, SOA, AR, Reports, Documents, file storage, correspondence, walk-ins, notarial functions, email automation, staff collaboration, mobile/PWA access, and limited client-facing functions (Client Portal where entitled, client uploads, payment links, consultation links, and similar token/link functions).

Each Customer receives an isolated tenant workspace. A & S hosts and operates the application. Cloud infrastructure is provided by subprocessors described in the Privacy Notice and DPA.

AEGYS is not a law firm, is not legal advice, and is not a substitute for the Customer’s professional obligations to clients, courts, or regulators. A & S is not the lawyer representing the Customer’s clients merely because AEGYS stores, transmits, organizes, generates, or otherwise processes law-firm information.

3. Two processing roles

Workspace data (Customer = PIC; A & S = PIP). The Customer determines the purposes of processing client, matter, billing, document, scheduling, notarial-workspace, correspondence, and similar practice records it enters or causes to be collected through AEGYS, including through client-facing functions. A & S processes that data to provide AEGYS under the Customer’s instructions, including the DPA.

Platform Records (A & S = PIC). A & S determines the purposes of processing trial/subscriber registration, the firm registry, licensing/subscription/payment records, Terms/Privacy acceptance records (when enabled), operator audit, security/rate-limit information, support communications, and similar operational/regulatory records.

A & S is not exclusively PIC or exclusively PIP for all processing. See the Privacy Notice and DPA.

4. Accounts, Authorized Users, and client-facing recipients

4.1 Authenticated workspace access is restricted to Authorized Users who sign in with a Google account. Google sign-in uses OpenID, email, and profile. A & S does not store user passwords.

4.2 The Google account used at trial setup is the firm administrator unless later changed through A & S’s operational process. The Customer is responsible for who it authorizes, for keeping Google accounts under its control, and for reviewing SOA, acknowledgment receipts, and other outputs before sending them.

4.3 Each Google account may be an active member of only one AEGYS firm at a time.

4.4 Clients must not receive an AEGYS workspace login; access the firm’s AEGYS dashboard as an Authorized User; or browse the firm’s matters, tasks, or billing as workspace users. Receiving an authorized output (email/PDF) or using a limited client-facing token/link does not make the recipient an Authorized User.

4.5 Portal/Link Recipients may use only the limited function the Customer authorized (for example viewing a balance, uploading a requested document, paying, or responding to a consultation link), subject to token/link validity, security rules, expiration, and the Customer’s entitlement.

4.6 Do not share login credentials. Report suspected unauthorized access to hello@aandssolutions.com, to dpo@aandssolutions.com where personal data may be involved, and to the firm administrator.

5. Trial

New Customers may start a 7-day trial. No payment card is required to start the trial.

The trial creates a private workspace for that administrator Google account. When the trial end time is reached, ordinary workspace access is locked immediately. Locking access is not deletion. Unconverted trial workspace content is retained for up to 90 days from trial expiration, then becomes deletion-eligible unless a legal hold or other lawful preservation basis applies.

A & S operator accounts cannot start a customer trial from the public trial flow.

Optional add-ons (including the Client Portal add-on) follow the then-current commercial catalog and entitlement rules. Absence of an unpaid add-on during trial is a commercial entitlement rule, not a privacy restriction and not a reduction of the core AEGYS product.

6. Fees, activation, and payment

Prices currently configured (Philippine pesos). These Terms describe the catalog; they do not themselves change product pricing:

• One-time activation / setup fee on first paid activation: ₱40,000
• Monthly subscription: ₱499 per 30-day term
• Annual subscription: ₱5,000 per 12-month term
• Optional staff training seminar: ₱5,000 where configured
• Optional Client Portal add-on: ₱10,000 one-time

Payment is made by the channels shown in the product (currently GCash, Maya, and/or bank transfer as configured). AEGYS does not automatically charge a card and does not automatically activate the workspace.

