This is the agreement that governs every Crosswalk plan. It is presented at the checkout and once more at the first activation of a licence key; if you do not agree at that point, do not activate - clause 8.2 provides a full refund within 14 days of purchase. Dated earlier versions are available on request via [email protected].

Crosswalk

Software Licence Agreement (Intended Use and Terms)

Depre.nl · Version 1.7 · Effective August 15 2026

Acceptance

This Software Licence Agreement (the "Agreement") is a binding agreement between Depre.nl, established in the Netherlands, KvK no. 63612828, registered office at Posthoorn 1, Haaren (the "Licensor", "we", "us"), and the business or professional entity that uses Crosswalk (the "Licensee", "you").

Crosswalk is available in two modes:

Crosswalk is offered exclusively to businesses and professionals for use in the course of their trade, business, craft, or profession. It is not offered to consumers.

The current version of this Agreement is published at eu-cyber-laws.com/crosswalk/licence.html and is available from the plans page and at the Polar checkout, so it can be read in full before any purchase.

You accept this Agreement in trial mode by acknowledging the start-up notice and continuing to use Crosswalk, and in licensed mode by confirming acceptance at the Polar checkout and completing the purchase; on the first activation of a licence key Crosswalk presents this Agreement once more for confirmation. By accepting you confirm that you have read, understood, and agree to be bound by this Agreement; that you are acting in the course of a trade, business, craft, or profession and not as a consumer; and that if you accept on behalf of an organisation you are authorised to bind it. If you do not agree, or if you are acting as a consumer, do not use Crosswalk.

If you do not agree with this Agreement when it is presented at first activation, do not activate the licence: you may then request a full refund within fourteen (14) days of purchase under clause 8.2.

The version of this Agreement that applies is the version presented to you at the time of use or purchase. We maintain an archive of dated versions at the address above. Your acceptance at the checkout is recorded by Polar together with the purchase; the confirmation at first activation is recorded by Crosswalk on your own device (version and date, shown in the licence panel).

Identity: "Crosswalk" and "eu-cyber-laws.com" are trading names of Depre.nl, KvK no. 63612828, which is the contracting legal entity under this Agreement.

Part A – Intended Use Statement

A.1 What Crosswalk is

Crosswalk is a software tool that maps and cross-references obligations across EU cybersecurity and product legislation (including, where applicable, the Cyber Resilience Act, NIS2 Directive, and Machinery Regulation) and generates structured crosswalk documents to support compliance work.

A.2 Intended purpose

Crosswalk is intended for use by professionals as a compliance-support aid: to accelerate the identification, comparison, and documentation of overlapping legal obligations. Its output is a working aid that informs, but does not replace, the user's own legal analysis and compliance decisions.

A.3 What Crosswalk is not

A.4 User responsibilities

You are responsible for verifying Crosswalk output against the authoritative sources, for exercising independent professional judgement, and for all compliance decisions you take. Legal content is subject to change; you must confirm that the legislation and references relied upon are current as at the date of your use.

Part B – Licence Agreement

1. Definitions

  1. "Crosswalk" means the Crosswalk software made available by the Licensor, including any updates, documentation, and related services.
  2. "Trial mode" means the free use of Crosswalk available without a licence, in two forms: the free version (the CRA workflow only, available without a time limit) and the plan trial (the full feature set of a chosen paid plan, limited to fourteen (14) days per project counted from the first time that project is opened). After a plan-trial window the project continues in the free version: the CRA workflow remains usable and the features of the paid plans become read-only, while all data remains viewable and exportable.
  3. "Licensed mode" means use of Crosswalk under a valid licence purchased through Polar, in which the watermark is removed.
  4. "Named User" means an individual employee or contractor of the Licensee who is authorised to use Crosswalk under a purchased seat. Each seat is intended for a single individual and is not to be shared. The Licensee may reassign a seat to a replacement individual where the original user no longer requires access.
  5. "Output" means the crosswalk documents, mappings, exports, and other materials generated through use of Crosswalk.
  6. "Subscription Term" means the annual period for which the Licensee has paid the applicable fees.
  7. "Fees" means the annual subscription fees payable per Named User, as set out at the point of purchase through Polar.
  8. "Polar" means Polar Software Inc., acting as the Licensor's reseller and Merchant of Record for licence purchases.

