Terms of Participation
A Bulgarian version is available at stihia.ai/events/slay-the-zmey/terms-bg. In case of discrepancy, the Bulgarian version prevails.
1. Organiser
1.1. The event is organised by Stihia Ltd., UIC 208453727, registered address: 20 Lajos Kossuth Str., fl. 4, apt. 10, Sofia 1606, Bulgaria, VAT No. BG208453727, e-mail: info@stihia.ai (“Stihia”).
1.2. Supervisory authorities: Commission for Consumer Protection (www.kzp.bg) and Commission for Personal Data Protection (www.cpdp.bg).
2. Subject
2.1. These Terms govern the relationship between Stihia and any person who purchases a ticket for or accesses the online event “Hack an AI Agent: Slay the Zmey” (the “Event”) (the “Participant”).
2.2. The Event is a live online educational session of about 2 hours, including a presentation, demonstrations of attacks on AI agents, the hands-on game “Zmey”, and a Q&A session.
2.3. Date and time: 20 October 2026, 18:00–20:00 Bulgarian time. Platform: Google Meet. Registration and payment: via Luma.
2.4. By ticking the acceptance box at registration, the Participant confirms having read, understood and accepted these Terms.
3. Tickets and prices
3.1. Prices are in euro and include all taxes, including VAT where applicable: early bird €23 until 15 October 2026 inclusive, and regular price €32 thereafter.
3.2. Stihia may issue a limited number of discount codes. A code is personal, single-use, cannot be combined with other discounts and cannot be exchanged for cash.
3.3. Places are limited to 50. Registration is confirmed by successful payment and a confirmation e-mail from Luma.
3.4. Payment is made by card via the payment service provider Stripe. Stihia does not receive or store card details.
3.5. An invoice is issued on request if the Participant provided company details at registration or requests one at info@stihia.ai within the statutory term.
4. Access and technical requirements
4.1. The personal access link is sent by Luma to the e-mail address provided at registration. The link is personal and may not be shared.
4.2. The Participant provides their own device with a browser and a stable internet connection. Stihia is not responsible for inability to attend caused by the Participant’s equipment or connection.
4.3. The session is not recorded and no recording is provided.
5. What the Participant receives
5.1. Live participation in the Event and in the Zmey game.
5.2. After the Event, by e-mail: a certificate of participation (PDF), a PDF with AI hacking techniques, and access to a free 5-minute online test of whether the Participant’s organisation uses AI safely and in compliance with applicable rules.
5.3. The materials are for the Participant’s personal use and internal use within their organisation only. Public distribution, uploading online, resale or use for training third parties without Stihia’s written consent is prohibited.
6. Withdrawal, cancellation and refunds
6.1. A consumer Participant may cancel and receive a full refund by notifying Stihia at info@stihia.ai or via Luma no later than 48 hours before the start of the Event.
6.2. After that, the amount is not refunded, but the Participant may transfer the ticket to another person by notifying Stihia before the Event starts.
6.3. By ticking the relevant box at registration, the Participant expressly requests the service to be provided on the stated date and acknowledges that the right of withdrawal is lost once the service has been fully provided (Art. 57(1) of the Bulgarian Consumer Protection Act).
6.4. If Stihia cancels the Event, the full amount is refunded within 14 days. If Stihia changes the date, the Participant may choose between attending on the new date and a full refund.
6.5. Refunds are made to the card used for payment.
7. Conduct and ethical use
7.1. Participants treat speakers and other participants with respect. Stihia may remove a disruptive Participant from the session without refund.
7.2. The techniques shown are presented for educational and defensive purposes only. The Participant undertakes not to use them against any system without the explicit permission of its owner. Unauthorised access to computer systems is a criminal offence.
7.3. Zmey is a purpose-built Stihia environment. Only the AI agent within the game may be attacked. Attacks on Stihia’s infrastructure, automated overloading of the service and attempts to access other participants’ data are prohibited.
7.4. Participants must not enter personal data, passwords or confidential information into Zmey.
8. The Zmey game and prizes
8.1. Zmey has 5 levels. Participants start during the Event and have 5 days (until 25 October 2026, 23:59) to complete all levels.
