September 2026
R2 Docuo is a file hosting, document management and workflow service, provided on a “software as a service” basis by R2 Sistemas Informáticos, S.L. (“R2 Sistemas”), a Spanish company with registered office at Paseo de la Castellana 77, 28046 Madrid, registered with the Commercial Registry of Madrid at volume 15,594, folio 35, sheet M-262513, with tax identification number B-82711078. The service also incorporates trusted electronic services and artificial intelligence features.
These conditions (the “Conditions”) govern the contracting of the right to use the R2 Docuo service (the “Service”) through the website https://www.r2docuo.com (the “R2 Docuo Website”), as well as the use of the Service through any of the Access Means.
The Conditions do not amend any particular agreement between the User and R2 Sistemas relating to other products or services of R2 Sistemas, which will continue to be governed by its own terms.
The collection and use of personal data are governed by the Privacy and Cookies Policy published at https://www.r2docuo.com/en/privacy-policy (the “Privacy Policy”), without prejudice to Clause 13 as regards the data that R2 Sistemas processes on the User’s behalf.
By accessing the R2 Docuo Website, by using the Service or, where applicable, by clicking “I accept”, the User declares that it has read the Conditions and accepts them in full and without reservation. Anyone who does not agree with them, in whole or in part, must refrain from accessing the R2 Docuo Website and from using the Service.
Unless these Conditions provide otherwise, R2 Sistemas may amend them at any time, notifying the User at the email address on its registration at least one (1) month before the new version takes effect. The date appearing at the beginning of the Conditions is that of their last update.
If the User does not accept the new version, it may cease using the R2 Docuo Website and the Service before that version takes effect. Use of the Service once the new version is in force constitutes full acceptance of it.
In these Conditions, capitalised terms have the following meaning, in both the singular and the plural:
– “Access Means”: the means by which the Service may be accessed: (1) the Desktop Application; (2) the Web Portal; (3) the Mobile Apps; (4) the API; (5) the MCP Server; and (6) any other means that R2 Sistemas may establish from time to time.
– “Account”: the user account that the User creates and activates on the R2 Docuo Website in order to use the Service.
– “Add-ons”: the optional features with their own price, such as integrations with third-party systems, provided for in Clause 7.4.
– “AI Act”: Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence, as amended by Regulation (EU) 2026/1744.
– “AI Features”: the features of the Service based on artificial intelligence systems, governed by Clause 21.
– “AI Provider”: the third party that operates the language model consuming the Tools through the MCP Client.
– “API”: the R2 Docuo programming interface that allows the User to develop applications that use the Service, governed by Clause 16.1.
– “API Application”: any software application, developed by the User or by a third party on its behalf, that accesses the Service through the API (R2 Docuo API application).
– “Balance”: the quantity of Credits acquired and not consumed appearing in the User’s Account at any given time.
– “Collaborator”: each collaborator account with restricted access to a Repository, in accordance with Clause 7.4.
– “Conditions”: these conditions.
– “Credits”: the prepaid system with which certain operations of the Service and the extension of its usage limits are paid for, governed by Clause 8.6.
– “Desktop Application”: the R2 Docuo application for Microsoft Windows ®[1] operating systems.
– “eIDAS Regulation”: Regulation (EU) No 910/2014 of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC.
– “Evidence Document”: the certificate containing all the evidence of a signature process, technical and non-technical, signed by R2 Sistemas.
– “Fee”: the periodic price, monthly or annual, of a Licence, depending on the Plan and the Parameters contracted.
– “GDPR”: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
– “Legacy Plans”: the “Professional Edition”, “Business Edition” and “Enterprise Edition” plans, in accordance with Clause 7.3.
– “Licence”: the right to use the Service in respect of a Repository, with the Plan and the Parameters contracted.
– “Licensed User”: each user account with access to a Repository and to its features, in accordance with Clause 7.4.
– “MCP Client”: the third-party application that connects to the MCP Server on the User’s behalf.
– “MCP Server”: the R2 Docuo server for the Model Context Protocol, governed by Clause 16.2.
– “Mobile Apps”: the R2 Docuo applications for the iOS[2] and Android[3] operating systems.
– “Paid Plans”: the Plans other than the Trial Plan, that is, One App, All Apps and Custom.
– “Parameters”: the magnitudes contracted for a Repository that determine the Fee —as at the date of these Conditions, the space, the number of Licensed Users, the number of Collaborators and the Add-ons—, in accordance with Clause 7.4.
– “Particular Conditions”: the document entered into between the User and R2 Sistemas establishing services or conditions additional to or different from those provided for in these Conditions, in accordance with Clause 7.6.
– “Plan”: each of the Licence types provided for in Clause 7.2.
– “R2 Docuo Apps”: the standard R2 Docuo applications, finished products that offer the same features to all Users and are not modifiable.
– “R2 Docuo Trusted Electronic Services”: the trusted electronic services governed by Clause 6.
– “Repository”: each space in which the User stores, edits and manages its files and data, associated with a Licence.
– “Support Ticket”: the support system of the R2 Docuo Website provided for in Clause 15.2, the sole channel of communication between the User and R2 Sistemas for the purposes of these Conditions unless another is indicated.
– “Tool”: each individual operation made available by the MCP Server, with its description, its parameters and its labelling in accordance with Clause 16.2.c).
– “User”: the legal person, or the natural person acting as a business or professional, that accepts these Conditions and contracts the Service.
– “User Content”: the trade marks, images, logos and other elements that the User uses to identify its Repositories and to customise the Access Means.
– “Web Portal”: the websites https://portal.r2docuo.com and https://app.r2docuo.com.
The Service is aimed exclusively at legal persons and at natural persons over eighteen (18) years of age acting in their capacity as businesses or professionals. It is not aimed at consumers, and consumer protection legislation therefore does not apply to it.
The natural person who accepts these Conditions declares that they are over eighteen (18) years of age and have full capacity to enter into obligations. Persons under that age must not access or use the Service.
Anyone who registers or uses the Service on behalf of a legal person declares that they are duly authorised to represent it, to accept these Conditions and manage the Account on its behalf, and to bind it to their performance. In that case, the User is that legal person.
The User may access and use the Service only in accordance with these Conditions, in good faith and without negligent, fraudulent or unlawful purposes. It will not engage in any conduct that may harm the image, the interests or the rights of R2 Sistemas, of other users or of third parties.
Before using the Service, the User must check that its characteristics and features, including those of the R2 Docuo Trusted Electronic Services as described in these Conditions and on the R2 Docuo Website, meet its needs, and must have available, at its own cost, the requirements, equipment and software necessary to use it.
The rights that these Conditions grant to the User are personal. They may not be assigned to third parties, in whole or in part and by any means —including subsidiaries, companies within the same group and any other related entity—, without the prior, express and written consent of R2 Sistemas. The marketing, resale and any analogous use of the Service are prohibited and will give rise to its immediate termination.
Without prejudice to the foregoing, the User may provide access to the Service to employees, customers, collaborators and other third parties, as Licensed Users, as Collaborators or as signatories of the R2 Docuo Trusted Electronic Services, as added value in its relationship with them and whether free of charge or for remuneration. The User is solely responsible for its relationship with those persons and for their compliance with the Conditions, and R2 Sistemas assumes no obligation or liability towards them.
Through the Service, the User stores, edits and shares files and metadata in its Repositories, signs documents with a qualified electronic signature by means of a digital certificate (eCertificate) and with an advanced electronic signature by means of a stroke, password, validation code or a combination of these (eSignature), and uses the other R2 Docuo Trusted Electronic Services. The User is solely responsible for those files, for their content, for its communications and for its conduct on the Service. R2 Sistemas does not monitor, review, edit or warrant the content that the User stores, publishes or shares, nor is it liable for it.
The User may access the Service through agents or assistants based on language models, on the terms of Clause 16.2. Operations executed in that way are deemed to have been carried out by the Licensed User holding the authorisation used, irrespective of whether the specific instruction was issued by an agent or assistant. The User is solely responsible for the instructions it issues by that route and for their results.
In order to use the Service, the User must register on the R2 Docuo Website, provide the information required there from time to time —including a valid email address, at which it will receive the notifications relating to the Service— and activate the Account by means of the validation email that R2 Sistemas will send automatically. The Account is created following that validation.
The registration information must be truthful, complete and up to date, and the User is solely responsible for keeping it so. No one may register by impersonating another person. If the information is false, incomplete or not up to date, or R2 Sistemas has grounds to suspect that it is, R2 Sistemas may suspend or cancel the Account, the use of the Service and the User’s Repositories.
The User is solely responsible for the use, configuration, management and administration of the Account and of its Repositories, and for all use of the Service made through it, from any device or location, by the User itself, by the Licensed Users and Collaborators attached to the Account or by any other third parties that it authorises to use features of the Service, such as the signatories of the R2 Docuo Trusted Electronic Services, with the indemnity provided for in Clause 18.
R2 Sistemas is not a party to any of the documents managed through the Service and makes no representation or warranty as to the transactions carried out by means of it. The User is solely responsible for those transactions and for their compliance with the formalities and conditions required by the applicable rules.
The User will safeguard its passwords, will treat them confidentially and will not disclose, publish, distribute or divulge them. It will not allow other persons to use its Account, nor will it use another user’s account. It will immediately inform R2 Sistemas of any security breach, actual or suspected, and of any unauthorised use of the Account, including theft, loss or unauthorised access to its credentials, so that R2 Sistemas can cancel them. If R2 Sistemas has grounds to suspect that the Account is being used by unauthorised third parties, it may suspend it, together with the use of the Service and the User’s Repositories.
The User is liable for any unlawful use of the Service made by a third party with credentials obtained through a lack of diligent safekeeping or through their loss, as well as for the use made by third parties to whom it voluntarily provides them. Until the User reports the events referred to in the preceding paragraph, R2 Sistemas is released from all liability arising from the improper use of the credentials by third parties.
The secrets and access tokens that the User or the Licensed Users generate in order to access the Service through the API or the MCP Server are, for all purposes of this Clause and of Clause 17, treated as passwords for access to the Service, on the terms of Clause 16.3.a).
The files and data stored, edited and managed in a Repository are hosted on servers controlled by R2 Sistemas.
