These terms explain use of this website, the certification type selection tool, request forms and the PCI Manager platform. The specific terms of each service are set out in the quote and agreement accepted by the customer.
1. Provider and contact
This website is provided by INNOTECH – INNOVATIVE TECHNOLOGIES SINGLE MEMBER LTD (Greek registered name: INNOTECH ΚΑΙΝΟΤΟΜΕΣ ΤΕΧΝΟΛΟΓΙΕΣ ΜΟΝΟΠΡΟΣΩΠΗ Ε.Π.Ε.; “Innotech”), registered at 15 Neratziotissis & 4 Thiseos, Marousi, 15124, Greece, VAT number 800525642, General Commercial Registry (GEMI) number 127434301000. Contact: [email protected], telephone +30 210 600 66 66.
2. Scope
The website is intended for businesses and professionals seeking PCI DSS information or services. Browsing, using the tool and sending a request are governed by these terms. The Privacy policy separately explains personal data processing and the Cookie policy explains browser storage technologies.
Submitting a form or choosing a package does not by itself constitute acceptance of an order by Innotech, commencement of a service or completed certification. Where a specific agreement is concluded, its specific terms govern that service, subject to mandatory law.
3. PCI DSS information and the certification type tool
The tool classifies your declared business role, payment methods, transaction volume and payment environment. Its result is an indicative SAQ type and level based on those declarations. It is not an examination of your systems, an attestation of compliance, certification or binding acceptance by an acquirer, card scheme or other accepting entity.
You are responsible for accurate and complete answers and for updating them when your payment environment changes. Final eligibility for a particular SAQ, scope and required deliverables must be confirmed with the relevant accepting entity and, where necessary, a qualified assessor. Complex or uncertain situations require individual review.
4. Quote and contact requests
Provide information for a business you are authorised to represent. Required fields are identified in the form. Innotech may request clarification of the payment environment and service scope before preparing a quote. Completing scoping supports quote preparation and does not replace a technical assessment.
Request details and answers are recorded and retained in our systems to handle requests, prepare quotes and conduct related communications, in accordance with the Privacy policy and applicable law. Accepting these terms and giving the consent requested for saving quote details do not subscribe you to a newsletter or provide general permission for advertising communications.
5. Packages, displayed prices and quotes
Displayed prices relate to the SAQ type, package and subscription period shown. Recurring charges, any initial or gap assessment charges and the first payment are distinguished where applicable. Final scope, total charges, tax treatment and payment terms are confirmed before ordering. A displayed price should not be understood to cover services not described in the relevant package.
In-house PCI is intended for businesses whose own technical team carries out the process through the portal. Managed PCI DSS involves Innotech providing the agreed support, with separate initial gap assessment work where stated. The precise allocation of work, deliverables and customer responsibilities is specified in the agreement.
The promotion offering up to 100% off certification costs when combined with a partner’s managed cloud services is assessed individually. It is not an automatic or unconditional offer of free certification. Eligible packages, the basis of the discount and other conditions are specified in the individual quote.
6. Services and ASV scans
Services are provided within the agreed scope and depend on accurate information, necessary cooperation and actions by the business. This website does not represent Innotech as independently accredited as a QSA or ASV. Where a qualified third-party assessor or ASV service is required, its role and scope are identified in the relevant agreement.
Scanning or testing technical resources requires appropriate authorisation for the specific targets and an agreed scope of work. Scan results reflect findings from that examination. A passing scan does not establish overall PCI DSS compliance or guarantee the absence of vulnerabilities or future incidents.
7. PCI Manager — scope and right of use
The following terms apply to Innotech’s PCI Manager platform. Access is provided for the business’s needs within its package or specific agreement. Available modules, permitted actions and third-party services depend on the access activated and the agreement. A website description or image does not itself create an entitlement to functionality outside the service provided.
Innotech grants a limited, non-exclusive right to use the platform for the agreed purpose. This right does not transfer ownership of the software or its design. Resale, granting access to other businesses or use to provide services to third parties is permitted only where expressly included in the agreement.
8. Accounts, users and access permissions
The business designates the people authorised to use the platform and ensures that access is limited to their necessary duties. Users must provide accurate information, protect their credentials and not disclose them to unauthorised persons. Accounts must not be used to access another customer’s information or bypass restrictions.
The business must promptly report users leaving or changing responsibilities and any suspected account misuse. If credentials may be compromised, stop using them and contact Innotech promptly through the agreed support channel or [email protected] without sending the password itself.
