Cloketa General Terms and Conditions — Customer Agreement

Identification and preamble

Version 2026-10-21-v6 — effective from October 21, 2026

Translation. In case of discrepancy, the French version prevails (article 32.5).

Provider: Be The Wave SRL, a private limited liability company (société à responsabilité limitée) governed by Belgian law, having its registered office at rue Albert et Louis Curvers 34, 4053 Embourg, Belgium, registered with the Crossroads Bank for Enterprises (CBE) under enterprise number 0839.986.742 (VAT BE 0839.986.742), publisher of the Cloketa service. Contact: [email protected] — data protection: [email protected].

Preamble

A. Be The Wave SRL develops and operates Cloketa, a software accessible online ("software as a service") enabling employers to record, schedule, correct, retain and export the working time of their workers.

B. The Customer is an undertaking that wishes to use Cloketa for its professional needs and, in particular, to organise the recording of its staff's working time.

C. The parties acknowledge that, as at the date of this version, the general obligation to record working time announced in Belgium for 1 January 2027 has not yet been definitively adopted and that its detailed rules may change. The Customer chooses Cloketa in full knowledge of these facts.

D. The Customer entrusts Be The Wave SRL with the processing of its workers' personal data. The parties intend to govern this processing in accordance with Regulation (EU) 2016/679 ("GDPR"), and the conditions for switching providers in accordance with Regulation (EU) 2023/2854 ("Data Act").

It is agreed as follows.

Title I — Contractual framework

Article 1. Definitions

The following terms, when capitalised, have the meaning set out below, in the singular as well as in the plural.

• Administrator: a User on whom the Customer confers, within Cloketa, the most extensive rights over the Company Space, in particular the management of Users, rules, the subscription and exports.
• Customer: the legal or natural person acting in the course of its professional activity, identified when the Company Space is created, who accepts the Agreement and employs the Workers.
• Agreement: these general terms and conditions, their annexes, the subscribed Plan and, where applicable, any specific document signed by both parties.
• Documentation: the information on the use of Cloketa published by the Provider, in particular on www.cloketa.eu and in the application.
• Customer Data: all data, including Personal Data, entered into Cloketa by the Customer or its Users, or generated by their use of the Service on behalf of the Customer (clock-ins, schedules, corrections, reasons, decisions, Locations, attachments, audit logs relating to the Company Space).
• Exportable Data: the Customer Data and associated metadata that may be extracted within the meaning of the Data Act, excluding elements protected by the intellectual property rights or trade secrets of the Provider or of third parties.
• Company Space: the logically segregated environment of Cloketa specific to the Customer, containing its settings and its Customer Data.
• Plan: the pricing offer chosen by the Customer (in particular Micro, Small, Team or Enterprise), with its monthly or annual billing period.
• Unavailability: a period during which the clock-in and consultation functions of Cloketa are inaccessible to all of the Customer's Users, for a cause attributable to the Provider's infrastructure, as defined in article 14.
• Kiosk: a shared device, configured by the Customer and linked to a Location, on which Workers clock in and out by means of a personal QR code or PIN code.
• Location: a place of work defined by the Customer (for example an office, a site, a construction site or teleworking), with or without an address or geographic coordinates, as well as, if the Customer enables it, the geographic position captured by a User's device at the time of a clock-in.
• Provider: Be The Wave SRL.
• Service or Cloketa: the Cloketa software provided online and as a progressive web application (PWA), its Documentation, its updates and, if subscribed, onboarding services such as Cloketa Start.
• Durable Medium: any instrument enabling information to be stored and reproduced unchanged, in particular an e-mail or a PDF document.
• Worker: any person whose working time the Customer records or has recorded in Cloketa, whatever his or her status (white-collar employee, blue-collar worker, temporary agency worker, student or other).
• Active Worker: any active or invited person who occupies a seat in the Company Space and may use the Service; this is the unit on which the price is calculated.
• User: any natural person authorised by the Customer to access the Company Space, whatever his or her role (Administrator, manager, Worker).
• Data Breach: a breach of security within the meaning of article 4(12) of the GDPR affecting Customer Data.