The Repository is accessible through any of the Access Means, with a broadband or better internet connection. The full features of the Service —including advanced and configuration tasks, the setting of permissions and the definition of workflows— require access to the Repository through the Desktop Application. Access through the MCP Server is limited to the features that R2 Sistemas publishes as available by that route from time to time, which do not necessarily coincide with those accessible through the other Access Means.
The User will identify each Repository with a name and may customise the Access Means with its image and its colours through the Account, within the technical limitations that R2 Sistemas establishes for each Access Means.
The User is solely responsible for the User Content. In uploading it, the User authorises R2 Sistemas to use it for the management of the Repository and for that customisation, warrants that it holds the rights necessary for that use and will ensure that it has the relevant authorisations where it uses third-party trade marks or names, with the indemnity provided for in Clause 18.
At the end of the trial period of a Licence with a Trial Plan or “Free Trial” (thirty (30) days), the Repository moves to the “Trial ended” status for thirty (30) days, during which the User cannot access the files stored in it. The User may recover the Repository during that period by acquiring a Licence with any of the Paid Plans. If that period elapses without its doing so, the Repository, together with its files and metadata, is permanently deleted with no possibility of recovery.
A Repository moves to the “Unpaid” status where any Fee cannot be charged in accordance with Clause 9.5, and to the “Deleted” status where the User deletes it through its Account, where it cancels the renewal of its Licence in accordance with Clause 8.3 or where thirty (30) days elapse in the “Unpaid” status.
In the “Unpaid” and “Deleted” statuses the User cannot access the files stored in the Repository or use the features of the Service in respect of it. Once thirty (30) days have elapsed since the Repository moved to the “Deleted” status, the Repository, with all its files and metadata, is permanently deleted with no possibility of recovery.
Before that point, the User may recover the Repository, with its files and metadata: if the User deleted it itself, by changing its status through the Account; if it moved to “Unpaid” or “Deleted” for non-payment, by paying the Fees corresponding to the period during which it remained in those statuses.
The deletion of a Repository does not terminate the Service where the User has other Repositories, which remain accessible; it does, however, entail the loss of access to the deleted Repository, to its files and to the data of the R2 Docuo Trusted Electronic Services linked to it, on the terms of Clause 11.
Where the User has the R2 Docuo Verifactu module active, the Service acts as an Invoicing Computer System (Sistema Informático de Facturación) within the meaning of Spanish Royal Decree 1007/2023 of 5 December and of Order HAC/1177/2024 of 17 October, exclusively in the «VERI*FACTU» mode and on the terms of the responsible declaration that R2 Sistemas keeps published at https://www.r2docuo.com/es/declaracion-responsable-verifactu. The User is the taxpayer responsible for the invoices it issues and for its tax obligations, and is liable for the accuracy of the data it enters. Without the Verifactu module active, the Service is not an Invoicing Computer System and the User will not use it to issue invoices from the date on which the applicable rules require the use of a system of that nature.
R2 Sistemas, in its capacity as a trust service provider, offers the User two non-qualified services: an advanced electronic signature service, comprising the creation, validation and preservation of signatures, and a certified electronic delivery service (the “R2 Docuo Trusted Electronic Services”). Both are provided in accordance with the eIDAS Regulation and with Spanish Law 6/2020 of 11 November governing certain aspects of trust services (the “Electronic Signature Act”), and have the legal validity and evidential effect that those rules attribute to them.
R2 Sistemas does not issue electronic certificates and does not act as a certification service provider. The qualified electronic signature of PDF documents with a digital certificate (eCertificate) operates with certificates issued by third parties and provided by the User. Different is the electronic certificate owned by R2 Sistemas, with which advanced electronic signatures (eSignature) are in all cases generated and the Evidence Document is signed: its obtaining, safekeeping, renewal and validity are exclusively a matter for R2 Sistemas, with no obligation or liability whatsoever for the User.
The R2 Docuo Trusted Electronic Services are provided with the configuration and on the conditions that the User chooses at the time of signature and in accordance with these Conditions. R2 Sistemas acts at all times as a trusted third party, securely preserves the evidential documentation and adopts the appropriate security measures for the safekeeping and preservation of the documents, including those relating to the protection of the personal data of Users and signatories, both on the platform and in the sending and subsequent safekeeping of the signed documentation.
The User authorises R2 Sistemas to provide the documents and certificates in its safekeeping, as well as the evidential documents of the signature process, to any administrative, judicial or arbitral authority that requests them in the exercise of its powers.
The Service allows PDF documents to be signed with a qualified electronic signature by means of the User’s own certificate, in two modes selected from the Desktop Application.
In the first, the Licensed User signs with a certificate installed on its own computer. The signing operation is carried out entirely on that computer and what reaches the R2 Docuo servers is the already signed document. The certificate is not uploaded to the Service, which therefore neither safeguards it nor stores its password, and the Licensed User does not enter that password for each signature. Responsibility for the security of the computer and of the certificate store from which signing takes place lies with the User.
In the second, the User uploads to the Service its digital certificate —compatible with those accepted by the Service from time to time— and its password through the Desktop Application, which allows signing from the R2 Docuo server. The password is stored encrypted in R2 Docuo and is decrypted automatically in each signature process; on uploading, the User authorises the Service to sign with that certificate autonomously, without entering the password for each signature. If the User withdraws the certificate from the Service, both the certificate file and the password are deleted.
It is the User’s responsibility to configure and maintain the security of the Service so that this feature is used only by authorised Licensed Users, and to comply with the conditions that the certification service provider establishes for the use of the certificate, in particular those relating to the confidentiality of the password and to the security of the certificate. The User warrants that it is the legitimate holder of the certificate, with the indemnity provided for in Clause 18.
On the basis of a document uploaded to the Service, in the format that the Service accepts from time to time, and of the signatory identification data provided by the User, the R2 Docuo Trusted Electronic Services generate an advanced electronic signature by means of a protected signature link, the characteristics of which depend on the configuration chosen by the User. The link is sent to the signatory with the validity period established for the sending. Having completed the authentication process configured by the User, the signatory signs by means of a handwritten stroke on their device, by means of a password known only to them, by means of a validation code received on their mobile device, or by means of any combination of the three, in accordance with the Service’s instructions and having accepted the corresponding conditions.
The User decides the security level of the signatory’s authentication from among those offered by the Service from time to time, such as the email address, the mobile telephone number, a password or a verification code by SMS.
The signature operation generates technical data linked to the signatory and to the sending, which R2 Sistemas manages and preserves and which include hash functions for evidential and security purposes, and non-technical data, provided by the User and over which R2 Sistemas exercises no control whatsoever.
On completion of the process, the signed version of the document and the Evidence Document are generated, containing the technical and non-technical data of the signature, which are sent to the User and, where applicable, to the signatory, and which serve as evidence of the management of the data transmitted and of the transaction. If the User has so requested, it is notified of the various milestones of the process. Once the process is complete, and according to the parameters configured for the sending, a copy of the signed document and of the Evidence Document signed by R2 Sistemas is made available to each signatory at the email addresses indicated by the User.
R2 Docuo safeguards and preserves the data of the signature process together with the Evidence Document, as an electronic signature preservation service. Optionally, at the User’s choice, R2 Sistemas may deposit a hash of the Evidence Document on blockchain networks or before a notary.
As part of the signature process, the R2 Docuo Trusted Electronic Services certify delivery of the document, recording in R2 Docuo, with appropriate security safeguards, the day and time at which (i) the hash functions of the process are generated, (ii) the signature link is sent to the signatory, (iii) the signatory accesses the link and views the document, and (iv) the signatory signs.
In order to access and use the Service, the User must contract a Licence. Each Licence gives the right to create one Repository, so that the User will contract as many Licences as it wishes to have Repositories.
There are four types of Licence depending on the Plan chosen:
– Trial Plan or “Free Trial”: a free evaluation Plan allowing the Service to be used, with the functional limitations established by R2 Sistemas, for thirty (30) days —or the period that R2 Sistemas sets from time to time— from the activation of the trial Licence. It is not contracted on a self-service basis: it is requested through the contact form on the R2 Docuo Website (https://www.r2docuo.com/en/contact) and R2 Sistemas decides at its discretion whether to grant it, having regard to whether the evaluation makes sense as a proof of concept of the Service, without being obliged to grant it. Only one Licence with this Plan is granted per Account. At the end of the trial period, the User must change its Licence to one of the Paid Plans in order to continue using the Service.
– One App Plan: the User, including the Licensed Users and Collaborators attached to the Account, has one (1) of the R2 Docuo Apps, of its choice from among those available from time to time, with the features described for this Plan on the R2 Docuo Website: https://www.r2docuo.com/en/pricing.
– All Apps Plan: the User, including the Licensed Users and Collaborators attached to the Account, has all the R2 Docuo Apps available from time to time and the additional features described for this Plan on the R2 Docuo Website: https://www.r2docuo.com/en/pricing.
– Custom Plan: the User, including the Licensed Users and Collaborators attached to the Account, has all the features of the Service —the complete document management platform, custom fields and processes and access to the API—, as described for this Plan on the R2 Docuo Website: https://www.r2docuo.com/en/pricing.
R2 Sistemas may create new features and include them in any Plan, and may modify the features included in each Plan, as described from time to time on the R2 Docuo Website, without prejudice to Clause 19 as regards substantial modifications of the Service.
Licences contracted before 1 June 2026 under the Legacy Plans are in the process of being migrated to the Plans in force. Until the migration is complete, they retain the financial and functional conditions applicable to them according to the Legacy Plans price list published on the R2 Docuo Website and, for all purposes of these Conditions, are treated as Licences with the Custom Plan.
On contracting a Plan, the User creates the Repository and determines its Parameters, which set the Fee. The Parameters are those provided for from time to time by the price list published on the R2 Docuo Website and, as at the date of these Conditions, the following:
1. Purchased space: the storage capacity of the Repository, in gigabytes, including its files, metadata and temporary files. The minimum is 100 GB. When eighty per cent (80%) of the purchased space is reached, R2 Sistemas notifies the User by email. When one hundred per cent (100%) is reached, it likewise notifies the User and blocks the uploading of new files until the User increases the purchased space or frees up space by deleting files.
2. Licensed Users: the number of user accounts with access to the Repository and to all its features, other than those reserved to the User, such as sharing files, managing them documentally, signing PDF documents with a digital certificate or using the workflow.
