Terms of service

Version 1.0, effective 14 October 2026.

1. Who these terms are between

These terms govern the use of TimberTrail by Kaudata ("TimberTrail", "the service"), including its connection for AI assistants, provided by KAUDATA d.o.o., Kidričeva cesta 2 B, 3320 Velenje, Slovenia, registration number 8948925000, VAT number SI 76817008 ("KAUDATA", "we").

The service is provided to organisations (each a "customer") under a written contract with KAUDATA. These terms apply to the customer and to every person who uses the service on its behalf (a "user"). Where the customer's contract says something different, the contract prevails. The service is offered to businesses only, not to consumers.

2. Accounts

There is no self sign-up. KAUDATA creates the customer's organisation and its first Skrbnik (owner). The Skrbnik (owner) invites colleagues and gives each a role: Skrbnik (owner), Oddajatelj (submitter), Pripravljavec (preparer) or Revizor (auditor). Only users with the Skrbnik (owner) or Oddajatelj (submitter) role can file.
Each account is personal. Users keep their password secret, may switch on a second factor on the Varnost računa (account security) page, and tell their Skrbnik (owner) at once if they suspect that someone else has used their account.
The customer is responsible for whom it gives access to, for the roles it assigns, and for deactivating the accounts of people who should no longer have access.
KAUDATA may deactivate an organisation or an account where the customer's contract allows it, or where that is needed to stop misuse or to protect the service or other customers. Users of a deactivated organisation cannot sign in, and its AI app connections stop working.

3. What the service does

It keeps the customer's suppliers, producers, plots and their geolocation, ZGS felling decisions, Article 6 mandates and products, and helps prepare due diligence statements and simplified declarations under Regulation (EU) 2023/1115 (the "EUDR").
It checks a statement's content and geolocation against the EU's rules before filing, files it in the EU Information System, follows its status, and keeps the record of what was sent and received.
It files into the EU system the statement's EU access key belongs to: the European Commission's acceptance (test) environment or its production environment. A statement filed into the production environment is a legal act.
It shows warnings about deadlines in the application and, from the production installation, sends them by e-mail to users with the Skrbnik (owner) or Oddajatelj (submitter) role. Warnings are an aid; they do not take over the customer's duty to meet the deadline.
It offers an optional connection for AI assistants (section 8).

4. What the service does not do

It gives no legal advice. Explanations and legal notes in the service, and in these texts, are general information about how the service applies the EUDR. They are not advice on the customer's situation. The customer decides whether it has to file, what, and in which role.
It does not verify that the data is true. It checks format, completeness and consistency with the EU's rules. It cannot know whether timber came from the plot stated, whether a ZGS decision is valid, or whether a mandate was signed by the right person.
It cannot guarantee the EU's answer. It cannot guarantee that the EU Information System accepts a filing or is available, or that a competent authority agrees with what was filed.
It does not take over the operator's responsibility. The operator remains responsible for the compliance of its products under Article 6(1) EUDR, also where KAUDATA files for it as authorised representative.

5. Filing

Every filing is made by a user, with a role that allows it, on the customer's behalf. On a screen, the user files by choosing to submit.
Through an AI app, a filing tool works only with a confirmation issued by a preparation step after the pre-flight check. The confirmation is bound to the exact content prepared, the user, the organisation and the app, can be used once, and is valid for 15 minutes. The service instructs the assistant to show the user what will be filed and to ask for an explicit yes, but it cannot verify that a person said yes. A filing made through a connected AI app is the customer's filing, exactly as one made on a screen.
A filed statement cannot be deleted. It can be amended or withdrawn only within the limits the EU rules set: within 72 hours of the reference number being made available, a period that can in some cases be extended, and in some cases not at all, for example once the statement has been referenced in a grouped statement or presented to customs.
When the outcome of a filing cannot be established, for example because the EU Information System does not answer in time, the service marks it as unknown and does not repeat it automatically. A user resolves it in the service. Do not file the same statement again until its outcome is known.
The customer is responsible for meeting every deadline the EUDR sets.

6. Authorised representative

Where the customer wants KAUDATA to file on its behalf as authorised representative under Article 6 EUDR, it appoints KAUDATA by a separate written mandate. These terms do not create a mandate. Under Article 6(1) EUDR the operator retains responsibility for the compliance of the relevant products.

