Terms & Conditions

1.Introduction and identification of the Service Provider

In short: who we are, what we operate, and who these terms apply to.

The Service Provider is a Hungarian limited liability company registered in the company register, which operates, develops and sells the cloud-based (SaaS) enterprise resource planning software known as ATMOS ERP. The provisions of these GT&C are binding on every natural person, legal entity or other organisation (hereinafter: Customer) entering into a contractual relationship with the Service Provider regarding ATMOS ERP, unless the parties agree otherwise in individually negotiated written terms. The Service Provider makes the GT&C continuously available on its website; any part of it may be printed and stored electronically.

2.Definitions

In short: the meaning of the words that recur throughout the text — it is worth reading through once, because every section is easier to understand afterwards.

For the purposes of these GT&C, the following terms shall have the following meanings:

• ›Service Provider — Quadrant Analytica Kft. (registered seat, tax number and company registration number as above).
• ›Customer — the natural person, legal entity or other organisation that enters into a contract with the Service Provider for the ATMOS ERP service, including demo access users.
• ›User — the natural person created by the Customer in the system who logs in with their own credentials (employee, contractor, subcontractor).
• ›Consumer — a natural person acting outside the scope of their profession, independent occupation or business activity, as defined in Section 8:1(1)(3) of Act V of 2013 on the Civil Code (Ptk.).
• ›Service — the remotely accessible cloud-based (SaaS) software and all related support and integration services provided by the Service Provider under the ATMOS ERP brand.
• ›Subscription — the paid right of use, for a fixed or an indefinite term, under the package selected by the Customer.
• ›Price List — the Service Provider's effective pricing and package list, published on the website, in an individual offer or on the Order Form.
• ›Contract — the legal relationship between the parties, consisting of the GT&C, the Order Form and any Individual Terms.
• ›Uptime — the period during which the Service is available for its intended use; save for the scheduled maintenance windows, this is continuous (24 hours a day).
• ›Subscription interface — the Settings → Subscription menu item of ATMOS ERP, where the Customer manages its package, its invoices and its payment data; it is not the same as the partner portal.

3.Scope, acceptance and amendment of the GT&C

In short: you accept the GT&C upon registration; if we amend them, we tell you 30 days in advance, and you may object to the amendment.

The GT&C apply geographically to the ATMOS ERP service provided online from Hungary, and linguistically to the published Hungarian and English texts. The Customer accepts the GT&C by an express, conscious declaration (check-box, button press or signature) upon completing registration, upon ordering a subscription package, or upon first using any paid function; commencing access constitutes acceptance of the provisions of the GT&C by conclusive conduct. The Service Provider is entitled to amend the GT&C unilaterally; it notifies the Customer of the amendment at the registered email address at least 30 calendar days before the change takes effect, and also publishes the amendment on its website. The Customer may object to the amendment in writing until it enters into force. In the event of an objection, the contract remains in force on the previous terms until the end of the subscription period already commenced; thereafter the Service Provider may terminate the contract with 30 calendar days' notice if it is unable to provide the Service without applying the amended terms. If the amendment is unfavourable to the Customer, the Customer may also terminate the contract until the amendment enters into force, by extraordinary termination with immediate effect. The amendment does not affect the fee for a subscription period already invoiced and commenced.

• ›The date of entry into force is the date shown in the header of the GT&C.
• ›Earlier versions of the GT&C are archived for at least 5 years and made available on request.
• ›For Customers qualifying as Consumers, the fact, time and version number of acceptance are recorded.
• ›The GT&C do not affect provisions of an Individual Contract signed by the parties that deviate from the GT&C; in case of conflict, the Individual Contract prevails.

4.Special notice — stipulations that differ from customary practice

In short: here, in one place, we have gathered the nine points that differ from customary contractual practice. Please read them carefully — by accepting the GT&C you accept these as well.

Pursuant to Section 6:78(2) of Act V of 2013 on the Civil Code (Ptk.), the Service Provider expressly draws the Customer's attention to the following stipulations, which differ materially from customary contractual practice. By accepting the GT&C, the Customer separately accepts these stipulations as well. The list is for information only: the full text of the sections concerned prevails.

For a Customer qualifying as a Consumer, the stipulations below apply solely to the extent permitted by law; the consumer exceptions are set out in the individual sections.

• ›The quantitative limitation of the Service Provider's liability for damages — section “Liability, warranties, defective performance”.
• ›The one-year preclusive deadline for enforcing claims — section “Exclusion of the Customer's terms, set-off, assignment, time limit for claims”.
• ›The exclusion of set-off and of the right of retention — section “Exclusion of the Customer's terms, set-off, assignment, time limit for claims”.
• ›The Service Provider's right to transfer the contract without the Customer's consent — section “Exclusion of the Customer's terms, set-off, assignment, time limit for claims”.
• ›The 12-month minimum term of add-on services — section “Allowance and term of add-on services”.
• ›The automatic renewal of a fixed-term subscription — section “Withdrawal, termination, end of contract”.
• ›The trial period automatically becoming a paid subscription where a bank card has been registered — section “Refunds and credits”.
• ›The presumption of delivery applicable to legal declarations sent by email — section “Fees during a lock, notices and the presumption of delivery”.
• ›The 12-month retention after termination of the contract — including the expiry of a trial period that has not become a subscription — and the subsequent, irreversible permanent deletion — section “Withdrawal, termination, end of contract”.

5.Subject and content of the Service

In short: what the system can do, and what your package includes. New functions may arrive, and old ones may be withdrawn with 30 days' notice.

Through the ATMOS ERP interface the Service Provider offers construction ERP functions, in particular: tender and bid management, partner and client registry, contract management, performance certificate (TIG) handling, task management, HR and leave module, document generation, AI-based pre-pricing and analytical functions, and the Stargate portal for external partners. The exact set of functions is defined per package in the effective Price List; the Service Provider reserves the right to introduce new functions, further develop existing ones, and — with at least 30 calendar days' advance notice — withdraw features that are little used.

• ›The Service is cloud-based (SaaS): the Customer installs no local server; the Service is accessible via the public Internet through a standard browser.
• ›The Service does not constitute a contract, tax declaration, accounting statement or official document; the Customer is responsible for verifying the legal and accounting compliance of generated documents.
• ›The Service Provider may engage third-party providers for parts of the Service (e.g. database, email, AI provider); detailed information is given in the Privacy Policy.
• ›Demo access exists solely for evaluation purposes; live production data and legally binding declarations must not be handled in it.

6.Published materials and the content of the contract

In short: what you see on the website, in a presentation or on the roadmap is information. What you have ordered is described by the Price List and the order form.

The ordered content of the Service is determined by the Price List in force at the time of the order and by the Individual Contract (order form). Functions, planned developments and dates appearing on the Service Provider's website, blog, marketing and sales materials, product demonstrations, newsletter or public roadmap are for information only.

• ›A function appearing in the above materials becomes part of the contract if the Price List or the Individual Contract expressly includes it.
• ›The Service is provided in its state as it is from time to time. The Service Provider undertakes no obligation to deliver a given function by a given date, unless the parties have agreed otherwise in writing.
• ›A function seen during the trial period or at a product demonstration is due to the Customer if it is included in the content of the ordered package under the Price List; otherwise the Service Provider is obliged to warn the Customer of this before the order.
• ›This section does not limit the Service Provider's statutory pre-contractual information obligation and does not release it from the consequences of misleading commercial practices. Towards a Consumer, the rules on the prohibition of unfair commercial practices continue to apply unchanged.
• ›If the Service Provider is unable to provide an ordered function that is included in the Price List, the Customer is entitled to a price reduction and — if the function is an essential element of the Service — may terminate the contract with immediate effect.

7.Limits of intended use — what the Service is not for

In short: ATMOS keeps records and supports decisions. It is not an electronic construction log, not an official document, and not a structural or occupational safety system — these must still be maintained separately, as required by law.

The Service is a record-keeping, planning and decision-support tool. The Customer may use the Service solely within this scope and expressly acknowledges that the Service is not suitable for replacing any record, document or official procedure prescribed by law. The Service is not a real-time system and is not designed for safety-critical operation.

• ›The Service is not suitable for keeping the electronic construction log (e-napló) and does not replace it; keeping the e-napló remains the Customer's statutory obligation, and the data recorded in ATMOS does not substitute for it.
• ›Data recorded in the Service and documents generated from it are not in themselves suitable for submitting an official notification or a permit application, nor for certifying structural, fire-safety or energy-performance compliance.
• ›The Service is not suitable for independently fulfilling and evidencing statutory obligations relating to occupational safety, work safety, health protection or working-time records; modules of this kind support solely the Customer's internal records.
• ›The Service may not be used in any application where its fault, delay or outage could endanger human life, bodily integrity or health, or could lead to serious damage to property or to the environment — in particular for controlling machinery, lifting equipment or scaffolding, for alarms, for emergency signalling, or for taking access-security decisions.
• ›In the areas set out above, the Customer is obliged to maintain the separate records, processes and fallback procedures prescribed by law, and to operate them even if the Service is unavailable.
• ›The Service Provider is not liable for damage arising from use that conflicts with this section. This exclusion does not affect Section 6:152 of the Civil Code (Ptk.), and towards a Consumer it applies only to the extent permitted by law.
• ›The Service Provider also indicates the above limits in the interface and in the help pages wherever the intended purpose of a function could be misunderstood; the absence of such an indication does not, however, extend the intended purpose of the Service.

8.System requirements, place of performance

In short: the Service is our responsibility up to the outbound point of our server — your internet connection, your device and your browser are yours from there on. Please use a supported, up-to-date browser.

In order to use the Service, the Customer needs a continuous internet connection and a device meeting the system requirements published by the Service Provider. The system requirements in force at any given time — the supported browsers and their last two major versions, the minimum iPadOS/iOS and Android versions, and the minimum screen resolution — are published by the Service Provider on its help pages, and may be adjusted by it to changes in the technological environment. In the event of a material tightening, the Service Provider notifies the Customer at least 30 calendar days in advance; if the Customer is unable to meet the new requirements, it may terminate the contract effective on the day the tightening enters into force, without any additional payment obligation.

