LEGAL NOTICE, GENERAL B2B CONDITIONS AND COMPREHENSIVE PRIVACY POLICY

This regulatory section exhaustively establishes the conditions governing the access, navigation, and commercial use of the website https://xortho.es/ (hereinafter, the "Platform" or the "Website"), as well as the legal precepts governing commercial transactions, the mandatory electronic billing regime, personal data processing policies, and algorithmic transparency obligations applicable under the legislation in force in Spain in the year 2026.

This document serves as a binding contract between the parties. By accessing, registering a corporate profile, or formalizing any transaction on the Platform, the User recognizes, understands, and expressly, fully, and without reservation of any kind accepts these clauses in their entirety. The User formally consents to waive any jurisdiction or legislation enacted for the protection of consumer rights, since the material goods and services provided here are strictly, only, and exclusively directed at registered professionals and commercial entities in the orthodontic and clinical sector.

First. Identity of the Information Society Services Provider In strict compliance with the public information duty enshrined in article 10 of Law 34/2002, of July 11, on Information Society Services and Electronic Commerce (LSSI-CE), it is stated and users are informed that the exclusive ownership and economic exploitation of the Platform correspond to the commercial entity ORTHONET TECHNOLOGIES S.L. (hereinafter, "The Company"), provided with Tax Identification Number, with registered office located in. The said company is duly registered in the Mercantile Registry of the province of, in Volume 38155, Folio 1, Section 8, Registration Sheet 679011, I/A 1 (09.12.18).

To guarantee direct, effective, and transparent communication, The Company provides professional users with the corporate e-mail box CALIDAD@XORTHO.ES and the commercial assistance telephone line +34644297766, channels that will operate as official routes for the escalation of incidents and the reception of legal notifications.

Second. Exclusive B2B Nature and Verification of User Qualification The Platform has been designed and operates under a Business-to-Business (B2B) business model. All products, technical equipment, clinical instruments, orthodontic supplies, and accessory services displayed in the virtual catalog are directed solely and exclusively to duly qualified health professionals, dental laboratory technicians, dental clinics, and commercial entities legally constituted for the provision of oral health services.

Under no circumstances is access, profile registration, or order formalization permitted by final consumers or private users, understood as those natural persons acting for a purpose outside their commercial, business, trade, or profession, as defined in the revised text of the General Law for the Defense of Consumers and Users (Royal Legislative Decree 1/2007). By accepting these terms, the User declares, guarantees, and certifies under their exclusive and total responsibility that they acquire the products and supplies with the sole purpose of integrating them into a clinical, productive, or business process typical of their declared professional activity.

As a consequence of this restricted nature, The Company reserves the inalienable right to audit the created profiles and to demand at any time the submission of reliable documentation accrediting the professional status of the User. This documentation may include, but is not limited to, the membership number in the corresponding official college of dentists, the certificate of registration in the Census of Entrepreneurs, Professionals and Retainers of the Tax Agency, or the deed of constitution of the clinical society. Failure to provide such documentation shall entitle The Company to proceed with the cautionary suspension or the immediate and permanent deletion of any account, without any right to compensation on the part of the suspended User.

Third. Exoneration of Clinical Liability and Limitation of Extracontractual Warranties All information, technical manuals, specifications catalogs, product descriptions, and simulation software provided through this Platform are for purely commercial, guidance, and informative purposes. Under no circumstances, neither explicitly nor implicitly, do such contents constitute clinical advice, diagnostic guidance, therapeutic prescription, or validated medical instruction.

The User assumes total, exclusive, and non-delegable responsibility for the choice, acquisition, practical application, and clinical use of the materials and dental equipment purchased through the Platform. The Company expressly and absolutely declines any type of civil, criminal, or administrative liability derived from damage to third parties, medical negligence, clinical malpractice, adverse reactions, or systemic complications that could arise in dental practice as a direct or indirect result of the use of the supplied products. Rectors and health professionals assume the unavoidable obligation to exhaustively review the manufacturer's instructions, safety data sheets, technical leaflets, and sterilization and biosafety protocols before proceeding to use any material on the anatomy of human patients.

Likewise, regarding the intrinsic availability and security of the Platform, The Company adopts advanced and diligent cybersecurity protocols; nonetheless, the current state of technology does not allow guaranteeing that the digital environment is perpetually free of technical coding errors, unforeseen server crashes, connectivity interruptions, or malicious cyber attacks orchestrated by third parties. Therefore, The Company expressly excludes, up to the maximum degree permitted by Spanish civil and commercial legislation, any economic liability for lost profits, business interruption, loss of business opportunities, or data corruption experienced by the corporate User as a consequence of operational failures in the telematic system.

Fourth. Comprehensive Privacy Policy and Personal Data Processing The treatment of personal information in the corporate environment of The Company is governed by the principles of lawfulness, fairness, minimization, transparency, and proactive responsibility required by the General Data Protection Regulation (GDPR) of the European Union and the Spanish Organic Law 3/2018 (LOPDGDD).