2. Trial mode

  1. Trial mode is provided free of charge, on an "as is" and "as available" basis, for evaluation and use subject to this Agreement. All provisions of this Agreement, including the Intended Use Statement and the disclaimers and limitations in clauses 10 and 11, apply to trial mode.
  2. The free version (the CRA workflow only) is available without a time limit and produces clean output without a watermark; it may be used for the Licensee's own internal business purposes. A plan trial provides the full feature set of the chosen paid plan for fourteen (14) days per project, counted from the first time that project is opened, and produces watermarked evaluation output; within that window you may evaluate that plan fully before deciding to purchase a licence. After the window the project continues in the free version: the CRA workflow remains usable, the features of the paid plans become read-only, and all data remains viewable and exportable. There is no managed-AI (Plus) option in trial mode.
  3. Watermarked plan-trial output is provided solely for internal evaluation of Crosswalk and must not be used for commercial purposes or delivered to clients or other third parties. Free-version output carries no watermark and may be used for the Licensee's own internal business purposes; client-facing and consultancy use requires a purchased licence.
  4. On browsers without folder access (no File System Access API), Crosswalk - in trial mode and licensed mode alike - runs in browser-storage mode: project data is held in the browser's own storage instead of files in a folder on the device. The browser controls that storage and may clear it; regular exports are the Licensee's backup. For production use the folder mode (a Chromium-based browser) is recommended.

3. Licence grant and business use

  1. Subject to purchase of a licence and to this Agreement, the Licensor grants the Licensee a non-exclusive, non-transferable, non-sublicensable right to use Crosswalk in licensed mode during the Subscription Term, for the Licensee's internal business purposes, on a per-Named-User basis for the number of seats purchased.
  2. The Licensee represents and warrants that it acquires and uses Crosswalk exclusively for purposes relating to its trade, business, craft, or profession, and not as a consumer. The Licensor makes this Agreement, sets its terms, and prices the licence in reliance on that representation.
  3. If the Licensee purchases in the name of a business or provides business details at checkout, the Licensee shall not later invoke consumer status. The Licensee shall indemnify the Licensor against any costs and losses arising from an untrue representation under clause 3.2, including costs incurred in proceedings in which consumer status is asserted.

4. Seat model (trust-based)

  1. Licensed use is intended on a per-Named-User basis: one seat per individual user. The Licensee agrees to obtain a seat for each individual who uses Crosswalk in licensed mode and not to share seats.
  2. The Licensor does not apply technical measures to enforce seat limits and relies on the Licensee's good faith compliance. This does not waive the Licensee's obligation under clause 4.1.
  3. The Licensor may, no more than once per year, request a written statement signed by an authorised representative of the Licensee confirming the number of individuals using Crosswalk in licensed mode. The Licensee shall provide such a statement within 30 days of the request.

5. Watermark

The watermark applied to plan-trial output (and to output beyond the free version's CRA surface) identifies it as unlicensed evaluation output. The Licensee shall not remove, obscure, or circumvent the watermark except by using Crosswalk in licensed mode under a valid purchased licence, or within the free version's own CRA surface, which is unwatermarked by design.

6. Restrictions

The Licensee shall not, and shall not permit any third party to:

7. Ownership of Crosswalk and of Output

  1. Crosswalk, and all intellectual property rights in it, remain the exclusive property of the Licensor. No rights are granted except as expressly set out in this Agreement.
  2. As between the parties, the Licensee owns the Output it generates and may use, reproduce, modify, and distribute that Output without restriction, including sharing it with clients, auditors, regulators, and other third parties. The Licensor claims no rights over the Output and asserts no control over the Licensee's use of it. This ownership of Output does not transfer any rights in Crosswalk itself or in any underlying templates, software, or know-how. This clause applies to licensed (non-watermarked) Output; watermarked trial Output remains subject to clauses 2.3 and 5.

8. Fees, purchase, and refunds

  1. Licences are purchased through Polar, which acts as the Licensor's reseller and Merchant of Record. Polar handles the transaction, applicable VAT, and the purchase record. The purchase is subject to Polar's checkout terms in addition to this Agreement.
  2. Because a fully functional free trial is available before purchase, allowing complete evaluation, licence Fees are non-refundable except (a) where a refund is required by mandatory law, and (b) under the acceptance window: a Licensee who does not agree with this Agreement as presented at the first activation of the licence key may request a full refund within fourteen (14) days of purchase, provided licensed mode has not been used (the key not activated and no unwatermarked Output produced). On such a refund the licence is revoked and the key invalidated.
  3. The Licensor may adjust Fees for any renewal term on at least 30 days' notice before the renewal date.