7. The customer's responsibilities

The customer is responsible for:

the data it enters being accurate, complete and lawfully obtained;
having a legal basis for the personal data it records, including data about forest owners, and for giving those people the information the GDPR requires;
holding a mandate wherever it files for someone else, and being entitled to use the EU access keys it stores;
the decision whether its users may connect AI apps and give them its data, including any processing of that data outside the European Economic Area by the AI app's provider;
keeping the records the EUDR requires it to keep; the service helps, but the duty stays with the customer;
its users following these terms.

8. The AI assistant connection

The connection is optional and is off for every organisation until KAUDATA switches it on for that organisation. Whether it is included is agreed in the customer's contract.
The AI app is a third-party service that the user or the customer chooses, used under its own terms with its provider. KAUDATA does not provide or control the AI app and is not responsible for its replies or for what its provider does with the conversation. AI apps make mistakes; the customer checks what an assistant has prepared before it is filed.
The AI app works with the user's role and never with more. It cannot create or replace EU access keys, manage users and roles, change passwords or second-factor settings, manage AI app connections, or reach KAUDATA's staff area.
Access through a connection ends 90 days after the user allowed it, and earlier in the cases the privacy policy lists. The connection is described in the AI connector documentation.
KAUDATA may switch the connection off for an organisation where the customer's contract allows it or where that is needed to protect the service. Switching it off ends every connection of that organisation.

9. Acceptable use

Users must not:

access or try to access another organisation's data, or test the service's security other than as the security page describes;
file anything they know to be false or that they are not entitled to file;
use the EU production environment for tests;
share their account or their sign-in with anyone else;
overload the service or the EU Information System, for example with automated requests beyond normal use; the EU limits how often it may be called, and every customer of the service shares that limit;
upload malicious files or files that are not the documents they claim to be;
copy, resell or decompile the software, except where the law allows it.

10. Availability and changes to the service

We work to keep the service available, but we do not guarantee that it is uninterrupted or free of errors. We may interrupt it for maintenance or for security.
The EU Information System is operated by the European Commission. When it is unavailable, the service cannot file statements or refresh their status.
There is no service level unless the customer's contract states one.
We may change and develop the service. Changes to what a customer has contracted for follow its contract.

11. Data protection

How the service handles personal data is set out in the privacy policy. The customer's contract sets out the terms on which KAUDATA processes personal data on the customer's behalf (Article 28 GDPR).

12. Intellectual property

The software, its documentation and these texts belong to KAUDATA. For the duration of its contract the customer may use the service for its own business. The customer's data remains the customer's; KAUDATA uses it only to provide the service.

13. Liability

KAUDATA is liable without limitation for damage it causes intentionally or through gross negligence.
For any other damage, to the extent the law allows: KAUDATA is not liable for indirect or consequential loss, loss of profit or loss of business, or for fines and other consequences of the customer's own obligations under the EUDR; and its total liability is limited to what the customer paid for the service in the 12 months before the event that caused the damage.
KAUDATA is not liable for the operation of the EU Information System, for AI apps and their providers, or for damage caused by inaccurate data the customer entered.
Nothing in these terms limits liability that cannot be limited by law.

14. Suspension and end of the contract

The customer's contract governs its duration and its end. When an organisation is deactivated, its users can no longer sign in and its AI app connections stop working. What happens to the organisation's data when the contract ends is described in section 7 of the privacy policy and agreed in the contract.

15. Changes to these terms

We may change these terms. The version and the date at the top change with every change, and the current version is always at /terms. A change to a customer's contractual position takes effect as its contract provides.

16. Governing law and disputes

These terms are governed by the law of the Republic of Slovenia, excluding its conflict-of-laws rules and the United Nations Convention on Contracts for the International Sale of Goods. Disputes are decided by the court with subject-matter jurisdiction at the registered office of KAUDATA d.o.o.. If a provision of these terms is held unenforceable, the rest remains in force.

17. Contact

KAUDATA d.o.o., Kidričeva cesta 2 B, 3320 Velenje, Slovenia. E-mail: info@kaudata.si. Company details are in the imprint.