The Customer notifies A & S that payment was sent. A & S verifies the payment, then an A & S operator records confirmation and activates the workspace. Until that happens, the firm remains on trial (or locked, if the trial has ended).

The same workspace continues after first activation. The Customer does not start over.

Failed or incomplete automatic payment-notification email does not cancel the obligation to pay or A & S’s need to verify funds. If the product cannot send the notice, email hello@aandssolutions.com with the reference.

AEGYS licence activation is manual. A & S does not collect AEGYS licence fees through a platform PayMongo subscription. A firm may separately store its own PayMongo keys for client payments if that feature is used.

Continued paid access is conditioned on applicable fees being paid when due. Ordinary unpaid lapse is handled through the existing entitlement/lapse architecture, not a separate “suspended” lifecycle status.

7. Price changes

A & S may revise AEGYS prices prospectively.

A price increase will not retroactively alter fees already paid or properly earned under an existing paid term (including an already-paid setup fee, monthly period, annual term, or purchased add-on).

For an increase in a recurring subscription price, A & S will ordinarily give at least thirty (30) calendar days’ advance written notice before the increased price becomes applicable to that Customer. The increase takes effect only on the first applicable renewal/billing period occurring at least 30 calendar days after proper notice. A mid-term annual price increase will not be imposed.

Before an announced recurring increase takes effect, the Customer may continue/renew at the new price or not renew/cancel in accordance with Section 9. Silence is not acceptance if no proper notice was given. Proper notice plus continuation/renewal after the effective date applies the revised price to the new period.

A later price decrease may be implemented prospectively without 30 days’ notice and does not automatically create a retroactive refund unless A & S agrees in writing.

Taxes and government charges are distinct from AEGYS fees. A & S may collect amounts required by law. Taxes remitted for government are not additional AEGYS subscription revenue.

This 30-day period is an AEGYS commercial policy, not a representation that Philippine law universally requires every B2B SaaS price change to have exactly 30 days’ notice.

A price-change clause does not authorize A & S to silently remove working modules or strip features from an already-paid term.

8. Refunds

The ₱40,000 setup/activation fee becomes non-refundable once A & S has commenced substantive onboarding, configuration or activation work, or once the Customer’s paid AEGYS workspace has been activated, whichever occurs first. If payment was made but A & S has not commenced that work and the Customer validly withdraws before activation, the setup payment may be returned subject to actual non-recoverable transaction charges lawfully chargeable.

Paid subscription fees are generally non-refundable for voluntary Customer cancellation during an active paid term. This does not exclude refunds for: duplicate/error payments; qualifying unauthorized charges; failure by A & S to provide the purchased service; material A & S breach where refund/rescission is legally available; refunds required by law; or discretionary written goodwill refunds.

If A & S terminates a prepaid subscription solely for its own convenience and without Customer breach, the unused prepaid subscription portion will be refunded; an already-earned setup fee remains non-refundable.

Cancellation and refund are separate. Refund is not deletion. Refunds, when due, are processed manually.

A & S will not impose an arbitrary contractual cancellation penalty solely because the Customer validly cancels or declines a future price increase. This does not extinguish amounts already properly due.

9. Customer cancellation and non-renewal

The Customer may request cancellation or non-renewal. The operational path is:

written electronic request through an A & S-designated business/support channel → authority verification → A & S processing → written confirmation.

A self-service one-click cancellation button is not required and its absence is not a limitation of the AEGYS product.

The request must come from a person reasonably authorized to act for the Customer (registered administrator, owner/partner, authorized officer, or other representative whose authority can reasonably be verified). A & S will not cancel the firm merely because an ordinary staff user, unidentified person, law-firm client, or other third party demands it. Verification will not be used to unreasonably obstruct a genuine authorized request. The Customer need not prove a particular business reason; optional feedback is not a condition of cancellation.

