Terms of Service

Version: LABS-TERMS-EN-IS-v1.0

Effective date: 2026-09-25

These Terms cover digital and IT services supplied by Gatula ehf. under the Gatula Labs brand to business customers and private customers. They do not replace an existing accepted contract by appearing on a website.

Company and agreement

Supplier: Gatula ehf., an Icelandic private limited company operating Gatula Labs. Business and correspondence address: Bíldshöfði 16, 110 Reykjavík, Iceland. Kennitala: 450526-1850. VAT/VSK: 161431. Company register: Fyrirtækjaskrá, Skatturinn (Iceland Revenue and Customs).

General enquiries, complaints and withdrawal notices: [email protected] or [email protected].

Technical support: [email protected].

You do not need to copy the same message to all addresses. The contact labels do not promise particular service hours or a response time. Project-specific support commitments are stated in the accepted order.

Agreement and order information

The Client is the person or legal entity identified as the contracting customer in the accepted order. A payer, representative or end user is not automatically substituted for that party. A consumer is an individual ordering for purposes outside their trade or profession. Actual purpose, not a label on an invoice or email account, determines whether consumer protections apply. Mixed or uncertain purposes must be assessed before the appropriate terms are selected.

A Scope or Statement of Work (SOW) identifies the ordered results, inclusions, exclusions, assumptions, price, dependencies, dates, acceptance criteria and responsibilities. A Deliverable is an identified result in that Scope. A Defect is a failure to meet an applicable agreed criterion, without narrowing any statutory conformity or remedy rights. A Change is a proposed alteration to the accepted Scope, not merely a report of a Defect.

Before an order is accepted, we provide the applicable Scope, the dated Terms and any identified additional agreement. The order states the method of acceptance and authorized contacts. An enquiry, receipt of a draft or use of this website is not itself a paid order. An agreed payment method may evidence order acceptance only where the disclosed terms and applicable formation requirements are met; payment never substitutes for acceptance of the completed Deliverable under section 4.

An individually agreed project term takes priority only for its expressly identified subject or departure. Conflicts must be resolved explicitly; an incidental technical note does not rewrite legal terms. A binding data-processing agreement governs its processing subject matter. No document order removes mandatory rights. A separately executed service agreement applies as recorded in that agreement; these Terms and later website updates are not silently incorporated into it.

The applicable Terms and order documents are provided in a form that can be saved and retrieved. If an online ordering facility is used, it explains before order the steps to conclude the contract, available contract languages, correction of input errors, and whether and how the accepted contract is stored and accessible. We provide the order acknowledgement required for that channel. The actual order method for your project is identified before agreement.

Information and confirmation for consumers

Before a consumer is bound, we provide clear information on the service and its relevant functionality or compatibility, our identity and contacts, the total price including applicable taxes or a lawful calculation basis, additional and recurring costs, delivery and payment, contract duration and cancellation, complaints, statutory remedies and any applicable withdrawal right. Required information and general conditions are provided in Icelandic for the applicable Icelandic consumer offering; an English version does not replace that requirement.

We provide the required order confirmation in a form the consumer can retain, such as a personally addressed email with the applicable documents. For an off-premises contract, the required information and copy or confirmation are provided on paper or, with the consumer's agreement, another durable medium. For an electronic distance order involving payment, the final ordering action must clearly acknowledge the obligation to pay. A general acceptance of these Terms is not an early-start request or consent to loss of a withdrawal right.

1. Services

Our work may include website design and development, platforms, backend systems, dashboards, automation, integrations, infrastructure configuration, security work, technical audits, consulting and technical care. Only the expressly accepted Scope is ordered. Describing a capability does not include every service, test, language, integration or support activity in every engagement.

We perform our agreed work with reasonable professional skill and care and remain responsible for the work we undertake, including work delivered through our subcontractors. Relevant confidentiality, access, data and rights requirements must cover those contributors. A provider contracted directly by the Client is a separate relationship, but that does not remove our responsibility for our own agreed selection, integration or configuration work.