8.2. Prizes go to the first three registered participants who complete all five levels, in order of completion: 1st place: €30, “Zmey Slayer” medal, a free seat at a future Stihia event and a LinkedIn shout-out (only with the winner’s consent); 2nd place: €20, a free seat at a future event and a digital badge; 3rd place: €10, 50% off a future event and a digital badge. The 1st-place winner’s employer receives 20% off a corporate workshop.
8.3. If fewer than three participants complete all levels, the remaining prizes are not awarded. How to prove completion is explained during the Event.
8.4. The game is won by skill, not chance. Each participant plays with one profile. Using multiple profiles, publishing solutions before the deadline or breaching section 7 leads to disqualification.
8.5. Cash prizes are paid by bank transfer within 7 days of the end of the game. The winner provides their name, IBAN and any data required by tax law. Where applicable, Stihia withholds and pays the tax due. Prizes cannot be exchanged for other benefits.
9. Intellectual property
9.1. The presentations, videos, checklists, the Zmey game and all other materials are owned by Stihia or used by it lawfully.
9.2. Participants may not record, film or broadcast the Event without Stihia’s written consent.
10. Liability
10.1. The Event is educational and does not constitute consulting, an audit or a security assessment of the Participant’s systems.
10.2. Stihia is not liable for damage resulting from use of the techniques shown in breach of section 7.
10.3. Stihia’s liability to the Participant is limited to the ticket price paid, except in cases of intent or gross negligence.
10.4. Stihia is not liable for failure caused by circumstances beyond its control, including outages of Google, Luma or Stripe services. In such cases Stihia offers a new date or a refund.
11. Personal data
11.1. Stihia processes Participants’ personal data in accordance with the Privacy Policy at stihia.ai/privacy.
12. Complaints and disputes
12.1. Complaints can be sent to info@stihia.ai. Stihia responds within 14 days.
12.2. A consumer Participant may contact the Commission for Consumer Protection or its General Conciliation Commission for out-of-court dispute resolution.
12.3. Bulgarian law applies. Disputes are resolved by the competent Bulgarian court, without prejudice to consumers’ statutory rights.
13. Changes
13.1. Stihia may amend these Terms by publishing a new version on its website. Changes do not affect tickets already purchased without the Participant’s consent.
13.2. Last updated: 26 September 2026.
Privacy: Events and workshops
This section supplements the Stihia Privacy Policy at stihia.ai/privacy and applies to registrations for Stihia events.
What data we collect
When you register for a Stihia event we collect: name and e-mail address; answers to registration questions (role, AI tools you use, company size, whether your company has AI usage rules, topics of interest); company name and VAT/UIC number if you request an invoice; attendance data; in the Zmey game, the messages you send to the agent and your progress; for prize winners, name, IBAN and data required by tax law. Card payments are processed by Stripe; we do not receive or store your card details.
Why and on what legal basis
To register you, give you access, send you the materials and certificate, and run the Zmey game and prizes: performance of a contract (Art. 6(1)(b) GDPR). To issue invoices, keep accounting records and meet tax obligations: legal obligation (Art. 6(1)(c)). To improve our events, prevent abuse and analyse Zmey attempts in anonymised or aggregated form to improve our security research: legitimate interest (Art. 6(1)(f)). To contact you about corporate training if you ticked that box: your request (Art. 6(1)(b)). To send you news about future events and services, and to mention a prize winner on LinkedIn: consent (Art. 6(1)(a)), which you can withdraw at any time.
Who receives your data
Luma (Luma AI, Inc., USA) for registration and ticketing; Stripe for payment processing; Google (Google Workspace / Meet) for the online session; Tally BV for the 5-minute online test; our accountants; and competent authorities where required by law. Luma and Stripe may also act as independent controllers under their own privacy policies.
International transfers
Some of these providers process data in the USA. Transfers are based on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses.
How long we keep it
Registration data: 2 years after the event. Accounting documents and invoices: as required by the Bulgarian Accountancy Act 10 years. Zmey messages: 6 months, then deleted or anonymised. Marketing data: until you withdraw consent.
Your rights
You have the rights of access, rectification, erasure, restriction, objection and data portability, and the right to withdraw consent at any time. Write to privacy@stihia.ai. You may also lodge a complaint with the Bulgarian Commission for Personal Data Protection (www.cpdp.bg).