General Terms and Conditions

Module A – General

A.1. Definitions

The capitalised terms in these General Terms and Condition have the following meaning.

A.1.1. General Terms and Conditions: the provisions laid down in this document.

A.1.2. Data: personal and other data which have been stored by Client and are accessible via the Service.

A.1.3. Service(s): the service(s) that Dyflexis will perform for Client as described in Dyflexis’s proposal or quotation including, but not limited to, supplying Hardware and software (-as-a-service).

A.1.4. Dyflexis: the private limited liability company under Dutch law Dyflexis B.V., with its registered office in The Hague and which is registered with the Chamber of Commerce under file number 59584327. Dyflexis also includes all trade names of Dyflexis B.V. register ed with the Chamber of Commerce, including the trade name Wodan Brothers.

A.1.5. Hardware: the equipment to be supplied to Client by Dyflexis under the terms and conditions set out in the Agreement.

A.1.6. Commencement date: the date on which the Agreement comes into effect and on which the provision of the Service starts.

A.1.7. Intellectual Property Rights: all intellectual property and related rights including, but not limited to, copyrights, database rights, domain names, trade name rights, trademark rights, design rights, neighbouring rights, patent rights, as well as rights to know-how.

A.1.8. Licence: the maximum permitted number of employees (or other records entered as an employee, such as administrators, agency workers, etc.) in the Employee Overview within the Service with the status ‘Active’ or ‘Inactive’. Users with the status ‘Inactive’ do not consume a Licence.

A.1.9. Client: the natural or legal person with whom Dyflexis has concluded an Agreement. Client also refers to the party with whom negotiations are being conducted to enter into an agreement as well as its representative(s), authorised person(s), successor(s) in title, or heirs.

A.1.10. Delivery: the moment that the Service has (or the login codes have) been made available to Client.

A.1.11. Agreement: every agreement between Dyflexis and Client arising from a proposal or quotation made by Dyflexis and the valid acceptance thereof by Client.

A.1.12. SLA: the service level agreement concluded between Dyflexis and Client containing the agreements regarding the level, the quality, and the manner in which problems in connection with the Service will be solved.

A.1.13. Updates: changes in and updates of the Service in connection with bug fixing, improving the functionality and/or remedying faults.

A.1.14. Upgrades: structural changes in and upgrades of the Service in order to add (important) functionalities.

A.1.15. Working Days: Monday through Friday, with the exception of national holidays in the Netherlands.

A.1.16. Work(s): the websites, applications, lay -out, data files, software, documentation, advice, reports, analyses, designs or other products developed or designed by Dyflexis, whether or not on behalf of and/or at the request of Client.

A.1.17. Working Hours: hours on Working Days between 9 am and 5 pm.

A.2. Applicability and order of precedence

A.2.1. These General Terms and Conditions are applicable to every quotation or proposal made by Dyflexis regarding Services and constitute an integral part of every Agreement.

A.2.2. If the company name used by Client refers to more than one natural or legal person or organisation, each is responsible for the complete fulfilment of the obligations arising from the agreement with Dyflexis.

A.2.3. The specific modules apply if the requested or offered Services fall under the scope of application described in the module. If a specific module applies, this module prevails over Module A.

A.2.4. The definitions as described in Article A.1 apply to all modules of these General Terms and Conditions, unless a meaning is attributed elsewhere in the Agreement and/or the General Terms and Conditions.

A.2.5. Provisions or conditions imposed by Client that deviate from, or do not appear in, these General Terms and Conditions are only binding for Dyflexis if and insofar as these have been accepted explicitly by Dyflexis in writing.

A.2.6. In the event of any contradiction between provisions in the Agreement, General Terms and Conditions or annexes thereof, the following order of precedence applies:

i. the Agreement;

ii. the concluded Service Level Agreement;

iii. any annexes to the Agreement;

iv. these General Terms and Conditions.

A.3. Quotations and commencement of the agreement

A.3.1. The Agreement commences upon explicit acceptance of the quotation or the proposal by Client.

A.3.2. If Client does not explicitly indicate that it accepts the quotation or the proposal, but nevertheless agrees, or gives th e impression that it agrees, that Dyflexis carr ies out activities that fall within the description of the Services, then the quotation is regarded as accepted. This is also the case when Client asks Dyflexis to carry out certain activities without waiting for a formal quotation.

A.3.3. Quotations made by Dyflexis are valid for the period indicated in the quotation. If no period has been specified, the quotation is valid up to thirty (30) days after the date on which the quotation was sent by Dyflexis.

A.3.4. If it appears that the information provided by Client when requesting an Agreement was incorrect, Dyflexis has the right to adjust the prices accordingly.

A.3.5. The Agreement commences as from the moment on which the Service has been delivered to Client technically (“the Commencement Date”) unless a different Commencement Date has been agreed in writing.

A.4. Performance of the agreement

A.4.1. After the commencement of the Agreement, Dyflexis will undertake to deliver the Service within a reasonable period of time in accordance with the quotation.

A.4.2. Insofar as not agreed otherwise in writing, Dyflexis guarantees that the Service will be performed to the best of its abilities with sufficient care and expertise.

A.4.3. The (delivery) periods stated are only indicative and under no circumstances periods whose non-observance constitutes a default, unless agreed otherwise in writing.

A.4.4. If and to the extent that this is required for the proper execution of the Service, Dyflexis has the right to have certain activities carried out by third parties without notifying Client. Dyflexis will not charge the costs incurred by the third party to Client, unless agreed otherwise in writing.

A.4.5. If certain work under the Agreement between Dyflexis and Client is performed by a third party, Client and Dyflexis may permit said third party to invoice Client directly. In that case, the payment of an invoice issued by the third party will release both Client and Dyflexis from their obligations ensuing from the Agreement relating to the part of the work under the Agreement that was performed by the third party.

A.5. Advice

A.5.1. All services that can be regarded as advice or that have an advisory nature will be performed exclusively to the best of Dyflexis’s knowledge and ability.

A.5.2. Dyflexis is not responsible and/or liable if the work arising from the advice results in the incapability to carry out Client’s project within the budget set, the timeframe set or any other predetermined terms.

A.5.3. Dyflexis will give advice based on the preconditions specified by Dyflexis and information obtained from Client. Should it emerge that not all relevant information was obtained and/or if other kinds of problems and/or insights arise including, but not limited to, incompatibility problems (Services that are incompatible with each other), the advice given may be changed to reflect the new situation.

A.6. Client’s obligations

A.6.1 Client must do everything, or refrain from doing anything, that is reasonably necessary or desirable to enable the timely and correct execution of the Service. In particular, Client must ensure that all data, which Dyflexis indicates are necessary, or which Client reasonably should understand to be necessary, for the execution of the Service, are provided timely to Dyflexis. If said information is not provided or is not provided in full or on time, Dyflexis will be entitled to deliver a standard configuration. A.6.2 Besides the data as referred to in Article A.6.1, Client must provide up-to-date contact details to Dyflexis for the communication between Dyflexis and Client. Client will immediately inform Dyflexis in the event of a change in these contact details. A.6.3 If the data and contact details referred to in Article A.6.1 and A.6.2 are not provided to Dyflexis timely or if Client does not fulfil its obligations in another manner, Dyflexis has the right to suspend fulfilment of its obligations without being obliged to pay any compensation. A.6.4 In performing an engagement, Dyflexis will only take into account the data, information, wishes, preferences or requests that Client explicitly communicate s to Dyflexis. A.6.5 Client will render any and all cooperation to Dyflexis and will at all times promptly provide all useful and necessary data and/or other information needed for the proper performance of the agreement. Client will warrant the accuracy of that data and/or other information. A.6.6 If data, information, wishes, and/or requirements needed for the performance of the agreement are not available to Dyflexis, or are not available on time and/or as agreed, or if Client fails to fulfil its obligations in any other way, Dyflexis will in any case be entitled to terminate or rescind the agreement or to suspend its performance of the agreement, and Dyflexis will be entitled to charge the resulting costs to Client at its usual rates. A.6.7 If changes or new facts arise in the int erim with regard to data, information, wishes and/or requirements previously provided, D yflexis will at all times be entitled, in consultation with Client, to amend the agreement to reflect those new circumstances, or to rescind or terminate the agreement. A.6.8 If Client makes functional impr ovements or other changes to the Products and Services after having obtained Dyflexis’s required prior written permission, Client will be obliged to communicate those changes to Dyflexis in cases where Dyflexis provides Maintenance, Support or other services in respect of the Products and Services provided to Client. A.6.9 If Dyflexis performs work at locations other than its own, Client will provide free-of-charge facilities reasonably required by Dyflexis, such as t oilets, cafeteria facilities, workspace and telecommunication facilities. A.6.10 Client is responsible for the integrity and security of the information, communication and telecommunication systems used by Client. Client will take appropriate technological and organisational security measures to protect Data. Client will follow Dyflexis’s reasonable instruction s regarding the technological and organisational security measures that need to be taken, unless Client is able to achieve a security level similar to the proposed security measures in an alternative manner.