Business goals inform the project; they are not guarantees of revenue, search rankings, conversion or investment return. Any measurable technical performance promise must identify the metric, environment, dependencies and acceptance method. This does not reduce agreed functional requirements or mandatory rights.

A paid discovery or assessment stage is ordered with its own result, price and conditions. It does not automatically order a subsequent build. A first enquiry or conversation is not retrospectively charged by renaming it discovery.

2. Client responsibilities

The Client provides the information, materials, licences, permissions, access, feedback and decisions specified for the project. We identify the required inputs and their effect on delivery. The Client is responsible for having the necessary rights to supply its materials and authorize the agreed use; we remain responsible for our own work and must raise material problems we identify.

Project contacts and the people authorized to change price, Scope or legal terms are recorded separately. A person's technical access does not give them unrestricted contractual authority. The parties keep a record of the version actually agreed, rather than relying on a general description of a phone call or meeting.

Credentials, confidential material and production data must use the agreed secure channel and only the access necessary for the authorized work. No password belongs in the Scope or a public project document. Access is removed when no longer needed, subject to the agreed handover and continuing service.

If an input is delayed or inaccurate, we explain the affected work, reasonable mitigation and proposed timing changes. Work that can properly continue is not automatically halted. A Client delay does not by itself authorize a price increase or erase an agreed delivery commitment; material consequences require an agreed change or an applicable contractual or legal remedy.

The Client's approval of supplied text, business information or specialist claims does not remove our responsibility for work we have agreed to perform. Each party must obtain any specialist advice, authorization or source material allocated to it in the Scope. We do not promise legal, medical or financial validation merely because a website includes such content.

3. Proposals and estimates

The written proposal identifies whether each stage is fixed-price, time-based with stated rates and an authorization limit, or another clearly described arrangement. It distinguishes indicative dates from committed dates and identifies assumptions and offer validity. A fixed price for the agreed Scope is not increased unilaterally by calling it an estimate.

For time-based work, the agreed record of work supports billing. We warn before the authorized limit is exhausted; additional chargeable work requires approval. Urgent, after-hours or emergency rates and any expenditure authority must be disclosed and accepted before that work is commissioned. No urgency premium or minimum charge is created by these Terms.

Consumer prices include applicable taxes and disclosed compulsory charges. Where a final price cannot reasonably be calculated in advance, the calculation method and possible additional costs are explained before the order. Recurring work identifies the cost per billing period and any minimum duration. An undisclosed item is not automatically payable. Additional payments require express agreement, not a preselected option or the Client's silence.

Deposits and payments

Deposits are credited to the agreed price.

A deposit may be required before an agreed stage starts. Its amount, payment date and application against the relevant price are stated in the written project terms. The deposit forms part of that price and is not charged a second time.

For ordinary contractual termination, we calculate the amounts due for properly performed work and for accepted, unavoidable external commitments, credit payments already received and return the unused advance balance within the agreed settlement period, subject to mandatory law. Statutory consumer withdrawal follows its own rules; only amounts lawfully chargeable under those rules may be deducted. Reserving time alone does not make the whole deposit non-refundable. The same work or cost is not charged twice.

Any separate capacity-reservation fee requires an express written agreement defining its purpose, amount, when it is earned and its cancellation treatment. No such fee arises merely because a payment is called a deposit. Mandatory consumer rights remain unaffected. The order identifies invoice triggers, due dates, currency and how advances are credited. We distinguish the full value of a stage from its unpaid balance. External costs such as hosting, domains, licences, APIs or assets identify the payer, included allowance, recurring charges, renewal and approval of excess usage. We do not commit the Client to additional expenditure merely because a third-party service is useful.

A disputed invoice item should be identified with reasons so it can be addressed. For an overdue, undisputed sum, proportionate suspension is limited to the affected work after notice identifying the amount and a reasonable opportunity to remedy, as agreed for that order and permitted by law. It does not authorize destruction of Client data, interference with unrelated services or removal of already-granted paid rights. Lawful consumer withholding or other mandatory remedies are not overridden.