9. Customer data, documents and confidentiality
The business retains its rights in the details, documents, answers and other material it submits. It is responsible for having permission to submit them, limiting information to what is necessary and checking accuracy and currency. Innotech may use the content to operate the service, provide support and carry out agreed work, subject to applicable confidentiality and data protection obligations.
The platform is intended to manage the compliance process, not to store actual card details or access secrets. Do not enter full card numbers, CVV/CVC, PINs, magnetic stripe data, passwords, private keys or unnecessary personal data in answers, documents or support requests. Use appropriately redacted examples where evidence is needed.
Where the service involves processing personal data on the business’s behalf, the respective roles, documented instructions and necessary processing terms are set out in a specific data processing agreement. Accepting these general terms does not replace that agreement or give general permission to exploit customer data independently.
10. Answers, deliverables and compliance responsibility
Saving answers, completing tasks or displaying a status in PCI Manager does not by itself constitute certification or acceptance by an acquirer or card scheme. The business reviews statements and deliverables before submission, approves anything signed on its behalf and remains responsible for implementing requirements in its actual environment.
Platform support is provided at the agreed service level. Any assessor or ASV involvement and related deliverables are specified separately. The portal does not replace an examination or assessment required by the relevant accepting entity.
11. Scans, technical targets and integrations
Where requesting or managing scans is enabled, the business confirms authorisation for every submitted IP address, domain or other technical target. It is responsible for specifying the correct scope and coordinating with system owners or hosting providers as needed. Testing third-party systems without permission is prohibited.
Any API or external integration may be used only through granted access, for the agreed purpose and within applicable restrictions. Tokens and API keys must be protected like passwords. Publishing them in public code, attempting to extract other parties’ data or bypassing security controls is prohibited. External services are also subject to their providers’ terms.
12. Availability, updates and support
The platform may require maintenance, corrections and updates or be affected by infrastructure services and third-party providers. Sending a support request does not imply a specific response or resolution time unless an applicable SLA has been agreed. Portal access alone does not guarantee uninterrupted availability or automatic resolution of compliance findings.
The business should retain the original documents and business information needed for its own operations. Use of the platform is not a standalone archiving or backup service unless expressly agreed. Specific availability, support and data recovery obligations are set out in the service agreement.
13. Access restrictions and ending use
Access may be restricted to the extent necessary to address a security incident, unauthorised use, unlawful activity or a material breach of these terms, in accordance with the agreement and applicable law. Where practicable without compromising security or a legal obligation, notice and an opportunity to clarify or remedy the issue are provided.
Service duration and renewal, termination and financial consequences are governed by the relevant agreement. Before the service ends, the business should coordinate with Innotech to receive the data and deliverables to which it is entitled. Platform access, return or deletion of data and any lawful retention are handled under the agreement, data protection obligations and applicable law. Unlimited access after the service ends is not implied.
14. Acceptable use and submitted content
Do not use the website for unlawful activities, unauthorised access attempts, disruption, malicious material or requests to test third-party systems without permission. Do not submit full card numbers, card security codes, passwords, private keys or other access credentials through the forms or scoping.
Provide only necessary information and third-party details you are entitled to share for the request. Submission does not transfer ownership of your content to Innotech; it permits its use to consider your request and provide the agreed service.
15. Intellectual property and third-party links
Website content, design and branding are protected by the rights of their respective owners. You may use the material to learn about the services. Republication or commercial exploitation requires appropriate permission. PCI SSC standards and documents, and partner or third-party marks, remain subject to their owners’ terms.
Links to external websites or portals are provided for convenience. External services have their own terms and privacy policies. A link does not mean that Innotech controls the external service’s content or all subsequent changes.
16. Availability, corrections and responsibility
We aim to provide useful and accurate information and tools. Corrections, updates or temporary interruptions may be necessary. References to standards should be read with the relevant version and current requirements of the competent entities. If you identify an error in a result or price, contact us before relying on it for a purchase or compliance decision.
Each party’s service obligations and responsibility are governed by the agreement and applicable law. No website term excludes liability or rights that cannot lawfully be excluded, or restricts mandatory consumer rights where applicable.
17. Updates and resolving issues
These terms may be updated when services or website functionality change. Updates do not automatically amend an existing specific agreement. For questions, corrections or complaints, contact [email protected]. Disputes are governed by applicable law without restricting your mandatory rights.