9. Term, renewal, and termination

  1. A licence starts on purchase and continues for the Subscription Term, renewing automatically for successive annual terms unless cancelled through Polar or the Licensee's account before the end of the then-current term, in accordance with Polar's cancellation mechanics.
  2. Either party may terminate with immediate effect by notice if the other commits a material breach that is not remedied within 14 days of notice, or becomes insolvent or subject to insolvency proceedings.
  3. On termination or expiry of a licence, the right to use licensed mode ceases and Crosswalk reverts to trial mode (the free version; where a project's plan-trial window has already elapsed the features of the paid plans are read-only, and project data remains viewable and exportable). Output already generated in licensed mode is unaffected and may continue to be used in accordance with clause 7.2. Any use of Crosswalk after expiry is trial use, and any output generated after expiry is watermarked trial Output subject to clauses 2.3 and 5.

10. Disclaimer of warranties and no reliance

  1. Crosswalk is provided as a compliance-support aid on an "as is" and "as available" basis, in both trial and licensed mode. To the maximum extent permitted by law, the Licensor gives no warranties, express or implied, including as to accuracy, completeness, currency, merchantability, or fitness for a particular purpose. The Licensor does not warrant that Crosswalk or its Output is error-free, that it reflects the current state of the law, or that reliance on it will achieve or demonstrate legal compliance. The Output is not legal advice and is not, by itself, proof of compliance.
  2. The Licensee confirms that it does not rely on Crosswalk or its Output as a substitute for its own legal analysis or professional advice, and that it uses Crosswalk at its own risk and on the basis of its own independent verification against the official EU publications.

11. Limitation of liability

  1. Nothing in this Agreement excludes or limits liability that cannot be excluded or limited under mandatory law, including liability arising from the Licensor's intentional misconduct or wilful recklessness.
  2. Subject to clause 11.1, the Licensor's total aggregate liability arising out of or in connection with this Agreement or the use of Crosswalk, whether in contract, tort (including negligence), or otherwise, shall not exceed the total Fees paid by the Licensee in the twelve (12) months preceding the event giving rise to the liability. In respect of claims arising from use of Crosswalk in trial mode, the Licensor's total aggregate liability shall not exceed one hundred euros (EUR 100).
  3. Subject to clause 11.1, the Licensor shall not be liable for any indirect or consequential loss, loss of profit, loss of business, loss of goodwill, loss or corruption of data, regulatory fines or penalties imposed on the Licensee, or any loss arising from reliance on the Output without independent verification.
  4. The Licensee acknowledges that it remains solely responsible for its own compliance decisions and for verifying Output against the official EU publications and other authoritative sources.
  5. Subject to clause 11.1, any claim against the Licensor arising out of or in connection with this Agreement or the use of Crosswalk lapses unless legal proceedings are commenced within twelve (12) months after the Licensee became aware, or reasonably should have become aware, of the event giving rise to the claim.

12. Indemnity

The Licensee shall indemnify the Licensor against any third-party claim arising from the Licensee's distribution or onward use of the Output, or from the Licensee's compliance decisions based on the Output, except to the extent such claim results from the Licensor's intentional misconduct or wilful recklessness.

13. Data protection and data flows

  1. Local by default. Crosswalk processes project content locally on the user's device. By default the software transmits no project content or telemetry to the Licensor, and the Licensor does not host the data the Licensee processes with Crosswalk. In respect of that local operation the Licensor is not a processor of the Licensee's data.
  2. Licensing operations. To validate and activate a licence, the software transmits the licence key and a short device label to the Licensor's licensing service, which verifies them against the purchase records held by Polar. The Licensor processes this limited operational data as controller, solely to operate licensing and, for the Plus add-on, the usage metering described in clause 13.4.
  3. AI features are opt-in. No content is sent to any AI provider unless the Licensee enables an AI provider in the settings. When an AI feature is used, the content the Licensee submits (prompts and the project context accompanying them) leaves the local environment as follows:
  1. Plus managed AI. With the optional Plus add-on, content the Licensee submits to the AI assistant is transmitted through the Licensor's proxy service to the AI provider engaged by the Licensor (the "AI Sub-processor"). The Licensor processes that content solely to provide the AI feature: it forwards the content and returns the response, stores no prompts or responses, and retains only aggregate usage metering (token counts per licence key per month). For this processing the Licensor acts as processor on the Licensee's behalf, and the Annex (Data Processing — Plus managed AI) forms the data processing agreement under Article 28 GDPR between the parties.
  2. Licensee responsibilities. The Licensee determines what it submits to AI features and remains controller of that content. The Licensee is responsible for having a lawful basis for any personal data it submits, for not submitting data it is not permitted to disclose, and — where it uses its own AI provider — for the terms and safeguards of that provider.
  3. Purchases. Licence purchases are handled by Polar as Merchant of Record. Polar acts as the seller and is responsible, as controller, for the personal and transactional data collected at checkout under its own privacy terms. The Licensor does not store that data.