A.7. Privacy

A.7.1. In connection with the Service, Dyflexis is regarded as the Processor and Client as the Controller in accordance with the General Data Protection Regulation.

A.7.2. Both parties undertake to act in accordance with the General Data Protection Regulation and other privacy-related laws and regulations.

A.7.3. The Parties will enter into a processing agreement as meant in Article 28(3) of the GDPR, which is attached to these General Terms and Conditions as ANNEX 2.

A.7.4. The personal data that Dyflexis receives from Client shall only be used for the execution of the Service.

A.7.5. Dyflexis will endeavour to take sufficient technical and organisational measures with regard to the to be carried out processing of personal data, against loss or against any form of unlawful processing (such as unauthorised access, infringement, change or distribution of the personal data).

A.7.6. Dyflexis is authorised to make Client’s company name and logo available to third parties for their information.

A.8. Intellectual property

A.8.1. For Works and/or Services developed by Dyflexis itself, the Intellectual Property Rights are with Dyflexis, unless agreed with Client in writing that the rights will be transferred.

A.8.2. The Intellectual Property Rights with regard to (open source) third -party software used by Dyflexis, are with the developer of this software or another owner. Such rights can in no case be transferred to Client. Client is responsible for compliance with the (open source) software licences and indemnifies Dyflexis for claims from third parties regarding compliance with these licences.

A.8.3. Client acquires a non -exclusive and non -transferable user right for the term of the Agreement from Dyflexis for the Works which have been developed specifically for Client and at the Client’s Request. Under this user right, Client has the right to use the Works for its own purposes. In addition, Dyflexis can impose limitations and/or conditions on the use of the Works.

A.8.4. Dyflexis may use the developed Works, corresponding source files and source codes, completely or partially for other clients and purposes.

A.8.5. Dyflexis is not required to make source files and the source codes of the developed Works available to Client, unless agreed otherwise in writing.

A.8.6. Dyflexis may take technical measures to prevent changes in the developed Works, corresponding source files and source codes. This also comprises securing the Works by means of encryption.

A.9. Liability

A.9.1. Dyflexis is only liable vis -à-vis Client for direct damages as a consequence of attributable failure in the fulfilment of an Agreement. Direct damages comprise exclusively all damage consisting of:

a. direct damage to material property (“property damage”);

b. reasonable and demonstrable costs that Client has had to make to summon Dyflexis to fulfil the Agreement properly (again);

c. reasonable costs to determine the reason and the size of the damages insofar as this concerns the direct damages as referred to here;

d. Reasonable and demonstrable costs that Client has made to prevent or limit the direct damages such as referred to in this Article.

A.9.2. Dyflexis is not liable under any circumstances for compensation of indirect or consequential damages or damages due to loss of revenue or profit, delays, loss of data, exceeding deadlines due to a change of circumstances, damages due to Client providing insufficient cooperation, information or materials and damages due to information and advice provided by Dyflexis, the content of which does not explicitly form part of the Agreement.

A.9.3. The maximum amount that will be paid out in the event of liability by virtue of paragraph 1 of this Article is limited per event or a series of interrelated events to the amounts that Client is required to pay per year under an Agreement (excluding VAT). However, the total compensation per year for direct damages will never amount to more than € 15,000 (excluding VAT).

A.9.4. The limitation of liability as referred to in the previous paragraphs of this Article does not apply in the event that and insofar as the damage is the consequence of intent or gross negligence on the part of the management of Dyflexis.

A.9.5. The liability of Dyflexis due to attributable failure in the fulfilment of an Agreement only arises in the event that Client issues a written notice of default to Dyflexis immediately and properly providing a reasonable period of time to cure such default, and Dyflexis continues to attributably fail to the fulfil its obligations after this period. The notice of default must contain an as detailed description as possible of the shortcoming, in order that Dyflexis can respond adequately.

A.9.6. Client indemnifies Dyflexis for all claims of third parties (including customers of Client) regarding compensation of damages, costs, or interest, in connection with this Agreement and/or a Service.

A.10. Force majeure

A.10.1. Dyflexis is not obliged to fulfil any obligation vis-à-vis Client if it is unable to do so due to any foreseen or unforeseen external cause, which is beyond Dyflexis’s control and as a result of which Dyflexis is unable to fulfil its obligations.

A.10.2. This is defined as a circumstance for which Dyflexis cannot be blamed, nor can be held accountable by law, by a legal act or according to generally accepted standards. Force majeure comprises in particular: civil unrest, mobilisation, wars, traffic congestion, traffic obstructions and/or transport restrictions; strikes, brief employee actions, go-slow actions or other labour conflicts, network attacks such as SYN floods or (distributed) denial of service attacks, hacking, cracking, ransomware attacks or any downtime or unavailability caused by unlawful acts of third parties, the destruction, damage or rendering unusable of any automated work or any work for telecommunications by whomever, causing disturbances in the course or functioning of said work, or the thwarting by any party whatsoever of any security measures taken in respect of said work; network disruptions, disruption of networks in the internet with which Dyflexis has not concluded a contract, business interruptions, stagnation of deliveries, fires, explosions, floods, import and export restrictions, not entirely correct specifications and/or functional descriptions of third party products and Services and/or products supplied by third parties, poor weather conditions, power outages, illness, lack of staff, accidents, government actions, the failure to obtain a required licence, permit or permission, material shortages, theft, the late availability of required data, information and/or specifications, or changes to said data provided; shortcomings on the part of Deflexis’s suppliers which render it impossible for Dyflexis to deliver, irrespective of the reason for this, as a result of which the fulfilment of the Agreement cannot reasonably be demanded of Dyflexis.

A.10.3. Dyflexis may suspend the obligations pursuant to the Agreement during the period in which the force majeure lasts, with which Client’s payment obligations are also suspended. If this period lasts longer than ninety (90) days, each party has the right to terminate the Agreement, without any obligation to pay compensation for damages to the other party.

A.10.4. Insofar as Dyflexis has partially fulfilled an obligation in the Agreement at the time that force majeure occurs or could fulfil this obligation during the period of force majeure, and attributes an independent value to the fulfilled or to be fulfilled part, Dyflexis has the right to invoice the already fulfilled or to be fulfilled part separately. Client is obliged to pay this invoice.

A.11. Confidentiality

A.11.1. Parties are bound to secrecy with regard to all confidential information that they receive about the company of the counterparty, including the contents of the Agreement. Parties also impose this obligation on their employees as well as on third parties that they have contracted for the execution of the Agreement.

A.11.2. Information that is deemed confidential in any case: all information that becomes known to the other party in connection with the Agreement, information that should be regarded as confidential due to the nature of the information including, but not limited to, the personal data provided by Client, or information which has been designated as such by one of the parties.

A.11.3. For a period of 12 (twelve) months after the Agreement has been terminated or rescinded, Client is not permitted to enter into any direct or indirect employment or similar relationships with Dyflexis’s employees without Dyflexis’s written permission.

A.12. Prices

A.12.1. The charges for the provision of the Services are stated in the quotation submitted by Dyflexis. All prices stated are in Euros and are exclusive of VAT and any other levies or charges imposed by any governmental authority, unless expressly indicated otherwise in writing by Dyflexis.

A.12.2. Import duties, customs charges, and any other levies or charges imposed by any governmental authority, as well as international banking charges, shall be borne by the Client. Where such charges are imposed on Dyflexis, these shall be passed on to the Client accordingly.

A.12.3. If the Agreement is a continuing contract, the payments due in accordance with the quotation will be invoiced to Client before each new period, unless agreed otherwise in writing. Any extra costs will be settled in arrears.

A.12.4. The fees agreed between Dyflexis and Client will be based, inter alia, on electricity costs, salaries, social security contributions, materials, travel and accommodation costs, as well as the exchange rate between the currencies used, as applicable at the time of entering into the agreement. In the event of any changes in one or more cost items, including the cost of third-party Services and/or changes in the exchange rate, Dyflexis will be entitled to adjust the prices to reflect those changes.

A.12.5. Dyflexis shall provide the Client with the opportunity to take note of any price changes as referred to in clause A.12.4 that take effect during the contract period. If the Client does not agree to a price change as referred to in clause A.12.4, the Client shall only be entitled to terminate the Agreement by giving notice with effect from the date on which the price change comes into force.

A.12.6. Dyflexis shall be entitled to index prices once per year on the basis of the Consumer Price Index (Consumentenprijsindex) or the Services Price Index (Dienstenprijsindex) as published by Statistics Netherlands ( Centraal Bureau voor de Statistiek), without the Client having the right to terminate the Agreement. The most recently published final quarterly figures shall be used for the purposes of indexation. Amounts credited or deducted shall not be subject to indexation.