Article 2. Purpose and contractual documents

2.1. The Agreement sets out the conditions under which the Provider makes the Service available to the Customer, as well as the rights and obligations of the parties.

2.2. The Agreement consists of, in descending order of priority: (i) any specific document signed by both parties; (ii) the subscribed Plan and its order summary; (iii) Annex 1 (Data Processing Agreement), which prevails on any data protection matter; (iv) these general terms and conditions; (v) Annexes 2 and 3; (vi) the Documentation.

2.3. The Agreement constitutes the entire agreement between the parties. It supersedes any prior exchange. The Customer's general purchasing conditions or other terms are inapplicable, even if communicated subsequently.

Article 3. Conclusion of the agreement, authority to represent and evidence

3.1. Exclusively professional use. Cloketa is reserved for undertakings within the meaning of article I.1, 1° of the Code of Economic Law. The Customer declares that it is acting for professional purposes. Consumer protection rules do not apply to the Agreement.

3.2. Authority to represent. The person who creates the Company Space and accepts the Agreement declares that he or she is legally authorised to bind the Customer, as a corporate body or as an agent. Failing this, he or she undertakes to procure the ratification of the Agreement by the Customer (porte-fort) and is personally liable for the obligations arising from it until such ratification. Use of the Service or payment of an invoice constitutes ratification.

3.3. Identification of the Customer. The Customer provides accurate and complete information, in particular its name, its enterprise number, its address and the identity of the signatory. The Provider may pre-fill this information from the Crossroads Bank for Enterprises; the Customer checks and corrects these data under its own responsibility.

3.4. Electronic acceptance. The Agreement is concluded by the Customer's electronic acceptance when the Company Space is created, by means of a checkbox that is not pre-ticked and a separate acceptance action. The Provider records the identity of the account, the date and time, the version accepted, its digital fingerprint (hash), the IP address and the identifier of the Company Space.

3.5. Evidence. Between undertakings, evidence may be adduced by any means. The parties agree that the records referred to in article 3.4 and the logs of the Service constitute evidence of the acceptance and of its content, unless proven otherwise. The Customer may at any time download from Cloketa a copy of the accepted version on a Durable Medium.

3.6. Pre-contractual information. The Customer acknowledges that, before acceptance, it was able to consult the Agreement, the Plan, the price, the procedure for switching providers and for export under article 27, and the list of sub-processors in Annex 2.

Article 4. Description and limits of the Service

4.1. Features. The Service makes it possible, in particular: to clock in and out in real time (start, break, resume, end) from a browser, a PWA or a Kiosk; to record fixed schedules automatically; to manage breaks, split shifts and work spanning midnight; to propose and approve corrections and keep them traceable; to view attendance; to manage Locations and, if the Customer enables it, geolocation at clock-in; to produce reports and an inspection export with a manifest and an integrity check; to manage several companies and access rights. The up-to-date description is set out in the Documentation.

4.2. Standard Service. The Service is standard software, offered identically to all customers of the same Plan, subject to the options turned on under Article 10.5. The Provider does not undertake to develop specific features, save under a signed specific document.

4.3. Changes. The Provider may change the Service, and add, modify or withdraw features for technical, security or legal reasons or to improve the product. Where a change substantially and adversely reduces a feature that is essential for the Customer, the Provider informs the Customer at least thirty days in advance, save in the event of a security emergency or a legal obligation; the Customer may then terminate the Agreement in accordance with article 25.3.

4.4. Changes to the legal framework. The Provider monitors developments in the regulations on the recording of working time and endeavours to adapt the Service within a reasonable period after the publication of the final texts. It does not guarantee that the Service will cover all future, sector-specific or collectively agreed requirements applicable to the Customer, nor by any specific date. If the Service cannot reasonably be adapted to an essential legal requirement, either party may terminate the Agreement in accordance with article 25.3.

4.5. What Cloketa is not. Cloketa is neither an official application of a public authority, nor a social secretariat, nor payroll software, nor an audit, certification or advisory service. Calculations, alerts, totals, Location suggestions, reports and exports are technical aids that the Customer checks before any use.