• ›The place of performance is the internet-facing outbound point of the data centre used by the Service Provider. The Customer's devices, local network, internet subscription, corporate firewall, VPN and browser extensions do not form part of the Service.
• ›A fault or outage arising from the causes listed in the previous point does not qualify as defective performance and is not included in the availability calculated under the section “SLA — availability, maintenance, downtime”.
• ›The Service Provider is not liable for a fault that would not have occurred had the latest version of the Service been used — in particular in the case of an outdated browser cache, an old application version, or an update that has not been run. This limitation is subject to the condition that the update is available to the Customer and can be carried out with reasonable effort; towards a Consumer the limitation may be applied only if the Service Provider has informed the Customer in advance, in a verifiable manner, of the need for the update.
• ›Where the Service is used in an environment that does not meet the system requirements (an unsupported browser or operating system), the Service Provider does not refuse support, but undertakes no warranty and no availability commitment for that environment.
• ›The Customer may not demand that an earlier version of the Service be maintained or operated in parallel.
• ›The Service Provider provides an optimised interface for using the Service on iPad and mobile devices. Functions relating to the camera, location services, file handling and offline operation depend on the capabilities of the device and of the operating system; the absence of such capabilities does not qualify as a defect of the Service.
• ›No provision of this section affects Section 6:152 of Act V of 2013 on the Civil Code (Ptk.), under which liability for a breach of contract committed intentionally or causing damage to human life, bodily integrity or health may not be limited.

9.Named user access, measurement of quantities

In short: one login belongs to one person, there are no shared accounts. We measure the number of users and the storage on which the fee is based — but you can see the measurement too, and you may dispute it.

User access is named: one user account belongs to one specified natural person. Sharing an account, its parallel use by several persons, and passing on credentials are prohibited. The Service Provider measures the quantities forming the basis of the fee — the number of active users, the storage used, and the allowances of add-on services — on the basis of the system logs. The current state of the measurement is continuously visible to the Customer's administrator on the Settings page, so the basis of the fee may be checked at any time.

• ›An account qualifies as an active user if it was in a non-deactivated state for at least one day in the given calendar month.
• ›Deactivating a user reduces the fee from the next billing cycle onwards; retroactive settlement is not possible. When a new user is added, the fee is settled pro rata from the day of the addition.
• ›The Service Provider retains the monthly aggregate result of the measurement for 8 years following the settlement period (the same period as for accounting documents), and releases it in itemised form within 15 calendar days at the Customer's request.
• ›In the event of a discrepancy, the Service Provider makes the itemised measurement data available to the Customer, and the parties reconcile the measurement data together. This point does not affect the burden of proof; no presumption may be based on the Service Provider's measurement towards a Consumer. The Customer may object to the measurement within 30 calendar days of receiving the invoice; in the case of a well-founded objection, the Service Provider issues a correction invoice and credits the difference within 15 days.
• ›If account sharing is detected, the Service Provider issues a written notice to the Customer. If the Customer does not cease the sharing within 8 calendar days of receiving the notice, the Service Provider may restrict the account concerned and invoice the fee corresponding to the number of persons actually using it. Immediate restriction takes place only if the sharing endangers the security of the Service or of other customers.
• ›The Service Provider uses the measurement data solely for calculating the fee, for capacity planning and for operating the Service. The Service Provider does not produce or release reports suitable for evaluating the individual performance of users, unless the package ordered expressly includes such a function.

10.SLA — availability, maintenance, downtime

In short: we commit to 99.5% availability per month. If we fall below it, you receive a credit on the next invoice — that is the remedy for such a case.

The Service Provider commits to 99.5% uptime measured at monthly level, calculated excluding the scheduled maintenance windows (the 3rd Sunday of every month, 02:00–06:00 Hungarian time). Availability is measured monthly, on the basis of the Service Provider's monitoring system.

• ›Scheduled maintenance window — the above period; the Service Provider may shift it by +/- 24 hours with prior notice.
• ›Emergency maintenance may occur without prior notice in case of a security incident or critical bug; the Service Provider informs the Customer of the reason afterwards.
• ›If monthly availability falls below the committed 99.5%, the Customer is entitled to a service credit equal to 10% of the monthly subscription fee on the next invoice, and to 25% where the figure is below 99.0%. Where the availability undertaking is not met, the service credit is the Customer's exclusive remedy; this does not affect the cases set out in Section 6:152 of Act V of 2013 on the Civil Code (Ptk.), and it does not limit statutory claims towards a Consumer.
• ›Scheduled maintenance, force majeure and Customer-side technical issues (local network, browser, extension) are excluded from the uptime calculation.
• ›The Customer may claim a service credit in writing within 30 calendar days following the month concerned; failure to observe this deadline extinguishes the entitlement to the credit. The assessment is based on the data of the Service Provider's monitoring system, which the Service Provider releases for the month concerned at the Customer's request. The credit is applied to the next invoice and may not be redeemed in cash; upon termination of the contract, any unused credit is settled in accordance with the section “Refunds and credits”. Towards a Consumer, failure to observe the notification deadline does not preclude the enforcement of other claims based on the applicable law.

11.Beta and experimental functions

In short: beta functions are there to be tried out, not for live work. Do not put sensitive or confidential data into them and do not base decisions on them — in return they are free of charge and can be switched off at any time.

The Service Provider makes certain functions available with beta or experimental status. Such functions are clearly marked in the interface. The use of a beta function is voluntary and free of charge: the Customer's administrator may switch it on and switch it off at any time, and a beta function does not form part of the set of functions of the ordered package under the Price List.

• ›The Service Provider gives no warranty and guarantees no availability for beta functions; the undertaking under the section “SLA — availability, maintenance, downtime” does not extend to them.
• ›Beta functions do not necessarily meet the data security and data protection requirements applicable to final functions. The Customer may not store in a beta function any special category of personal data under Article 9 of the GDPR, or any business secret; if it nevertheless records such data, the Customer is liable for the consequences arising therefrom.
• ›The Customer may not base live business, financial or employment decisions on the output of a beta function, and may not treat data created in a beta function as an authentic record.
• ›The Service Provider may modify, restrict or withdraw a beta function at any time. If the withdrawal affects data recorded in the function, the Service Provider notifies the Customer at least 15 calendar days in advance and provides an opportunity to export the data.
• ›Information relating to a beta function that is not yet public qualifies as a business secret. The Customer may not publish any public review, comparison or screenshot of a beta function without the Service Provider's prior written consent. This obligation does not apply to a Consumer, and it does not restrict the Customer from expressing an opinion on the Service based on true facts. The obligation ceases as soon as the Service Provider makes the function publicly available or presents it publicly.
• ›The Customer makes its feedback on a beta function available to the Service Provider free of charge, and the Service Provider may use it without restriction. This does not affect the Customer's rights in its own data and documents.
• ›In connection with the use of beta functions, the Service Provider's liability is excluded to the extent that exclusion is permitted by law. This exclusion does not apply in the cases set out in Section 6:152 of the Civil Code (Ptk.), nor towards a Consumer; towards a Consumer the Service Provider is liable under the applicable law.

12.Subscription packages, fees, pricing

In short: the fees are set out in the Price List; we raise them at most once a year, with 30 days' prior notice, and you may terminate the contract if we do.

Fees are charged in accordance with the Service Provider's effective Price List. Unless otherwise indicated, fees are denominated in Hungarian forints (HUF) and do not include value added tax (VAT) under Act CXXVII of 2007. The monthly or annual subscription fee depends on the chosen package, the number of users and the optional modules used. The Service Provider may adjust its Price List once per year by the consumer price index published by the Hungarian Central Statistical Office or — in excess of that — with at least 30 calendar days' advance notice; the Customer may exercise extraordinary termination within 15 calendar days against such an increase.

• ›Monthly fees are invoiced pro rata from the first day of the subscription period to the end of the calendar month.
• ›Annual packages entitle the Customer to the discount advertised in the Price List (typically 2 months free).
• ›Upgrades take effect immediately with a pro-rata differential fee; downgrades take effect from the beginning of the next billing cycle.
• ›An add-on module is activated immediately upon finalising the order, and its fee falls due at the same time: the Provider charges the pro-rated fee for the period remaining until the renewal date at the time of the order, and the full monthly fee from the renewal date onwards. If the charge does not succeed, the add-on module is not activated. With an annual subscription, the Provider issues a separate monthly invoice for the monthly fees of add-on modules.
• ›Custom development, integration and training services are invoiced at the hourly rate stated in a written individual offer.
• ›For items not listed in the Price List, the individually signed order form prevails.

13.Contract conclusion, registration and ordering process

In short: how the contract comes into being, from registration to confirmation, and when you receive access.

The contract is concluded electronically in the following steps: (i) the Customer registers on the website or the ATMOS ERP interface; (ii) for paid packages the Service Provider issues an electronic order form; (iii) the Customer finalises the order by accepting the order form and expressly accepting the GT&C and the Privacy Policy; (iv) the Service Provider confirms receipt of the order electronically within 48 hours; (v) for paid functions, access is granted within 1 business day after the credit of the fee on the Service Provider's bank account or the successful closing of the card transaction. Pursuant to Section 6(3) of the E-Commerce Act (Elker. tv.), where the confirmation is not sent, the Service Provider releases the Customer from being automatically bound by its order.

• ›The contract language is Hungarian; the English version is informative, the Hungarian text prevails in case of discrepancy.
• ›The contract is concluded electronically and, pursuant to Section 6:7(3) of Act V of 2013 on the Civil Code (Ptk.), qualifies as having been made in writing, since it is recorded in a form suitable for reproducing its content unchanged and for identifying the person making the declaration and the time of the declaration. The Service Provider retains the order and its confirmation for 5 years and releases them at the Customer's request.
• ›The Service Provider may review the order and, in justified cases (false data, suspected fraud, sanctioned customer), reject it; any fees already received are refunded within 14 calendar days without deduction.
• ›Consumers receive order confirmation on a durable medium; the pre-contract information required by Art. 5 of the E-Commerce Act is provided by the Service Provider.

14.Representation at the time of ordering, verification of the Customer

In short: whoever orders from the company's own email address or with administrator rights is treated by us as the company's representative. We may verify public company data, and we may also refuse to conclude a contract.