A.12.7. Upon renewal of the Agreement as referred to in clauses A.14.1 and A.14.2, or upon the commencement of a new calendar year in the case of ongoing agreements, any agreed pricing arrangements shall lapse and Dyflexis shall be entitled to apply the standard rates in force at that time, unless otherwise agreed in writing.

A.12.8. From the moment of Delivery, the agreed fees shall be payable by the Client to Dyflexis, regardless of whether the Client makes actual use of the Service.

A.13. Payment conditions

A.13.1. Dyflexis will send an invoice to Client for the amount owed by Client. The payment period of this invoice is fourteen (14) days after the invoice date, unless specified otherwise in the invoice or agreed otherwise in the Agreement. If payment in advance has been agreed, the Service will only be provided after the invoice has been paid.

A.13.2. Client agrees to electronic invoicing by Dyflexis. Invoices will be sent as a PDF or other generally accepted format to the email address of Client known at Dyflexis.

A.13.3. If Client has not yet paid all amounts due ( in full) at the end of the payment period, Dyflexis will grant Client the opportunity to pay the invoiced amount as yet within a reasonable period. As from sixty (60) days after the due date of the invoice, Client who has not paid timely is automatically in defau lt by force of law, without a notice of default being required. As from that moment, Dyflexis has the right to limit all of its services, for example, by limiting the access to the Service or temporarily suspending the Service, or showing a warning message in the Service without Client having the right to demand compensation for any damage it may suffer as a result. In the event of a suspension by Dyflexis, the obligations of Client remain in effect in full including, but not limited to, the payment obligation. This suspension right also applies with regard to Services for which Client has fulfilled all its obligations.

A.13.4. In the event of non -timely payment, Client is obliged to refund all out -of-court and legal expenses, including all lawyer expenses, in addition to the amount due and the accrued interest on this amount.

A.13.5. The payment obligation is immediately due and payable in the event Client or a third party applies for the bankruptcy of Client or applies for a moratorium of payments of Client, or in the event of a general seizure of the Client’s asset s by a third party, or Client enters into liquidation or is dissolved.

A.13.6. Client may not suspend or settle the payment of amounts that are due.

A.13.7. Client is obliged to pay all amounts owed under the Agreement in full, even if Client opts at a later time not to have some of the contractual work under the Agreement carried out.

A.14. Duration of the agreement

A.14.1. The Agreement is entered into for the period specified in the quotation. If no period is specified, the Agreement is entered into for a period of twelve (12) months or for the period that is necessary for the provision of the Service. Early termination of the Agreement is only possible as stipulated in the Agreement, or with the consent of both parties. If the Agreement concerns a contract for professional services, this agreement cannot be terminated early by Client.

A.14.2. If the Agreement concerns a continuing contract (for example, in the event of a SaaS agreement), this agreement is automatically extended for the same period if a written notice of termination is not received before the end of the aforementioned period, taking into account the notice period, unless agreed otherwise.

A.14.3. Both parties will take a notice period of three (3) months into account.

A.14.4. Dyflexis has the right to terminate the Agreement immediately and without any obligation to pay compensation for damages, insofar as reasonable, if:

a) Client has failed to fulfil its obligations and such a failure has not been remedied by Client within five (5) working days after receiving a written notice of default.

b) Client is declared bankrupt, applies for a moratorium of payments, or a general seizure is imposed on the Client’s assets.

A.14.5. In the event of complete or partial cancellation of the Agreement by Client, on grounds whatsoever, Client is obliged to pay 50% of the non-recurring costs specified in the quotation or the hours already spent - depending on which amount is higher. Cancellation is only possible up to the moment that Dyflexis has taken the order into production.

A.15. Amendments

A.15.1. Dyflexis may amend these General Terms and Conditions provided that it announces the intended amendment to Client no later than thirty (30) days in advance. These amendments also apply with regard to existing Agreements.

A.15.2. Amendments of minor importance can be carried out at all times, without Client having the right to terminate the Agreement.

A.15.3. If Client refuses to accept an amendment in these Terms and Conditions, Client can terminate the Agreement up to the date on which the new terms and conditions come into force.

A.16. Other provisions

A.16.1. Dutch Law applies to the Agreement.

A.16.2. Unless mandatory statutory provisions specify otherwise, all disputes that may arise pursuant to this Agreement are submitted to the competent court in the court district of The Hague, location The Hague.

A.16.3. The version of any communication and administration received by or stored by Dyflexis is deemed authentic and conclusive evidence, with the exception of evidence to the contrary to be provided by Client.

A.16.4. Communication by email is also regarded as “written” in these General Terms and Conditions provided that the identity of the sender and the integrity of the contents are sufficiently ascertained.

A.16.5. If Client is acquired by a third party or if Client acquires a third party, it must immediately notify Dyflexis as soon as Client has become aware of the acquisition.

A.16.6. Dyflexis has the right to transfer its rights and obligations pursuant to the Agreement to a third party who takes over the Service or the business activity concerned from Dyflexis, without the approval of Client being required for this.

A.16.7. If a provision in the Agreement turns out to be void, this does not affect the validity of the whole Agreement. Parties of the Agreement will then determine a new provision or new provisions as a replacement, with which as much as legally possible the intention of the original Agreement will be maintained.

A.16.8. The heading above the clauses of these Terms and Conditions are only intended to enhance the readability of this document. The content and meaning of a clause that is placed under a heading is therefore not limited to the meaning and content of the heading.

Module B – Consultancy and project management

If the Service (also) includes providing advice with regard to ICT and ICT infrastructure, implementation and/or use of software or providing training, that which is stipulated in this module also applies.

B.1. Consultancy and project management

B.1.1. Dyflexis will carry out consultancy and project management to the best of its abilities with care and expertise.

B.1.2. Parties will determine in advance which items are part of the consultancy and/or project management. If necessary, this will be adjusted during the project management in mutual consultation. Dyflexis has the right to charge any extra costs in connection with this.

B.1.3. Consultancy and project management within the context of the Agreement is always a best-efforts obligation unless agreed otherwise in writing.

B.1.4. Client is aware that following advice given by Dyflexis is completely for Client’s own risk. Dyflexis is only liable for damages suffered insofar as this follows from the Agreement.

B.1.5. Dyflexis will always inform Client in advance about the time and costs in connection with work to be carried out. The time that is necessary for the work in question is dependent on various factors, including the cooperation of Client.

B.2. Training sessions and courses

B.2.1. Dyflexis determines the contents of training sessions or courses. Client can inform Dyflexis about its preferences with regard to the contents; however, Dyflexis cannot guarantee at all times that these preferences will be taken into account in the training sessions or courses.

B.2.2. Training sessions and courses take place in the training accommodation of Dyflexis in The Hague unless agreed otherwise in writing.

B.2.3. In the event that Dyflexis gives a training session or course at a location of Client, Client is responsible for providing the facilities required by Dyflexis (including in any case sufficient course space, computers, beamers, internet connection s, food and drinks) for the training session or course, as well as handling the registrations.

B.2.4. Cost-free cancellation and/or rescheduling of a training session or course by Client can only take place up to five (5) Working Days before the date of the planned training session or course. In the event of cancellation and/or rescheduling within five (5) days before the date, 50% of the agreed costs must be paid.

B.2.5. In the event of cancellation and/or rescheduling on or after the day of the training session, 100% of the agreed costs must be paid. When Client does not appear on the day of the training session without announcing this (a No-show), 100% of the agreed costs must be paid.

B.2.6. In the event of mandatory training sessions, Dyflexis is not obliged under any circumstances to repay the paid fees.

B.2.7. Dyflexis has the right to cancel and or reschedule a training or course free of costs up to five (5) working days before the date of the planned training or course. The amounts that have already been paid in connection with training or courses that have not taken place will be repaid within ten (10) Working Days. In the event of mandatory training sessions, Dyflexis is not obliged under any circumstances to repay the fees paid. In such a case, parties will set another date in consultation.

B.2.8. For the protection of your and our property, we make use of camera surveillance at our office.

Module C – Supplying hardware

If the Service (also) includes supplying (ICT) Hardware that which is stipulated in this module also applies.

C.1. Delivery

C.1.1. Dyflexis strives to deliver the Hardware on the agreed date. However, Dyflexis is dependent on its suppliers and cannot exert any influence on the transporters. Therefore, Dyflexis cannot guarantee that the Hardware will be delivered within the agreed period.

C.1.2. The Hardware will be delivered, in principle, at the address of the Client that is known at Dyflexis. Client is responsible for providing the correct address details if th is changes, or if Client wishes to use a different delivery address.