3. Collaborators: the number of collaborator accounts with restricted access to the basic features of the Repository, such as uploading, downloading, editing and replacing files.
4. Add-ons: the optional features that the price list offers with their own price, such as integrations with third-party systems. Each Add-on is available only in the Plans indicated by the R2 Docuo Website, which may include it in the price of some of them. The operation of an Add-on that integrates with a third-party system also depends on that system and on the conditions of its provider, for which R2 Sistemas is not liable.
Each Licensed User and each Collaborator is identified with a unique email address and password. The User may limit at any time, at no cost, the features they access through its Account. For the purposes of the Parameters, all active, blocked and deactivated accounts count until the User deletes them.
Each Plan includes the number of Licensed Users, the space and the Add-ons indicated by the R2 Docuo Website, and the Parameters are contracted in the bands established there.
R2 Sistemas may suspend or delete the User’s Account and Repositories if it considers that the User, or the Licensed Users or Collaborators attached to the Account, are in breach of these Conditions.
The User and R2 Sistemas may agree additional services or conditions, or terms different from those provided for in these Conditions, by signing Particular Conditions. These will prevail over the Conditions in everything they contradict, and the Conditions will apply on a subsidiary basis.
Use of the Service with any of the Paid Plans requires payment of the Fee, monthly or annual at the User’s choice, depending on the Plan and the Parameters contracted. The User may check on the R2 Docuo Website the Fee corresponding to each Plan with the various Parameters, and may request through a Support Ticket the breakdown of the Fee for its Licences, in particular where it results from a commercial offer or from particular conditions. The Fee covers the use of the software, the hosting, the maintenance and the additional features corresponding to the Plan and the Parameters contracted. The price list may provide for different prices according to the periodicity of the Fee. A commercial offer accepted by the User may set, for the Licences to which it relates, prices and conditions different from those of the published price list, which prevail over it.
The prices published on the R2 Docuo Website for the Plans and for the Credits are expressed in euros and, unless otherwise indicated, do not include Value Added Tax or equivalent taxes.
The monthly Fee is paid in advance each calendar month; the first monthly Fee of each Licence is paid on contracting and is proportional to the days remaining in the current month. The annual Fee is paid in advance on contracting and on each annual renewal date.
The User may change the periodicity of the Fee, from monthly to annual or vice versa, before the next renewal of the Licence; the new periodicity applies to the following period.
Licences renew automatically and successively at the end of each month or of each year, unless the User cancels the renewal before expiry: by the 25th day of each month for monthly Licences, or by the day before the annual expiry for annual ones. Once renewal is cancelled, the Licence terminates on its expiry and the Repository is subject to Clause 5.4.
The User may modify the Parameters of a Repository through the R2 Docuo Website or by means of a Support Ticket, which modifies the Licence and, where applicable, the Fee. On the Website, before accepting the modification a summary of the resulting Licence and of its conditions is displayed; once accepted, the User receives by email the new conditions and the amount of the Fee. Where the User requests it by means of a Support Ticket, R2 Sistemas provides the summary and the amount by that route, and the modification is not applied until the User accepts it.
If the modification increases the Fee —for example, on increasing the purchased space—, it applies immediately and the proportional part of the difference is charged for the remainder of the current month or year.
If it reduces the Fee —for example, on reducing the number of user accounts or the purchased space—, it applies at the start of the following period. It is for the User to adjust the Repository to the new Parameters before the current period ends, for example by deleting surplus users. If at the end of the period the Repository has not been adjusted, or the adjustment is insufficient, the modification is not applied, the Fee is not reduced and R2 Sistemas notifies the User by email.
Each Licence includes monthly usage limits on certain operations of the Service —among others, the steps executed in workflows, the documents generated automatically, the API calls and the emails sent through the R2 Sistemas servers—, in the quantities indicated by the R2 Docuo Website for each Plan. The limits are calculated per Repository, unless the R2 Docuo Website indicates that they are calculated according to the number of Licensed Users, and they reset on the first day of each month.
Once a limit is exhausted, the corresponding operation is not executed until the following period, unless the User extends it by means of Credits, in the bands and at the cost published on the R2 Docuo Website, where the limit may be extended by that route. The reduction of an included limit and the increase of its extension cost are governed by Clause 8.7 as regards the cost in Credits of the features; extensions may be applied immediately. The limits of the API and of the MCP Server are also governed by Clause 16.
Certain operations of the Service are paid for by means of Credits: consumption actions —such as the advanced electronic signature, the certified electronic delivery, the sending of SMS messages, access by third parties without an account to a document and artificial intelligence operations— and the extension of the usage limits under Clause 8.5. Credits may be acquired as part of the Fee or separately, through the R2 Docuo Website or by the other means that R2 Sistemas accepts from time to time, where the User is informed of the applicable price. The acquisition of Credits is a prepayment for the execution of features of the Service and not an electronic currency. For security reasons, the unused Balance may not exceed 1,200,000 Credits.
The Credits acquired make up the Balance, which the User may consult at any time on the R2 Docuo Website. They do not expire and are not refundable. Only the User may use them, through its Account, for the features that the R2 Docuo Website indicates as available by means of Credits and on the redemption conditions established there; the User may not assign, sell, encumber or otherwise dispose of them in favour of third parties, or allow third parties to use them. The cancellation or termination of the Service in accordance with these Conditions entails the loss of the Balance, with no refund.
When a feature that consumes Credits is requested, its cost is deducted from the Balance. If the Balance is insufficient, the feature is not executed or is not available, an error message may be displayed and the User receives an email informing it of this.
The price of the Credits and the cost in Credits of each operation are published on the R2 Docuo Website: https://www.r2docuo.com/en/pricing. The price of the Credits may vary according to whether they are acquired together with the annual Fee or on demand; in the former case, the Credits corresponding to the period are acquired at the start of that period. The price applicable to the Credits is the one in force at the time of their acquisition; the cost in Credits of an operation is the one in force at the time of its consumption.
Artificial intelligence operations are paid for by means of packages acquired with Credits. The content of each package is expressed on the R2 Docuo Website as an estimated number of tokens, calculated with a reference model as at the date of publication. The package is consumed according to the tokens actually processed in each operation, both input and output, at the price per token that the provider applies to the model used at the time of consumption. Accordingly, the actual number of operations that a package allows varies according to the model that executes each operation, the length of the instructions and of the documents processed, and the provider’s rates. R2 Sistemas will update the published estimate where those circumstances change materially; that update does not constitute a modification of the cost in Credits for the purposes of the prior notice provided for in this Clause, which does apply to a change in the price in Credits of the package itself. Where the User uses its own account with the provider in accordance with Clause 21.h), no packages are consumed for the tokens processed.
R2 Sistemas may modify the price of the Credits with the three (3) months’ prior notice and on the terms provided for in Clause 8.8 for the price list. It may modify the cost in Credits of the features with thirty (30) days’ prior notice where the modification is unfavourable to the User, and immediately where it is favourable. An unfavourable modification takes effect on the date indicated in the notification and applies simultaneously to all Users, irrespective of the date of contracting or of renewal of their Licences.
R2 Sistemas may modify the price list of the Service, and with it the Fees, with at least three (3) months’ prior notice of the date of application, notifying the User by email. The modified price list applies to each Licence from the first billing period starting after it takes effect, without affecting periods already paid; the Fee for a Licence is that resulting from the price list published on the R2 Docuo Website on the date of its contracting or of its renewal.
If the User does not accept the modified price list, it may cancel the renewal of the affected Licences in accordance with Clause 8.3 before the start of the first period to which that price list applies, at no cost or penalty. Use of the Service after the modified price list takes effect constitutes acceptance of it.
R2 Sistemas offers consultancy, implementation and training services, at the prices appearing on the R2 Docuo Website or in the commercial offer accepted by the User. They are one-off payments, do not form part of the Fee and are invoiced on contracting. They are provided on the dates agreed between the parties, remotely unless otherwise agreed, and constitute an obligation of means: R2 Sistemas provides qualified personnel and due diligence, without guaranteeing any particular outcome, which also depends on the cooperation and the information provided by the User.
In order to contract a Licence with any of the Paid Plans, the User follows the instructions on the R2 Docuo Website and provides the details of a credit or debit card, which is associated with the Account as the means of payment of the Fee. Subsequent Licences and acquisitions of Credits are charged to that same means of payment, without the User having to provide new details. Only one means of payment per Account is permitted, common to all its Licences and Repositories.
Before confirming the contracting of a Licence or the acquisition of Credits, the R2 Docuo Website displays a summary of the transaction and a confirmation screen. Once confirmed, the User receives at the email address on its registration confirmation of the contracting, together with the tools, details and instructions for accessing and using the Service. The Licence or the Credits are not activated until payment has been received or authorised by the financial institution.
As these are services not intended for consumers, neither the right of withdrawal nor the guarantees under consumer protection legislation apply.
Payment of the Fee and of the Credits is made through a payment platform (the “Payment Platform”) managed and operated by Stripe Payments Europe, Limited[4] (“Stripe”), whose terms, conditions and privacy policy the User must accept. Card details are stored and safeguarded directly by Stripe; R2 Sistemas in no case has direct access to them and is not liable for the operation of the Payment Platform.
By clicking “Contract now”, the User authorises R2 Sistemas to make charges through the Payment Platform. Subsequent charges are made automatically on the 1st day of each month (CET/CEST time zone) or on the annual renewal date, as applicable, unless the Account has no means of payment associated with it or the User has elected to terminate the Service.
A User that is a business or professional located in the SEPA area of the European Union may set “SEPA direct debit” as the method of payment through the R2 Docuo Website, following the instructions indicated there. In that case, the Service is paid for by means of SEPA Direct Debit B2B charges.
R2 Sistemas and the User may agree particular payment conditions —among others, in the commercial offer accepted by the User or in the Particular Conditions signed in accordance with Clause 7.6— relating to the means of payment, its periodicity, the due dates or the issuing of invoices. Those conditions prevail over this Clause only as regards the agreed method of payment. In all other respects, and in particular as regards the consequences of failure to pay as agreed, including the Repository moving to the “Unpaid” status, this Clause applies in full.