A. Non-renewal / end-of-paid-term (ordinary default). The Customer retains ordinary AEGYS access, including full paid-plan functionality, through the end of the already-paid subscription period. The subscription ends at the close of that paid term. The 90-day post-cancellation retention period begins when cancellation becomes effective. A pending end-of-term cancellation is not a reduced-service period.

B. Immediate / early cancellation. If the Customer specifically requests cancellation before the end of the paid term and A & S verifies and processes that instruction, workspace access may end on the confirmed effective date; the 90-day period begins from that date. Unused prepaid amounts are not automatically refundable merely because of voluntary early cancellation; Section 8 governs refunds.

The confirmation should identify the firm, whether the request is end-of-term or immediate, the effective date, expected access-end date, the offboarding/retention position, and available export options. Manual written confirmation is acceptable.

The Customer may withdraw a future end-of-term cancellation by verified instruction before it takes effect. That is continuation of the existing subscription, not reactivation (Section 12).

A & S-initiated termination for breach, non-payment, or security abuse is distinct and is not an ordinary Customer cancellation.

10. Temporary protective access restriction

AEGYS does not use a separate persistent “suspended” account lifecycle status. Existing states (active, trial, trial expiry/retention, paid lapse, cancellation, cancellation retention, legal hold, deletion) remain distinct.

A & S nevertheless retains a narrow contractual right to take proportionate temporary protective measures where reasonably necessary because of:

• suspected credential compromise, unauthorized access, account takeover, or malicious/unsafe use;
• a material threat to AEGYS, another tenant, or tenant isolation;
• use A & S reasonably believes is clearly unlawful, or that would require A & S to participate in unlawful processing;
• a lawful court order, NPC/regulatory direction, or other binding legal requirement;
• ordinary entitlement consequences already handled through lapse/cancellation (not a duplicate “suspend” status).

This is an exceptional protective measure, not a general right to arbitrarily disable paying Customers, and not a reduced version of AEGYS. A security response directed at an actual threat is an operational safeguard, not product reduction.

Where reasonably sufficient, A & S should prefer the least disruptive available measure (for example restricting a compromised user rather than the entire firm, or invalidating a compromised token). A & S does not promise a technical control that has not been implemented.

Where reasonably practicable, A & S will notify the Customer of a material restriction, except where notice would compromise security, prejudice an investigation, disclose another tenant’s information, violate law, or expose security secrets. Advance notice is not promised for emergency security restrictions. Where the issue is reasonably capable of cure and delay would not materially increase risk, A & S should ordinarily provide a reasonable opportunity to correct it.

Temporary restriction does not start the 90-day retention clock, does not convert an active Customer into a cancelled Customer, and does not itself create a legal hold. When the basis is resolved and the Customer otherwise remains entitled to service, A & S should restore ordinary access without undue delay. That restoration is not Section 12 reactivation.

A & S will not restrict a Customer merely for making a legitimate complaint, exercising a lawful privacy right, requesting an audit, raising a legitimate subprocessor objection, requesting cancellation, asking for an offboarding export, or declining a future price increase.

A & S may terminate for material Customer breach where permitted by these Terms and applicable law (including serious or repeated prohibited use, deliberate compromise of AEGYS security, material unlawful use, uncured material breach after reasonable notice where cure is appropriate, or circumstances making continued service unlawful). Actual termination will have a clear effective date, after which retention/offboarding—not indefinite “suspension”—governs.

11. Term, lapse, and A & S termination

Paid authorized use follows the subscription term recorded at activation. When that term lapses unpaid, ordinary service ends as of the effective lapse date.

After ordinary service ends: access stays locked; full service is not silently restored; tenant workspace data is retained up to 90 days from the effective trial expiry or paid termination/cancellation/lapse date unless a legal hold, earlier deletion instruction, or other lawful preservation basis applies.

A & S may terminate for material breach or non-payment as described in these Terms.