The Service is ordered self-service, electronically, and therefore clarifying the power of representation is in the parties' common interest. This section does not override the rules of the Civil Code (Ptk.) on representation, but makes their application predictable.

• ›The Service Provider treats as the Customer's representative any person of whom it may reasonably be assumed, on the basis of their conduct and the Customer's conduct, that they are entitled to act on the Customer's behalf in the matter of concluding the contract — in particular a person acting from an email address belonging to the Customer's own domain or with the Customer's administrator rights.
• ›A limitation of the power of representation is effective towards the Service Provider if the Customer has notified the Service Provider of it in advance, in writing. The Customer may modify administrator rights independently, at any time, in the interface of the Service; the modification takes effect from the time of recording and requires no separate notice.
• ›If the Customer subsequently claims that the person acting was not entitled to represent it, the Service Provider is nevertheless entitled to the consideration for the services actually used. The Customer may terminate the contract for the future within 15 days of communicating that claim.
• ›The Service Provider is entitled — but not obliged — to verify the Customer's corporate legal status, the validity of its tax number, and its financial and economic position from public and official registers, both before concluding the contract and during the term of the contract.
• ›The Service Provider uses the result of the verification solely for the contractual decision and for fraud prevention, does not disclose it to any third party, and informs the Customer of its content at the Customer's request.
• ›The Service Provider may refuse to conclude the contract without giving reasons. In the event of refusal, the Service Provider refunds any fee already paid within 14 calendar days, without deduction.

15.Payment methods — bank transfer and card transactions

In short: you may pay by bank transfer or by bank card. A recurring card charge requires separate consent, which you may withdraw at any time.

The Service Provider offers the following payment methods. For bank transfer, the Service Provider sends the invoice electronically, in PDF format, to the Customer's registered email address. The Service Provider ensures the authenticity of origin and the integrity of content of the electronic invoice by means of a business control procedure and by the data reporting made to the NAV Online Invoice system. Card payments are processed through Barion Payment Zrt. (registered seat: Irinyi József utca 4-20., 2nd floor, 1117 Budapest; company reg. no.: 01-10-048552; tax no.: 25353192-2-43; MNB licence no.: H-EN-I-1064/2013; e-money issuer institution) and through Stripe Payments Europe Ltd. (1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland; payment service provider authorised by the Central Bank of Ireland). The Service Provider does not see, store or transmit the Customer's card data — full processing of card transactions takes place within the relevant PCI-DSS Level 1 certified provider's system, in accordance with the EU PSD2 and SCA (strong customer authentication) requirements. The Service Provider's performance time for the order (activation of access after payment) is typically no more than 1 business day; the invoice is issued by the Service Provider in advance of performance, on the first day of the subscription period, with an 8-day payment deadline.

• ›Bank transfer (HUF, EUR) — to the Service Provider's account number 10410400-00000100-48504907 (K&H Bank Zrt.), quoting the invoice number. For international wires, please request IBAN and SWIFT from customer service.
• ›Online card payment via Barion's secure page — accepting VISA, Mastercard, Maestro, American Express, Apple Pay and Google Pay. 3D Secure 2 (SCA) authentication is enforced by the issuing bank. Transaction fees are borne by the Service Provider with no surcharge for the Customer.
• ›Online card payment via Stripe's secure page (Stripe Checkout / Stripe Elements) — as an alternative payment channel, at the Customer's choice, under the same scheme rules.
• ›Recurring card payment — via Barion Token-payment or Stripe off-session, solely with the Customer's express, conscious, written (electronic) consent (a mandatory checkbox displayed before payment initiation, also showing the monthly or annual renewal date and amount). Consent can be withdrawn at any time from the ATMOS Settings → Subscription page with one click (card removal or subscription cancellation); the card token will not be used from the next billing cycle onward. A reminder e-mail is sent to the Customer's registered address at least 7 calendar days before each renewal — for monthly, half-yearly and annual cycles alike — containing the renewal date, the gross amount, and a one-click cancellation link.
• ›Merchant descriptor on the cardholder statement: card transactions processed via Barion Payment Zrt. (both one-off and tokenised recurring charges) appear on the Customer's bank statement and card notifications in every case as “BARION PAYMENT ZRT.” (or, depending on the issuer's truncation, “BARION”), NOT directly under the Service Provider's company name — this follows from Barion's Smart Gateway settlement model and serves to prevent cardholder confusion and unwarranted chargebacks. To aid transaction reconciliation, the Service Provider includes its own invoice number alongside the Barion payment reference on every electronic invoice and successful-payment confirmation e-mail sent to the Customer.
• ›SEPA transfer (EUR) — available to Customers within the European Economic Area, to the Service Provider's IBAN.
• ›If the Customer incurs bank transfer costs, these are not reimbursed by the Service Provider; the full amount, net of deductions, must be credited to the Service Provider's account by the payment deadline.
• ›The Service Provider does not accept cash payment.

16.Payment deadlines, default, recovery costs

In short: the invoice carries an 8-day deadline, and late payment attracts default interest and a flat recovery fee. After 15 days we may lock access — but even then we do not delete your data.

Unless otherwise agreed individually, the payment deadline is 8 calendar days from the date of the electronic invoice issued by the Service Provider. For card payments, performance occurs at the moment of the successful transaction (authorisation + capture). For bank transfer, performance occurs at the time when the full amount of the fee is credited to the Service Provider's bank account. The Service Provider points out that, under Section 6:130 of Act V of 2013 on the Civil Code (Ptk.), in a contract between businesses the deadline stipulated for the performance of a monetary debt may not exceed 60 calendar days; the Service Provider applies a more favourable 8-day deadline.

• ›In the event of the Customer's late payment, the Service Provider is entitled to default interest under Section 6:155(1) of Act V of 2013 on the Civil Code (Ptk.) (central bank base rate + 8 percentage points), from the day of default.
• ›Under Act IX of 2016, the Service Provider is entitled — without separate undertaking — to a recovery flat fee equivalent to EUR 40 in HUF, per invoice.
• ›After more than 15 calendar days' delay, the Service Provider may restrict some or all functions (lock) after prior email warning.
• ›After more than 30 calendar days' delay, or non-payment of two consecutive monthly fees, the Service Provider may terminate the contract by extraordinary termination with immediate effect.
• ›During the lock period the Customer's data is retained unchanged, and the Customer may use the data export function during the lock as well. The Service Provider does not delete the Customer's data because of late payment; deletion takes place solely after termination of the contract, once the 12-month retention period under the section “Withdrawal, termination, end of contract” has expired.
• ›Default interest at the rate set out in this section and the flat recovery fee may not be enforced against a Customer qualifying as a Consumer. In the event of a Consumer's default, the Service Provider is entitled to default interest under Section 6:48 of Act V of 2013 on the Civil Code (Ptk.) — the central bank base rate in force on the first day of the calendar half-year affected by the default — and to its actually incurred, evidenced costs; Act IX of 2016 on the flat recovery fee does not apply towards a Consumer.

17.Fees during a lock, notices and the presumption of delivery

In short: if we lock access because of late payment, the fee is still due, because we continue to keep your data. Email is deemed delivered on the second business day — which is why it is important that your address is up to date.

The rules on the lock under the section “Payment deadlines, default, recovery costs” and on communications between the parties are supplemented by the following. The Service Provider always sends a written warning before a lock, and lifts the lock within 1 business day of the arrears being settled.

• ›A lock due to late payment does not affect the Customer's payment obligation: the subscription fee remains due for the duration of the lock, since the Service Provider continues to maintain the Customer's data, storage and capacity during that time.
• ›If the lock was applied for a reason within the Service Provider's scope of responsibility or by mistake, the Service Provider credits the fee for the period of unavailability pro rata and restores access without delay.
• ›The Service Provider may charge a one-off administration fee for lifting the lock, as set out in the Price List; its amount may not exceed 10% of the monthly subscription fee concerned. On the first occasion, and where the arrears are settled within 8 calendar days, the Service Provider does not charge this fee.
• ›Legal declarations addressed by the parties to each other are deemed delivered on the second business day following dispatch to the email address given in the contract, provided that the sender's system confirmed the dispatch as successful and no delivery failure notice was received.
• ›The parties are obliged to notify each other of any change of email address without delay, in writing. Failing this, the legal declaration is deemed delivered to the last address notified.
• ›In addition to email, the Service Provider also displays termination, extraordinary termination and payment reminders in the interface of the Service, so that the Customer learns of them irrespective of the delivery of the email.
• ›Towards a Consumer, the presumption of delivery applies until the contrary is proven; the Consumer may rebut the presumption by proving that the declaration could not be received for reasons beyond their control.

18.Invoicing, accounting documents, corrections

In short: we send an electronic invoice by email; if it is incorrect, tell us within 8 days and we will issue a correction.

The Service Provider accounts for the fees in every case on an electronic invoice issued in accordance with Act C of 2000 on Accounting and Decree 23/2014 (VI. 30.) NGM, authenticated by a qualified electronic signature or covered by online data reporting to NAV. The invoice is sent in PDF format to the email address nominated by the Customer. A paper invoice is issued and posted upon request; for a Customer that is not a Consumer, the fee for this is a one-off HUF 1,500 + VAT. For a Customer qualifying as a Consumer, the issuance of a paper invoice is free of charge. The Customer must keep the invoicing data (company name, registered seat, tax number, EU VAT number, group tax number) up to date and available to the Service Provider; the Service Provider is not liable for damage arising from incorrect invoicing data.

• ›Monthly fees: within 3 business days from the first working day of the given month, in advance for the month.
• ›Annual fee: within 3 business days from the start of the subscription year, in advance for the full year.
• ›Usage-based fees (e.g. AI tokens, document generation) — by the 5th business day of the following month, in arrears.
• ›The Service Provider issues a correction invoice where the Customer reports the error in a verifiable manner (by email) within 8 days of receipt of the invoice; failure to observe this deadline does not affect the Service Provider's statutory obligation to issue a correction; the tax consequences arising from a late report are borne by the Customer.
• ›Issued electronic invoices are downloadable at any time from the Service Provider's Customer Portal and retained for at least 8 years.