4.6. Beta features. Features flagged as "beta", "preview" or "experimental" are provided as is, for testing purposes, without any commitment as to availability or continuation, and may be withdrawn at any time.

Title II — Accounts, Users and obligations of the Customer

Article 5. Company Space and Administrators

5.1. The Customer designates at least one Administrator. It freely determines the roles and rights of each User in its Company Space.

5.2. Instructions given in Cloketa by an Administrator or by a User holding the necessary rights (invitations, settings, approvals, exports, deletions, change of Plan) are deemed to be given by the Customer and are binding on it.

5.3. The Customer keeps the list of Administrators up to date. If an Administrator leaves or access is lost, the Provider may, upon written request from a person authorised to represent the Customer and after reasonable verification, assign Administrator rights to another person.

Article 6. Users and Workers

6.1. The Customer is the sole party to the Agreement. The Agreement is concluded with the Customer only. Users, including Workers, do not become parties to the Agreement and acquire no rights of their own to its performance, without prejudice to their rights as data subjects within the meaning of the GDPR.

6.2. Access granted by the Customer. The Customer grants its Users a personal, non-transferable right of access, limited to the term of the Agreement and to the use of the Company Space. This right ends when the Customer deactivates the User or when the Agreement ends.

6.3. Users' terms of use. Upon first login, each User reads and accepts the Terms of Use in Annex 3 and receives the information on data protection. These terms govern the fair and safe use of the Service. They place no price or financial obligation on the User and do not replace the Customer's obligations towards its Workers.

6.4. Customer's liability for its Users. The Customer is liable to the Provider for the acts and omissions of its Users as for its own. It ensures that they comply with the Agreement and Annex 3.

6.5. Personal credentials. Each access is strictly personal. Sharing an account, a PIN code or a QR code between several persons is prohibited. The Customer informs its Users that a clock-in made on behalf of a colleague falsifies the recording of working time.

6.6. Multi-company accounts. The same person may have an account used in several Company Spaces. His or her roles, staff numbers and work data remain specific to each Company Space and are not accessible to other customers.

Article 7. Obligations of the Customer as employer

7.1. Employment-law responsibility. The Customer remains the sole employer and is solely responsible for compliance with labour and social security law, collective and sector-level agreements, its work rules, working hours and working-time arrangements, breaks, remuneration, declarations and obligations to retain social documents. It determines whether the Service and its configuration are suitable for its situation and, where necessary, consults its social secretariat or a qualified adviser.

7.2. Information and consultation of staff. Before going live, the Customer completes the steps required by law and the applicable agreements, in particular:

1. prior, clear and complete information of the Workers on the processing of their data (articles 13 and 14 of the GDPR), including on any geolocation at clock-in;
2. information and, where applicable, consultation of the works council, the committee for prevention and protection at work or the trade union delegation, in particular where a new technology is introduced;
3. amendment of the work rules in accordance with the statutory procedure, where the recording system or its arrangements must be set out therein;
4. compliance with the language legislation applicable to employment relationships, in particular in the Dutch-speaking or German-speaking language region, by choosing the appropriate language for the interface and for documents provided to Workers.

7.3. Geolocation and Locations. Geolocation at clock-in is disabled by default. The Customer alone decides whether to disable it, make it optional or make it mandatory. If it enables it, it:

1. has a specified purpose and a valid legal basis, documented in writing, and verifies the proportionality of the measure, in particular in light of the less intrusive solutions offered by the Service (Locations without coordinates, Kiosk linked to a site);
2. carries out a data protection impact assessment where required;
3. does not use geolocation to track Workers' movements outside clock-ins, nor for any incompatible purpose.

The automatic Location suggestion relies on the location provided by the User's browser, with the User's permission. It may be inaccurate; the User and the Customer check the result.

7.4. Workers' devices. The Customer may not require the use of a private device without an appropriate legal or contractual basis. Where necessary, it makes an alternative available, for example a Kiosk or a work device.

