WiNOVA Terms of Use

WiNOVA is provided by Soft Opera, Unipessoal Lda, NIF 517794934, Rua da Escola, n.º 75, 3530-301 Mangualde ("we", info@winova.pt), to the company that creates the account ("your company") and to the users it invites.

The service is intended only for businesses and professionals, in the course of their business. Your company confirms that it is not acting as a consumer, and whoever accepts declares that they have authority to bind it.

These terms and Annex A are available in full before acceptance and can be saved and printed. We will clarify any point you ask us about.

We give 30 days' notice of important changes and ask for new acceptance. If it does not accept, your company may terminate without penalty before the change takes effect.

Changes required by law or for security, and those that do not harm your company, apply at once, with notice.

We keep all versions and the record of acceptances.

Your company chooses the users and their roles, and is responsible for their compliance with these terms. Accounts are personal and credentials are confidential.

Your company is responsible for acts carried out with its users' credentials, unless due to a failure on our part.

Notify us at once of any unauthorised access.

We grant your company a non-exclusive, non-transferable licence to use WiNOVA for as long as the service lasts. The software, the brand and the content belong to us or to those who licensed them to us.

It is not permitted to:

• make the service available to third parties;

• copy, modify or decompile the software;

• use it, or use the catalogues, to create a competing product;

• extract catalogues by automated or systematic means;

• circumvent or test security without written authorisation;

• overload the service;

• use it for unlawful purposes.

These prohibitions do not limit:

• your company's data (point 5);

• switching provider (point 10.4);

• rights granted directly by a supplier;

• acts that the law does not allow to be prohibited.

The catalogues of the suppliers and of WiNOVA may be protected by copyright and by the database maker's right, and are licensed only for use within the service.

Your company warrants that it has the rights to the content it uploads and that it processes its customers' data lawfully. It bears third-party claims, and the reasonable expenses they cause us, arising from its content or from a use contrary to these terms that is attributable to it.

We may freely use the suggestions you send us. We may name your company and show its logo as a customer, unless you object by e-mail.

The data your company creates or uploads belong to it. We keep them separate from those of other companies, with access controls appropriate to the risk.

We use them only to provide the service, keep it secure and comply with the law. To improve the service, your company instructs us to produce aggregated and anonymous statistics, which never identify your company, its customers or its prices. We do not sell your data.

Export. On request, we deliver within 15 days, even if the account is suspended, the data in CSV and JSON and the issued documents in PDF.

• One export per quarter is free. Further exports may have a reasonable cost, which we state beforehand.

• At the end of the service and when switching provider, export is always free.

For the personal data of your company's customers and contacts, your company is the controller and we are the processor (Article 28 GDPR), under Annex A. It is responsible for having a legal basis for the processing and for informing the data subjects.

For the data of the users themselves (account, access and security), we are the controller, in accordance with our privacy policy.

Sub-processors:

• Hetzner: servers, in Germany and Finland;

• Backblaze: encrypted backups, in the EU;

• Cloudflare: network and protection;

• Stripe: payments;

• Moloni: invoicing;

• Resend: sending e-mails.

Transfers outside the EU are made only with the European Commission's standard contractual clauses or under the EU-U.S. Data Privacy Framework.

New sub-processor.

• It requires your company's agreement, requested 30 days in advance through acceptance of a new version of these terms.

• Silence does not count as agreement.

• Without agreement, either party may terminate without penalty, with a refund of the paid and unused portion.

The price and the plan are those of the subscription. Prices do not include VAT and are paid in advance: payments go through Stripe and invoices are issued by Moloni. They may change on 30 days' notice, for the following period.

Trial period. We give notice 3 days before it ends. Without payment, the account is suspended, and it can be resumed by paying.

Failed payment. There are 7 days to settle; after that, the account is suspended.

Without settlement within 30 days after the suspension, the service ends (point 10.3).

Amounts paid are non-refundable, except in the cases provided for in these terms or if the service ends due to a failure on our part.

Late payment. Interest accrues at the commercial rate. In addition, compensation of €40 is due, plus the reasonable and proven collection costs exceeding it (Decreto-Lei n.º 62/2013 (Portuguese Decree-Law 62/2013)).

We do our best to keep the service available and give notice of planned maintenance. Unless agreed in writing, we do not guarantee a minimum level of availability.

We may improve, change or withdraw features. If we withdraw a feature included in your company's plan in a way that materially reduces the service:

• we give 30 days' notice;

• your company may terminate without penalty, with a refund of the paid and unused portion.

We make encrypted backups outside the main servers. Keep the documents you need for your business.

WiNOVA supports calculation, design and documentation. Production, pricing and compliance decisions are your company's, as is CE marking, as manufacturer. Your company must validate the drawings and measurements before producing.

We are not liable for:

• errors in data entered by your company or supplied by third parties, including catalogues and prices;

• loss of profit, loss of business, customers or orders, reputational damage or production stoppages;

• damage that the validation in point 9.1 would have avoided;

• loss of data beyond the restoration in point 9.3;

• misuse of credentials without a failure on our part;

• events beyond our reasonable control.

In the event of loss of data attributable to us, we restore the data from the latest available backup.

Cap. Our total liability in each 12-month period is limited to the amount paid in that period, with a minimum of €300.

• The cap covers liability between the parties, including the right of recourse under Article 82(5) GDPR.

• It does not cover liability towards data subjects.