19.Invoicing and NAV data reporting — allocation of responsibility

In short: invoices are not issued by ATMOS but by your own invoicing software, which also sends the data to the tax authority. We connect the two.

This section applies to the Customer's own outgoing and incoming documents handled through the Service; invoices issued by the Service Provider to the Customer are governed by the section “Invoicing, accounting documents, corrections”. ATMOS ERP does not qualify as invoicing software within the meaning of Decree 23/2014 (VI. 30.) NGM on the tax administration identification of invoices and receipts. The issuance of the Customer's outgoing invoices and the data reporting to the NAV Online Invoice system take place in the system of the external invoicing provider chosen by the Customer (in particular Billingo or Számlázz.hu), to which the Service provides a data transfer connection.

• ›The Customer is responsible for its own legal relationship with the invoicing provider, for the statutory registration of the invoicing software, and for the substantive correctness and the timely issuance of the documents.
• ›Document data prepared in ATMOS is not in itself an invoice or an accounting document; it becomes one solely upon issuance by the invoicing provider.
• ›Incoming invoices are retrieved from the NAV Online Invoice system using the Customer's own technical user. The Customer is responsible for creating the technical user, for its permissions and for the validity of its keys; the Service Provider uses this data solely for carrying out the retrieval, in encrypted form, and does not disclose it to any third party.
• ›The Service Provider is not liable for damage arising from a fault or outage of the external invoicing provider, of the NAV systems, of banks or of email providers, including data reporting that is omitted, incorrect or delayed as a result.
• ›If a fault in the integration arises within the Service Provider's scope of responsibility, the Service Provider notifies the Customer thereof without delay, remedies the fault within the deadline set out in the section “Liability, warranties, defective performance”, and its liability in this respect is not excluded.
• ›Fulfilling tax, accounting and other regulatory obligations on time is in all cases the Customer's obligation; the Service provides a tool for this, but does not take over the obligation and does not supervise its fulfilment.
• ›If the invoicing integration ceases or the contract with the external provider terminates, the Service Provider notifies the Customer at least 30 calendar days in advance and provides an opportunity to export the data concerned.

20.Refunds and credits

In short: when money is refunded and when it is not. The fee for a period already commenced is generally not refunded, but an erroneous charge is.

Fees are refunded solely in the cases set out in this section and, as regards Consumer withdrawal, in the section “Withdrawal, termination, end of contract”. The trial period is free of charge: no payment obligation arises until it expires.

• ›Closing of the trial period. If the Customer registered a bank card during the trial period, the subscription automatically switches to the selected package after the last day of the trial period, and the Service Provider charges the card with the fee for the first period. Before the charge, the Service Provider sends the reminder described in the section “Payment methods — bank transfer and card transactions”, containing the date of the switch, the gross amount of the charge and the one-click cancellation link. The Customer may cancel free of charge up to the day of expiry on the Settings → Subscription page; no charge is then made. If the Customer did not register a bank card, access ceases at the end of the trial period, without any charge. Towards a Consumer, the automatic switch to a paid subscription may be applied solely with the Consumer's express prior consent.
• ›The fee of a billing period already started (month or year) is non-refundable — except in the case of Consumer withdrawal; upon termination the Service remains fully available until the end of the paid period.
• ›In case of an erroneous, duplicate or unauthorised charge, the Service Provider refunds the affected amount within 15 calendar days of the Customer's report, via the same payment method as the original transaction.
• ›If the availability undertaken in the SLA is not met, compensation is provided primarily in the form of a credit against the following period's fee (see the section “SLA — availability, maintenance, downtime”); a monetary refund is made only upon termination of the contract, up to the amount of the unused credit.
• ›Save for add-on services tied to a fixed term, when an add-on module is cancelled the pro-rata fee for the period already paid is not refunded; the module remains usable until the end of the paid period despite the cancellation.
• ›If the Customer terminates an annual (discounted) subscription mid-term, no refund is due; if the contract is terminated by the Service Provider for reasons within its own scope, the fee for unused full months is refunded pro rata.
• ›Refunds are always made in the currency and via the payment channel of the original transaction (bank card or bank transfer); the Service Provider makes no cash refunds.

21.Allowance and term of add-on services

In short: certain add-ons are provided against an annual allowance and have a 12-month term. This commitment does not apply to Consumers.

Certain add-on services — in particular the Opten company registry lookup package — are provided against an annual allowance, while the fee for them falls due monthly. The size and the content of the allowance are set out in the Price List in force at any given time.

The minimum term of such an add-on service is 12 months, counted from the day of first activation. If it is cancelled before the end of the term, the Customer is obliged to pay the fees for the remaining months, given that the Service Provider has ordered and paid for the related allowance at the data provider for a full year in advance.

• ›The allowance is renewed on the anniversary of first activation — not per calendar year and not monthly.
• ›Any unused part of the allowance may NOT be carried over to the next period.
• ›The lookup allowance applies to unique companies: the data of a company already looked up may be refreshed without limit within the given period, and this does not consume the allowance.
• ›If the allowance is exhausted, the Service Provider suspends further lookups until the next period begins or the allowance is extended. Previously retrieved data remains accessible.
• ›The allowance may be extended at any time within the term; the extension takes effect from the day of the extension and does not change the anniversary.
• ›Cancelling and re-ordering the add-on service does not start a new allowance: the anniversary remains tied to the day of first activation.
• ›The Service Provider draws the Customer's attention separately and prominently to the 12-month minimum term before the order is finalised, and the Customer expressly accepts it. The minimum term obligation under this section does not apply to a Consumer; a Consumer may cancel the add-on service with effect from the end of the next billing cycle, without any additional payment obligation.

22.Customer rights and obligations

In short: what you may and may not do with the system. Protecting your access credentials and the accuracy of the data entered are your responsibility.

The Customer is entitled to use the Service in accordance with the GT&C and to receive the support provided by the Service Provider. The Customer must use the Service in compliance with applicable Hungarian and EU law, keep credentials confidential, and not grant access to unauthorised third parties.

• ›The Customer is solely responsible for the truthfulness and lawful processing of data stored in the system; the Service Provider acts only as data processor.
• ›The Customer must notify the Service Provider in writing without delay, at the latest within 24 hours, of any unauthorised access, abuse or data incident.
• ›Stress testing (DoS), abusive exploitation of security vulnerabilities, or unauthorised penetration testing is prohibited; such conduct may trigger immediate termination and liability for damages.
• ›The Customer may not reverse-engineer or reimplement the essential functions of the Service, or build a competing service on the API, save for the decompilation for interoperability purposes expressly permitted under Section 60(1) of Act LXXVI of 1999 on Copyright (Szjt.).
• ›The Customer must pay fees under the chosen package by the deadline, in full.
• ›The Customer is entitled to export its data in a machine-readable format (CSV, JSON), on the terms and at the frequency set out in the section “Data security, backups, storage quota and data export”.

23.Service Provider rights and obligations

In short: what we undertake — careful operation, prior notice of changes, and the release of your data at the end of the contract.

The Service Provider undertakes to provide the Service in accordance with the GT&C, the Individual Contract and the Price List, with the due care expected, and to handle Customer data confidentially, storing it securely as described in the Privacy Policy.

• ›The Service Provider may — with at least 30 calendar days' advance notice — further develop, consolidate or discontinue modules, and introduce new functions.
• ›The Service Provider may suspend access upon prior warning if the Customer engages in unauthorised or unlawful conduct.
• ›The Service Provider is entitled to engage contributors in providing the Service (data centre, hosting and database provider, email and AI provider). The Service Provider is liable for the conduct of a contributor so engaged as if it had acted itself, within the limits of liability set out in the section “Liability, warranties, defective performance”. A third party with which the Customer itself has a legal relationship, or whose engagement the Customer has chosen, does not qualify as a contributor of the Service Provider — in particular the systems of the National Tax and Customs Administration (NAV), banks, the invoicing service provider and the company information data provider; the Service Provider is not liable for their operation.
• ›Upon contract termination, the Service Provider must retain the Customer's data unchanged during the 12-month retention period and, at the Customer's request, provide it in an export format.
• ›Planned downtimes must be announced at least 48 hours in advance; unplanned downtimes must be communicated without delay via the status page and email.

24.Use as a reference

In short: we would like to mention you among our customers. If you would rather we did not, one email is enough and we take it down within 15 days.

The Service Provider is entitled to display the Customer's company name and logo as a reference on its website, in its sales materials and in tender reference lists for the duration of the contract. The content of the display is limited to the fact that the Customer is a subscriber to the Service.

• ›The Customer may prohibit the use as a reference at any time, without reason, in writing; the Service Provider removes the display within 15 calendar days of receiving the prohibition. The prohibition affects neither the contract nor the fee.
• ›The Service Provider uses the logo in accordance with the Customer's brand guidelines, without modification, and does not create any appearance of a recommendation or endorsement by the Customer, or of an ownership relationship.
• ›The publication of any further content relating to the Customer — case study, quotation, numerical results, project data, screenshot — is possible solely with the Customer's prior written consent.
• ›In the context of the use as a reference, the Service Provider does not name or present the Customer's business secrets, projects, partners, or the data stored in the Service.
• ›Following termination of the contract, the Service Provider removes the reference display within 30 calendar days; the only exception is material already printed or archived.

25.Intellectual property, licence

In short: the software remains ours, your data remains yours. The right of use lasts for the term of the contract.

The source code, database structure, user interface, brand marks, logos, documentation and AI models of ATMOS ERP are the exclusive intellectual property of the Service Provider (or its licensors), protected by the Hungarian Copyright Act (LXXVI of 1999), the Trade Mark Act (XI of 1997) and the relevant EU legislation. For the duration of the contract, the Customer obtains only a non-exclusive, non-transferable, non-sublicensable licence necessary for proper use.

• ›All data, documents and content uploaded by the Customer into the Service (“Customer Data”) remain the Customer's property; the Service Provider obtains only the limited usage right necessary to deliver the Service.
• ›The Service Provider may use anonymised, aggregated statistics derived from Customer Data for service improvement and quality assurance.
• ›The Customer may not rent out, publish or make the Service available to third parties beyond its own employees and subcontractors.
• ›Misuse of trade marks, logos or other intellectual property is an immediate termination ground on the Service Provider's side.