C.1.3. Hardware can be collected free of charge. The costs of shipping to outside the EU will be charged to Client.

C.1.4. If the Hardware ordered by Client is not or no longer deliverable, Dyflexis may deliver similar Hardware that meets the specifications. If possible, Dyflexis will inform Client of this in advance.

C.1.5. Client is obliged to check the Hardware immediately after receiving the Hardware. If Client observes visible shortcomings, Client must inform Dyflexis within ten (10) Working Days.

C.1.6. Other shortcomings must be reported to Dyflexis within twenty (20) days of receipt of the Hardware or completion of the work.

C.1.7. If Dyflexis is not informed of the above -mentioned complaint within the aforementioned periods, the received Hardware is deemed to have been in a good state or the work is deemed to have been carried out properly.

C.1.8. Minor deviations with regard to specified sizes, weights, colours and such are not regarded as shortcomings on the part of Dyflexis.

C.1.9. Complaints do not suspend Client’s payment obligation.

C.1.10. If after delivery the nature and/or composition of Hardware has been changed or completely or partially adapted, processed or damaged, Client no longer has the right to lodge a complaint.

C.2. Payments and retention of title

C.2.1. For the delivery of Hardware, Client must pay half of the agreed amount to Dyflexis in advance. Dyflexis will only send and/or make this Hardware available to Client after this first payment. Dyflexis is not liable for damage due to late delivery as a result of a delay in payment by Client.

C.2.2. As long as Client has not paid the total agreed amount in full, all delivered goods remain the property of Dyflexis.

C.3. Real-time time registration module including hardware

C.3.1. Article C.3. Is only applicable in the event that Client makes use of the real-time time registration module including Hardware.

C.3.2. Hardware that is supplied to Client in a module is on loan and remains the property of Dyflexis. The on -loan use ends automatically upon the termination of the subscription.

C.3.3. Client shall follow all instructions issued by Dyflexis regarding the use and installation of the Hardware. The Hardware can be exchanged at Dyflexis’s request.

C.3.4. Client may not encumber Hardware with (limited) rights and may not sell, rent, or make equipment available to third parties in another manner.

C.3.5. If there is such a defect, caused by improper handling by Client or unauthorised changes in the Hardware made by Client, that the Hardware can no longer be repaired, Client is obliged to pay compensation to Dyflexis for the amount of the residual value of the Hardware and/or any repair costs.

C.3.6. Client shall handle the Hardware with due care. If the Hardware that Dyflexis has made available is damaged, becomes unusable or no longer functions properly in another manner, due to circumstances that can be attributed to Client, Client shall compensate Dyflexis for the damage.

C.3.7. Upon the termination of the Service, Client shall return the Hardware within 10 Working Days.

C.4. Warranties

C.4.1. Dyflexis provides a twenty-four (24) month warranty on the supplied Hardware.

C.4.2. If the Hardware shows shortcomings within the first year of purchase, Client can return the Hardware to Dyflexis. The costs for returning the Hardware to Dyflexis are for Client’s account.

C.4.3. After inspection by Dyflexis, it will repair the Hardware free of charge, unless it appears from the inspection that the shortcomings are the consequence of Client’s own acts. If that is the case, then Dyflexis may charge the costs of repair to Client. Dyflexis will always inform Client in advance of an estimate of the costs. In addition, Dyflexis may return refurbished Hardware if repair is not possible.

C.4.4. After the second year, as referred to in the first paragraph, Client can submit a request to Dyflexis for the repair of the Hardware. After receiving the Hardware, Dyflexis will inform Client about the costs in connection with the repair. After approval, Dyflexis will repair the Hardware.

C.4.5. Dyflexis is not obliged to provide (temporary) replacement Hardware to Client, unless agreed otherwise in writing.

Module D – Saas services

If the Service (also) includes services concerning the supply of software (as a service), or installing, administrating, and maintaining software (as a service), that which is stipulated in this module also applies.

D.1. Delivery of software (as-a-service)

D.1.1. Dyflexis grants the non-exclusive, non-transferable, and limited right to make use of the Service to Client for the duration and under the terms and conditions of this Agreement.

D.1.2. The right of use as referred to in the previous paragraph also includes all future Updates. Dyflexis is entitled to charge additional costs for the installation of Upgrades.

D.1.3. Client has the right to make use of the Service under the right of use for Client’s company or institution. The limitations, also including the number of employees and/or administrators and available functions are specified in the Agreement.

D.1.4. Unless agreed otherwise in writing, Client may not sub-lease the Service or make the Service available to third parties in another manner. This does not include the employees of Client’s company or institution.

D.1.5. When making use of the Service, Client shall ensure that all applicable statutory obligations are complied with.

D.1.6. Client will take appropriate technological and organisational security measures.

D.1.7. Dyflexis will send or deliver the login details of the Service to Client around the Commencement Date. Client is aware that loss of the login details can lead to unauthorised access to the Service. Therefore, Client shall ensure that unauthorised persons are unable to view the login details.

D.1.8. Client is responsible for uploading all data into the Service using the uploading option or one of the synchronisation options that Dyflexis has made available in the Service. Dyflexis is not liable for any errors after the uploading or when synchronising the data, unless in the case of intent or gross negligence.

D.1.9. Client will at least impose the same terms and conditions as stated in Article D.5 on the end users with regard to the use of the Service.

D.1.10. Dyflexis may use the anonymised Data for statistical analyses and/or benchmarking. Furthermore, Dyflexis may monitor the use of the Service based upon which it can make recommendations to Client.

D.2. Licenses and usage

D.2.1. The number of Licences and the associated payment obligations shall be determined on the basis of the Agreement. Any underutilisation of the Service and/or the Licences by the Client shall be disregarded. The records and systems of Dyflexis shall be leading for the purpose of determining the number of Licences payable.

D.2.2. Any increase in the number of Dyflexis Licences shall form an integral part of the Agreement and may be requested by the Client either within the Service or by email.

D.2.3. An increase in the number of Licences shall apply for the remainder of the agreed contract period and shall be carried forward upon any (tacit) renewal thereof.

D.2.4. A reduction in the number of Licences may only be requested by the Client in writing to Dyflexis, subject to a notice period of three (3) months prior to the end of the agreed contract period. The Client shall remain liable for the agreed fees as applicable immediately prior to the requested reduction until the end of the contract period, following which invoicing shall be based on the reduced number of Licences.

D.2.5. Where the Client makes use of flexible licences (“Flex Licences”), these shall relate to the number of Licences used in excess of the agreed number of fixed licences as determined in clauses D.2.1 through D.2.4. The total number of Licences shall be determined on a per calendar month basis, calculated by reference to the highest number of Licences used by the Client during that month.

D.3. Availability and maintenance

D.3.1. If an SLA (Service Level Agreement) has not been concluded between the parties, the following provisions apply.

D.3.2. Dyflexis aims to ensure that the Service is available; however, it does not guarantee uninterrupted availability.

D.3.3. Dyflexis actively maintains the Service. Maintenance can take place at every moment, also when this could lead to limited availability. However, Dyflexis will make an effort to carry out the maintenance during times that minimal use is made of the Service. Maintenance will be announced in advance in as far as possible.

D.4. Guarantees and modifications

D.4.1. Client accepts that the Service only contains the functionalities and other features as Client encounters in the Service at the time of delivery (“as is”), therefore with all visible and invisible errors and shortcomings. In the case of “as is” deliveries, Client waives it right to invoke the provisions of Section 17 of Book 7 of the Dutch Civil Code, and waives its right to fully or partially rescind or terminate the agreement concerned or to seek rescission or termination at law after an “as-is” delivery has been made or completed.

D.4.2. Dyflexis will make an effort to remedy problems/shortcomings in the Service. However, Dyflexis does not give any guarantees with regard to this.

D.4.3. Client is responsible for checking the calculations or processing of Data by the Service. Dyflexis does not guarantee that all calculations and/or processing will be error-free at all times.

D.4.4. Dyflexis may modify the functionality of the Service from time to time. The feedback and suggestions of Client are welcome in this case; however, Dyflexis has the right not to implement the modifications if it has reasonable grounds for this. Dyflexis aims to, but is not obliged to, announce which modifications it plans to implement at least two (2) Working Days in advance. Client may not continue to make use of the old version of the Service under any circumstances.

D.4.5. Instead of the Service ordered by Client, Dyflexis may deliver other Services provided that their operation and capacity do not differ materially from the original order.

D.4.6. Dyflexis is not obliged to continue to offer or facilitate third-party Services subject to intellectual or industrial property rights owned by third parties and which form part of the Service (including third-party plugins) in any form whatsoever.

D.5. Support by Dyflexis

D.5.1. Dyflexis offers support in connection with the delivery of the Service in the form of oral (telephone) and written (email) advice on the use and functioning of the Service.