On each renewal, the Fee is charged to the Account’s means of payment. If the Account has no means of payment associated with it or a Fee cannot be charged for any reason, R2 Sistemas notifies the User by means of a notice in its Account and the affected Repository or Repositories move to the “Unpaid” status, with the effects and periods provided for in Clause 5.4. If what cannot be charged is an acquisition of Credits, that acquisition does not take place.
The User has available on the R2 Docuo Website the history of its payments and may download its invoices in PDF format or configure their receipt by email at the time of issue. One invoice is issued for each Licence and for each acquisition of Credits. R2 Sistemas issues its invoices in accordance with the applicable invoicing rules, including the Verifactu system.
The User may enter and modify its billing details and its tax information through the Account or by means of a Support Ticket. The tax details determining the applicable Value Added Tax are provided by the User itself during the contracting process, whether in the purchase through the R2 Docuo Website or on accepting the commercial offer. The User is solely responsible for the accuracy of that data, for the tax rate resulting from it and for the type of invoice to be issued, with the indemnity provided for in Clause 18. A User that is an intra-Community operator may request validation of its details so that the applicable tax is charged.
In relation to the Service, the R2 Docuo Website and the Access Means, the User may not:
– decrypt, decompile, disassemble, reverse engineer or attempt to obtain the source code, the ideas or the algorithms of any part of the technology with which R2 Sistemas provides the Service, except to the extent that the applicable rules expressly prohibit this restriction;
– impersonate another person or entity, or falsely state or misrepresent its affiliation with a person or entity;
– use a third-party digital certificate negligently or contrary to the conditions established by the certification service provider that issued it;
– interfere with the operation of the Service, of the R2 Docuo Website, of the Access Means or of the servers and networks with which R2 Sistemas provides them; breach their security; or carry out any act that damages, disables, overloads —as assessed by R2 Sistemas— or impairs them, or that prevents or hinders their normal use;
– circumvent any measure by which R2 Sistemas prevents or restricts access to the Service, to the R2 Docuo Website, to the Access Means or to other accounts, systems or networks associated with the Service;
– access the Service with programs, applications or tools other than those provided by R2 Sistemas, except for API Applications developed in accordance with Clause 16.1, or for a purpose other than the normal use of the Service, such as attempts to take control of the Service or to deny it, performance testing or benchmarking. This restriction extends to any electronic activity directed at the infrastructure of R2 Sistemas —its servers and its public IP addresses— that is contrary to its normal operation under these Conditions or that unjustifiably harms or may harm the interests of R2 Sistemas, save with the prior, express and written authorisation of R2 Sistemas;
– copy, rent, lease, distribute, download, reproduce, transmit, disseminate, display, sell, license or otherwise exploit the content of the Service, of the R2 Docuo Website or of the Access Means by means other than those provided for their normal operation, save as expressly authorised by these Conditions;
– use the AI Features for any of the practices prohibited by Article 5 of the AI Act, or for the high-risk purposes in its Annex III, on the terms of Clause 21;
– use the Service to send unauthorised emails, emails that may be classified as SPAM, viruses or malware, or for any other conduct contrary to the applicable rules or that infringes the rights of third parties;
– use the MCP Server to extract the content of a Repository on a mass or systematic basis for a purpose other than the normal use of the Service, in particular in order to build a corpus, an index or a copy of the Repository outside the Service;
– use the content obtained through the MCP Server to train, fine-tune or evaluate third-party artificial intelligence models, unless this concerns exclusively data for which the User is responsible and it has the necessary legal basis;
– circumvent or attempt to circumvent the usage or rate limits of the API or of the MCP Server, or share an oAuth authorisation, a secret or an access token contrary to Clause 16.3.a); or
– resell, sublicense or expose the MCP Server to third parties as part of a service of its own, or interpose it in products that compete with the Service, without the prior written authorisation of R2 Sistemas.
R2 Sistemas may terminate the Service, and thereby cancel the access of the User, of its Licensed Users and of its Collaborators to the R2 Docuo Website, to the Access Means and to the data in its Repositories, at any time, with or without notice and with immediate effect, where the User breaches these Conditions or R2 Sistemas has well-founded grounds to suspect that it is in breach of them.
Without needing to terminate the Service, R2 Sistemas may immediately suspend access to the MCP Server or revoke any authorisation or access token, notifying the User as soon as possible, where there is an anomalous usage pattern or disproportionate consumption affecting the stability of the Service, a reasonable indication that an authorisation or a token has been compromised, or a breach of Clause 10. That suspension does not affect access through the other Access Means and does not release the User from payment of the Fee.
The User may terminate the Service at any time by following the instructions on the R2 Docuo Website: to do so it must delete all its Repositories and then cancel its Account. Thirty (30) days after cancellation of the Account, R2 Sistemas deletes from its servers all the User’s data associated with it that is no longer necessary for the purpose for which it was collected, except for information that it must retain by legal requirement and for the legally established period.
Termination of the Service brings the contractual relationship to an end. The User ceases to have access to its Repositories, to the files stored in them —including the documents signed by means of the R2 Docuo Trusted Electronic Services and their associated data— and to the other features of the Service, and all obligation of R2 Sistemas to safeguard and preserve for the User the data of the electronic signature processes ceases. The deletion of one of several Repositories produces those same effects in respect of the deleted Repository, without terminating the Service, in accordance with Clause 5.4.
The foregoing is without prejudice to the document retention obligations arising from the applicable rules. The provisions of these Conditions that by their nature are to survive termination will remain in force after it, in particular those relating to industrial and intellectual property, data protection, confidentiality, exclusion of warranties, indemnity and limitation of liability.
All industrial and intellectual property rights in the Service, the R2 Docuo Website and the Access Means —including their design, their source code, their software, their logos, trade marks, distinctive signs and graphic design— belong wholly and exclusively to R2 Sistemas or to its licensors and are protected by international industrial and intellectual property rules. The same applies to the MCP Server, to its Tools, to their descriptions and to its documentation.
The User acquires no right whatsoever in the trade marks of R2 Sistemas or in those of the AI Providers or MCP Clients through which it accesses the Service, and may not make statements suggesting a relationship of collaboration, sponsorship or endorsement between R2 Sistemas and those third parties, or between the User and any of them, without prior written authorisation.
On contracting the Service, R2 Sistemas grants the User a personal, limited, revocable, non-exclusive and non-transferable authorisation to use the Service, including the software comprising it, in accordance with these Conditions. Save with express authorisation, the User may not reproduce, transform, distribute, communicate to third parties, make available, extract or reuse the Service, the R2 Docuo Website or the Access Means, or create derivative works from them.
The User is the owner of the files that it stores, edits or manages in its Repositories. R2 Sistemas acquires no rights in them other than those necessary to provide the Service: the User grants it a non-exclusive, royalty-free and worldwide licence to access those files where the provision of the Service so requires, including, where necessary, compliance with the applicable rules, the enforcement of these Conditions, the detection and prevention of fraud and of technical or security problems, and the protection of the rights of R2 Sistemas, of other users or of third parties. The User warrants that it holds all the rights necessary in the files for their storage, editing and management in the Service and in order to grant that licence, with the indemnity provided for in Clause 18.
R2 Sistemas does not permit activities that infringe industrial or intellectual property rights through the Service, and will delete —without prior notice, if it deems it necessary— any file whose infringement of third-party rights is duly notified to it.
Where the provision of the Service requires R2 Sistemas to process personal data for which the User is the controller, R2 Sistemas will act as processor within the meaning of the GDPR. That access does not constitute a disclosure or an assignment of data, but access on the User’s behalf in order to provide the Service.
The subject matter, nature and purpose of the processing are the provision of the Service in accordance with these Conditions. Its duration extends to the term of the User’s Licences and to the retention periods provided for in Clauses 5 and 11. The types of personal data and the categories of data subjects are those that the User decides to upload to or generate in its Repositories, together with those of the Licensed Users, the Collaborators and the recipients of the R2 Docuo Trusted Electronic Services designated by the User itself; R2 Sistemas determines neither of them and has no means of knowing them in advance. It is for the User to ensure that the data it uploads to its Repositories is adequate, relevant and limited to what is necessary for its own purposes.
For the purposes of Article 28.3.a) of the GDPR, the User’s documented instructions consist of these Conditions, the configuration that the User applies in its Account and in its Repositories —including permissions and access restrictions, processes, automations and the enabling or disabling of features— and the instructions it issues by means of a Support Ticket. R2 Sistemas will process the personal data only in accordance with those instructions and, if it considers that any of them infringes data protection rules, will immediately inform the User.
The enabling of the MCP Server by the User constitutes a documented instruction to make the Repository data available to the MCP Client designated by the User itself, within the permissions of the authorisation used.
R2 Sistemas undertakes to:
– process the personal data in accordance with the User’s instructions and solely in order to provide the Service, without using it for its own purposes: in particular, it will not use it to train, fine-tune or evaluate artificial intelligence models, whether its own or third parties’, or to build profiles, or to develop new products, nor will it disclose it or make it available to third parties other than the sub-processors authorised in accordance with this Clause. R2 Sistemas may compile and use statistical and aggregate information about the use of the Service provided that it is anonymised so that no data subject can be re-identified by reasonable means;
– ensure that the persons authorised to process the personal data have undertaken to respect its confidentiality or are subject to a statutory obligation of confidentiality;
– apply the security measures required by data protection rules and, in particular, by Article 32 of the GDPR, in accordance with Clause 13.4;
– assist the User, taking into account the nature of the processing and the information available to it, in complying with the obligations under Articles 32 to 36 of the GDPR, including reasonable cooperation in impact assessments and in prior consultations with the supervisory authority;
– notify the User of personal data breaches in accordance with Clause 13.8;
– assist the User in responding to data subjects’ rights in accordance with Clause 13.9;
– make available to the User the information necessary to demonstrate compliance with this Clause, in accordance with Clause 13.5;
– not engage another processor without the User’s authorisation, in accordance with Clause 13.6; and
– delete or return the personal data at the end of the Service, in accordance with Clause 13.10.
R2 Sistemas holds an information security, cybersecurity and privacy protection management system certified to ISO/IEC 27001:2022 for the design, development, implementation and support of its business management software applications, and a certificate of conformity with the Spanish National Security Framework (Esquema Nacional de Seguridad) at HIGH category, with a high level in all five security dimensions, whose scope comprises the information system supporting the R2 Docuo platform. R2 Sistemas will keep those certifications in force, or such others of an equivalent level as may replace them in future, and any modifications it introduces to its security measures will not entail a reduction in the level of protection of the personal data processed.