26.Partner portal (Stargate) access

In short: you may invite your external partners to the portal free of charge, but you are responsible for the data visible there. One login may be internal at one company only, and access may not be passed on for a fee.

The Service enables the Customer to invite its external partners — client, subcontractor, designer, technical supervisor — to the partner portal (Stargate) with limited permissions. On the portal, the invited partner sees only the data that the Customer shares with them; the extent of the sharing is set by the Customer, who may withdraw it at any time.

• ›The invited partner accepts these GT&C independently when first using the portal; a free-of-charge user relationship arises between the partner and the Service Provider. This relationship does not affect the contract between the Customer and the Service Provider, and the partner acquires no rights attaching to the Customer's subscription.
• ›In respect of the data shared on the portal and recorded by the partner, the controller is the inviting Customer. The Customer is responsible for processing the data of the partner's contact persons lawfully and for limiting the scope of the shared data to what is necessary.
• ›A single user identifier may be an internal user at only one Customer at a time; the same person may be granted access at another Customer solely as an external partner. This rule ensures the separation of data between tenants and is also enforced technically.
• ›The Customer may neither request nor accept consideration from a third party for providing partner access, and may not resell or lease the Service to third parties.
• ›The Service Provider currently provides partner access free of charge. The Service Provider reserves the right to make it subject to a fee or to limit it quantitatively in the future, in accordance with the notification and termination rules governing amendments to the GT&C; no such change may be introduced for a subscription period already commenced and invoiced.
• ›In the event of the partner's breach of contract, the Service Provider may restrict or terminate the partner's access without affecting the Customer's subscription; it notifies the Customer thereof without delay and — if this does not endanger the security of the Service — consults the Customer in advance.
• ›The Customer may withdraw partner access at any time. Following the withdrawal, the partner no longer has access to the previously shared data; documents uploaded by the partner remain with the Customer, who is responsible for their further processing.
• ›The Customer is liable towards the Service Provider for content uploaded to the partner portal by the partner as if the Customer had entered it itself. If a third party asserts a claim against the Service Provider because of the uploaded content, the indemnity obligation under the section “Indemnity against third-party claims” rests with the Customer.

27.Customer data, data entry and system use — allocation of responsibility

In short: the system knows what is entered into it. You, not we, are responsible for the accuracy of the data and for the decisions taken on the basis of it.

ATMOS is a record-keeping and decision-support tool: the Customer is solely responsible for the completeness, accuracy, timeliness and lawfulness of the data stored in it. The Service Provider does not verify, correct or supplement the content of data recorded by the Customer (or received via integrations).

• ›Reports, statements, margin and cost calculations produced by the system are based on the data entered; incomplete, late or incorrect data entry may distort the results — the Service Provider is not liable for business decisions based on such data or for damages arising from them.
• ›The Customer must verify the legal and professional adequacy of documents generated by the system (contract drafts, performance certificates, statements, etc.) before use; the Service — including suggestions of the AI assistant — does not constitute legal, tax or financial advice.
• ›The Customer is responsible for fulfilling tax, accounting and other regulatory obligations (e.g. invoicing, NAV data reporting); the Service Provider is not liable for damages caused by errors or outages of third-party providers (NAV Online Invoice, Billingo, Barion, banking and email systems).
• ›Managing access — passwords, invitations, permission levels, Stargate partner access — is the Customer's responsibility; all operations performed by the Customer's users or with their credentials are attributable to the Customer.
• ›The Service Provider is not liable for errors, data loss or service limitation resulting from improper use (use deviating from documented functions, bypassing the interface, mass automated data entry).
• ›The Customer must regularly export its critical business data (using the system's built-in export functions); the Service Provider's backups serve operational purposes (disaster recovery), and individual data restoration may be requested under a separate agreement.
• ›If unlawful content or data is recorded, liability rests solely with the Customer; the Service Provider may make the affected content inaccessible with prior notice.

28.Company data provided by a third party

In short: we do not produce the company data ourselves — we take it over from OPTEN without modification, and OPTEN is therefore responsible for its accuracy.

Company data shown in ATMOS ERP — in particular the company name, registered seat, sites and branches, tax number, group tax number, company registration number, main activity code (TEÁOR), bank account numbers, company and tax status, as well as balance sheet and profit and loss figures — is NOT produced by the Service Provider itself. It is taken over without modification from the official company information database provided by OPTEN Informatikai Kft. (registered seat: 1138 Budapest, Népfürdő utca 22.; company registration number: 01 09 367756) acting as data provider.

The Service Provider's role in respect of this data is limited to transmission and display. The data provider is responsible for the accuracy, completeness and timeliness of the data; beyond the scope mandated by law, the Service Provider accepts no liability for it.

• ›The source of the data is the official company information database of OPTEN Informatikai Kft., which is based on the records of the company court and the tax authority.
• ›The Service Provider does not modify, supplement or interpret the data received — it displays it in the form in which it was received.
• ›The data reflects the state existing at the time of the query. A change occurring subsequently in the company register is not automatically reflected in previously retrieved data.
• ›If the Customer notices an error or a discrepancy in the company data displayed, it may report this to the Service Provider; the correction may be initiated at the data provider.
• ›The Customer acknowledges that it may not base its business decisions solely on the company data displayed here, and that it must, where necessary, verify their accuracy against the official records.
• ›The financial figures (revenue, profit, balance sheet total, equity) originate from published annual reports and are therefore, by their nature, historical data tied to the publication schedule.

29.Data security, backups, storage quota and data export

In short: where we store your data, how we back it up, how much storage your plan includes, and how you can take your data away — for 12 more months after the contract ends.

The Service Provider stores the Customer's data in data centres located within the European Union (database: Ireland; application runtime: Germany, Frankfurt am Main; all uploaded files, including documents, plan sheets and photographs: object storage under EU jurisdiction), and encrypts the data in transit (TLS) and at rest (AES-256).

The Service Provider uses the automatic daily backup of the service platform, with 7-day retention, in an EU data centre. The Service Provider verifies at least once a year that restoration from backup works, and keeps a record of the verification. The committed recovery objectives are: at most 24 hours of data loss (RPO) and restoration within at most 8 business hours (RTO). Restoration applies to the entire system; individual, customer-level restoration (for example accidentally deleted data) is carried out by the Service Provider against a separate fee, on the basis of the Customer's data export.

• ›Subscription packages include a single, shared storage quota (Starter 5 GB, Pro 15 GB, Ultra 25 GB; trial period 1 GB). Only uploaded files — documents, plan sheets uploaded to the Blueprint plan archive and photos attached to defect tickets — count jointly against the quota; data recorded in the database does not. The Blueprint plan-archive add-on — including the one contained in the Ultra package — does not include a separate storage quota and does not increase the shared quota.
• ›The quota may be set to a total of 100 GB, 250 GB, 500 GB or 1 TB by choosing a storage package under the Price List; a tier below the quota included in the subscription package may not be selected. The tier chosen determines the total quota and is not added to the base quota of the package. Only one storage package may be in effect at a time; upon switching to another tier, the fee is settled pro rata.
• ›The Service Provider informs the Customer's administrator when 80% of the quota is reached and warns them at 90%. When the quota is full, the uploading of new files is suspended until an upgrade; access to data, the recording of records, downloading and signing continue to work unchanged.
• ›The Customer may request a full export of its data at any time in Settings (database records in machine-readable and spreadsheet form, together with the uploaded files), once every 24 hours; the package produced may be downloaded for 3 days.
• ›During the 12-month retention period following termination of the contract (section “Withdrawal, termination, end of contract”), the Customer may request and download its data and may resume work with the retained data by taking out a new subscription; when the retention period expires, the Service Provider permanently deletes the data and the uploaded files, and the data ages out of the backups when the backup cycle expires, within 30 days at the latest. We are unable to delete an individual record from a backup: a backup is a closed, encrypted file that can be used solely for restoring the entire system.
• ›Accounting and sector-specific retention obligations (in particular the 8-year retention of accounting documents and the statutory retention of construction documentation) rest with the Customer; the Service Provider provides the export facility for fulfilling them.
• ›The Service Provider gives notice of changes to the storage quotas, the backup frequency and the recovery objectives in accordance with the rules governing amendments to the GT&C.

30.Liability, warranties, defective performance

In short: we make mistakes and we put them right. If we cause damage, we pay for it — but up to one year's fees, and at most HUF 3 million. We do not compensate lost profit.

The Service Provider warrants the Service under Art. 6:157 of the Civil Code and applicable law. In case of defective performance the Customer may exercise warranty rights (repair, price reduction, refund of the affected fee) and — where fault on the Service Provider's side causally led to damage — claim damages under Art. 6:142 of the Civil Code.

• ›The Service Provider's total liability — counting all claims together within one calendar year — is limited to the amount of the subscription fees that fell due in the 12 months preceding the notification of the damage claim, and in any event to a maximum of HUF 3,000,000. Pursuant to Section 6:152 of Act V of 2013 on the Civil Code (Ptk.), the limitation may not be applied to a breach of contract committed intentionally or causing damage to human life, bodily integrity or health. Towards a Consumer, the limitation applies solely to the extent permitted by law.
• ›The Service Provider is not liable for indirect damages, lost profit, loss of goodwill, or consequential business losses from data loss, except where law prohibits such exclusion.
• ›Errors may be reported on the ATMOS interface or at info@quadrant.hu; the Service Provider acknowledges critical (service-down) errors within 4 uptime hours, severe errors within 1 business day, and other errors within 5 business days.
• ›Towards Consumers the Service Provider may limit liability only to the extent permitted by law; consumer warranty, product warranty and guarantee rules under Government Decree 45/2014. (II. 26.) apply.
• ›The Service Provider is not liable for an outage or fault caused by a circumstance falling outside its control within the meaning of Section 6:142 of Act V of 2013 on the Civil Code (Ptk.), which was not foreseeable at the time the contract was concluded and which could not be averted — in particular war, natural disaster, a nationwide energy or internet backbone outage, or an attack originating outside the Service Provider's infrastructure that could not be repelled by protection corresponding to the state of the art at the given time. This exclusion does not affect Section 6:152 of the Civil Code (Ptk.) or liability under Article 82 of the GDPR, and towards a Consumer it applies solely to the extent permitted by law.
• ›In the course of using the free trial period, demo access and beta functions, the Service Provider's liability is excluded to the extent that exclusion is permitted by law. This exclusion does not apply in the cases set out in Section 6:152 of the Civil Code (Ptk.), nor towards a Consumer, in respect of whom the Service Provider is liable under the applicable law.