14. Confidentiality

Each party shall keep confidential the other party's non-public information disclosed in connection with this Agreement and use it only for the purposes of this Agreement, except where disclosure is required by law. This does not restrict the Licensee's use of its own Output under clause 7.2.

15. General

  1. We may amend this Agreement from time to time. The version in force for licensed use is the version presented at the time of purchase; for trial use, the version presented on start-up. Where a change is material and affects an active licence, we will present the updated Agreement for acceptance on renewal.
  2. If any provision is held invalid or unenforceable, it shall be modified to the minimum extent necessary or severed, and the remainder shall continue in full force. In particular, if any limitation of liability is held unenforceable in part, it shall apply to the maximum extent permitted by law.
  3. This Agreement, together with the purchase details captured by Polar, constitutes the entire agreement between the parties regarding Crosswalk and supersedes prior agreements, representations, and statements on its subject matter, none of which the Licensee has relied upon. This Agreement prevails over any conflicting terms the Licensee seeks to apply, including any general terms of purchase, which are expressly rejected (Article 6:225(3) of the Dutch Civil Code).
  4. No failure or delay in exercising a right operates as a waiver of it.

16. Governing law and jurisdiction

This Agreement is governed by the laws of the Netherlands, excluding the United Nations Convention on Contracts for the International Sale of Goods. Any dispute shall be submitted to the exclusive jurisdiction of the competent court of the Rechtbank Oost-Brabant, location 's-Hertogenbosch, without prejudice to any mandatory protective jurisdiction rules that may apply.

*Crosswalk is not a source of legal truth. You are responsible for checking all references against the official EU publications yourself.*

Acceptance record

This Agreement is accepted electronically; no physical signature is required. In trial mode, acceptance is given by acknowledging the start-up notice and continuing, and is recorded on the Licensee's device (version and date). In licensed mode, acceptance is given at the Polar checkout - where this Agreement is presented and its acceptance is a required step - and is recorded by Polar together with the purchase; the confirmation at first activation of the licence key is recorded on the Licensee's device (version and date, shown in the licence panel). The applicable version is the one presented at the time; the Licensor maintains a dated version archive at eu-cyber-laws.com/crosswalk/licence.html, and Polar's purchase record evidences the date from which licensed use applies.

Annex — Data Processing (Plus managed AI)

This Annex applies only where the Licensee uses the Plus managed-AI add-on, and forms the data processing agreement under Article 28 GDPR referred to in clause 13.4. The Licensee is controller; the Licensor (Depre.nl) is processor.

  1. Subject matter and duration. The processing consists of relaying the content the Licensee submits to the AI assistant (prompts and accompanying project context) to the AI Sub-processor and returning the response, together with usage metering, for as long as the Licensee's Plus add-on is active.
  2. Nature and purpose. Transient relay of AI requests and responses to provide the managed AI feature, and per-seat usage metering (token counts) to apply the monthly allowance. The Licensor uses the content for no other purpose: no storage of prompts or responses, no training of models, no profiling, no advertising.
  3. Categories of data and data subjects. The Licensee determines the content it submits; it may include personal data appearing in the Licensee's project data (for example names of contacts, roles, and assessment notes). Data subjects are the persons whose data appears in that content.
  4. Instructions. The Licensor processes the content only as needed to provide the feature, this Annex constituting the Licensee's complete documented instructions. Persons acting under the Licensor's authority are bound to confidentiality.
  5. Security (Article 32). Content is transmitted over encrypted connections (TLS); the Licensor's proxy holds the AI Sub-processor credentials server-side only, stores no request or response content, and retains only usage counters. Usage metering records expire automatically no later than sixty (60) days after the end of the month they concern.
  6. Sub-processing. The Licensee grants general authorisation for the engagement of the AI Sub-processor identified in the product documentation (at the effective date: Anthropic, PBC). The Licensor will announce a change of AI Sub-processor via the product or website; if the Licensee objects, it may stop using Plus and switch to its own key or a local model at any time, which ends this processing. Where the AI Sub-processor processes data outside the EEA, the transfer takes place under a valid Chapter V GDPR transfer mechanism (such as an adequacy decision or standard contractual clauses) as maintained by the AI Sub-processor.
  7. Assistance and notification. Taking into account the nature of the processing (transient relay, no storage), the Licensor provides reasonable assistance with data-subject requests and with the Licensee's Articles 32–36 obligations, and notifies the Licensee without undue delay after becoming aware of a personal data breach affecting this processing.
  8. Deletion and audit. No content is stored, so no content deletion is required on termination; remaining usage counters expire as set out in clause 5 of this Annex. The Licensor makes available the information reasonably necessary to demonstrate compliance with this Annex and allows audits, limited to once per twelve (12) months, on reasonable notice and at the Licensee's cost.