7.5. Accuracy and checks. The Customer guarantees the accuracy, lawfulness and relevance of the Customer Data. It configures its rules, schedules, breaks, Locations, rights and approval processes. It checks the results, in particular automatic recordings of fixed schedules and corrections, before any payroll run, declaration, decision or communication to an authority.

7.6. Retention and exports. The Customer itself exports and retains, for the applicable statutory period, the documents and data that it must be able to produce to an inspectorate or a court. The Service is not a statutory archiving system.

Article 8. Acceptable use

8.1. The Customer and its Users shall in particular refrain from:

• using the Service for unlawful or fraudulent purposes or purposes contrary to the rights of Workers;
• entering special categories of data (article 9 of the GDPR), in particular health data or medical reasons, in free-text fields, correction reasons, comments or attachments;
• circumventing security measures, testing the vulnerability of the Service or subjecting it to load testing without prior written consent;
• extracting data on a large scale by automated means other than the exports and interfaces made available;
• decompiling, disassembling or reproducing the Service, save within the limits strictly permitted by law;
• reselling, sub-licensing or making the Service available to third parties outside the Customer's undertaking;
• introducing malicious content or content infringing the rights of third parties.

8.2. The Customer reports to the Provider without delay any unauthorised use, any compromise of credentials and any security incident of which it becomes aware, and cooperates reasonably in its analysis.

Title III — Financial terms

Article 9. Trial period

9.1. The Customer may benefit from a free trial period of fourteen days from the creation of the Company Space, with no obligation to subscribe.

9.2. During the trial, the Service is provided as is, without any availability target or guaranteed support. The Agreement applies in all other respects, in particular Annex 1.

9.3. If no subscription is taken out at the end of the trial, access is restricted. The Customer Data remain exportable for thirty days and are then deleted in accordance with article 27.5. The Provider may refuse or limit repeated trials for the same undertaking.

Article 10. Prices and Plans

10.1. Prices are those of the chosen Plan and of the options turned on, as published on www.cloketa.eu or stated in the order summary. They are expressed in euros, exclusive of VAT and other taxes, which are borne by the Customer.

10.2. The price is set per Company Space, according to the number of Active Workers. The number of Administrators and managers does not affect the price, unless they are also Active Workers.

10.3. Change of tier. Where the number of Active Workers exceeds the tier of the Plan, the Customer moves up to the higher Plan. Failing this, the Provider may move it up automatically after fourteen days' prior notice that has not been acted upon. The difference is invoiced pro rata for the current period. A move to a lower Plan takes effect at the next renewal date, without refund.

10.4. Enterprise Plan and additional services. The terms of the Enterprise Plan (16 Active Workers or more) and of onboarding services, such as Cloketa Start (99 EUR excl. VAT, optional and invoiced separately), are set out in the relevant offer. An onboarding service is a best-efforts service, limited to its described content.

10.5. Options. Shared clocking kiosks, team management and leave management are options. They are included in the Enterprise Plan. With the other Plans, an Administrator turns them on or off from the Service, at the prices published on www.cloketa.eu and shown before activation: per active kiosk for kiosks, per Active Worker for teams and leave. An option is free during the trial period. It is then invoiced with the Plan, for the same billing period; an activation during a period is invoiced pro rata. The number of kiosks and Active Workers is recorded daily: an increase is invoiced pro rata for the current period, a decrease takes effect at the next renewal date, without refund. An option turned off remains available until the end of the paid period, without refund; the related data is kept. Discounts and promotional codes also apply to the options, unless stated otherwise. An option offered by the Provider is not invoiced.

Article 11. Invoicing and payment

11.1. Fees are payable in advance, for the annual or monthly period chosen. Payment is made by the means offered in the Service, in particular through the payment service provider Stripe. The Customer authorises the corresponding recurring debits.

11.2. Invoices are issued in electronic form, where applicable via the Peppol network in accordance with Belgian electronic invoicing obligations. The Customer provides and keeps its billing details up to date.