Consumer withdrawal — part of section 3

When the statutory right applies

For a service contract covered by the Icelandic distance or off-premises consumer-contract rules, the consumer normally has 14 days from conclusion of the contract to withdraw without giving a reason. This is distinct from ordinary termination under sections 3 and 7. A contract made at business premises does not acquire a general 14-day right merely through these Terms; any other statutory or expressly agreed cancellation right still applies.

Before conclusion, we supply the applicable withdrawal information and prescribed model form. Use of the form is optional. The consumer may instead send a clear statement identifying the contract and the decision to withdraw to [email protected] or [email protected], or the Supplier's confirmed postal address above. Sending it before the applicable deadline is sufficient. Where an online withdrawal facility is provided, we acknowledge receipt on a durable medium without undue delay.

If required withdrawal information was not provided, the period can extend to 12 months after the end of the original period. If it is supplied during that extension, the period ends 14 days after the consumer receives the information. The consumer should keep evidence of the notice; we retain the required information and consent records without treating retention as consent.

Starting a service within the withdrawal period

We start during that period only following the consumer's express request and the required information. For an off-premises contract, the request must be on a durable medium. We record the request separately from general acceptance of these Terms. The consumer may choose a later start instead.

If the consumer withdraws after a properly requested early start, an amount is payable only where the law permits it, proportionate to the service supplied up to notice compared with the full agreed service. The total agreed price is the basis unless excessive, when the market value of the supplied service is relevant. Ordinary supplier commitments, internal reservation fees or a blanket non-refundable deposit are not automatically deductible under this route. No service amount is charged where the legally required information or express request was missing.

The withdrawal right is not lost simply because work starts, a deposit is paid, or the project is bespoke. For a fully performed service, loss of the right requires the relevant prior express consent and acknowledgement that full performance will end the right, together with actual full performance. Acceptance of one stage does not prove full performance of a larger ordered service.

Digital content and refunds

For a separately identified supply of digital content without a physical medium, any loss of withdrawal rights follows that distinct statutory rule: prior express consent to begin supply, acknowledgement of the resulting loss and the required confirmation. We do not apply this exception to all development, hosting or care merely because files are delivered electronically. No digital-content charge is imposed on statutory withdrawal where the required consent, acknowledgement or confirmation was absent.

We reimburse amounts due without undue delay and no later than 14 days after notification of withdrawal, normally by the same payment method unless the consumer expressly agrees otherwise without a fee. Any lawful proportionate service amount is identified separately. Linked contracts are dealt with under the applicable statutory rules; ordinary cancellation deductions do not displace them. Withdrawal is separate from rights relating to defective or non-conforming work, which remain available where applicable.

4. Delivery, review and approval

Delivery may take place in the stages identified in the Scope. Readiness for review, acceptance, permission to go live, account handover and payment are distinct events. We identify the result and version submitted, not simply state that the whole project is finished.

We provide each agreed deliverable for review with the materials needed to assess it against the written acceptance criteria. The project terms set the review period, reviewer and correction arrangements. Acceptance requires the Client's express written confirmation. Silence, payment, testing or use alone does not constitute acceptance; a delayed response leads to a reminder and escalation through the agreed contacts.

The Client may expressly accept with an agreed list of non-blocking items, responsibilities and target dates. Corrections due under the agreed scope remain distinct from separately purchased maintenance or new work. New requests follow section 5. Acceptance does not by itself authorize production launch or remove outstanding correction obligations or mandatory rights. Where we are responsible for a failure to meet the agreed criterion, we correct it within our correction obligation without charging an additional development fee and arrange the relevant retest. The Scope identifies any contractual post-acceptance correction period and process. Expiry of that period does not remove mandatory rights, nor does absence of a care subscription make a correction already owed chargeable.

Consumers retain the applicable statutory remedies for defective or non-conforming performance. A review deadline, test environment, acceptance record or optional commercial guarantee does not reduce those remedies. A defect that could not reasonably be discovered during review is not treated as waived by that review. Any separately offered guarantee is described with its own conditions and does not replace statutory rights.

5. Change requests

A request outside the confirmed Scope can affect price, time, acceptance, data, rights or recurring costs. Before additional work, we describe the difference and its consequences. Authorized representatives must accept the change in a durable written record. Silence does not approve it, and payment for an earlier stage does not authorize unrelated work.