12. Reactivation after effective cancellation

If the Customer’s subscription has actually entered cancelled status, the Customer may request reactivation while the original tenant workspace still exists and has not been deleted, subject to verified authority, A & S confirmation, applicable payment/subscription requirements, absence of a legal/security bar, and technical availability.

Where reactivation occurs before deletion, A & S will restore the same firm identifier, the same tenant workspace, and retained workspace data. A & S will not create a duplicate tenant or migrate the retained workspace to a new firm identifier merely to reactivate.

Valid reactivation ends the cancellation-retention/deletion path while the restored subscription remains active and begins a new paid service term from the confirmed reactivation/activation date (or other clearly agreed effective date) at the then-current applicable recurring price, unless A & S agrees otherwise in writing. Recurring fees will not be charged for the cancelled period unless separately and validly owed. A second ₱40,000 setup/activation fee will not ordinarily be charged merely to restore the same intact previously activated workspace. A & S may still charge the new recurring price, separately agreed services, purchased add-ons, or extraordinary reconfiguration expressly agreed.

Payment alone will not automatically revive a cancelled tenant. Ordinary first-time activation remains a separate process and does not itself reactivate a cancelled workspace.

If the workspace has already been deleted, it is not reactivatable. A later return is a new subscription/workspace (a new firm identifier may be created) at then-current activation and subscription pricing. Provider recovery copies are not a customer reactivation service (Section 18). The A & S PIC tombstone is not a customer-data backup.

Withdrawing a pending end-of-term cancellation before it takes effect is continuation of the active subscription, not reactivation. Restoring access after a temporary Section 10 restriction while the subscription remained active is not reactivation.

Once validly reactivated, the Customer receives the full AEGYS product included in its then-current commercial plan. There is no degraded “reactivated customer mode.” Add-on entitlements follow the current paid catalog. Expired/revoked tokens do not automatically become valid again.

13. Customer content and responsibility

The Customer controls and bears responsibility for the lawful and professionally appropriate content and use of its tenant workspace, including information it causes to be collected through client-facing functions.

For information entered or generated by the Customer or its Authorized Users, the Customer is responsible for lawfulness, appropriate accuracy/completeness, purpose, lawful basis/authority, professional use, and what is stored or communicated through AEGYS.

The Customer does not automatically warrant the factual accuracy of every raw statement, document, payment proof, consultation response, or upload submitted directly by a Client or other recipient through a portal, token, or link. The Customer remains responsible for deciding to request or accept that information, having an appropriate lawful basis, determining its use, reviewing or verifying it where professionally or legally necessary, and complying with applicable professional, confidentiality, and data-protection obligations.

A & S does not warrant or assume responsibility for the factual truth, legal sufficiency, authenticity, professional significance, or substantive accuracy of information supplied by the Customer, its personnel, its clients, or other recipients merely because AEGYS processed it.

A & S retains its separate security, confidentiality, tenant-isolation, and PIP obligations. This Section does not waive A & S’s liability for its own acts or failures as allocated in Sections 21 and 22.

14. Acceptable use

The Customer must not: attempt to access another firm’s workspace; probe or attack the service (including unauthorized penetration testing, vulnerability scanning of production, credential attacks, scraping, or denial-of-service testing); upload malware; use AEGYS to break law; or store data it is not allowed to store.

Active technical security testing of AEGYS requires A & S’s prior written authorization. Accidental good-faith vulnerability reports are welcome.

AEGYS may process confidential, privileged, work-product, sensitive, or SPI information when the Customer determines that is necessary and lawful. AEGYS does not require unnecessary SPI for ordinary platform operation and will not automatically inspect case content or disable uploads merely because SPI or privileged information may be processed. Consent is not the only or universal lawful basis.

15. Confidentiality and privilege

Each party will treat the other’s non-public information as confidential. Customer workspace data is confidential. A & S will access, use, or disclose it only as reasonably necessary to operate, support, and secure AEGYS, to follow Customer instructions, to comply with law or legal process, or to establish, exercise, or defend legitimate legal rights.