11.3. Unless otherwise stated on the invoice, invoices are payable on the due date indicated, and no later than fourteen days from their date. Any dispute must be sent in writing, stating reasons, within fifteen days of the invoice; failing this, the invoice is deemed accepted, without prejudice to proof of a clerical error.

11.4. Any amount unpaid on the due date shall, automatically and without formal notice, bear late-payment interest at the rate provided for by the Law of 2 August 2002 on combating late payment in commercial transactions, together with the flat-rate compensation for recovery costs provided for by that law, without prejudice to higher recovery costs duly substantiated.

11.5. Fees paid are non-refundable, save in the cases expressly provided for in the Agreement (articles 14.5, 23.3, 25.3, 25.4, 28 and point 5.3 of Annex 1) or by a mandatory provision.

11.6. Referral programme. The Customer may recommend Cloketa to another business under the terms of the referral programme published in the Service ("Referral" screen), which form part of the Agreement. The referred business receives a discount on its first invoice, which cannot be combined with another promotion code. The Customer's reward takes the form of a credit, equal to one monthly fee excluding VAT of the referred business's subscription and capped at one monthly fee excluding VAT of its own subscription, applied automatically to its next fee invoices. The credit is never refunded, paid out or exchanged for cash; it bears no interest and cannot be transferred. Any credit balance not yet applied is forfeited, without compensation, when the Agreement ends for any reason, in particular when the Customer does not renew its subscription. The Provider may refuse an abusive referral or one that breaches the terms, and change or end the programme for the future; credits already granted remain applicable as long as the Agreement is in force.

Article 12. Late payment and suspension

12.1. In the event of non-payment on the due date, the Provider sends a reminder. If payment is not made within seven days of that reminder, it may suspend the administration functions of the Company Space.

12.2. So as not to deprive Workers of their recording tool, the clock-in and export functions remain available for thirty days following the suspension of the administration functions.

12.3. If the situation is not regularised at the end of that period, the Provider may suspend the entire Service and terminate the Agreement in accordance with article 25.5. Suspension does not suspend the amounts due.

Article 13. Price changes

13.1. The Provider may change its prices for a valid reason, in particular changes in its costs, in the health index, in the functional scope or in the legal framework. The change applies from the next renewal date.

13.2. The Provider notifies any increase on a Durable Medium at least sixty days before it takes effect for an annual Plan, and thirty days before for a monthly Plan.

13.3. A Customer that does not accept the increase may terminate the Agreement, free of charge, with effect from the date on which the new price takes effect. Failing this, the new price is deemed accepted.

Title IV — Service level, maintenance and support

Article 14. Availability of the Service

14.1. Best-efforts obligation. The Provider uses reasonable means to ensure that the Service is permanently accessible. It does not guarantee uninterrupted or error-free operation.

14.2. Availability target. The Provider targets a monthly availability of 97 % for the clock-in and consultation functions, i.e., for information purposes, a cumulative Unavailability of approximately 21 h 36 min over a thirty-day month. The rate is calculated as follows: (minutes in the month − non-excluded minutes of Unavailability) / minutes in the month. Only Unavailabilities of at least fifteen consecutive minutes, as recorded by the Provider's monitoring tools, are taken into account.

14.3. Exclusions. The following are not counted as Unavailability: planned or emergency maintenance (article 15); force majeure (article 23); failures of the communication networks, devices, browsers, operating systems or connections of the Customer or the Users; failures of third-party services not forming part of the hosting infrastructure of the Service (in particular notification, e-mail, payment, DNS resolution, content delivery or attack protection services); cyber attacks despite reasonable security measures; suspensions in accordance with the Agreement; non-compliant use of the Service; beta features and the trial period.

14.4. No penalty. The availability target is a quality objective. Failure to meet it gives rise to no service credit, penalty, price reduction or damages, subject only to article 14.5.

14.5. Serious failure: sole remedy. A serious failure exists if (a) availability is below 97 % for two consecutive months or for three months within a twelve-month period, or (b) a continuous non-excluded Unavailability exceeds seventy-two hours. The Customer may then terminate the Agreement in writing within thirty days of the serious failure, with immediate effect. The Provider refunds the fees paid in advance for the period not yet elapsed, pro rata temporis. Such termination and refund constitute the Customer's sole and exclusive remedy for any Unavailability, performance degradation or lack of availability, subject to article 22.6.