Additional pages, languages, integrations, migrations, design rounds or functions may be Changes only if they were not already ordered. A missing item included in the accepted Scope is not renamed an extra feature to make its correction chargeable. Where classification is uncertain, we record and resolve the issue before committing to extra charges.

If a Change is declined, the existing Scope continues unless an affected part genuinely requires resolution. Any pause and proposed next step are explained; no unapproved additional work is treated as ordered. Emergency work requires an existing scoped authorization or a new express agreement on authority, limits and charges. A consumer's mandatory rights cannot be removed through the change process.

6. Intellectual property

For each custom deliverable or clearly identified group, the written project terms specify whether the Client receives an assignment of defined economic rights or a licence. They identify the permitted use, source access, maintenance by others and the relevant payment condition. Neither model is selected automatically; payment or administrator access alone does not define the rights grant.

Internal production tools used to perform the work remain with Gatula Labs, including tools developed during the engagement. This reservation does not reclassify a tool or other result expressly commissioned as a deliverable. It does not permit reuse of Client confidential information or override third-party rights.

If a retained component is needed for the agreed operation, rebuilding, deployment or maintenance, we identify the dependency and agree the necessary use rights, service arrangement or alternative before committing to the handover. This does not transfer ownership of the tool or automatically license all Labs materials.

Third-party materials retain their applicable licences. Material restrictions and necessary rights must be addressed for the intended use. Any public reference, Client logo or case study requires a separate written approval. The order identifies the actual outputs and the rights attached to each. An assignment must specify the transferable rights; a licence must specify its permitted uses, duration, territory, modification, source access, use by an independent maintainer and any recurring conditions that apply. The payment trigger must identify the relevant result or defined group and its allocated price, rather than depend on an unrelated invoice.

We must have or obtain the rights necessary to supply the agreed result and grant. A technical job title or a branding credit is not evidence of a contributor's rights transfer. The Client retains its supplied materials and permits their use for the agreed work only. Each party's confidential information remains protected.

Any pre-payment evaluation access is separately defined. Rights already validly granted and paid for do not automatically end when a separate care service ends. The treatment of work in progress and paid stages on early termination is recorded consistently with settlement and the selected grant. No general right to withdraw paid rights or hold unrelated accounts is created to secure payment.

Nothing in these Terms or an agreed Scope restricts non-waivable rights of a lawful software user, including the rights provided by Article 42a of the Icelandic Copyright Act where applicable and subject to its conditions. This does not grant access to internal production tools that are not supplied, assign their ownership or permit use beyond those rights and the agreed grant.

Handover of a source archive is not itself an assignment of copyright, and retaining a production tool does not mean that Labs owns all code written for the Client. The Scope must let the Client understand what it will receive, what remains external, and what is needed for the promised continuing use.

7. Hosting, access and maintenance

Hosting, monitoring, backup operations, restore testing, maintenance, incident response and modifications are supplied to the extent expressly ordered. This does not remove our duties for work or processing we actually undertake, including mandatory safeguards and reasonable professional care.

The Scope identifies project resources, who controls each relevant hosting, domain, repository or deployment account, and the agreed handover. Where agreed and technically permitted, the Client receives its project source and full administrator access to its identified resources. This excludes internal Labs production tools, shared master accounts and unrelated client environments. Resources may need separation or migration to meet the promised handover. Credentials use the agreed secure channel; the completion record contains no passwords.

Technical care. A care order specifies covered assets, activities, period, price or allowance, contact and service window, any response or restoration commitment, renewal, notice and exit. Support, correction of a Defect and new development are not interchangeable. No automatic renewal, 24-hour coverage, unlimited changes or guaranteed recovery time arises from this general description. A renewal or price change must have a clear agreed basis and comply with applicable consumer rules; no retrospective change is created by updating this website.

Changes by others. If the Client or another provider changes code, DNS, plugins, data, credentials or infrastructure, the parties assess the cause and effect of a reported issue. We are not responsible to the extent an outside change caused the harm, but remain responsible for our own obligations and contribution. This is not a blanket exclusion of consumer remedies. Investigation or repair outside our existing obligation is paid only where its scope and charges are accepted.