31.Indemnity against third-party claims

In short: if someone brings a claim against us because you entered unauthorised or unlawful data into the system, you bear it. If someone brings a claim against you because our software infringes copyright or industrial property rights, we bear it.

The parties indemnify each other against third-party claims as set out below. In both directions, the indemnity is subject to the condition that the party learning of the claim informs the other party in writing within 8 calendar days of becoming aware of it, hands over the conduct of the defence, provides the information and documents reasonably required for it, and makes no admission and concludes no settlement without the other party's prior written consent. Late notification releases the other party only to the extent that it actually made the defence more difficult.

• ›The Customer indemnifies the Service Provider against every third-party claim — including a claim by the Customer's employee, subcontractor, client or partner — that arises from the Customer having entered data into the Service without authorisation, having stored unlawful content, or having used the Service in breach of the law. In this respect the Customer reimburses the Service Provider's evidenced damage and costs, including reasonable legal representation fees proportionate to the subject matter of the case.
• ›The Service Provider takes action at its own cost against any third-party claim based on the assertion that the intended use of the Service infringes a third party's copyright or industrial property rights, and reimburses the Customer's evidenced damage arising therefrom.
• ›In this respect the Service Provider is entitled, at its own discretion, to modify the function objected to, to replace it with a solution serving the same purpose, or — if this is not possible with reasonable effort — to withdraw it against a pro-rata refund of the fee. In the event of withdrawal, the Customer may terminate the contract effective on the day of the withdrawal, without any additional payment obligation.
• ›The Service Provider has no indemnity obligation if the infringement was caused by a modification initiated by the Customer, by use of the Service other than as intended, by content uploaded by the Customer or imported from a third party, or by the use of a version of the Service whose update the Service Provider made available free of charge.
• ›The Service Provider's liability under this section exists within the limits of liability set out in the section “Liability, warranties, defective performance”, save for the cases set out in Section 6:152 of the Civil Code (Ptk.).
• ›The Customer's indemnity obligation under this section does not apply to a Consumer; a Consumer is liable under the general rules on damages of the Civil Code (Ptk.). The Service Provider's indemnity also applies towards a Consumer.

32.Withdrawal, termination, end of contract

In short: when and how the contract can be terminated, what happens at the end of the contract — we keep your data for 12 months so that you can come back — and what right of withdrawal a consumer has.

A Customer qualifying as a Consumer may withdraw without giving reasons within 14 calendar days of the conclusion of the contract, pursuant to Section 20 of Government Decree 45/2014 (II. 26.). If, at the Consumer's express prior request, the Service Provider commences performance within the 14-day period, the Consumer may exercise the right of withdrawal regardless, but must, pursuant to Section 26 of Decree 45/2014, reimburse the Service Provider's reasonable costs, that is, the pro-rata fee for the service actually provided up to the communication of the withdrawal. The Consumer loses the right of withdrawal once the service has been performed in full, where the Service Provider commenced performance with the Consumer's express prior consent and the Consumer acknowledged that they would lose the right of withdrawal upon full performance (Section 29(1)(a) of Government Decree 45/2014).

• ›Customers that are not Consumers (B2B) have no right of withdrawal; a fixed-term contract may not be terminated before expiry by ordinary termination, while an indefinite-term contract may be terminated by either party, without giving reasons, with 30 calendar days' notice, effective at the end of the next billing cycle. In the absence of written termination given by the 30th day before expiry, a fixed-term subscription is automatically renewed for an identical term. The Service Provider sends a reminder of the date and the amount of the renewal at least 7 calendar days before the charge; if the reminder is not sent, the Customer may still validly terminate within 15 calendar days of receiving the reminder. Towards a Consumer, automatic renewal may be applied solely with the Consumer's express prior consent, and the Consumer may cancel the renewal free of charge up to the day of renewal.
• ›The Service Provider may exercise extraordinary termination in case of: payment delay over 30 days; material breach not cured within 15 calendar days of written notice; abusive or unlawful use of the Service; insolvency or bankruptcy/liquidation proceedings against the Customer.
• ›After termination of the contract, the Service Provider retains the Customer's data — including uploaded files and user accounts — unchanged and free of charge for 12 months from the date of termination (retention period). During the retention period the Service workspace is not available; however, the Customer may request and download a full export of its data, and may resume using the Service in the same account with the retained data by taking out a new subscription, which ends the retention period. During the retention period the Service Provider performs no operation on the data other than storage, preparing the export and reactivation. The Service Provider notifies the Customer's contact person and administrators by email of the deletion date upon termination and at least 30 and 7 days before permanent deletion. When the retention period expires, the Service Provider — subject to mandatory statutory retention — permanently deletes the Customer Data and informs the Customer by email that the deletion has taken place; permanent deletion — except for earlier deletion at the Customer's request — takes place no earlier than on the 7th day after the 7-day notice is sent, and no later than on the 30th day after the retention period expires. The Customer may shorten the retention period at any time: its representative or administrator may request earlier permanent deletion by written request sent to info@quadrant.hu, which the Service Provider fulfils within 15 days of receipt of the request at the latest, after verifying authority and warning that the deletion is irreversible. If a user of the Customer is also a member of another Customer's partner portal, the Service Provider nevertheless deletes the Customer's data within the above deadline, and retains only that user's login data (name, email address, password hash) for as long as the partner access with the other Customer lasts. For the purposes of this point, a trial period that has not become a subscription — even if the Customer cancelled it earlier — terminates on the day it expires, and the retention period runs from that day.
• ›Termination does not affect fee obligations arising before termination, and confidentiality obligations survive for another 5 years.
• ›A Consumer may exercise the right of withdrawal by an unequivocal statement sent by email to info@quadrant.hu, or by using the model statement set out in Annex 2 to Government Decree 45/2014 (II. 26.). The text of the model statement: “Addressee: Quadrant Analytica Kft., 2234 Maglód, Wodiáner Ipari park 089/47., info@quadrant.hu — I, the undersigned, declare that I exercise my right of withdrawal/termination in respect of the contract for the provision of the following service: … Date of conclusion of the contract: … Name of the consumer: … Address of the consumer: … Signature of the consumer (only where the statement is made on paper): … Date: …”. The Service Provider confirms receipt of the statement within 48 hours and refunds any fee paid within 14 calendar days, using the same payment method.

33.Complaints, consumer dispute resolution

In short: where you may send a complaint, how quickly we reply, and which authority or body you may turn to if you disagree with us.

A Consumer may submit a complaint to the Service Provider in writing (by email or by postal letter). The Service Provider gives a substantive reply to the complaint within 30 calendar days. In the event of rejection, the Service Provider must inform the Consumer of the available remedies.

• ›Conciliation body — the Consumer may turn to the Pest County Conciliation Body (Pest Vármegyei Békéltető Testület, 1119 Budapest, Etele út 59-61. II. em. 240.; postal address: 1364 Budapest, Pf. 81.), which is competent over the Service Provider's registered seat, or — at the Consumer's choice — to the conciliation body competent at their own domicile or place of residence. The Service Provider has a duty to cooperate in conciliation body proceedings.
• ›Consumer protection authority — consumer protection authority tasks are performed by the county government offices. A Consumer may turn to the government office competent at their place of residence, or to the organisational unit of the Pest County Government Office acting within its consumer protection competence at the Service Provider's registered seat; the current contact details are available at kormanyhivatal.hu.
• ›Online dispute resolution — the European Commission's former online dispute resolution platform has been discontinued. A Consumer may settle a consumer dispute within the Hungarian conciliation body system; in cross-border matters the European Consumer Centre (ECC-Net Hungary) provides assistance.
• ›Data protection complaints — the Hungarian Data Protection Authority (NAIH), 1055 Budapest, Falk Miksa utca 9-11.
• ›The Service Provider keeps a dedicated complaints register for at least 5 years.

34.Exclusion of the Customer's terms, set-off, assignment, time limit for claims

In short: your own purchasing terms do not apply to this contract, the fee may not be reduced by a disputed claim, and a complaint must be notified in writing within one year. These do not apply to Consumers.

The legal relationship between the parties is governed by these GT&C, the Price List and any Individual Contract. The following provisions clarify the framework of the legal relationship and supplement the section “Miscellaneous and closing provisions, governing law”.

• ›The Customer's own general terms and conditions do not apply to this legal relationship, even if the Customer refers to them in its order, in its procurement documents or in correspondence. The Customer's terms become part of the contract solely upon the Service Provider's express written acceptance.
• ›The Customer may not set off its claims against the Service Provider against the fee claim, and may not refuse payment of the fee by invoking a right of retention. This limitation does not apply to a claim established by a final court judgment or a final decision of an authority, acknowledged in writing by the Service Provider, or not disputed by the Service Provider and already due. This limitation does not apply towards a Consumer.
• ›The Service Provider is entitled to transfer its rights and obligations arising from the contract without the Customer's prior consent, in particular in the event of transformation, merger, transfer of a business unit or change of ownership. The Service Provider notifies the Customer of the transfer at least 30 calendar days in advance; in such a case the Customer may terminate the contract effective on the day of the transfer, without any additional payment obligation. The transfer leaves the data processing obligations relating to the Customer's data unchanged.
• ›The Customer may transfer its rights and claims arising from the contract with the Service Provider's prior written consent; the Service Provider may not withhold the consent without good reason and declares its decision within 15 calendar days.
• ›The Customer is obliged to notify the Service Provider in writing of any claim arising from the contract within 1 year of becoming aware of it; failure to observe this deadline precludes the enforcement of the claim. This provision does not apply to a Consumer, nor to a claim arising from a breach of contract committed intentionally or causing damage to human life, bodily integrity or health.