14.6. Fallback procedure. The Customer acknowledges that no online service is permanently available. It puts in place a fallback procedure enabling working time to be recorded during an Unavailability (for example a paper record or a spreadsheet), and then re-entered into Cloketa by way of a traceable correction.

14.7. Information. In the event of a major incident, the Provider endeavours to inform the Administrators by e-mail, in the application or on a status page, without any commitment as to timing.

Article 15. Maintenance and defects

15.1. Planned maintenance. The Provider endeavours to carry out planned maintenance outside working days from 7:00 to 19:00 (Brussels time) and to inform the Administrators at least forty-eight hours in advance where the foreseeable interruption exceeds thirty minutes.

15.2. Emergency maintenance. The Provider may interrupt the Service without notice where the security, data integrity or stability of the Service so requires.

15.3. Defects. The Customer reports any defect with a precise description enabling it to be reproduced. The Provider determines, according to its reasonable assessment of the severity and impact, whether and when it corrects a defect, by means of an update, a workaround or documentation. No correction time is guaranteed.

15.4. No compensation. A defect, bug, slowness or malfunction gives rise to no compensation, subject to articles 14.5, 22.4 and 22.6. The Customer checks the results of the Service in accordance with article 7.5.

Article 16. Support

16.1. Channels and hours. Support is available by e-mail ([email protected]) and through the integrated support module, on Belgian working days, from 9:00 to 17:00, in French, Dutch, German and English.

16.2. No service level. Support is provided on a best-efforts basis, with no guaranteed time for acknowledgement, response or resolution. The Provider handles requests according to their severity and order of receipt.

16.3. Scope. Support covers the use and operation of the Service. It does not include legal, employment or payroll advice, configuration on behalf of the Customer, or training, save where an onboarding service has been subscribed. The Provider may respond to Administrators only.

16.4. Support access to data. The Provider's staff access Customer Data only to the extent necessary to handle a request, for security or to comply with a legal obligation. Such access is logged. Support attachments are accessible only to authorised persons.

Title V — Data, security and ownership

Article 17. Customer Data and data protection

17.1. Ownership of Customer Data. The Customer retains all its rights in the Customer Data. It grants the Provider, for the term of the Agreement and of the end-of-agreement operations, the right to host, reproduce and process them solely to the extent necessary for the provision of the Service, its security and compliance with the Provider's legal obligations.

17.2. Roles. For Customer Data constituting personal data, the Customer acts as controller and the Provider as processor, under the conditions of Annex 1, which forms an integral part of the Agreement.

17.3. Provider's own processing. The Provider acts as a separate controller for: the creation and management of access accounts, authentication and the security of the platform; the management of the contractual relationship, invoicing and debt recovery; the prevention of fraud and abuse; communications relating to the Service; compliance with its legal obligations; website audience measurement on the basis of consent. This processing is described in its privacy notice, accessible from the Service. The Customer passes this information on to its Users where necessary.

17.4. Anonymised data. The Customer instructs the Provider to produce, from the Customer Data, irreversibly anonymised and aggregated data that do not allow either a natural person or the Customer to be identified. The Provider may use these data, during and after the Agreement, to produce statistics, measure usage, improve and secure the Service and develop new features. These data constitute neither Customer Data nor personal data. The Provider does not sell them and publishes them only in an aggregated form that does not reveal the identity of the Customer.

17.5. Service communications. The Provider may send Users the messages necessary for the operation of the Service (invitations, notifications, security alerts, resets). Any commercial communication to Users complies with the applicable regulations and may be refused at any time.

Article 18. Security, hosting and backups

18.1. Security measures. The Provider implements the technical and organisational measures described in Annex 2, proportionate to the risk. It may change them provided that the overall level of protection is not reduced. As no connected system is invulnerable, these measures do not guarantee the absence of any vulnerability, intrusion or data loss.