The User acknowledges that the security of the processing also depends on the configuration that it applies in its Repositories and on the diligent safekeeping of the access credentials in accordance with Clause 4.3.
At the User’s request by means of a Support Ticket, R2 Sistemas will make available to it the certifications in force with their scope and, subject to confidentiality, the summary of the latest audit report. In accordance with Articles 28.5 and 32.3 of the GDPR, that documentation satisfies the obligation under Article 28.3.h) of the GDPR, unless the User demonstrates on reasoned grounds that it is insufficient for the specific processing that it entrusts. Once that insufficiency is demonstrated, the User may send R2 Sistemas, once (1) every twelve (12) months, a written security questionnaire, which R2 Sistemas will answer within a reasonable period.
Only where the foregoing proves demonstrably insufficient, where a supervisory authority so requires or where a personal data breach affecting the User has been confirmed, may the User audit or inspect the processing, on the following conditions: with thirty (30) days’ written prior notice; once (1) every twelve (12) months; during business hours and without disrupting the provision of the Service; by means of an independent auditor that is not a competitor of R2 Sistemas and that undertakes a duty of confidentiality; with a scope limited to the systems and procedures that process the User’s own personal data, excluding in all cases access to other customers’ data and to shared infrastructure elements whose exposure could compromise them; at the User’s cost, R2 Sistemas being entitled to pass on the reasonable cost of its assistance; and with delivery to R2 Sistemas of the resulting report, which will be confidential.
The User expressly authorises R2 Sistemas to engage, as sub-processors, its hosting service providers and, generally, the other sub-processors that R2 Sistemas publishes from time to time in the list of sub-processors published at https://www.r2docuo.com/en/subprocessors, stating their identity, the service they provide and the country in which they process the data. R2 Sistemas will not engage any other sub-processor without the User’s prior written authorisation. The model providers for the AI Features are additionally governed by Clause 21.h).
R2 Sistemas will notify the User of the addition or replacement of a sub-processor at least one (1) month in advance. During that period, the User may object on reasonable data protection grounds by means of a Support Ticket; if the objection prevents the Service from being provided on equivalent terms, the User may terminate the affected Licences at no cost or penalty, with a refund of the part of the Fee corresponding to the unused period.
R2 Sistemas will impose on each sub-processor, by contract, the same data protection obligations set out in this Clause, and will remain liable to the User for their breach.
The MCP Client and the AI Provider are not sub-processors of R2 Sistemas and are not covered by the foregoing authorisations. Where their involvement entails processing personal data for which the User is the controller, it is for the User to put in place with them the processing agreement required by Article 28 of the GDPR, to assess the international transfers that they entail and, where appropriate, to update its record of processing activities and its impact assessment. The User will not enable the MCP Server on Repositories containing special categories of data under Article 9 of the GDPR without having first assessed the lawfulness and proportionality of that processing.
R2 Sistemas states the locations in which it processes the personal data covered by this Clause in the list of sub-processors published at https://www.r2docuo.com/en/subprocessors. It will not carry out or permit transfers of that data to third countries or to international organisations without one of the instruments in Chapter V of the GDPR being in place and without having first assessed its suitability. The addition of a processing location outside the European Economic Area will be notified to the User with the same prior notice and the same right to object as provided for in Clause 13.6 for sub-processors. Transfers involving the MCP Client and the AI Provider are for the User to assess in accordance with that same Clause.
If a judicial, administrative or law enforcement authority requires R2 Sistemas to grant access to or to hand over personal data covered by this Clause, R2 Sistemas will notify the User without undue delay so that it may exercise any remedies available to it, unless such notification is prohibited by the applicable rules or could compromise an ongoing investigation. R2 Sistemas will verify the validity and scope of the request, will object to those that are manifestly disproportionate or unfounded and will limit disclosure to the minimum required.
R2 Sistemas will notify the User of personal data breaches without undue delay and, in any event, within a maximum of forty-eight (48) hours from becoming actually aware that one has occurred. The period runs from confirmation of the breach, not from the detection of an indication or of an alert pending analysis.
The notification will include, to the extent available to R2 Sistemas, the information referred to in Article 33.3 of the GDPR: the nature of the breach, the categories and approximate number of data subjects and records affected, its likely consequences and the measures taken or proposed to remedy it and mitigate its effects. If it is not possible to provide that information all at once, it will be provided in phases without undue delay. The notification does not imply any acknowledgement of liability or of breach by R2 Sistemas.
The Service allows the User to locate, export, rectify and delete the information in its Repositories by itself, and that is the ordinary route for responding to requests to exercise rights that it receives from data subjects. Where a request requires action that the User cannot carry out by itself, R2 Sistemas will assist it upon request by means of a Support Ticket. If a data subject contacts R2 Sistemas directly, R2 Sistemas will not deal with the request, will forward it to the User without undue delay and will inform the data subject that they must contact the User.
At the User’s request by means of a Support Ticket, R2 Sistemas will provide the information about the processing that it needs for its record of processing activities and, where applicable, for its impact assessment.
At the end of the provision of the Service, R2 Sistemas will delete the personal data processed or return it to the User, at the User’s choice, and will delete existing copies, within the periods and with the exceptions provided for in Clauses 5 and 11, unless the applicable rules require it to be retained. The User may export the content of its Repositories by itself at any time during the term of its Licences, and that is the ordinary route for return. Where the volume of the Repository makes that export by the User’s own means impracticable, R2 Sistemas offers, at the User’s request by means of a Support Ticket, a service for extracting and securely delivering the content, which may be provided by means of encrypted physical media or by direct upload to the systems that the User indicates. That service is contracted as a one-off payment service, subject to acceptance of its quotation, and does not condition or replace export by the User’s own means, which remains available at no cost during the term of the Licences. Backups are overwritten in accordance with the retention cycles of R2 Sistemas, selective deletion not being technically possible; until then, the data remains subject to the security measures and to the duty of confidentiality under these Conditions.
The User warrants to R2 Sistemas that it complies and has complied, in relation to the processing that it entrusts to R2 Sistemas, with all the formal and substantive obligations of data protection rules, with the indemnity provided for in Clause 18.
Reciprocally, and within the limit of Clause 17.1, each party will be liable to the other for the part of the penalties, damages, claims and defence costs attributable to its own breach of data protection rules or of this Clause. Where they arise from a concurrent breach, they will be apportioned in proportion to the responsibility of each party, having regard to the nature of the breach, to the role of each party in the processing and to the other circumstances. Each party will notify the other without undue delay of any data subject claim and of any action by a supervisory authority relating to the processing, and both will cooperate in good faith in dealing with them.
This Clause constitutes the data processing agreement required by Article 28.3 of the GDPR between the User, as controller, and R2 Sistemas, as processor, and prevails over the remainder of the Conditions in all matters relating to the processing of personal data on the User’s behalf. Its provisions survive termination of the Service for as long as R2 Sistemas retains personal data covered by it. The User and R2 Sistemas may enter into a specific data processing agreement; failing that, this Clause is sufficient and fully applicable.
The data and documents provided by the User and the files stored in its Repositories are strictly confidential: R2 Sistemas will use them solely in order to provide the Service and will not disclose them to third parties other than its employees and subcontractors or the third parties indicated by the User.
As a general rule, the employees and subcontractors of R2 Sistemas do not access that data, those documents and those files. R2 Sistemas employees may access the metadata of the files where there is a sufficiently justified need, but not their content. Only in the exceptional cases where the applicable rules so require may a specified number of R2 Sistemas employees access the files in a Repository or the data and documents provided by the User.
The provision of the Service includes automated processes not supervised by persons —such as the replacement of tags and data fields— that temporarily access the content of the files. The Tools of the MCP Server are likewise automated processes not supervised by persons, which temporarily access the content of the files in order to attend to the MCP Client’s invocation, and do not extend the access of R2 Sistemas employees or subcontractors to that content.
R2 Sistemas may temporarily suspend the Service in order to carry out maintenance tasks, such as updating infrastructure or software versions. If the anticipated suspension exceeds one (1) hour, it will notify the User at least three (3) days in advance; if it is equal to or less than that, it will notify the User as far in advance as possible, whenever it is able to do so. R2 Sistemas may provide updates to the Service and to the software on which it is based at any time, with or without prior notice.
In the event of any incident or problem in accessing or using the Service, the User may request support from R2 Sistemas by means of the Support Ticket system on the R2 Docuo Website. R2 Sistemas will respond as soon as possible, without committing to any deadline. Support is provided in Spanish and English, solely through that system and solely to the User; support requests received by other routes will not be dealt with.
By way of exception to the foregoing, R2 Sistemas maintains a specific, publicly accessible channel for reporting vulnerabilities and security incidents relating to the Service, available at https://portal.r2docuo.com/docuor2/forms/iasec or at the address indicated from time to time on the R2 Docuo Website, and also usable by third parties that are not Users. R2 Sistemas will acknowledge receipt of the reports received through that channel and will deal with them with the diligence that their seriousness requires, without this constituting any commitment as to response time or the provision of support by that route.
a) Object and requirements. The API allows the User to develop software applications that use the Service. Only the holder of a Licence in force that includes it may develop on the API. Anyone developing on behalf of the organisation holding the Licence declares that they have its authorisation and accepts this Clause on its behalf; for these purposes, that organisation is the User.
The development of an API Application requires prior authorisation from R2 Sistemas, requested by means of a Support Ticket. R2 Sistemas may refuse or revoke it where it considers that the User is in breach of these Conditions in form or in substance, that it is seeking to conceal a use contrary to the Service’s licensing policy, or that the API Application is harmful to R2 Sistemas or to users of the Service. The API Application will comply with these Conditions, with the applicable Particular Conditions and with the technical documentation that R2 Sistemas provides from time to time.
b) Dedicated account. The API Application will use an R2 Docuo account dedicated to API traffic, without administration privileges and without the ability to log in to the Service: if an attempt is made to use it in the Desktop Application, the Web Portal, the Mobile Apps or any other Access Means, the Service will return an error.
c) Prohibited actions. In addition to Clause 10, the User and its API Application may not: (i) make mass calls to the API, iterative stress tests or any other automated action that may be interpreted as a threat to the availability of the Service; (ii) use the API without implementing in the API Application its own mechanism for authenticating its users, so that under no circumstances is access to, download of or listing of Repository content offered without prior authentication in the API Application; or (iii) use mechanisms aimed at circumventing the Service’s licensing policy, such as the sharing of one Service user’s secrets or access tokens among several users of the API Application, without the written consent of R2 Sistemas.
d) Operational limits. Use of the API is subject to the following limits which, where monthly, reset on the 1st day of each month at 00:00 CET/CEST. Once any of them is exceeded, the API returns the corresponding error code.