35.Miscellaneous and closing provisions, governing law

In short: the remaining legal questions — governing law, confidentiality, notices, and the competent court.

Matters not regulated by these GT&C are governed by Hungarian law, in particular the Civil Code (Ptk.), the E-Commerce Act (Elker. tv.), Government Decree 45/2014 (II. 26.), Act CLV of 1997 on Consumer Protection, and data protection and accounting legislation. For disputes arising between them — with the exception of matters concerning a Customer qualifying as a Consumer — the parties stipulate the exclusive jurisdiction of the court having subject-matter and territorial competence at the Service Provider's registered seat. The Service Provider does not stipulate exclusive jurisdiction towards a Consumer; in disputes involving a Consumer, the general rules of civil procedure apply. If any provision of the GT&C proves invalid, this does not affect the effect of the remaining provisions; the invalid provision is replaced by a lawful provision closest to the parties' contractual intent.

• ›Confidentiality: parties must keep business secrets, know-how and customer data learnt under the contract confidential without time limit, including after contract termination.
• ›Severability — the invalidity of any single provision does not affect the rest of the GT&C.
• ›Assignment — the Customer may not assign rights without the Service Provider's prior written consent.
• ›Notices — communications between the parties are validly sent by email to the addresses in the contract; the sender must evidence delivery.
• ›Amendments in writing only — the Individual Contract may be amended only by mutual, duly executed signatures (e-signature accepted).
• ›Language and jurisdiction — these GT&C are drawn up in Hungarian and are governed by Hungarian law. Except in matters concerning a Consumer, the court having subject-matter and territorial competence at the Service Provider's registered seat (depending on the value in dispute, the district court or the Budapest Environs Regional Court) has exclusive jurisdiction to decide disputes.

36.What this annex covers: the subject matter, purpose, nature and duration of the processing

In short: the Customer enters the data of its own staff and partners into the system, and we process it solely so that the Service works — for as long as the contract lasts, and afterwards for up to 12 months so that the Customer can come back.

The subject matter of the processing. All personal data that the Customer or the Customer's user enters into the Service, creates or uploads in it, or that arises in the course of using the Service. The Customer has control over this data: it is the controller. The Service Provider — Quadrant Analytica Kft., 2234 Maglód, Wodiáner Ipari park 089/47., tax number: 32943874-2-13 — acts as a processor.

The purpose and nature of the processing. We have a single purpose: to provide the ATMOS ERP cloud-based enterprise resource planning service to the Customer. Within this framework we store, organise, display and make the data searchable, produce documents from it, transmit it to those to whom the Customer grants access in the system, perform backups and restorations, and provide support and troubleshooting. We do not use it for our own business purposes, we do not disclose it to any other customer, and we do not analyse it.

The duration of the processing. For the term of the subscription contract, and thereafter until the end of the 12-month retention period following termination of the contract, or — if the Customer so requests — until earlier permanent deletion. After that we delete the data in accordance with the point “What happens to the data upon termination of the contract” of this annex.

The categories of data subjects and the data processed. The typical categories of data are shown in the list below. The actual content is determined by the Customer, through what it enters into the system.

Special categories of data. The Service was not built for the mass or systematic processing of special categories of data under Article 9 of the GDPR. In the workforce record-keeping module the type of absence (for example sick leave) may indicate a state of health, but the system neither requests nor offers a field for a diagnosis, a medical history or a medical opinion. If the Customer nevertheless records or attaches such data, that is its own decision: it must ensure the valid legal basis and the information of the data subjects. The same applies to data relating to criminal convictions and offences under Article 10 of the GDPR, for the processing of which the system is likewise not intended.

• ›Data subjects: the Customer's employees and the other persons performing work for it.
• ›Data subjects: the contact persons and representatives of the Customer's subcontractors, suppliers and clients.
• ›Data subjects: the contact persons of the external partners invited to the partner portal.
• ›Data subjects: the Customer's own users (system administrators, project managers, office and on-site staff).
• ›Data processed: identification and contact data — name, job title, email address, telephone number, workplace, the data of the company represented.
• ›Data processed: record-keeping data relating to employment — working time, attendance, holiday and absence, data relating to remuneration.
• ›Data processed: the personal data contained in business documents — contracts, performance certificates, invoices, minutes, partner evaluations.
• ›Data processed: uploaded files — drawings, on-site photographs, voice notes, signature images.
• ›Data processed: account and log data — role, permissions, logins, activity log.
• ›The Customer — as controller — is obliged to inform its employees and other data subjects, in accordance with Articles 13–14 of the GDPR, that it processes their data in ATMOS ERP, and to make them familiar with the Service Provider's privacy policy. The Service Provider makes the information necessary for this available.

37.Bound by instructions, and confidentiality

In short: we do only what the Customer instructs us to do by using the system, and everyone on our side who has access is bound by confidentiality.

The instruction. We process the Customer's data solely on its instructions. The primary form of the instruction is the intended use itself: whatever the Customer and its users do on the interface or through the API, we treat as an instruction. Added to this are the subscription contract, the GT&C and the permission structure set by the Customer. No separate written instruction is needed for the system to work in the usual way.

Individual instructions. If the Customer gives an instruction falling outside ordinary operation — for example if it requests the out-of-course deletion, release or relocation of a category of data — we accept it by email, from its system administrator or its contractual contact person, at info@quadrant.hu. If carrying out the instruction requires significant work outside the ordinary operation of the Service, we inform the Customer of this and of the expected cost in advance, and we may make performance subject to agreement.

When we may depart from the instruction. If EU or Hungarian law obliges us to carry out processing for which the Customer has given no instruction — for example to comply with a request from an authority — we follow the law. We inform the Customer of this before the processing, unless the law prohibits this on important grounds of public interest. This is how Article 28(3)(a) of the GDPR prescribes it.

If an instruction appears unlawful. If in our judgement an instruction infringes the GDPR or another data protection rule, we notify the Customer of this without delay, and we may suspend performance of the instruction until the question is clarified. It is not our task to examine the lawfulness of the Customer's processing, but we will not carry out a manifest infringement.

Confidentiality. Among our staff, only those for whom it is indispensable for operation, support or troubleshooting have access to the Customer's data — to the extent and for the time necessary. Every such member of staff is bound by a written confidentiality obligation that survives the termination of their engagement. We log the data modifications carried out on the Service Provider's side, and we provide information on them at the Customer's request.

The AI functions. For certain functions to work, we send the text or file to be processed to an external model provider. What exactly is sent out, to whom, and with what guarantees, is described in the Privacy Policy. These providers are sub-processors within the meaning of this annex.

• ›The following qualifies as an instruction: the intended use of the Service on the interface and through the API.
• ›The following qualifies as an instruction: the subscription contract, the GT&C and the permission structure set by the Customer.
• ›The following qualifies as an instruction: an individual request arriving by email from the Customer's system administrator or contractual contact person.

38.Security measures

In short: over and above the protection described in the section “Data security, backups, storage quota and data export” of the GT&C, each customer's data is separated from that of the others already in the database itself.

Our technical and organisational measures are set out in the section “Data security, backups, storage quota and data export” of the GT&C, and they form part of this annex. We do not repeat them here, we only recall the essentials: we store the data in data centres within the European Union, the transmission is protected by TLS and the stored data by AES-256 encryption, and an automatic backup is taken every day with 7-day retention, in an EU data centre; the committed data loss window (RPO) is 24 hours and the recovery time (RTO) is 8 business hours.

Having regard to Article 32 of the GDPR, we supplement these measures with the following. These are core elements of the protection, not optional settings.

We may develop the above measures in line with the state of the art; the level of protection, however, may not be reduced. If the backup frequency, the recovery objectives or the protective measures change materially, we inform the Customer of this in accordance with the rules governing amendments to the GT&C.

Security is a shared responsibility. The Service Provider protects the system; it is the Customer's task to keep the user accounts up to date, to remove the access of departing staff, to align permissions with actual job roles, and to keep login credentials confidential. We have no insight into whom the Customer grants access to, and we do not override this either.

• ›Row-level data separation. Every data row is tied to a single subscriber, and row level security in the database shuts it off from the other subscribers. The separation applies not only in the application but in the database itself.
• ›Role-based permission management. The Customer itself sets which of its users has access to which module and, within that module, to which operation — viewing, creation, modification, deletion.
• ›Access and activity logging. The system records who modified what and when, and also logs access from the Service Provider's side.
• ›Encryption both in transit and at rest. The data travels over an encrypted channel and is stored encrypted; passwords are stored as an irreversible hash, and we do not know the plaintext password.
• ›Separation of the development and the production environment. Development and testing take place in an environment separated from production; we do not copy live customer data over for development or testing purposes.
• ›Verification of restoration. We test from time to time that restoration from the backups works, so that the committed objectives do not exist only on paper.
• ›Restriction of access. Access on the Service Provider's side is personal, limited to the scope and duration necessary for the task, and ceases immediately upon termination of the engagement.

39.Sub-processors

In short: we use subcontractors, their list is public and always up to date, we give notice before a change, and the Customer has 30 days to object.

General authorisation. In order to provide the Service we use external providers — sub-processors. These include, for example, the database and hosting provider, the infrastructure running the application, the email delivery provider and the model provider supplying artificial intelligence. By accepting the GT&C, the Customer gives its general authorisation to this under Article 28(2) of the GDPR.

The list. The full sub-processor list in force at any given time — showing, for each provider, the registered seat, the task performed and the location where the data is stored — is set out, with a date, in the section “Our processors and sub-processors” of the Privacy Policy. We deliberately do not repeat it here, so that two divergent lists can never arise. That list forms part of this annex.

The sub-processor's obligations. With every sub-processor we conclude a contract complying with Article 28 of the GDPR, which imposes on it at least the obligations undertaken in this annex — being bound by instructions, confidentiality, security measures and deletion. If the sub-processor fails to fulfil these, we are liable for it towards the Customer under Article 28(4) of the GDPR as if we had acted ourselves.

Notice in the event of a change. If we engage a new sub-processor or replace an existing one, we notify the Customer's contractual contact person of it by email at least 30 days before the change enters into force, and we also indicate it in the interface of the system. At the same time we update the list in the Privacy Policy.