If A & S receives a legally binding demand seeking tenant workspace information, A & S may comply to the extent legally required; where legally permitted and reasonably practicable, A & S should notify the Customer; A & S should disclose only what is reasonably required.

Privilege. Whether particular information is protected by attorney-client privilege or another legal privilege depends on the underlying lawyer-client relationship, the nature and circumstances of the information or communication, and applicable law. Use of AEGYS does not itself create or determine legal privilege. A & S does not represent that every client, case, document, or communication stored in AEGYS is automatically privileged. A & S does not waive the Customer’s privilege by hosting the platform.

16. Data ownership, export, and offboarding

Workspace data the Customer enters remains the Customer’s data. A & S hosts and processes it as PIP to provide AEGYS.

The Customer grants A & S a limited right to process that data solely to operate the service, including storage, security, provider recovery windows if any, support the Customer requests, offboarding, and legal compliance.

While ordinary access remains, the Customer may download available reports and records through the export and PDF functions provided within AEGYS (including clients CSV and AR aging CSV where those panels are available, and individual PDFs/files the product already provides). There is no universal customer self-service “download everything” button.

For termination or offboarding, A & S may provide a controlled workspace export through its administrative offboarding process, subject to identity/authority verification, applicable retention requirements, and legal or preservation obligations. The operator export package may contain CSV/JSON, a manifest, and a file inventory where available. File bytes are not always embedded. A & S does not promise a particular turnaround time unless separately agreed. Deletion is not delayed indefinitely merely because an export was never requested.

Cancellation does not create a right to another firm’s data, AEGYS source code, infrastructure credentials, or A & S proprietary information.

When the Customer’s subscription/workspace access actually ends, AEGYS need not continue servicing firm-generated client-facing functions indefinitely. Availability of Client Portal, document-request links, payment links, consultation links, and similar functions depends on the firm’s active entitlement/service state and offboarding architecture. While the subscription remains active through a future end-of-term cancellation date, ordinary included client-facing functionality remains operational.

17. Retention, deletion, and legal hold

PIP tenant workspace. After ordinary service ends:

1. Access stays locked.
2. Tenant workspace data is retained up to 90 days from the effective trial expiry or paid termination/cancellation/lapse date.
3. A verified Customer instruction may request earlier deletion through the controlled A & S operator process (not a customer one-click). Early deletion is not automatic merely because cancellation was requested.
4. A legal hold recorded by A & S suspends automatic deletion. Removing a hold does not grant a fresh 90-day period if the original deadline has already passed. Legal hold is preservation, not account suspension.
5. After deletion eligibility, A & S securely deletes PIP tenant workspace content from active production. A & S PIC records are retained separately for the periods in the Retention Schedule (contractual/legal-acceptance and minimal deletion evidence generally 10 years; they are not a 10-year copy of the deleted workspace).
6. Protected internal/demo/security-test workspaces are excluded from automatic cleanup.
7. Scheduled destructive purge remains off until A & S expressly authorizes it. That safeguard is not a reduction of ordinary AEGYS functionality.

Provider recovery copies may remain until provider windows expire (Section 18). Application deletion is not instantaneous destruction of all backup history.

18. Availability, backup, and recovery

The service depends on cloud providers listed in the Privacy Notice (including Vercel, Neon, Vercel Blob, Google sign-in, Resend, and rate-limiting infrastructure). Outages, rate limits, maintenance, and errors can occur.

No uptime percentage is promised. No service-credit SLA is promised. Support is by email to hello@aandssolutions.com. No response-time SLA is promised unless A & S later agrees in writing.

Outbound email, when used, is sent from A & S’s verified transactional domain with the firm’s configured address as Reply-To where set. Successful email delivery is not guaranteed.

A & S will maintain reasonable safeguards and use reasonable efforts to restore AEGYS data where recovery is technically available through verified provider capabilities. A & S does not guarantee recovery of any particular record or file, uninterrupted availability, a specific RPO or RTO, daily backups, or long-term backup.