– Burst, general limit: 10 calls per second. Not extendable.
– Burst, search API: 4 calls per second. Not extendable.
– API calls: 5,000 per month. Extendable by consuming Credits.
– File transfer, uploaded and downloaded: 1 GB per month. Extendable by specific agreement.
– Transfer of data other than files: 1 GB per month. Extendable by specific agreement.
– Rows per query in calls that return lists: 1,000. Not extendable.
The API is available in Licences with the Custom Plan and with Legacy Plans, in accordance with Clause 7. A User needing higher limits may request, by means of a Support Ticket, a quotation for a specific agreement. R2 Sistemas may limit the number of calls accepted where it considers that their volume may adversely affect the API or the Service.
e) Consumption of Credits. Use of the API may consume Credits on the terms and at the prices provided for in Clauses 8 and 9 and published on the R2 Docuo Website: https://www.r2docuo.com/en/pricing.
f) Approval of the API Application. Every API Application starts in “in development” status, with the same API features as in production and a limit of five (5) oAuth authorisations. In that status the User may build it and carry out pilot tests, and undertakes not to use it in production until it is approved. Once development is complete, the User may request the change to “in production” status, which R2 Sistemas will refuse if the API Application does not comply with these Conditions. For approval, R2 Sistemas may require all or part of the source code of the API Application and test users, in order to verify its functionality and the correct use of the API.
g) Other platforms. The User is solely responsible for the interaction of its API Application with other platforms, products and operating systems.
h) Evolution of the API. The API and the Service are under continuous development. The User acknowledges that the API will change as R2 Sistemas adds or refines features, on the terms of Clause 15 and of section 16.3.f).
a) Object and availability. The MCP Server is an Access Means that allows third-party applications based on language models to query and update the content of a Repository on the User’s behalf. It is available only in the Plans indicated from time to time by the R2 Docuo Website (https://www.r2docuo.com/en/pricing), with the usage limits provided for in section b). The publication of a Repository through the MCP Server is disabled by default and may be enabled only by a Licensed User with administration privileges, in accordance with Clause 21.i); while it remains disabled, the Repository is not offered in the authorisation process and no MCP Client can access it. Collaborators do not have access to the MCP Server.
The MCP Server is authorised with the nominal account of a Licensed User, in accordance with the common regime in section 16.3.a), and inherits the permissions that the User has assigned to that account in the Service. The requirement for a dedicated account in section 16.1.b), which is intended for API Application traffic, and the approval procedure in section 16.1.f) do not apply to it, because the MCP Server is developed and published by R2 Sistemas, not by the User or by a third party. All the common provisions of section 16.3 do, however, apply to it.
The removal of the MCP Server from a Plan contracted by the User constitutes a substantial modification of the Service and will be notified in accordance with Clause 19.
b) Included usage limits and consumption of Credits for excess use. Use of the MCP Server is subject to its own usage limits, independent of those of the API provided for in section 16.1.d). Each Plan includes the limits described from time to time on the R2 Docuo Website: https://www.r2docuo.com/en/pricing.
Once the included limit is exhausted, the excess may be met by means of Credits in respect of the limits that the R2 Docuo Website identifies as extendable by that route and at the cost published there, deducted from the Balance in accordance with Clauses 8 and 9. If at the time of the invocation the Balance is insufficient, or the limit exceeded is not extendable by means of Credits, the Tool is not executed and returns the corresponding error code.
The User acknowledges that a single query to an MCP Client may give rise to multiple Tool invocations and, accordingly, to a consumption of limits and of Credits greater than that of a manual use of the Service. It is for the User to monitor its Balance and to configure the use of the MCP Server accordingly.
R2 Sistemas may modify the included limits and the cost in Credits of the excess. Where the modification is unfavourable to the User, by reducing the included limits or by increasing the cost in Credits of the excess, it will be governed by Clause 8.7 as regards the cost in Credits of the features: thirty (30) days’ prior notice, effect on the date indicated in the notification and simultaneous application to all Users, irrespective of the date of contracting or of renewal of their Licences. Increases in the included limits and reductions in the cost in Credits may be applied immediately. The rule on effects in Clause 8.8 does not apply to these modifications, because they do not alter the Fee but the consumption of Credits, which is independent of it. A User that considers the limits of its Plan insufficient may request, by means of a Support Ticket, a quotation for a specific agreement, on the terms of section 16.1.d).
c) Functional scope and permissions. The MCP Server always operates within the permissions that the User has assigned in the Service to the Licensed User holding the authorisation: it does not extend permissions, does not circumvent the access restrictions configured in the Repository and does not allow access to Repositories other than those authorised. The list of available Tools and the capabilities referred to in this Clause are those that R2 Sistemas publishes in the MCP Server documentation. That list depends on the configuration and on the modules active in each Repository, so the Tools that an MCP Client offers for one Repository may not coincide with those for another.
Each Tool is published labelled as read-only, write or destructive. Operations that may overwrite or delete existing information —including the updating of metadata, which may overwrite previous values— are labelled as destructive and their execution requires the express confirmation of the end user through the MCP Client.
No Tool allows the Licence, the Repository Parameters, the Balance or the billing details to be modified; nor the creation, deletion or modification of Licensed User or Collaborator accounts or their permissions; nor the creation or modification of document categories, processes, automations or Artificial Intelligence Instructions, whose configuration may be carried out only through the other Access Means. The Tools relating to invoicing are limited to querying and recording accounting facts in the Repository, such as invoices and payments; no Tool executes payments, transfers funds or operates on means of payment.
In relation to the R2 Docuo Trusted Electronic Services, the MCP Server allows a third party to be asked to sign a document or to be sent a certified electronic delivery, on the same terms and with the same effects as if the request were made through any other Access Means. No Tool signs on behalf of the User or of a Licensed User.
The MCP Server likewise allows a document to be advanced between the statuses of a process. Where the User has previously configured that process —necessarily through an Access Means other than the MCP Server— so that a status transition automatically executes an action, including the signature of a document with the User’s digital certificate in accordance with Clause 6, that action will be executed when the transition requested through the MCP Server occurs. The MCP Server does not itself use the User’s digital certificate, but it may trigger a pre-configured automation that uses it. The User accordingly acknowledges that an instruction issued through an MCP Client may produce effects vis-à-vis third parties and consume Credits, and assumes responsibility for assessing that risk when enabling the MCP Server on Repositories whose processes incorporate signature or certified electronic delivery automations, on the terms of sections d) and e) and of Clause 17.2.
d) Non-deterministic nature and human supervision. The User acknowledges that the language models through which the MCP Server is used are not deterministic: given the same instruction they may invoke different Tools, with different parameters, and may generate incorrect, incomplete or fabricated responses, even where the Repository data is correct. Accordingly, the User undertakes to review the responses before basing any decision on them —in particular before using them in actions with legal, accounting, tax or employment effects—, to verify against the Repository the data and citations obtained, and to maintain human supervision over write operations. Responses obtained through the MCP Server do not constitute advice of any nature from R2 Sistemas, have no evidential value and do not replace the files or the Evidence Documents stored in the Repository, which prevail in all cases.
e) Untrusted content and prompt injection. The files, metadata, comments and data fields of a Repository are content provided by the User or by third parties, not instructions from R2 Sistemas. The User acknowledges that a file may contain text, visible or hidden, drafted so that a language model interprets it as a command and causes unwanted queries, writes or disclosures. R2 Sistemas applies reasonable measures to delimit the content returned by the Tools and not to attribute instructional character to it, but cannot guarantee that an MCP Client or a language model will ignore it. The User is responsible for assessing this risk when enabling the MCP Server on Repositories that receive files of external origin and for maintaining the human supervision provided for in section d).
f) MCP Client and AI Provider. The MCP Client and the AI Provider are independent third parties, freely chosen and contracted by the User. R2 Sistemas neither controls nor supervises them, and is not liable for their operation, their availability, their security or their contractual terms. When a Tool is invoked, the content returned by the MCP Server leaves the Service and comes to be processed in the infrastructure of those third parties; from that moment it is governed by the terms and the privacy policy that the User has accepted with them, including those relating to the retention, the location and the use of the data for model training. It is for the User to verify that those terms are acceptable for the type of information contained in its Repositories.
g) Records, traceability and evolution. Operations executed through the MCP Server are recorded in the Repository audit trail, identifying the Licensed User holding the authorisation and the fact that they were carried out by this route. Each invocation of a Tool is also recorded, with the request received and the parameters with which the Tool is invoked, together with the date and time, the Licensed User and the Repository, the identification of the MCP Client as declared by it on connecting, the Tool invoked, whether the invocation succeeded or failed, its duration and the consumption of usage limits and of Credits that it generates. The content that the MCP Server returns to the MCP Client in response to an invocation is not recorded. That record is stored in the User’s database, with the same security measures and the same separation from other customers as the rest of the information in its Repository: it forms part of the Repository, is governed by Clause 13, is retained and deleted with it, and R2 Sistemas accesses it as processor for the purpose of providing support on the use of the MCP Server, applying the usage limits and settling the Credits consumed. The instructions that the end user issues to the MCP Client and the conversation they hold with it do not reach the MCP Server, without prejudice to the fact that a parameter of the invocation may reproduce part of what the end user asked for. Of the activity of the MCP Server, R2 Sistemas processes as controller only the aggregate consumption of usage limits and of Credits attributable to each Licence and the security logs of the infrastructure on which the Service is provided, on the terms described in the Privacy Policy.