ORTHONET TECHNOLOGIES S.L., with the identification data detailed in the First Condition of this document, acts as the Data Controller for the data collected through interaction with the Website.

4.1. B2B Legitimizing Basis and Purposes of Processing In accordance with the regulatory provision of article 19 of the LOPDGDD, in conjunction with article 6.1.f) of the GDPR, the processing of professional contact data (such as name, surname, functions or position held, telephone number, and corporate e-mail address) of the natural persons who provide their services in the client legal entities, as well as the data of individual entrepreneurs, is irrefutably supported by the legitimate interest of the Data Controller. This legitimate interest is imperative for the correct achievement, maintenance, and development of the professional, commercial, and institutional relationship that binds both parties.

The concrete, specific, and explicit purposes for which this information is processed are the management of corporate account registration, the verification of professional membership, the logistical and accounting processing of the orders placed, the issuance and delivery of electronic invoices, and the compliance with tax, accounting, and money laundering prevention obligations required by the State. Additionally, protected by the provisions of the LSSI-CE on commercial communications between companies with a prior contractual relationship, the data will be used for sending technical catalogs, safety bulletins on materials, and offers related to the dental supplies usually acquired, guaranteeing in every commercial communication the inclusion of an automated, free, and simple mechanism so that the User can manifest their will of opposition or unsubscribing from said distribution lists.

4.2. Absolute Prohibition Clause on Health Data Processing This Platform is a purely transactional and commercial ecosystem. In no case is the web infrastructure, nor should it be used as, a storage system for clinical records, a telemedicine tool, or a medical repository. It is strictly and categorically forbidden for all Users to enter, load in free text areas, attach in technical support modules, or send to the corporate e-mails of The Company any special category data contemplated in Article 9 of the GDPR. This absolute prohibition covers identifiable X-rays, maxillofacial molds with patient metadata, therapeutic diagnoses, patient names, social security numbers, or any piece of information revealing the physical or mental health status of an individual.

In the event that a User seriously violates this clause and proceeds to enter clinical data of their patients in the servers or communication channels of The Company, said User shall act solely and exclusively as the infringing Data Controller of said breach of confidentiality. By accepting this agreement, the User is legally obliged to fully indemnify, keep The Company totally harmless, and assume the legal defense costs of The Company against any third-party claims, sanctioning files initiated by the Spanish Data Protection Agency (AEPD), administrative sanction, or civil conviction for extracontractual liability arising from negligence in the transmission of health data by the clinician. The automated systems of the Platform are instructed to proceed with the secure, irreversible, and immediate destruction of any clinical information or files detected on the servers.

4.3. Exercise of Rights, Conservation and Security Breaches The legal representatives, administrators, and contact persons of the clinics and client entities retain intact their right to exercise the prerogatives of access, rectification, deletion (right to be forgotten), limitation of processing, data portability, and opposition. The material exercise of these rights will be directed through communication to the e-mail FACTURACION@XORTHO.ES, attaching the appropriate documentation reliably proving the identity of the applicant.

Personal data related to commercial transactions and B2B billing will be blocked and stored securely for a minimum period of six years, in compliance with the provisions of article 30 of the Commercial Code, and until the definitive prescription of the liabilities derived from the General Tax Law. In the event of an incident materializing that violates the security of the stored personal data, The Company will proceed to activate its incident response plan, notifying the AEPD within the maximum 72-hour period required by the regulations and, if the risk to the rights and freedoms were considered high, communicating the event without undue delay to the affected professionals.

Fifth. Management of Device Identifiers and ePrivacy Regulation The Website uses data storage and retrieval devices (commonly called cookies) and similar tracking technologies on User terminals. In strict compliance with the framework of the ePrivacy Directive and conforming to the updated and binding interpretive criteria issued by the AEPD for the year 2026, the installation of any cookie that is not strictly necessary for the technical functioning of the network is inexcusably conditioned to obtaining prior, free, explicit, granular, and revocable consent.

The Platform's architecture categorizes these technological devices into two dimensions. On the one hand, technical and essential functionality cookies, which allow basic navigation, secure management of the inter-company shopping cart, prevention of transactional fraud, and maintenance of the billing session. These cookies do not require the User's consent and their forced deactivation would disable the operations of the web. On the other hand, analytical and performance measurement cookies are used exclusively to audit catalog interaction metrics and optimize information architecture; the latter will only be installed if the User provides an unequivocal affirmative action through the initial configuration panel.

The consent provided will have a maximum temporary validity, after which its renewal will be required. Likewise, the User retains the inalienable right to revoke their consent or reconfigure their preferences at any time during navigation. To do so, the Platform guarantees the absence of deceptive design patterns (dark patterns), ensuring that the rejection or revocation process requires the same cognitive effort and number of clicks as the initial acceptance, facilitating permanent access through a privacy panel anchored in the footer of the Website.