D.5.2. Dyflexis is entitled to charge costs for Upgrades. Dyflexis will always inform Client in advance about the costs.

D.6. Rules of conduct

D.6.1. Client may not make use of the Service to violate Dutch laws or regulations or other laws and regulations that apply to the Client or Dyflexis or to infringe upon the rights of others.

D.6.2. It is forbidden by Dyflexis (whether this is legal or not) to make use of the Service to offer, store, or distribute materials that:

a. are clearly primarily intended to help others violate the rights of third parties, such as websites with (exclusively or mainly) hack tools or explanations about computer crime that are clearly intended to enable the readers to carry out the described crim inal activities or to have these carried out, and not to be able to defend themselves against this;

b. are clearly dishonourable, defamatory, insulting, racist, discriminating or spread hatred;

c. contain child pornography or bestiality pornography or are clearly aimed at helping others to find such materials;

d. result in a violation of the privacy of third parties, including in any case, but not limited to, distributing the personal data of third parties without permission or necessity or repeatedly bothering third persons with undesired communication;

e. contain hyperlinks, torrents or references with (locations of) materials that clearly infringe upon copyrights, related rights or portrait rights;

f. contain unsolicited commercial, charitable, or idealistic communication; or

g. contain malicious content such as viruses or spyware.

D.6.3. Client shall refrain from hindering other customers or internet users or causing damage to systems or networks of Dyflexis or other customers.Client may not start processes or programmes, whether or not via the systems of Dyflexis, of which Client knows or could reasonably suspect that these would hinder or damage Dyflexis, its customers or internet users.

D.6.4. If, in the opinion of Dyflexis, hinder, damage or another danger arises for the functioning of the computer systems or the network of Dyflexis or third parties and/or the service provision via internet, in particular due to excessive sending of emails and other data, (distributed) denial of service attacks, inadequate security of systems or activities of viruses, trojans and similar software, Dyflexis is entitled to take all measures that it deems reasonably necessary to avert or prevent this danger. Dyflexis may recoup the costs that are reasonably necessarily connected to these measures from Client.

D.7. Notice & takedown (complaints procedure)

D.7.1. When Dyflexis receives a complaint regarding a violation of the previous Article by Client, or when Dyflexis observes that this appears to be the case, Dyflexis will inform Client as soon as possible about the complaint or violation. Client shall respond t o this as soon as possible, after which Dyflexis will decide on what action to take.

D.7.2. If Dyflexis is of the opinion that this concerns a violation, it will block the access to the data and/or files in question; however, without removing these permanently (unless this is technically impossible, in which case Dyflexis will make a back -up). Dyflexis will make an effort not to affect any other data and/or files. Dyflexis will inform Client as soon as possible about the measures taken.

D.7.3. If Dyflexis is of the opinion that this concerns a violation of the previous Article (Rules of Conduct) it has the right - 24 hours after sending the notification - to limit all of its services, for example by restricting the access to the Service or tempo rarily suspending the Service, without Client having the right to demand compensation for any damages that it could suffer as a result. Dyflexis may also always report the observed criminal facts to the authorities. Dyflexis is only obliged to hand over da ta of Client to a third party after a court summons.

D.7.4. Although Dyflexis aims to act as reasonably, carefully, and adequately as possible after receiving a complaint about Client, Dyflexis is never obliged to pay compensation for damages as a consequence of measures referred to in this Article.

D.7.5. Dyflexis has the right to terminate the Agreement in the event of frequent complaints about Client or about the information stored by Client.

Annex 1 – Service level agreement

1. Definitions

In addition to the definitions as used in the General Terms and Conditions, the following definitions are used in this SLA.

1.1. Actual Availability: the actual realised degree of availability of the Service.

1.2. Fault: substantially not satisfying the functional specifications explicitly agreed between Parties in writing. It is only considered a Fault when Client can demonstrate this, and this Fault can be reproduced by Dyflexis.

1.3. Desired Availability: the degree of availability of the Service aimed for by Dyflexis.

1.4. Recovery time: the time between (i) the time at which Dyflexis has discovered a Fault or Client has reported a Fault and this has been confirmed by Dyflexis and (ii) the time at which the Fault has been remedied, (the Fault in) the Service has been replaced, or a Workaround has been created, as determined by Dyflexis.

1.5. Maintenance: carrying out repairs, taking precautionary measures and regularly checking the Service as well as scheduled maintenance.

1.6. Support: providing oral (telephone) or written advice and/or other supporting activities with regard to the use and the functioning of the Service.

1.7. Response time: the time between (i) the time at which Client has reported a Fault and (ii) the time at which Dyflexis sends a response to Client regarding receipt of the report, as determined by Dyflexis.

1.8. Working Day: from 9 am to 5 pm on Monday through Friday, with the exception of recognised and official holidays in the Netherlands.

1.9. Modifications: a structural modification in the Service which has been requested by Client and registered by Dyflexis.

1.10. Workaround: an act with which a Fault can be circumvented temporarily or permanently.

2. Nature of the agreement

2.1. This document forms the SLA for the Service as this is provided by Dyflexis. The purpose of the SLA is to lay down the service level. This is achieved by describing important elements, setting performance standards, and laying down the consequences of not achieving these standards.

2.2. The SLA comes into force at the time of the first delivery of the Service and is entered into for the same period as the Agreement under which the Service is delivered. The SLA ends automatically on the date on which the Agreement ends. A termination of th e Agreement will also be regarded as a termination of this SLA.

2.3. This SLA only pertains to the following standard support activities of Dyflexis:

a. carrying out (periodic) Maintenance;

b. remedying Faults;

c. implementing Modifications;

d. monitoring the Desired Availability; and

e. providing Support.

2.4. In addition to these standard support activities, Dyflexis can carry out other activities for Client. These activities may be charged separately. Dyflexis will always provide an overview of the costs to Client in advance.

2.5. The General Terms and Conditions apply to this SLA. In the event of a contradiction between the provisions, the order of priority set out in the General Terms and Conditions applies.

3. Contact information

3.1. Client shall make use of the following contact information to report Faults:

3.2. Outside Working Hours, Client can contact Dyflexis via the above-mentioned telephone number if, in Client’s opinion, it concerns a Fault as described in priority level 1. Should that not be the case in Dyflexis’s opinion and should Dyflexis believe that misuse has been made of the emergency number, then Dyflexis has the right to charge the hours worked.

3.3. Client and (certified) employees of Client may contact Dyflexis under this SLA.

4. Priority levels and fault handling

4.1. Faults will only be reported to Dyflexis by Client in accordance with the overview specified in Article 3 (Contact information). If Faults are reported to Dyflexis in another manner, for example via other telephone numbers or email addresses, a correct handling will in all likelihood not take place or will not take place properly.

The following information must be provided to Dyflexis when reporting a Fault:

a) the name of Client’s organisation;

b) the name of the contact person for this Fault at Client;

c) up-to-date contact information ((mobile) telephone number, email address) of this contact person;

d) description of the Fault, as accurately as possible;

e) description of the steps already taken by Client.

4.2. The Faults, provided they are amenable to further action by Dyflexis, are categorised into the following priority levels:

Based on the information provided in Client’s report, the priority level is determined reasonably by the Dyflexis support employee, who will start handling the Fault.

4.3. The best-efforts obligation of Dyflexis with regard to handling Faults is set out in the columns below for each priority level:

Dyflexis is not obliged to provide support work outside Working Days, unless agreed otherwise in writing. Dyflexis recommends using the Service on Working Days whenever possible.

In deviation from the above-mentioned overview, Dyflexis may pass Faults with priority level 3 on to next releases of the Service. In doing so, Dyflexis will take the consequences for Client into account in as far as possible; however, Dyflexis is not obliged to do so.

4.4. The support employee of Dyflexis will inform the contact person at Client of the specific Fault by email within the Response Time about:

a) The priority level of the Fault; and - if this is already known -;

b) The cause and the solution of the Fault.

4.5. In order to inform Client about the handling of the Fault, Dyflexis must have Client’s up-to-date contact details. It is Client’s responsibility to provide correct and up -to-date contact details.

4.6. If the contact details that are known at Dyflexis are not correct due to an act or omission on the part of Client, or if not timely providing information to Client regarding handling of the Fault by Dyflexis is due to circumstances for which Dyflexis canno t be held accountable, then the time of providing information on the handling of the Fault is deemed to be the attempt that Dyflexis has made to do so.

4.7. Client will assist to the best of its abilities with remedying the Fault.

4.8. If assistance is not provided as referred to in the previous paragraph, not due to Dyflexis’s actions, the Recovery Time will only commence at the time that Client provides the necessary assistance.