18.2. Shared security. The Customer secures its accounts, devices, Kiosks, networks and access codes, applies the principle of least privilege and withdraws without delay any access that is no longer needed. The Provider may require multi-factor authentication or a passkey for accounts with extended rights.

18.3. Hosting. The Service, its production data and its backups are hosted in the European Economic Area, currently with OVHcloud. The Provider may change hosting provider in favour of a solution offering an overall equivalent level of security, in compliance with Annex 1.

18.4. Backups. The Provider makes encrypted backups, stored separately from the production environment and retained for a rolling period of 35 days, and periodically tests their restoration according to a risk-based approach. Backups serve the continuity of the Service; they do not constitute archiving on behalf of the Customer. A restoration may result in the loss of the most recent data; no recovery point or recovery time objective is guaranteed.

18.5. Retention within the Service. The Customer configures retention periods within the limits offered by the Service and in light of its legal obligations. Deletions requested by the Customer become final in the production database, and then in the backups at the end of their rotation cycle. Audit logs and the original values of corrections are retained for as long as the record to which they relate exists, in order to preserve the integrity of the audit trail.

Article 19. Intellectual property

19.1. The Provider and its licensors retain all intellectual property rights in Cloketa, in particular the software, its code, its databases, interfaces, export templates, trade marks, logos and Documentation. The Agreement does not entail any assignment of rights.

19.2. The Provider grants the Customer a non-exclusive, non-transferable, non-sublicensable right to use the Service, for its internal needs, limited to the term of the Agreement and to the subscribed Plan.

19.3. The Provider may freely and without charge use the suggestions, feedback and ideas communicated by the Customer or its Users, without any obligation towards them.

19.4. Unless the Customer objects by e-mail at any time, the Provider may mention the Customer's name and logo among its commercial references, without disclosing any Customer Data.

Article 20. Confidentiality

20.1. Each party keeps confidential the non-public information of the other party obtained in connection with the Agreement. It uses such information only for the performance of the Agreement and discloses it only to persons who need to know it and are bound by an equivalent obligation of confidentiality.

20.2. This obligation does not apply to information that is public through no fault of the receiving party, already known to it, independently developed, or whose disclosure is required by law or by an authority, in the latter case after informing the other party where permitted.

20.3. The obligation of confidentiality survives for five years after the end of the Agreement. Customer Data constituting personal data remain protected without time limit in accordance with Annex 1.

Title VI — Warranties and liability

Article 21. Warranties

21.1. The Provider warrants that it holds the rights necessary to provide the Service and that it provides it with the care of a normally prudent and diligent professional.

21.2. To the fullest extent permitted by law, any other warranty, express or implied, is excluded, in particular any warranty of fitness for a particular purpose, of compliance of the Service or its configuration with the Customer's legal, sector-specific or collectively agreed obligations, of acceptance of a report or export by an inspectorate, a court or an authority, and of absence of errors.

21.3. The Customer warrants that it has all the legal bases, information and authorisations required to enter the Customer Data into the Service and to have the personal data processed in accordance with the Agreement.

Article 22. Liability

22.1. Principle. The Provider's obligations are best-efforts obligations. It may be held liable only for a proven fault attributable to it, and only for the direct, foreseeable and personal damage of the Customer that results from it with certainty.

22.2. Excluded damage. The Provider is not liable for indirect or intangible damage, such as loss of profits, turnover, business, customers, opportunity or reputation, additional staff costs, costs of reconstituting data that the Customer could have avoided through its own exports, or third-party claims.

22.3. Employment and administrative consequences. To the extent permitted by law, the Provider does not bear fines, administrative or criminal penalties, social security contributions or adjustments, arrears of remuneration, compensation owed to Workers, or the consequences of an inspection or decision by an authority, all of which remain linked to the Customer's organisation of work and its obligations as employer. Nor is it liable for the consequences of inaccurate data, insufficient configuration or checks, unlawful instructions, non-compliant use, the absence of a fallback procedure (article 14.6) or a third-party service.