R2 Sistemas may add, modify, rename or withdraw Tools, and modify their parameters and their usage limits. Where a change removes a Tool or alters its parameters in an incompatible way, it will notify the User at least thirty (30) days in advance, unless it is necessary for reasons of security, regulatory compliance or data protection, in which case it may apply it immediately and notify afterwards. The addition of Tools with effects other than those described in section c) will require the prior amendment of these Conditions in accordance with Clause 1.3.
a) oAuth authorisation and safekeeping of credentials. Access to the Service through the API and through the MCP Server is authorised by means of oAuth in the name of a nominal Service user, in the mode specific to each means. In the API, the authorisation consists of user_id, user_secret and access token. In the MCP Server, the MCP Client registers dynamically with the Server and obtains its access and refresh tokens by means of an authorisation code flow with PKCE, following authentication and consent by the Licensed User. In both cases the authorisation is linked to a single nominal user and, save with the written authorisation of R2 Sistemas to the contrary, may not be shared between two or more nominal users of an API Application or of an MCP Client.
Where an MCP Client does not support dynamic registration, R2 Sistemas may issue, at the User’s request made by means of a Support Ticket, a fixed client identifier and secret in order to connect that MCP Client to the MCP Server. Those credentials identify the MCP Client and do not replace the nominal authorisation of each Licensed User, which is granted in the same way through the authorisation code flow. The User will configure them solely in the third-party system for which they were issued, will be responsible for their safekeeping in that system and will request their rotation on any suspicion of compromise. R2 Sistemas may rotate or revoke them for security reasons, informing the User as soon as possible.
Sharing an access or refresh token among several users, making concurrent accesses with the same token or generating tokens for several users with the same credentials without the authorisation of R2 Sistemas may give rise to the definitive revocation of the authorisation without prior notice. A User needing a different use must raise it with R2 Sistemas by means of a Support Ticket before programming it, so that an alternative may be considered or it may be authorised by means of a specific agreement including an account prepared for concurrent traffic.
The user_secret, the access and refresh tokens, the client identifier and secret issued in accordance with this section and any other credential issued in those flows are passwords for access to the Service for all purposes of Clauses 4 and 17. The User will safeguard them diligently, will not enter them in third-party applications or services that it does not control and will revoke them immediately on any suspicion of compromise, notifying R2 Sistemas. R2 Sistemas may revoke any authorisation or token for security reasons, informing the User as soon as possible.
b) End users’ personal data. If personal information is collected through an API Application or an MCP Client, the User will ensure that it is collected, processed, transmitted, retained and used in accordance with the rules applicable in Spain, in the European Union and in its own country, will publish and make available to end users a privacy policy of its own, will comply with it and will adopt reasonable measures to protect the personal information collected by those routes.
c) Brand and compatibility. The User will not use the name “R2 Docuo” or the trade marks, logos or corporate identity elements of R2 Sistemas without its written consent, nor will it state or advertise the compatibility of the Service with other products or services without the authorisation of R2 Sistemas; in particular, it will not advertise its API Application as “compatible with R2 Docuo” without that authorisation. The foregoing is without prejudice to Clause 12.
d) Termination and revocation of programmatic access. R2 Sistemas may terminate the User’s access to all or part of the API or of the MCP Server: (i) for breach of any provision of these Conditions; (ii) upon a legal requirement addressed to R2 Sistemas; (iii) if R2 Sistemas ceases to offer the corresponding service, in whole or in part; or (iv) for any other reason, in the latter case with thirty (30) days’ written prior notice. In cases (i) and (ii), and in the cases of suspension provided for in Clauses 11 and 16.2, the termination or revocation of credentials may be immediate. Termination of access to the API or to the MCP Server does not of itself terminate the Service, which will remain accessible through the other Access Means.
e) No warranties. THE API AND THE MCP SERVER ARE PROVIDED “AS IS”, FOR USE AT THE USER’S OWN RISK, WITHOUT EXPRESS OR IMPLIED WARRANTY AND WITHOUT WARRANTY OF FITNESS FOR A PARTICULAR PURPOSE OR OF NON-INFRINGEMENT OF ANY LEGAL REQUIREMENT. This exclusion is without prejudice to liability that cannot be excluded under the applicable law and applies on the terms and within the limit of Clause 17.1.
f) Amendment. This Clause 16 may be amended on the terms and with the one (1) month’s prior notice under Clause 1.3. A User that does not accept the new version may cease using the API and the MCP Server before it takes effect and continue using the Service through the other Access Means. Use of the API or of the MCP Server after it takes effect constitutes acceptance of the new version.
The User uses the Service, the R2 Docuo Website and the Access Means at its own risk and responsibility, and is responsible for complying with the laws of its jurisdiction. R2 Sistemas is not liable for misuse or improper use of the Service or for breach of these Conditions by the User.
The Service is provided “as is” and “as available”, without warranty or condition of any kind, express or implied. R2 Sistemas does not offer, and excludes, all warranties and representations —among others, those of title, quality, satisfaction, non-infringement, lawfulness, absence of viruses or malicious code, merchantability, fitness for a particular purpose and performance— and, to the maximum extent permitted by the applicable rules, does not warrant and is not liable for the availability and continuity of the Service, of the R2 Docuo Website or of the Access Means, for their reliability, quality, correctness, security, integrity, legality or usefulness for a specific purpose, or for the loss of the files stored in a Repository. No information, oral or written, obtained from R2 Sistemas or through the Service creates any warranty not expressly set out in these Conditions.
Without limitation, R2 Sistemas is not liable for damage arising from: the use of devices incompatible with the Service, the R2 Docuo Website or the Access Means; interruptions, errors, failures, viruses, trojans or the like, interference, omissions or unavailability, power cuts and failures of telecommunications networks or of the equipment of the User, of the Licensed Users, of the Collaborators or of the third parties that access on the User’s behalf or with its authorisation; delays or blockages caused by deficiencies in or overloading of the internet, of communications networks or of the electricity grid; the impossibility of accessing the Service, the R2 Docuo Website or the Access Means; the acts of third parties, including unauthorised access to or use of the servers of R2 Sistemas and of the personal or financial information stored on them; and any other event outside the control of R2 Sistemas.
R2 Sistemas does not warrant, endorse or accept liability for the services that third parties offer in connection with the Service, and is not a party to and does not control the transactions between the User and those third parties.
As regards the files stored in a Repository or managed through the Service, R2 Sistemas acts exclusively as the provider of an intermediation service that allows the User to store and transmit them. Liability for those files and for any other information, data, text, software, sound, photograph, graphic, video or material that the User stores or transmits lies exclusively with the User, save in the specific cases provided for by the applicable law; R2 Sistemas is in no case liable for the files stored in a Repository or for their content.
As regards the signature of PDF documents with third-party digital certificates, R2 Sistemas acts exclusively as the provider of a service that enables that signature. The validity, effectiveness, correct use and currency of the certificate are the exclusive responsibility of the certification service provider that issued it and of the User, in accordance with the applicable rules; R2 Sistemas is not liable for them and does not warrant any digital certificate.
R2 Sistemas, its officers, employees and agents will not be liable to the User for any damage or loss, of any nature, in contract or in tort, on a strict liability basis or on any other ground, arising from the use of the Service, of the R2 Docuo Website or of the Access Means, in an amount exceeding thirty thousand (30,000) euros or the amounts paid by the User to R2 Sistemas for the Service during the last twelve (12) months, whichever is the greater, irrespective of whether or not R2 Sistemas had been advised of the possibility of such damage. This limitation applies to the maximum extent permitted by the law of the applicable jurisdiction.
Within that limit, which the use of the API and of the MCP Server does not alter, and to the maximum extent permitted by law, R2 Sistemas is not liable for: (i) decisions taken by the User on the basis of responses obtained through the MCP Server; (ii) operations executed within the permissions of the authorisation used, even where they were induced by an imprecise instruction from the end user or by untrusted content within the meaning of section 16.2.e); (iii) the operation, the security and the data processing of the MCP Client and of the AI Provider; or (iv) the use of an authorisation or of an access token by third parties to whom the User has provided them or from whom it has not safeguarded them diligently.
R2 Sistemas is not liable for damage arising from errors, misuse, force majeure or delays in the sending or signing of documents occurring for reasons beyond the control of R2 Sistemas, or arising from a use of the Service contrary to these Conditions or to the instructions of R2 Sistemas. As a general rule, R2 Sistemas is not liable for damage caused by the negligence of the User or of the signatory. The safekeeping of the Service’s passwords and keys and the notification of their improper use, including identity theft, are governed by Clause 4.3.
The signatory is solely responsible for the authenticity of the handwritten signature that R2 Sistemas captures by means of a biometric stroke during the signature process; its forgery or inaccuracy is the exclusive responsibility of the signatory, which the User knows and accepts. R2 Sistemas is not liable for the accuracy, reliability or correctness of the non-technical data and information that the User provides during the signature process and that is incorporated into the Evidence Document —such as the signatory’s name or identity document—, the content of which is the exclusive responsibility of the User.
The User is solely responsible for ensuring that the documents it signs by means of the R2 Docuo Trusted Electronic Services meet the requirements that the legislation in force lays down for their legal validity. R2 Sistemas is unconnected with the relationship that those documents seek to establish or govern and assumes no liability in that regard.
In accordance with the rules in force on electronic signatures, and without limiting the foregoing, R2 Sistemas is released from liability where the User:
a) has not provided truthful, complete and accurate information for the provision of the R2 Docuo Trusted Electronic Services —in particular, as to the identity and contact details of the signatories and as to the other data necessary for the sending and authentication of a signature request— and R2 Sistemas, acting with due diligence, has been unable to detect the inaccuracy;
b) has not reported without undue delay any change in the circumstances affecting the provision of the R2 Docuo Trusted Electronic Services, including the expiry of the electronic certificate provided to the Service;
c) has been negligent in preserving its signature creation data, in ensuring its confidentiality or in protecting it against any access to or disclosure of that data or of the means giving access to it;
d) has not requested the provider that issued it to suspend or revoke the electronic certificate, nor withdrawn it from the Service, where there were doubts as to the confidentiality of its signature creation data or of the means giving access to it; or
e) has used the signature creation data, or kept the electronic certificate uploaded to the Service, after its validity period has expired or its currency has ended or been suspended.
The references to the electronic certificate in this section are to be understood as referring exclusively to the certificate that the User provides to the Service for the qualified electronic signature (eCertificate), issued by a third-party certification service provider in accordance with Clause 6, and not to the certificate owned by R2 Sistemas with which advanced electronic signatures (eSignature) are generated and the Evidence Document is signed.