Claims must be notified to us in writing within 90 days of becoming aware of the fact, on pain of forfeiture (caducidade) (artigo 330.º do Código Civil (article 330 of the Portuguese Civil Code)).

Scope of points 9.2 to 9.5. They cover only contractual liability for ordinary negligence. They do not apply:

• to wilful misconduct or gross negligence, by us, our representatives or the persons we use to perform our obligations;

• to damage to life, to physical or moral integrity or to health;

• to non-contractual pecuniary damage;

• to liability towards data subjects and authorities, including that imposed by the GDPR; point 9.4 still applies to the right of recourse between the parties.

Nor do they exclude the right to performance, to termination of the contract or other non-waivable rights. These reservations apply to all exclusions, limitations and indemnities in these terms.

Terminating the service.

• Your company may terminate at any time and keeps access until the end of the paid period.

• We may terminate without cause, on 90 days' notice, refunding the paid and unused portion.

Suspension.

• We may suspend the account for breach of point 4 or for non-payment, with prior notice.

• In a security emergency or by order of an authority, we may suspend without prior notice and notify you immediately afterwards.

• If a breach of point 4 is not remedied within 30 days after the notice, we may terminate.

• Before terminating for a failure on our part, your company gives us at least 15 days to remedy it, unless remedy is impossible or there is another legal ground for immediate termination.

Data after termination. Unless there is a legal obligation to keep them:

• the data are kept for 30 days, without access, and you may request the export (point 5.3);

• then, we delete them from the active databases within 15 days, or after delivering the requested export;

• we delete them from the backups up to 35 days later;

• with no pending export, this gives a maximum of 80 days.

Switching provider (Regulation (EU) 2023/2854).

• Notice and transition. Your company gives notice of no more than 2 months and states the destination: another provider or its own infrastructure. A transition of up to 30 calendar days follows, without undue delay, with the service running. Your company may extend it once, for the period it chooses.

• If 30 days are not technically feasible: we say so within 14 working days, with the justification and an alternative period of up to 7 months.

• What we transfer: all data created, uploaded or generated (customers, quotes, configurations, own prices, documents and files), with the metadata, in the format of point 5.3. Also the digital assets that your company can use independently. Excluded are the software, the catalogues licensed only for use in the service and the internal operational data (logs, metrics and infrastructure configuration).

• Assistance: we provide reasonable assistance to your company and to the third parties it authorises. We support its exit strategy with all relevant information. We maintain continuity and a high level of security during the transfer and retrieval, inform of known risks and confirm completion.

• Information: the page winova.pt/termos/dados forms part of these terms. It sets out the categories of exportable and excluded data and assets, the procedures, limitations, structures, formats and standards, the countries of the infrastructure and the measures against unlawful access by foreign authorities. Export in open, documented formats is free.

• Costs: switching has no costs, but the normal price is due during the transition.

• End of the contract: it ends once switching is completed. The data remain retrievable for a further 30 days, and the deletion periods of point 10.3 then follow.

• Deletion only: instead of switching, your company may request deletion only, and the contract ends at the end of the notice.

• These rules prevail over suspension and deletion.

• After delivery, we are not responsible for storing the data, for the import or for the new provider's service.

Communications by e-mail to the account administrator are valid.

Your company may assign its position only with our written agreement.

Each party keeps confidential the other's prices, terms and non-public technical information, during the service and for 3 years afterwards.

Specifically negotiated agreements prevail over these terms. An invalid clause does not affect the others. The Portuguese text prevails over the translations.

Portuguese law applies. The Tribunal Judicial da Comarca de Viseu, the district of our registered office, has jurisdiction, unless a mandatory rule provides otherwise.

Subject matter, nature, purpose and duration. The purpose is to provide WiNOVA to your company. The nature: hosting, storage, calculation, documents, e-mails on request, backups and support. It lasts as long as the service and until the end of the periods in point 10.

Data and data subjects.

• Data: identification and contact details (name, NIF, address, telephone, e-mail), data from quotes, orders and invoices, and uploaded documents.

• Data subjects: end customers, contacts of customers and suppliers, and users to the extent that they appear in those data.

Instructions.

• We process the data only on your company's documented instructions: the use of the service and written requests, including with regard to transfers (point 6.3).

• We inform you immediately if an instruction appears to us to be unlawful.

• If the law requires other processing of us, we inform you beforehand, unless the law prohibits it.

Confidentiality and security. Anyone who accesses the data is bound by confidentiality. We apply the appropriate measures under Article 32: encryption in transit, encrypted backups, separation by company, role-based access and logging of administrative access.

Sub-processors. Only those in point 6.3 and those accepted under point 6.4, bound by the same obligations. We are liable for them.

Assistance. We help with data subjects' requests and with the obligations in Articles 32 to 36, with the information we have. Assistance beyond normal use, which the law does not require to be free of charge, is invoiced at the support hourly rate in force.

Personal data breaches. We notify you without undue delay, to allow for the 72-hour deadline in Article 33.

End. Your company chooses:

• return (point 5.3) followed by deletion;

• or deletion only.

In both cases, within the periods in point 10.3, unless there is a legal obligation.

Audits. We make available the necessary information and allow audits and inspections, by your company or by a mandated auditor, without access to other companies' data. Except in case of breach or a requirement of an authority, they take place once a year, on a working day, with reasonable notice and at your company's cost. These limits do not prevent additional audits that are justifiably necessary to demonstrate compliance with Article 28.