4.9. Dyflexis makes use of an escalation procedure which is implemented when a Fault cannot be solved within a specific period of time (Recovery Time). During this procedure, Dyflexis will make use of all available resources (including, when it considers this necessary, external technical engineers) to expedite solving the Fault. In addition, specific agreements can be made with Client regarding solving the Fault during the escalation procedure. During the escalation procedure, Dyflexis will inform Client about the progress with regard to solving the Fault every working day.

4.10. Dyflexis maintains the right not to provide any Support one working day a year in connection with team building and training purposes. The day in question will not be defined as a Working Day.

5. Availability

5.1. Dyflexis makes an effort to ensure that the Service is available twenty-four (24) hours a day, seven (7) days a week during the whole year 99.8% of the time, this is the Desired Availability.

5.2. Availability means that the Service can be accessed and used by Client. Interruptions of the connection and/or equipment that are beyond Dyflexis’s control, including Client’s own connection and/or equipment are not included.

5.3. The Actual Availability is calculated by Dyflexis monthly as follows:

“DB” = Percentage of Actual Availability; “GB” = Desired Availability in minutes; “G” = The number of minutes that a Fault occurs.

5.4. Non-availability caused by force majeure, Maintenance, Hardware and/or equipment supplied by Dyflexis over which Dyflexis has no control, is not regarded as a Fault and does not under any circumstances have an effect on the calculation of the Actual Availability.

5.5. Dyflexis strongly recommends that Client schedule sufficient time and margin for overruns for using a Service, in any case for payroll matters. Dyflexis recommend that Client observe a margin of at least three Working Days.

6. Monitoring availability

6.1. Dyflexis will take a sample of relevant data every five minutes in order to determine whether the guarantees laid down in Article 5 (Availability) are adhered to. An average is calculated based on these samples. This average determines whether the specifie d standards are exceeded unless Client provides evidence to the contrary.

6.2. At Client’s request regarding alleged non-availability and after receiving a notification of non-availability of a Service, Dyflexis will respond in accordance with the Response Times as specified in Article 4.3.

7. Maintenance

7.1. Dyflexis can carry out Maintenance of the Service from time to time as it sees fit. Dyflexis shall seek to carry out such Maintenance resulting in non-availability as much as possible outside Working Days. Dyflexis will make an effort to inform Client at l east two (2) Working Days in advance about such Maintenance, but Dyflexis is not under any circumstances obliged to do so. Maintenance will not affect the guarantees in Article 4 (Performance levels and fault handling) and 5 (Availability).

8. Modifications

8.1 Client can request Modifications by contacting Dyflexis via the contact details as described in Article 3 (Contact information). Dyflexis will make an effort to handle the request as soon as possible but does not guarantee this. 8.2 Dyflexis can also take the initiative to propose a Modification to Client if this Modification would solve a structural Fault. However, Dyflexis is not obliged to make such a proposal and can implement this Modification without Client’s permission if it co nsiders this necessary. Client also does not have any influence on the Modification in question. 8.3 For each Modification request, Dyflexis will submit a proposal to Client with regard to the contents, planning and costs of the Modification. 8.4 Dyflexis will make an effort to carry out modification requests, but until agreement has been reached regarding the contents, planning and costs of the Modification, Dyflexis can always decide not to carry out the Modification partially or completely if it considers the effort that has to be made disproportional. 8.5 If a requested Modification is not going to be carried out, Dyflexis will immediately inform Client.

9. Back-up

9.1 Dyflexis makes a back-up of the Service every day. This back-up can only be accessed by Dyflexis. Client can request Dyflexis to make the back-up available; however, Dyflexis can always refuse such requests. 9.2 Dyflexis may charge reasonable costs to Client for making a back -up available or replacing a back-up. Dyflexis will always inform Client in advance about the costs. 9.3 Dyflexis is under no circumstances liable for loss of Data due to a failure of the Service and/or the back-up (software). Client remains responsible at all times for the storage of the Data stored via the Service. 9.4 Client is responsible for the security of the data stored via the Service. Dyflexis is under no circumstances responsible for loss of data in any manner whatsoever, unless agreed otherwise in writing.

10. Support by Dyflexis

10.1. Dyflexis offers Support when providing the Service in the form of telephone support, making a connection with software of third parties and other activities that are supporting in Dyflexis’s opinion and can be carried out quickly and easily. Dyflexis may charge costs for the activities in question. Dyflexis will always send a quotation to Client before carrying out the activities.

10.2. Dyflexis may refuse to provide support to non-certified users.

10.3. Dyflexis will always inform Client in advance about the costs of the Support before carrying out the activities.

10.4. Dyflexis is not obliged to provide Support outside Working Days, unless agreed otherwise in writing.

10.5. Dyflexis maintains the right not to provide any Support one working day a year in connection with team building and training purposes. The day in question will then not be defined as a Working Day in accordance with Article 4 (Priority level and fault handling).

11. Penalty clause

11.1. In the event that Dyflexis does not fulfil the response obligation in accordance with the Response and Recovery Times stipulated in Article 4 (Priority levels and fault handling), for each hour in which the response or recovery does not take place, Dyflexi s will pay a penalty that equals one-thirtieth of the monthly amount due for the Service in question.

11.2. In the event that Dyflexis does not comply with one or several of the guarantee provisions in Article 5 (Availability), Dyflexis will pay a penalty for every day (or part of a day) that a guarantee is not satisfied that equals one -thirtieth of the monthly amount due for the Service in question.

11.3. This penalty takes the place of any compensation for damages that Client could claim for non-compliance.

11.4. If Client concludes that a compensation is payable, Client shall inform Dyflexis in writing and this will be credited on the next invoice.

11.5. If Client is of the opinion that compensation is payable whereas Dyflexis does not pay this, Client must submit a request for payment and provide proof if requested.

11.6. The to be paid compensation per month will never exceed the total amount of the monthly payment.

12. Changes in terms and conditions

12.1. Dyflexis may amend this SLA at any moment.

12.2. Dyflexis will announce the amendments or additions at least thirty (30) days before they come into effect in writing or via the Service so that Client can take cognizance of the amendment.

12.3. If Client does not wish to accept an amendment or addition to the SLA, Client can give notice of termination until the date that the amendment or addition comes into force. Making use of the Service after the date of the coming into effect is regarded as acceptance of the amendment or addition to the SLA.

Annex 2 – Data processing agreement

This Annex contains the Dyflexis Data Processing Agreement and is an annex to the Agreement and its associated appendices, such as the applicable Dyflexis General Terms and Conditions.

Dyflexis B.V., established at Saturnusstraat 14, 2516 AH in The Hague, registered with the Chamber of Commerce under number 59584327, further referred to as “Processor”, and

Client, further referred to as “Controller”,

Hereafter jointly referred to as “Parties”.

DECLARE, - ALSO IN IMPLEMENTATION OF THE PROVISIONS OF ARTICLE 28 (3) GDPR, TO HAVE AGREED AS FOLLOWS:

1. Definitions

The terms below shall have the following meanings in this Data Processing Agreement: 1.1 Agreement: The agreement entered into by the Controller and Processor for the provision of services by Processor and from which processing of Personal Data may result. 1.2 Autoriteit Persoonsgegevens (“AP”): The Dutch supervisory authority responsible for monitoring the adherence to the GDPR within the meaning of Article 51 GDPR, as defined in Article 4 subsection 21 GDPR. 1.3 GDPR: The EU General Data Protection Regulation (Regulation 2016/679/EU). 1.4 Data Breach: A breach of security leading to the accidental or unlawful destruction, loss, alteration or unauthorised disclosure of, or unauthorised access to, data transmitted, stored or otherwise processed. 1.5 Data Processing Agreement: This agreement as referred to in Article 28 (3) GDPR between the Controller and Processor with the subject of the processing of Personal Data, including all documents referred to and setting out the further rights and obligations of the Parties. 1.6 Data Subject: The natural person to whom a Personal Data relates. 1.7 Client: The party on whose instructions Processor processes personal data. The Client will usually be Controller (“Controller”) within the meaning of Article 4 subsection 7 GDPR. 1.8 Personal Data: Any data relating to an identified or identifiable natural person. 1.9 Sub-Processor: The natural person or legal entity that assists a Processor in Processing Personal Data on behalf of the Controller. 1.10 Controller: The natural person, legal entity or any other person who, or the administrative body which, alone or jointly with others, determines the purpose of and the means for processing Personal Data. 1.11 Processor: A natural or legal person, a government agency, a service or another body that processes Personal Data on behalf of the Controller. 1.12 Processing: any operation or set of operations concerning Personal Data, including in any case the collection, recording, organising, storage, adaptation, modification, retrieval, consultation, use, provision by means of transmission, dissemination or any other form of making available, bringing together, linking, as well as blocking, erasure or destruction of data. 1.13 All of the words and terms used above in the singular shall have the same meaning as in the plural and vice versa. 1.14 The headings above the articles of this Data Processing Agreement have the sole purpose of increasing the readability of the Data Processing Agreement. The content and scope of the article included under a particular heading are not limited to that heading.