The production Neon database currently retains approximately 6 hours of Instant Restore change history. That restore capability has not been tested as a disaster-recovery exercise. That is not a daily or long-term backup. Independent Vercel Blob restore/undelete is not a verified AEGYS backup service. Neon restore does not bring back Blob objects. Retention dry-run jobs are not backups. Marker/dump jobs are not verified production database backups unless separately verified as restorable.

19. Security (non-exploitative summary)

Implemented measures include HTTPS/TLS; authenticated Google sessions; server-side authorization; tenant-scoped access; database row-level security for AEGYS tenant queries; private object storage with authenticated, scoped file delivery; restricted A & S operator access; rate limiting; production logging/monitoring; retention and legal-hold controls; controlled deletion; isolated tenant workspaces.

This is not a promise of perfect security and is not SOC 2, ISO, NPC certification of AEGYS, or similar certification.

Customer audit rights are described in the DPA. They do not include production database credentials, source code, other tenants’ data, cloud consoles, or unauthorized penetration testing.

Personal data breach. Not every application error, 5xx response, failed login, rate-limit event, outage, or bug is a personal data breach. A security incident is assessed to determine whether there has been an actual or reasonably believed compromise of personal data meeting applicable notification criteria.

Where an incident concerns Customer Personal Data, A & S as PIP shall notify the Customer as PIC without undue delay and, where reasonably practicable, within twenty-four (24) hours after becoming aware of or reasonably believing that a personal data breach affecting that Customer’s workspace has occurred. The 24-hour period is an AEGYS operational/contractual target. It is not a universal NPC statutory deadline. Its purpose is to give the Customer time to assess and comply with the applicable regulatory notification period, currently generally seventy-two (72) hours upon knowledge or reasonable belief by the PIC or PIP of a breach requiring notification, subject to applicable rules. The legal clock is not restarted by internal escalation. An initial notice may be incomplete and supplemented as information develops.

The Customer, as PIC of workspace data, remains primarily responsible for required NPC and data-subject notifications for that data. A & S shall reasonably assist and will not automatically file an NPC notice on behalf of every Customer. A & S may assist or file only where expressly authorized by the Customer or independently required by law or lawful NPC direction. NPC filings, where required, are presently made through DBNMS as an operational/DPO process; AEGYS does not hard-code DBNMS automation.

Where the affected data consists of Platform Records for which A & S is PIC, A & S’s DPO assesses and, where required, makes applicable notifications. That duty is not routed to the Customer.

Suspected incidents involving unauthorized access, acquisition, disclosure, alteration, loss, or destruction of personal data must be escalated to the DPO (dpo@aandssolutions.com). Current operational recording is by DPO/mailbox/manual process.

20. Intellectual property

AEGYS software, design, and documentation remain A & S property. Customer content remains the Customer’s. Feedback may be used by A & S without obligation.

21. Indemnity

Indemnity concerns specified third-party claims, not every first-party contractual dispute between the parties.

Customer indemnity. The Customer will indemnify A & S against third-party claims to the extent arising from: the Customer’s unlawful or infringing Customer-controlled content; unlawful or unauthorized use of AEGYS by the Customer; Customer-controlled privacy violations; or the Customer’s professional/legal services — but not for A & S’s own acts or failures. The Customer indemnity is not governed by the numerical cap on A & S’s liability in Section 22.

A & S indemnity. A & S will provide a limited indemnity for qualifying third-party claims that AEGYS itself infringes Philippine intellectual-property rights, subject to exclusions (including Customer content, combination with non-AEGYS materials, unauthorized modification, or use contrary to these Terms) and to Section 22 to the extent legally permissible.

Indemnity includes reasonable defense costs, uses proportionate causation where both parties contributed, and includes notice, defense, and settlement protections. Neither party will settle a claim imposing an admission or non-monetary obligation on the other without consent not to be unreasonably withheld.