The User will defend, indemnify and hold harmless R2 Sistemas and its officers, employees, agents, affiliates, parent companies and subsidiaries against any claim, damage, obligation, loss, liability, cost, debt or expense —including lawyers’ and court agents’ fees— originating in: (i) access to the Service, to the R2 Docuo Website or to the Access Means and their use by the User or by the persons to whom it gives access in accordance with Clauses 3 and 4; (ii) breach of these Conditions; (iii) the infringement of third-party rights, including intellectual and industrial property, property and privacy rights, in particular by the User Content, by the files stored in its Repositories or by the digital certificate that it provides to the Service; (iv) the inaccuracy of the data that the User provides for tax or invoicing purposes; (v) the User’s breach of data protection rules in the processing that it entrusts to R2 Sistemas, without prejudice to the apportionment of liability provided for in Clause 13.11; (vi) the use of the API and of the MCP Server, including third-party claims —among them those of data subjects whose data appears in a Repository— relating to the making available of Repository content to an MCP Client or an AI Provider designated by the User; and (vii) any damage caused to a third party through the use of the Service, of the R2 Docuo Website or of the Access Means.
This obligation survives the termination of these Conditions and of the use of the Service. R2 Sistemas may assume the exclusive defence and control of any matter subject to indemnity, in which case the User will cooperate with it in asserting any available defence.
If a court of competent jurisdiction declares any provision of these Conditions void, the remainder will retain full effect, and a partially void provision will retain it as regards the unaffected part.
R2 Sistemas is not liable for delay in or failure to perform its obligations where this is due to force majeure, whether unforeseeable or foreseeable but unavoidable, such as fires, accidents, embargoes, governmental measures or blockades.
These Conditions are available to the User before the contracting of any Licence or Service and before the acquisition of Credits, and may be stored and reproduced on a durable medium and printed for consultation. They are available in Spanish and in English; in the event of any contradiction, the Spanish version prevails. To acquire a Licence or Credits, the User need only follow the instructions on the R2 Docuo Website.
R2 Sistemas may modify the Service at any time, with or without prior notice and with no obligation or compensation whatsoever towards the User. Substantial modifications of the Service will, however, be notified in the manner provided for in Clause 1.3 for the amendment of the Conditions and will be accepted on those same terms.
The User authorises R2 Sistemas to use and reproduce its corporate logo on the R2 Docuo Website, during the term of the contractual relationship and for the sole purpose of promoting the Service by making known that the User uses it. The User may revoke this authorisation at any time by means of a Support Ticket.
These Conditions are governed by and construed in accordance with the laws of the Kingdom of Spain, unless, by reason of the User’s status, other rules are mandatorily applicable.
The User and R2 Sistemas submit to the jurisdiction of the courts and tribunals of the city of Madrid, expressly waiving any other jurisdiction that may correspond to them, unless, by reason of the User’s status, another jurisdiction is mandatorily applicable.
a) Object and features covered. The Service incorporates features based on artificial intelligence systems. As at the date of these Conditions they are: (i) the R2AI Assistant, which allows queries, searches and actions in natural language on the content of the files, documents and processes of a Repository; and (ii) the Artificial Intelligence Instructions, which allow the content and metadata of a document to be sent to a language model and the response to be stored in a Repository field, for later use in documents, emails or formulas. The AI Features use language models from various providers. The model that executes each operation is determined by R2 Sistemas or, where the AI Feature so allows, chosen by the User from among those that the Service offers from time to time. R2 Sistemas describes the AI Features on the R2 Docuo Website and in its Help Centre, and publishes their cost in accordance with Clause 8.7.
Access to the Service through the MCP Server is governed by Clause 16.2 and not by this Clause, without prejudice to sections d), e), f), g) and i), which apply to it equally.
b) Regulatory framework and allocation of roles. The AI Features are subject to the AI Act. For its purposes, R2 Sistemas is the provider of the AI Features, as it puts them into service under its own trade name, and the User is the deployer, as it uses them under its own authority in the course of its professional activity. Each party assumes the obligations that the AI Act attributes to its status and will provide the other with the reasonable information and cooperation it needs in order to comply with its own.
c) Transparency and identification of generated content. R2 Sistemas informs the User that the R2AI Assistant is an artificial intelligence system and that the text produced by the AI Features is artificially generated content, to which R2 Sistemas will apply the identification and marking required by Article 50 of the AI Act on the terms and within the periods provided for there. The User will not remove, conceal or alter the notices, markings or identifiers of artificial origin that the Service incorporates, and will disclose that circumstance where it presents content generated by the AI Features to third parties that are not Licensed Users, such as signatories, Collaborators, users of web forms or recipients of emails.
d) Prohibited practices. The User will not use the AI Features, or the Service through the MCP Server, for any of the practices prohibited by Article 5 of the AI Act or by the prohibitions that it may incorporate in future. In particular, and without limitation, it will not use them to:
– infer emotions of natural persons in the workplace or in educational institutions;
– carry out biometric categorisation aimed at deducing a person’s race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation;
– evaluate or classify natural persons or groups on the basis of their social behaviour or personal characteristics, where this gives rise to detrimental or unfavourable treatment in contexts unrelated to that in which the data was generated;
– assess the risk of a natural person committing a criminal offence on the basis of profiling or of personality traits;
– create or expand facial recognition databases through the untargeted scraping of facial images; or
– exploit the vulnerability of a person or of a group, or materially distort their behaviour, by means of subliminal, manipulative or deceptive techniques.
Breach of this section is a material breach of these Conditions and entitles R2 Sistemas to suspend or terminate the Service immediately in accordance with Clause 11, without prejudice to Clause 18.
e) High-risk uses. The Service has not been designed, documented or assessed as a high-risk artificial intelligence system within the meaning of Article 6 and Annex III of the AI Act, and R2 Sistemas does not declare it suitable for such uses. The User will not use the AI Features for the purposes in Annex III of the AI Act without first notifying R2 Sistemas and without signing such Particular Conditions as may be necessary. These include, among others, those relating to employment and worker management —such as the selection or filtering of applications, performance evaluation, the allocation of tasks, promotion or the termination of the employment relationship—, to access to essential public or private services, to creditworthiness assessment and to education and vocational training.
The User acknowledges that, in accordance with Article 25.1 of the AI Act, if it modifies the intended purpose of the Service or of the AI Features so that they come to constitute a high-risk system, or if it offers them to third parties under its own name or brand, it will acquire the status of provider of that system and will assume the corresponding obligations. The assistance and information that R2 Sistemas must provide to it in that case in accordance with Article 25.2 of the AI Act will be agreed in Particular Conditions. All of the foregoing is without prejudice to the AI Act’s application timetable, under which the obligations relating to the high-risk systems in Annex III are enforceable from 2 December 2027.
f) Human supervision and accuracy. Artificial intelligence systems are not deterministic: given the same instruction they may return different responses, and those responses may be incorrect, incomplete or fabricated even where the Repository data is correct. The User, as deployer, will entrust the use of the AI Features to persons with appropriate competence and will ensure that a person with the necessary knowledge reviews the result before using it for any real purpose. The responses and content obtained do not constitute advice of any nature from R2 Sistemas, have no evidential value and do not replace the User’s professional judgement or the files and Evidence Documents in the Repository, which prevail in all cases. The User will not take, on the sole basis of a result of the AI Features and without meaningful human intervention, decisions that produce legal effects concerning a natural person or that similarly significantly affect them.
g) AI literacy. The User will adopt proportionate training measures so that the personnel using the AI Features on its behalf have a sufficient understanding of how they work, of their limitations and of the risks of their use, in accordance with Article 4 of the AI Act. R2 Sistemas will make available to it, through the Help Centre, the functional documentation necessary for that purpose.
h) Content, models and data processing. The execution of an AI Feature entails transmitting to the provider of the corresponding model the content and metadata of the document needed to attend to the request, to the extent the User has configured. R2 Sistemas does not use that content to train its own models and does not authorise model providers to use it to train or fine-tune theirs.
By way of exception to and in addition to Clause 13.6, the User expressly authorises R2 Sistemas to engage, as sub-processors, the model providers that R2 Sistemas publishes from time to time in the list of sub-processors published at https://www.r2docuo.com/en/subprocessors, irrespective of whether the specific model is determined by R2 Sistemas or chosen by the User in accordance with section a). As at the date of these Conditions they are Anthropic, OpenAI and Google[5], through their entities established in the European Union. R2 Sistemas will inform the User of the addition or replacement of those providers one (1) month in advance, during which period the User may object by disabling the affected AI Features in accordance with section i).
Where the User configures an AI Feature to use the account that it itself holds with a model provider, the relationship with that provider is established directly between them and is governed by the terms they have agreed; R2 Sistemas is not a party to it and is not liable for its operation, its security or its data processing. In that case, the tokens processed are paid for by the User directly to the provider and the Service does not consume for them the artificial intelligence operation packages under Clause 8.7.
i) Enabling and disabling. The AI Features and the publication of the Repository through the MCP Server are configured per Repository, on the terms described in the Help Centre, and only by Licensed Users with administration privileges. The configuration comprises, at a minimum: a general control whose deactivation immediately disables all artificial intelligence in the Repository; the separate enabling of the R2AI Assistant, which may also be enabled or disabled by document category; the separate enabling of the Artificial Intelligence Instructions, whose deactivation prevents the execution of all those previously created; and the enabling of the publication of the Repository through the MCP Server, disabled by default in accordance with section 16.2.a).
The User is solely responsible for that configuration and for assessing the suitability of the processing according to the nature of the content of each document category. If it does not wish the content of its Repository to be processed by means of AI Features or to be accessible through the MCP Server, it will keep the corresponding options disabled.
[1] Microsoft Windows is a registered trade mark owned by Microsoft Corporation.
[2] iOS is a trade mark of Cisco Systems, Inc., used under licence by Apple Inc.
[3] Android is a trade mark of Google LLC.
[4] Stripe is a trade mark of Stripe, Inc.
[5] Anthropic, OpenAI and Google are trade marks of Anthropic, PBC, of OpenAI and of Google LLC, respectively.
The other names of third-party products, services and protocols cited in these Conditions, including Model Context Protocol, belong to their respective owners and are used solely for identification purposes.