2. Processing of personal data

2.1 Processor may process Personal Data, as further specified in sub-annex 2.1, on behalf of the Controller in accordance with the provisions of this Data Processing Agreement. Processor shall only process Personal Data in performance of the Agreement, this Data Processing Agreement, and other written instructions from the Controller, unless a provision of Union or Member State law applicable to the Processor requires otherwise. 2.2 In the event that a Union or Member State law provision applicable to Processor obliges Processor to process Personal data otherwise, Processor shall notify the Controller of that statutory provision prior to processing, unless such legislation prohibits such notification for important public interest reasons. 2.3 Controller warrants to Processor that the processing of Personal Data as assigned to Processor and/or carried out by Controller using the services of Processor does not violate any applicable laws or regulations, is not unlawful and does not infringe any right of a Data Subject or third party. Controller further warrants to Processor that Controller acts in accordance with applicable laws and regulations and that Controller adequately secures its systems and infrastructure at all times. The Controller indemnifies Processor against all claims, damages and fines related to the provisions of this Article 2.3. 2.4 If, pursuant to this Data Processing Agreement, Processor needs to take certain measures, research activities, adjustments, or perform other work, Processor is only obliged to perform this additional work if such work has been expressly agreed in writing with Processor. Processor is entitled to charge the Controller reasonable costs for the additional work, at the discretion of Processor also as an advance payment. This shall in any case include the time that Processor’s employees will spend on performing this additional work.

3. Security

3.1 Processor shall take appropriate technical and organisational measures to secure the Personal Data against loss or against any form of unlawful processing. The measures taken upon entering into the Data Processing Agreement are shown in Sub Annex 2.1. The Controller acknowledges that with the measures listed in Sub Annex 2.1, in the opinion of the Controller, Processor complies with the obligation in the first sentence of this provision and the provisions of Article 28(1) GDPR. 3.2 If further measures prove necessary to continue providing an adequate security level as referred to in Article 3.1, whether or not on the basis of updated legislation and/or regulations, the Processor will be entitled to charge the reasonable costs related to taking those further security measures to the Controller before the Processor will be obliged to implement those further measures vis-à-vis the Controller.

3.3 Processor holds the certifications: ISO 27001 and ISO 9001. Upon request, Processor will provide the Controller with access to the reports accompanying these certifications.

4. Data breach

4.1 The Controller is responsible for assessing the existence of an obligation to and actually reporting a Data Breach to a supervisory authority and/or Data Subjects under Articles 33 and 34 of the GDPR. 4.2 Processor will report any Data Breach to the Controller as soon as possible after Processor becomes aware of it. In doing so, Processor will, as far as possible, include at least the following information: (a) The (probable) cause and nature of the Data Breach;

b) The categories of Data Subjects and Personal Data concerned and, approximately, the number of Data Subjects concerned;

c) The (as yet known and/or expected) consequences of the Data Breach. 4.3 The Controller and Processor shall observe strict confidentiality vis-à-vis everyone other than each other regarding the Data Breach, any fear of a Data Breach and further related matters, except for obligations to the contrary pursuant to Union law or Dutch law. 4.4 Processor will, if necessary, provide further information about the Personal Data breach and will provide reasonably necessary cooperation to Controller for the purposes of making a notification to a supervisory authority and/or Data Subjects as referred to in Articles 33 and 34 of the GDPR. Processor may charge the reasonable costs it incurs in this context to Controller at its then current rates.

5. Confidentiality

5.1 Parties are obliged to maintain the confidentiality of the Personal Data. Processor may only use the Personal Data for the performance of the Agreement and this Data Processing Agreement. 5.2 Processor shall ensure that the persons processing Personal Data under its responsibility are bound by an obligation of confidentiality. 5.3 Processor is entitled to disclose Personal Data to third parties if and insofar as disclosure is necessary pursuant to a court order, a statutory regulation or on the basis of an authorised order issued by a public authority. 5.4 All access and/or identification codes, certificates, information on access and/or password policies provided by Processor to the Controller and all information provided by Processor to the Controller that gives substance to technical and organisational security measures are strictly confidential. They will be treated as such by the Controller and only disclosed to authorised employees of the Controller. Controller shall ensure that its employees are bound to secrecy and comply with the obligations of this article.

6. Duration and termination

6.1 This Data Processing Agreement forms part of the Agreement and any new or further agreement arising from it. This Data Processing Agreement shall enter into force at the time the Agreement is concluded. The Data Processing Agreement cannot be terminated separately from the Agreement. This Data Processing Agreement shall terminate by operation of law upon termination of the processing activities under the Agreement between the parties.

6.2 Upon termination of the processing activities under the Contract, Processor shall, at the request of the Controller and as far as reasonably possible, delete or return to the Responsible Party all Personal Data, and delete existing copies, unless Processor is required by Union or Member State law to store the Personal Data.

7. Data subject rights

7.1 Processor will, where possible, cooperate with reasonable requests from the Controller relating to Data Subject Rights invoked with the Controller by the Data Subject. If Processor is approached directly by a Data Subject, it will, where possible, refer them to the Controller. 7.2 Taking into account the nature of the processing and the information available to the Processor, the Processor will assist the Controller, if necessary and as far as possible, in complying with the obligations under Articles 32 to 36 of the GDPR. 7.3 Taking into account the nature of the processing and (technical) possibilities immediately available to Processor, Processor shall, to the extent possible, cooperate in fulfilling the obligation of the Controller to respond to requests of Data Subjects regarding the rights set out in Chapter III of the GDPR. 7.4 Processor shall support the Controller in responding to requests from Data Subjects seeking to exercise their rights in the following manner: requests from a Data Subject, such as requests for access, rectification, or erasure, may be carried out directly by the Controller within the Dyflexis software. Should the Controller encounter any difficulties or have any questions in relation to such requests, the Controller may submit a support request to the Dyflexis support department.

8. Audits

8.1 Processor shall make available to Controller all information necessary to demonstrate compliance with the obligations laid down in the Data Processing Agreement. 8.2 Processor shall have regular audits performed by an independent expert, In particular, Processor holds the following valid certifications: ISO 27001 and ISO 9001. Upon request, Processor will provide Controller with access to the audit reports accompanying these certifications. The Controller acknowledges that by means of a valid certificate or a report from an experienced independent expert, Processor can demonstrate that Processor complies with its obligations referred to in Article 8.1. 8.3 If the Processor is required to do so and the Controller has demonstrable reason to do so, the Processor will cooperate in audits, including inspections, by the Controller or an auditor qualified in terms of level of knowledge authorised by the Controller, no more than once a year, who will undertake, prior to his or her examination, to observe confidentiality with regard to potentially sensitive business information of the Processor. The costs of such ad hoc audits will be borne by the Controller. 8.4 Processor shall provide assistance in relation to Data Privacy Impact Assessments (DPIAs) in the following manner: If required to do so by the Controller, the Processor will cooperate in a data protection impact assessment (DPIA) or a subsequent prior consultation as referred to in Articles 35 and 36 of the GDPR, following a reasonable request to do so. Controller may submit a request to cooperate in a DPIA to Dyflexis’ support department. Dyflexis will then first make an estimate of time and costs and on that basis send a quotation to the Customer for the work involved in the DPIA. The parties shall consult as soon as possible about the results in the report. Parties will follow up the proposed improvement measures laid down in the report insofar as they can reasonably be expected to do so. Processor shall implement the proposed improvement measures insofar as they are appropriate in its opinion taking into account the processing risks associated with its product or service, the state of the art, the implementation costs, the market in which it operates, and the intended use of the product or service.

9. Sub-processors

9.1 Controller hereby permits Processor to engage the Sub-Processors. Controller agrees in any event to the engagement of the Sub-Processors in place at the time of execution of this Data Processing Agreement, as set out in Annex 2.1. Processor shall inform the Controller of any intended changes regarding the addition or replacement of Sub-Processors. Controller shall be entitled to raise a written objection to such changes within 30 days of notification. Where the Controller objects to a new Sub-Processor, the Processor shall be entitled to terminate the Principal Agreement with immediate effect or to suspend the performance thereof, without being liable for any damages, compensation, or other obligation in connection with such termination or suspension. 9.2 Processor shall impose the same or equivalent obligations on Sub-Processors in a written agreement as are incumbent on Processor itself under this Data Processing Agreement. Where the sub-processor fails to comply with its data protection obligations, Processor shall remain fully liable to the Controller for compliance of that Sub-Processor with the obligations.