Interruptions and security. We do not promise permanent error-free availability or immunity from attack. Any sold availability or recovery commitment is defined in the order. For a material security risk or unlawful instruction, we may take proportionate protective action on the affected service, with notice as soon as lawfully practicable and an explained recovery path. A third-party failure does not automatically excuse our own agreed continuity or integration work. An event outside reasonable control requires notice, mitigation and an appropriate continuation or exit; it does not erase mandatory rights.

Ending ordinary work or care. The order sets its duration, any ordinary cancellation rights, notice and the opportunity to remedy material breach. No blank notice field selects immediate termination. On ending, we identify performed work, payments, remaining duties, paid rights, Client materials, account handover and any expressly ordered transition. Section 3 governs ordinary advance settlement; statutory withdrawal has its own route. Unperformed future work is not automatically payable in full. If our breach affects the result, available correction, refund and other remedies are addressed without charging again for curing our own non-performance.

The end of a build does not erase owed corrections or create indefinite support. Access is withdrawn after the agreed handover or continuing service, with data return and deletion handled under section 9. The Client retains mandatory termination and remedy rights independently of the ordinary notice process.

8. AI-assisted work

We may use AI-assisted tools for research, drafting, code support, testing, automation design and productivity, within the permitted project scope. Professional review remains our responsibility. Naming an AI provider does not authorize use of every account, product or feature with the Client's information.

Before submitting confidential material, code or personal data to a tool, we establish the authorized purpose, necessary information, actual service and settings, recipients and processing arrangements. The location of our own servers does not determine the location of external AI processing. These Terms do not promise exclusive processing in France, zero retention or no model training without evidence for the specific use.

AI functionality included in the delivered product must be separately described: intended users, limits, human review where needed, operating costs, data and acceptance criteria. Internal use of AI by the team does not mean an AI feature is included in the Client's product. The parties identify who must validate specialist or regulated claims; this does not transfer responsibility for our own contracted work to the Client.

9. Confidentiality and data

Each party protects the other's confidential information and uses it only for the authorized purpose. Access is limited to people and approved providers who need it and are subject to appropriate duties. The duty excludes information lawfully public, already held, independently developed or lawfully received without restriction. Legally required disclosure is limited to what is necessary, with notice where permitted. Any applicable separate confidentiality agreement is identified in the order.

Our Privacy Policy explains processing for our own enquiries and business relationship. Where we process personal data on a Client's behalf, the relevant roles, instructions and binding data-processing terms must be established before that processing. A link to the Privacy Policy or a field in a SOW is not a complete data-processing agreement. Service providers, permitted locations and international transfers must have the arrangements required for the actual processing.

Security measures, incident cooperation, access and retention are matched to the actual scope. A processor-scope personal-data breach is notified to the relevant controller without undue delay after awareness, with available information and updates. We do not substitute a blanket 72-hour allowance for that duty or claim an unverified incident-response capability.

Delivery-date archive. The order specifies authorized snapshot contents, purpose, handover date, duration, storage, access and deletion or return. At handover, we create the authorized snapshot described in the order and retain it for the stated period, up to five years unless a different lawful contractual arrangement applies. Shorter purpose-based, mandatory or processing-agreement limits prevail. This is not a continuously updated backup, a tested-restore certificate or an order for maintenance.

Personal data processed on the Client's behalf is returned or deleted, at the controller's choice, when the relevant processing service ends, including copies unless law requires retention. A separately continuing archive service needs documented instructions, purpose, duration and applicable processing terms. Necessary records retained for our independently determined lawful purposes are assessed separately and minimized. A five-year archive clause is not permission to retain every operational database, credential or user file. Lawfully retained material remains protected and is not reused for unrelated purposes.

10. Limitation of liability

Business orders — a limit agreed for the identified work

For each business order, the liability arrangements are expressly agreed in the written Scope before that order is accepted. Any contractual cap applies only to the parties, work and claims identified in that accepted provision, subject to applicable law. The provision states its amount or calculable basis, currency, tax and external-cost treatment, relevant period, aggregation of related claims and any special treatment of confidentiality, personal data or intellectual property. These Terms do not impose a default limit based on cash received during the three months before a claim.