Right to object. The Customer may object to the new sub-processor within 30 days of the notice, in writing, on data protection grounds. In the event of an objection we look for a solution: another provider, a narrowed scope of data, or switching off the function concerned at the Customer. If we do not arrive at a common solution within 30 days, the Customer may terminate the subscription contract by extraordinary termination, effective on the day the change enters into force, and receives back the pro-rata part of the prepaid, unused fee. The objection in itself entails no payment obligation and does not qualify as a breach of contract.

Replacement that cannot be delayed. If the replacement of a sub-processor cannot be delayed for security reasons, because of the sub-processor's breach of contract or because its service has ceased, we give notice immediately afterwards instead of in advance. The Customer has the right to object in this case too, with the consequences set out above.

The Customer authorises the Service Provider to transfer data outside the European Economic Area to the extent necessary for engaging the sub-processors, subject to the guarantees under Chapter V of the GDPR — such as the standard contractual clauses under the European Commission's Decision 2021/914, or an adequacy decision. The providers concerned and the guarantees are listed in the Privacy Policy.

40.Assistance and personal data breaches

In short: we assist in fulfilling data subject requests and in the impact assessment, and in the event of a breach we notify the Customer within 48 hours at the latest.

Data subject requests. If someone requests access, correction, erasure or data portability, fulfilling the request is the task of the controller Customer. The system provides tools for this: searchable records, individual record export and full data export in machine-readable format, and correction and deletion functions. If the Customer is unable to fulfil the request using the tools of the system, we assist to a reasonable extent — this is prescribed by Article 28(3)(e) of the GDPR.

If the request reaches us. If a data subject request comes directly to us concerning data that falls within the Customer's processing, we do not fulfil it — we have no legal basis for doing so. Within five business days we forward it to the Customer's system administrator, and we inform the data subject of this as well. We act substantively only if the Customer expressly instructs us to do so.

Requests from authorities. If an authority or a court requests the Customer's data from us, we inform the Customer of this in advance — unless the law prohibits it — so that it may make use of its remedies.

Assistance with security and impact assessment obligations. Under Article 28(3)(f) of the GDPR we assist the Customer in fulfilling its obligations under Articles 32–36: in assessing the security measures, in handling breaches, in preparing the data protection impact assessment (Article 35) and in preparing the prior consultation (Article 36). For this we make available the description of the system and of the security measures, the sub-processor list, and the description of the backup and deletion regime. The extent of the assistance is determined by the nature of the Service and by the information available to us; in the case of exceptional cooperation requiring significant work we may charge a fee agreed in advance.

What counts as a personal data breach. Where the personal data processed is accidentally or unlawfully destroyed, lost, altered, disclosed without authorisation or made accessible.

The notification deadline: 48 hours. If this happens, we notify the Customer's contractual contact person and system administrator by email without undue delay, but at the latest within 48 hours of becoming aware of it — in urgent cases by telephone as well. If the details of the breach are not yet fully available within that time, we still give notice within the deadline and provide the missing information in stages, as the investigation progresses.

What the notification contains. The information set out in the list below, to the extent available.

Reporting to the authority is the Customer's task. The 72-hour report to the supervisory authority and — where necessary — the communication to the data subjects are made by the controller Customer; we provide all the information we hold for this. We do not act before the authority on the Customer's behalf, and we do not inform the data subjects without prior consultation with the Customer. We keep a record of every breach, even where it entails no reporting obligation.

• ›The nature of the breach, the time of its occurrence (or likely occurrence), and the manner of its discovery.
• ›The categories of data concerned and the approximate number of data subjects and data records, where this can be established.
• ›The likely consequences of the breach.
• ›The measures already taken and planned, including the steps taken to mitigate the damage.
• ›The name and contact details of the contact person from whom further information may be requested.

41.What happens to the data upon termination of the contract

In short: after the contract we keep your data for 12 months — during this time you can take it away, or take out a new subscription and continue where you left off. After that we delete it permanently (earlier on request), and it ages out of the backups within 30 days at the latest.

Export during the contract. During the term of the contract the Customer may at any time request a full export of its data in Settings, on the terms set out in the section “Data security, backups, storage quota and data export” of the GT&C. The export contains the data recorded in the database in machine-readable and spreadsheet format, together with the uploaded files.

The 12-month retention period. Following termination of the contract we retain the data unchanged for 12 months. The retention is based on the Customer's instruction given in this annex and serves two purposes: during this time the Customer can download its data, or take out a new subscription and continue working in the same account with the retained data. During this time we merely store the data; apart from preparing the export and the reactivation initiated by the Customer we perform no other operation on it, and the security and confidentiality rules of this annex continue to apply to it unchanged. The Customer may shorten the retention period at any time and is responsible for ensuring that it is consistent with its own retention rules. A trial period that has not become a subscription — even if the Customer cancelled it earlier — terminates on the day it expires, and the retention period runs from that day.

Notice before deletion. Upon termination, and then at least 30 and 7 days before permanent deletion, we notify the Customer's contact person and administrators by email of the deletion date. Deletion — except for earlier deletion at the Customer's request — takes place no earlier than on the 7th day after the 7-day notice is sent, and no later than on the 30th day after the retention period expires.

Deletion or return. Until the end of the retention period the Customer may choose: we return the data — the Customer downloads the full export — or delete it permanently. If the Customer makes no declaration, when the retention period expires we permanently delete the data together with the uploaded files and user accounts. If the Customer's representative or administrator requests deletion earlier (info@quadrant.hu), we carry it out after verifying authority, within 15 days of receipt of the request at the latest — before doing so we draw attention to the fact that the deletion is irreversible and that we cannot restore the data afterwards. If a user of the Customer is also a member of another Customer's partner portal, we nevertheless delete the Customer's data and retain only that user's login data for as long as the partner access with the other Customer lasts. We notify the Customer by email once the deletion has taken place and, on request, confirm it in writing.

The backups. Data ages out of the backups when the backup cycle expires, within 30 days at the latest. We are unable to delete an individual record from a backup: a backup is a closed, encrypted file that can be used solely for restoring the entire system. For as long as such data is in a backup, the security and confidentiality rules of this annex continue to apply to it unchanged, and we do not use it for any other purpose.

Statutory exception. We do not delete data whose retention is required of us by EU or Hungarian law. We merely store such data, do not use it for any other purpose, and delete it when the retention period expires. This exception is based on Article 28(3)(g) of the GDPR. We keep the invoices for the fees paid to us not as a processor but as a controller in our own right, for 8 years under the Accounting Act.

The Customer's own retention obligations. Accounting and sector-specific retention obligations — such as the statutory retention of construction documentation — rest with the Customer. We provide the export for this; retaining the downloaded data is the Customer's responsibility.

42.Audit, liability and amendment of the annex

In short: the Customer may audit us once a year, with advance notice; the limits of the GT&C apply to liability between us, but liability towards data subjects under the GDPR remains unaffected.

The right to audit. The Customer is entitled to verify whether we comply with what we have undertaken in this annex. This is prescribed by Article 28(3)(h) of the GDPR, and we regard it as a genuine right, not a formality.

First step: documentation. At the Customer's written request we send, free of charge, the description of the system and of the security measures, the description of the backup, restoration and deletion regime, the sub-processor list in force at any given time, the part relating to the Customer of the record of processing activities carried out on the Customer's behalf, kept under Article 30(2) of the GDPR, and the results of any independent expert examinations or certifications available to us. In most procurement due diligence exercises this is sufficient; if it satisfies the Customer's reasonable audit need, no further examination is required.

Certifications — frankly. At the time this annex enters into force we do not hold an ISO/IEC 27001 or equivalent independent certification. If we obtain one, we will publish it and present it during an audit. What we can give today is the documentation set out above and the certifications of our sub-processors.

On-site or remote examination. If the documentation is not sufficient, the Customer — or an independent expert engaged by it — may carry out an examination. The conditions for this are set out in the list below. The purpose of the conditions is not to make the audit impossible, but to ensure that the data of our other customers and the operational security of the Service are not compromised.

If the examination reveals a deficiency. We remedy a deficiency that conflicts with this annex within a reasonable deadline, at our own cost, and inform the Customer in writing of the measures taken.

Extraordinary audit. We also allow an examination beyond the one occasion per year if a supervisory authority orders it, or if it is justified following a proven personal data breach affecting the Customer's data. The conditions set out in the list apply in such a case too, with the exception of the 30-day notice period.

Liability. The limitations of the Liability, warranties, defective performance section of the GT&C apply to liability arising from this annex and enforceable in the relationship between the parties. This does not, however, affect or limit liability towards data subjects under Article 82 of the GDPR, or the powers of the supervisory authority. If one party pays compensation for damage, or pays a fine, that is attributable to the conduct of the other party, it may claim reimbursement from the other party under Article 82(5) of the GDPR.

The Customer's responsibility. The Customer is responsible for ensuring that there is a valid legal basis for the data entered into the system, for informing the data subjects, for setting permissions correctly, and for using the system in accordance with its own data processing rules. The Service Provider does not examine the lawfulness of the Customer's processing.

Amendment and effect of the annex. The annex forms part of the GT&C; the rules governing amendments to the GT&C apply to its amendment, save that an amendment made mandatory by a change in legislation enters into force on the day that legislation enters into force. If there is a conflict between the annex and another section of the GT&C, the annex prevails as regards the processing of personal data. The annex remains in force after termination of the contract, for as long as we process the Customer's personal data in any form.

• ›At most once per calendar year.
• ›With written notice at least 30 days in advance, at a time agreed in advance, on a business day and during business hours.
• ›At the Customer's cost; the Customer reimburses the evidenced costs of the Service Provider's cooperation.
• ›The person carrying out the audit signs a confidentiality declaration in advance and may not be a competitor of the Service Provider or an agent of one.
• ›The audit may not extend to the data of other customers, to the Service Provider's source code constituting a business secret, or to information whose disclosure would breach a confidentiality obligation owed to a third party.
• ›The audit may not disrupt the ordinary operation of the Service; in the absence of a prior written agreement we may refuse an examination method that endangers operational security — such as penetration testing.
• ›The Customer treats the findings confidentially and uses them solely for verifying compliance with this annex.