This Section does not transfer the Customer’s professional malpractice liability to A & S, and does not make A & S the Customer’s lawyer.

22. Limitation of liability

Subject to the carve-outs below and to the maximum extent permitted by applicable law, the aggregate liability of A & S arising out of or relating to AEGYS, the applicable subscription, these Terms, or the DPA shall not exceed the greater of ₱100,000 or the AEGYS fees actually paid by the affected Customer during the preceding 12 months. This is an aggregate cap across claims arising from the same or related events.

For a Customer that has used AEGYS for less than twelve months, the fees actually paid since commencement apply, subject to the ₱100,000 minimum cap.

Taxes collected or remitted on behalf of government are not treated as AEGYS fees for purposes of calculating the cap.

To the extent legally permissible, A & S is not liable for indirect, incidental, special, consequential, or punitive damages, including lost profits, lost revenue, lost business opportunity, lost anticipated savings, reputational or goodwill loss, and business-interruption losses, where those damages are indirect or consequential rather than proven direct loss arising from the breach.

This exclusion does not abolish legally recoverable direct damages, including proven direct loss arising from loss or unavailability of records. Direct data-loss claims remain subject to the aggregate cap in this Section to the extent permitted by law, and are not an unlimited exclusion of A & S’s liability for its own acts or failures.

The limitation will not purport to waive: fraud; willful misconduct; gross negligence where it cannot lawfully be limited; or other non-waivable liability under applicable law.

A & S retains its security, confidentiality, and PIP obligations. Ordinary claims arising from those obligations remain subject to this contractual cap to the extent permitted by law. This Section does not state that the Customer assumes responsibility for an A & S cross-tenant disclosure, that A & S has no responsibility for its own security failures, or that the Customer waives all remedies for an A & S-caused personal-data breach.

Customer payment obligations are separate from A & S’s aggregate damages liability. Taxes are treated as provided in Section 7 for liability-cap calculations.

This Section does not allow A & S to ignore functionality expressly included in the Customer’s paid plan.

23. Governing law and venue

These Terms, the applicable subscription, and the parties’ relationship concerning AEGYS shall be governed by and construed in accordance with the laws of the Republic of the Philippines, without giving effect to conflict-of-laws principles that would require application of another jurisdiction’s law, subject always to mandatory applicable law.

Subject to applicable mandatory law and rules on subject-matter jurisdiction, any action, suit, or proceeding arising out of or relating to AEGYS, these Terms, the subscription, or the DPA shall be commenced and maintained exclusively in the proper courts of Davao City, Philippines, to the exclusion of all other venues.

Mandatory arbitration is not imposed. Exclusive contractual venue does not displace mandatory NPC or other regulatory jurisdiction.

24. Changes to these Terms

A & S may update these Terms. Material changes will be posted on /terms with a new version identifier. Continued use after a required in-product acknowledgement (when that mechanism is turned on for a new version) constitutes acceptance of that version. Existing firms will not be treated as having accepted a version they never accepted.

25. Notices, survival, and entire agreement

Notices to the Customer may be sent to the registered administrative/correspondence email, by AEGYS administrative notice, or another reasonable written electronic method. Notices to A & S: hello@aandssolutions.com (support) and dpo@aandssolutions.com (privacy).

Provisions that by their nature should survive (including confidentiality, IP, indemnity, limitation of liability, governing law/venue, retention of A & S PIC records, and accrued payment obligations) survive termination.

These Terms, the DPA, and any written order or quotation with a stated validity period constitute the agreement for AEGYS. The Privacy Notice is A & S’s transparency notice and does not form part of this entire-agreement formulation. If a provision is unenforceable, the remainder continues.

26. Contact

A & S INFORMATION SOLUTIONS OPC Support: hello@aandssolutions.com DPO: Atty. Janine Rose G. Lumanag · dpo@aandssolutions.com https://www.aandssolutions.com