10. Transfer outside the EU/EER

10.1 Processor shall not transfer the Personal Data to a third country outside the EU/EEA or an international organisation without a written instruction to that effect issued by the Controller on legitimate grounds, an adequacy decision of the European Commission, binding corporate rules within the meaning of Article 47, or appropriate safeguards within the meaning of Article 46 GDPR. This also includes the storage of data. 10.2 Controller warrants to Processor that the transfer of personal data to a parent, subsidiary, sister, or otherwise affiliated company in a third country takes place lawfully in compliance with the legal requirements of the EU General Data Protection Regulation.

11. Other

11.1 This Data Processing Agreement forms an integral part of the Agreement and the Dyflexis General Terms and Conditions. All rights and obligations under the Agreement, including any applicable general terms and conditions and/or limitations of liability, shall also apply to the Data Processing Agreement. The (sub-)annexes of the Processing Agreement form an integral part of the Processing Agreement. In case of conflict between the (sub-)annexes and the Data Processing Agreement, the Data Processing Agreement shall prevail.

Sub-annex 2.1 – Personal data processing / technical and organisational measures

(Sub-Annex 2.1 attached to the Dyflexis Data Processing Agreement)

2.1.1 Description of processing of personal data

Categories of Personal Data

The Dyflexis Products and Services are designed and set up to process the following types of (personal) data:

• Name and address data

• E-mail address

• Employee contract data (such as salary and benefits)

• Personal work schedule

• Time and attandance registration

• Balances (leave, holidays, absence, etc.)

• Login and logging information

• Device identifiers

Warning: It is prohibited for the employer to enter special categories of personal data, such as data relating to health, in absence registration.

Categories of Data Subjects

The Dyflexis Products and Services are designed and set up to process (personal) data of the following categories of Data Subjects:

• Employees of Responsible Party and/or employees of customers of Responsible Party;

• Other Categories of Data Subjects.

Nature and Purpose of Processing

Dyflexis is intended for time registration and employee scheduling and provides all information for payroll administration. Dyflexis is not a payroll system, but provides various links to other payroll software.

Processor may process Personal Data on behalf of Controller in the context of the provision of the following Dyflexis Products and Services: Dyflexis Workforce Management Software and Hardware. Dyflexis is the market leader in user-friendly workforce management, workforce scheduling, time recording software and hardware. Dyflexis includes the following components:

• Personnel planning: Efficient planning based on budgets, availability (leave requests), labels and external information lines. Changes are immediately visible to everyone through push notifications.

• Hours registration: Hours are clocked quickly and easily by our in -house developed clock system, the Rex-O-Matic NOA. The clocked times can be seen in one overview alongside the scheduled times and immediately highlights any differences. The system automatically calculates all allowances and supplements. Manual recording by employee or employer is also possible.

• Clock system: With our clock system, the Rex-O-Matic NOA, employees easily clock in and out.

By scanning a personal card, working hours are automatically registered in Dyflexis.

• App for Android and iOS: In the Dyflexis app, employees can see when they are scheduled or when there is a change. When a new shift is created, which employees can sign up for, they receive a notification. The app also allows employees to quickly enter their availability and access their balances.

DYFLEXIS PRODUCTS AND SERVICES TAKE DUE ACCOUNT OF THE PROCESSING OF SPECIAL CATEGORIES OF PERSONAL DATA: Dyflexis has been set up, with appropriate technical and organisational measures, in such a way that personal data related to time registration and personnel planning can be processed securely, even if these personal data can be regarded as special personal data. It is the obligation of Controller to have special categories of personal data processed by Dyflexis only where this is permitted in compliance with the provisions of Article 9 GDPR.

WARNING: Please note that Dyflexis offers the possibility for all personnel to view who is scheduled or potentially on leave when. The reason for leave can be entered by the employer, the employer should make its own choices regarding these possibilities and insights within the limits of the applicable laws and regulations and should include this in its own privacy policy. Under no circumstances should the employer enter special categories of personal data, such as personal data relating to health, in Dyflexis Products and Services.

WARNING: If the Client chooses to use the Rex-O-Matic time registration hardware, the clock system, in addition to Dyflexis, there is the option of using a finger scan for time registration by clocking. The scan then only stores a hash of some unique characteristics so that the fingerprint can no longer be recognised or reconstructed. This hash can be considered biometric data under the GDPR. As such, it is special personal data. Dyflexis therefore advises against using the fingerprint scanner. If you do want to use this option, please note that when using biometrics, making a Data Privacy Impact Assessment is mandatory for the employer. You are not allowed to require your employees to clock in with their finger. As an employer, you are also highly unlikely to be able to invoke the employee’s consent to the processing of biometric data, as usually there will be a dependency relationship between the employer and employee and it is suspected that in such a situation consent cannot be freely, specifically and informedly given. The employee should always have a completely free choice between clocking in with a card or with the finger and this preference should always be revokable. There should be no additional barriers or disadvantages to a choice of a pass, such as a deposit or fine in case of loss. Even if, as a company, you give the employee a completely free choice, the Autoriteit Persoonsgegevens will always act in the event of a complaint. This is because, according to the Autoriteit Persoonsgegevens, a complaint shows that no free choice is perceived. Dyflexis therefore recommends not using the finger scan and is not liable for any fines and/or damages related to this.

Grounds for Processing

In most cases, the basis of processing is the performance of the contract with the employee or a legal obligation incumbent on the Controller. In some cases, the basis is a legal obligation of the Processor.

In exceptional cases, the basis may be the legitimate interests of the Controller or Processor, in which case the Data Subject has the right to object to the processing. The parties will provide each other with the necessary cooperation to respond to the objection of an individual Data Subject.

Duration of processing of personal data

The retention period is in principle equal to the term of the Agreement with the Client, unless other periods are agreed upon at the request of and in consultation with the Client.

If the client is subject to a certain statutory retention period with regard to personal data processed by Dyflexis on behalf of the Client, e.g. in connection with legal obligations arising from personnel planning and time registration, but wishes to terminate the agreement with Dyflexis earlier, Dyflexis offers the possibility to transfer a copy in raw form of the processed personal data to the client’s custody by mutual agreement. Client may submit a request to this effect in writing to Dyflexis.

Dyflexis also offers the possibility to purchase our Archive Service for a fee, with which a copy of the processed personal data can be found in an online hosted environment in a format readable by humans.

AFTER TERMINATION OF THE AGREEMENT WITH A CLIENT, THE PROCESSOR REMOVES THE PERSONAL DATA THAT IT PROCESSES FOR THE CLIENT IN PRINCIPLE WITHIN 3 MONTHS IN SUCH A WAY THAT THEY CAN NO LONGER BE USED AND ARE NO LONGER ACCESSIBLE (RENDER INACCESSIBLE).

AFTER TERMINATION OF THE CONTRACT WITH THE CLIENT, PROCESSOR RETURNS ALL PERSONAL DATA IT PROCESSES FOR THE CLIENT WITHIN 3 MONTHS. The standard procedure is to transfer personal data by means of a database export. Further arrangements concerning the implementation, such as method of transmission and delivery, as well as any costs involved in this work, shall always be determined in advance in consultation between Dyflexis and the client.

Sub-Processors

Dyflexis is entitled to engage the following sub-processors without obtaining further prior consent of Controller.

/terms-and-conditions/subprocessors

PROCESSOR PROCESSES PERSONAL DATA (IN PART) OUTSIDE THE EU/EER. THE PROCESSOR SHALL ENSURE IN THE FOLLOWING MANNER THAT AN ADEQUATE LEVEL OF PROTECTION IS ENSURED: Dyflexis processes personal data mainly within the EU/EEA. The relevant Sub-Processors located outside the EU/EEA are listed on our website: /terms-and-conditions/subprocessors. For processing operations outside the EU/EEA, Dyflexis has put in place appropriate safeguards, namely (i) the assessment of whether the relevant country is qualified as safe by the European Commission in an adequacy decision of the European Commission; and (ii) the agreement of a Data Processing Agreement including the Standard Contractual Clauses as established by the European Commission.

2.1.2 Security measures per date of formation of data processing agreement

We regularly adjust the security measures described here to remain prepared and up-to-date with regard to data protection. We will keep you informed of new versions via our website and Product Update newsletter.

PROCESSOR HAS TAKEN THE FOLLOWING SECURITY MEASURES TO PROTECT ITS PRODUCT OR SERVICE:

Dyflexis is ISO 27001 certified. Within ISO 27001 certification, security measures are laid down in various manuals, including Dyflexis’ Security & Quality Manual.

• Confidentiality and integrity are guaranteed because:

  • only employees who need it can access the data;

  • continuous security audits are performed on Dyflexis;

  • there is logging at critical points.

  • customer systems are backed up and redundancy is applied to the servers containing customer data. This ensures that availability of and access to personal data is restored in a timely manner in the event of an incident.

  • Software is extensively reviewed and tested, before it goes into production.

  • Our computers are encrypted, secured with strong passwords and anti-virus software.