For a one-off build, the provision identifies the ordered build and relevant fee base or other agreed amount, including its application after payment. For continuing care, it identifies the covered obligations and period, allocation of prepaid fees, the initial period and claims after care ends. For combined work, it states how a claim involving both build and care is allocated and aggregated. Caps are not automatically added together, nor is all work automatically reduced to the smallest care payment. A particular multiplier, number of months or cap equal to the project price is not chosen by this general description.

A limit must actually be agreed; an incomplete reference or a later website update does not supply it. Where no enforceable cap has been agreed, the parties' liability is determined by the applicable law and accepted contract. This is not a promise of unlimited compensation and does not create a zero cap.

Settlement, remedies and protected rights

An agreed damages cap does not reduce the obligation to pay the agreed price or to reconcile and return unused advances under section 3. The written project terms state how correction, re-performance, other refunds and compensation interact with the cap, without double recovery for the same loss. Ordinary termination and statutory consumer withdrawal retain their separate rules.

Any agreed exclusion of indirect or consequential loss must be expressly described and reviewed for the engagement. Data loss, a third-party outage or a security incident is not automatically excluded regardless of its cause or the obligations we undertook. No limitation applies where the law does not allow it, and no inter-party term restricts the rights of individuals under data-protection law or the powers of authorities. No contractual exclusion or limitation of liability in these Terms or an accepted business Scope applies to liability arising from fraud, wilful misconduct or gross negligence, or to liability that cannot lawfully be excluded or limited. This provision does not establish liability where none otherwise arises, change the applicable causation or proof requirements, or allow double recovery. The Scope separately records the treatment of inter-party confidentiality, personal-data and intellectual-property claims, without overriding these exceptions or mandatory rights.

Consumers — separate protection

The business-cap mechanism above is not incorporated into a consumer order. A consumer retains the statutory conformity and remedy rights available under the law applicable to that order. Those rights are not replaced by a fee-based business limit. Those rights are not conditional on buying technical care. Any specific consumer provision must be separately reviewed, clear and fair, communicated before agreement and consistent with mandatory rights. Calling work an estimate, an AI output or a third-party dependency does not itself remove our responsibility for our agreed work.

11. Governing law

These Terms are governed by Icelandic law. For a consumer, this does not remove mandatory protections or access to a competent forum that applicable conflict-of-law or jurisdiction rules preserve, including where the consumer lives in another country. A separate governing-law or forum provision in an individual contract must be expressly reviewed and agreed, not inferred from a project contact or website visit.

Questions, complaints and withdrawal notices may be sent to [email protected] or [email protected], or to the confirmed postal address above. Technical support is available through [email protected] and the listed IT contact, within the agreed scope. Identify the order and issue where possible without including passwords or unnecessary personal data. One message is enough; internal routing does not require a duplicate submission or Labs approval to exercise a statutory withdrawal right. We respond to requests for information and complaints as quickly as possible and seek a satisfactory resolution, explaining the proposed response. Discussion or internal escalation does not prevent urgent protective steps, statutory remedies or timely access to a competent dispute-resolution body or court.

For eligible consumer disputes, information about the Complaints Board for Goods and Services — Kærunefnd vöru- og þjónustukaupa (KVTH) is available at https://island.is/v/kaerunefnd-voru-og-thjonustukaupa. The published contact address is Borgartún 29, 105 Reykjavík, Iceland. The Board's jurisdiction and admissibility rules apply; referral is not a promise that every claim will be accepted. If we reject a consumer claim in whole or in part, we provide information about the competent dispute-resolution body, including its address and website, without delay in writing or on another durable medium. The consumer is not required to complete an additional internal appeal before receiving that information. These Terms do not establish voluntary participation in an unidentified scheme or arbitration.

Questions about Scope, payments, rights or handover should be resolved before acceptance of the order. Future changes to this website do not retrospectively amend an existing contract. The agreed version and any expressly accepted amendment remain identifiable, subject always to mandatory law.