Sixth. Algorithmic Transparency and Compliance with the Artificial Intelligence Act In order to optimize the efficiency of the commercial service and to strictly comply with the mandatory transparency obligations stipulated by the European Artificial Intelligence Regulation (AI Act, Regulation EU 2024/1689), fully applicable in the current exercise, The Company establishes the following determinations regarding content generation: Certain technical descriptions of orthodontic consumables, automated translations of manufacturers' manuals, as well as immediate responses provided by initial level technical support systems (conversational assistants or chatbots), may have been generated, edited, or substantially assisted by predictive AI generative models. All synthetic content showing relevance for the professional's decision-making will be subject to explicit marking or labeling in the visual interface of the Platform, warning clearly and unmistakably about its non-human origin. The Company excludes any liability derived from semantic or translation inaccuracies that these predictive models could generate anomalously. It is the unavoidable responsibility of the registered practitioner to carry out the final review and validate the technical specifications of the material against the manufacturer's official certifications before its application in the clinical environment.

Seventh. Digital Intermediation and DSA Mechanisms In those cases where the Platform enables participatory modules or directories that allow the hosting of reviews of materials by clinicians, or hosts repositories of data and technical specifications directly supplied by third-party manufacturers without prior editorial modification, The Company shall assume the legal status of data hosting service provider under the precepts of the European Union's Digital Services Act (DSA).

The Company operates under a duty of care regime, not assuming any general obligation to actively monitor the entirety of the information stored to proactively search for illegal facts or circumstances. However, The Company has implemented internal protocols and standardized electronic forms to receive formal notifications of the existence of content that could violate industrial property rights, be unlawful, defamatory, or constitute a legal infringement. After acquiring effective knowledge of the existence of said contents, whether by resolution of a competent authority or detailed denunciation by an alert-blower, The Company will act with the maximum speed to disable access or remove the reported information, collaborating at all times with the competent commercial and judicial supervision authorities.

Eighth. Obligations in B2B Electronic Invoicing (Crea y Crece Law) Subject to the technical and tax requirements established by Law 18/2022 on the creation and growth of companies, and the binding implementation regulations since the phased entry into force of digital invoicing regulations in 2026 and 2027, the corporate User manifests their agreement and acceptance to submit to the following strict invoicing regime: All invoices derived from the purchase and sale operations materialized on the Platform will be generated, sent, and stored in a structured electronic format (using the standard XML/Facturae syntax) and will contain the necessary cryptographic validations to ensure their integrity, connectivity, and unalterability against public Tax Agency systems, such as the VERIFACTU system, at the time it comes into force.

Of vital importance is the assumption by the B2B client of their legal obligations as a recipient of the electronic invoice. The receiving company or dental clinic is obliged by law and by this contract to communicate to the issuer (The Company), within the strict regulatory period of four calendar days, the commercial acceptance or rejection of the issued invoice. Similarly, the client acquires the mandatory commitment to electronically notify the date of the actual and complete payment of the contracted obligation. Failure to communicate these invoiceable states within the periods set shall be considered a contractual and regulatory breach attributable solely to the buyer, releasing The Company from liability before the state private delinquency observatory.

Ninth. Intellectual and Industrial Property Rights and Prohibition of Scraping The integrity of the source code, the design of the graphic interface, the navigation architecture, the product databases, the logos, the original manuals, and all the visual and software elements that make up the Platform are the exclusive property of ORTHONET TECHNOLOGIES S.L. All these elements are deeply protected by current national, community, and international legislation on Intellectual and Industrial Property.

It is expressly, strictly, and under warning of legal action, forbidden to reproduce, commercially distribute, algorithmically transform, and communicate publicly, including its mode of making available, all or a substantial part of the Platform's contents. Likewise, it is strictly forbidden to perform automated data extraction techniques (web scraping), use mass indexing robots (crawling) aimed at copying the catalog for use in competing platforms, or reverse engineering on the B2B purchasing systems.

Tenth. Applicable Law, Jurisdiction and Settlement of Disputes The legal and commercial relationships arising from the use of this Platform, the validity of these clauses, and the execution of the obligations contained herein shall be governed, interpreted, and subject unconditionally to the common Spanish civil and commercial legislation.

For the clarification, resolution, and judgment of any controversy, interpretative discrepancy, litigation, or claim that could arise by reason of the validity, execution, compliance, or resolution of this B2B agreement or the general use of the Website, both contracting parties formulate an explicit and irrevocable waiver of any alternative jurisdiction that by right or territoriality could apply to them, and agree to submit uniquely, exclusively, and definitively to the jurisdiction and competence of the corresponding civil and commercial Courts and Tribunals of the judicial district of the city of Madrid.