22.4. Loss or alteration of data. In the event of loss or alteration of Customer Data attributable to the Provider, the Provider undertakes to use reasonable means to restore them from the last available backup. Such restoration constitutes the Customer's sole remedy for this damage, subject to article 22.6.

22.5. Cap. The total and aggregate liability of the Provider under or in connection with the Agreement, for all causes and claims combined, is limited to the amount of the fees excluding VAT actually paid by the Customer for the Service during the twelve months preceding the first event giving rise to liability.

22.6. Statutory limits. No provision of the Agreement excludes or limits the Provider's liability in the event of wilful misconduct (dol), fraud, intentional fault or gross negligence committed by the Provider itself or its agents, of harm to life or physical integrity, or in any other case where the law prohibits it. No provision has the effect of depriving an essential obligation of the Agreement of its substance. The rights that data subjects derive from article 82 of the GDPR are not affected; as between the parties, apportionment is made according to each party's share of responsibility.

22.7. Contribution. Where several causes, including an act of the Customer or of a third party, have contributed to the damage, the Provider is liable only to the extent of its own contribution.

22.8. Limitation period. Any action by the Customer against the Provider must be brought within one year from the day on which the Customer became aware, or should reasonably have become aware, of the event giving rise to the damage, failing which it shall be time-barred, save where a mandatory provision provides otherwise.

22.9. Extra-contractual action and auxiliaries. The exclusions and limitations in this article apply whatever the basis of the action, contractual or extra-contractual, in accordance with Book 6 of the Civil Code. The Provider's directors, employees, subcontractors and other auxiliaries may invoke them against the Customer.

22.10. Customer indemnity. The Customer indemnifies and holds the Provider harmless against any claim, action or penalty from Workers, Users, authorities or other third parties resulting from the Customer Data, its instructions, its configuration, a breach of articles 7 and 8 or its role as controller, and compensates it for reasonable defence costs, save to the extent that the damage results from a fault of the Provider.

Article 23. Force majeure

23.1. Neither party is liable for a failure resulting from an event beyond its reasonable control, which could not reasonably have been foreseen at the time the Agreement was concluded and whose effects cannot be avoided by appropriate measures, in particular: natural disaster, fire, flood, epidemic, war, act of terrorism, decision of an authority, external strike, general failure of telecommunications or energy networks, major failure of the hosting provider or of a critical supplier not attributable to the Provider, large-scale cyber attack despite reasonable security measures.

23.2. The prevented party informs the other as soon as possible and uses reasonable means to limit the effects of the event. Performance of the affected obligations is suspended for the duration of the impediment. The obligation to pay sums already due is not suspended.

23.3. If the impediment lasts more than sixty days, either party may terminate the Agreement in writing, without compensation. The Provider then refunds, pro rata temporis, the fees paid in advance for the period not provided.

Title VII — Term, end of the agreement, discontinuation of the product and assignment

Article 24. Term and renewal

24.1. The Agreement takes effect upon its acceptance. After the trial period, it continues for the period of the subscribed Plan (one month or one year) from the first payment.

24.2. On each renewal date, the Agreement is tacitly renewed for a period of the same duration, unless terminated by the Customer from within the Service or in writing before the renewal date. For an annual Plan, the Provider sends a reminder of the renewal date at least thirty days in advance on a Durable Medium.

Article 25. Termination

25.1. Termination at the renewal date. The Customer may terminate the Agreement at any time with effect from the end of the current period. It retains access to the Service until that date.

25.2. Early termination by the Customer. In accordance with the Data Act, the Customer may, at any time, give notice of its wish to end the Agreement before the renewal date, in particular in order to switch providers. Termination takes effect on the date indicated by the Customer and, at the latest, two months after the notice, and is then followed by the transition period under article 27. For an annual Plan, the fees for the current annual period remain due to the Provider as a flat-rate and proportionate early termination fee: they correspond to the consideration for the annual commitment, by reason of which the Customer benefited from a price reduced by approximately two months compared with the monthly Plan. For a monthly Plan, no fee is due.

25.3. Termination for substantial change. In the cases provided for in articles 4.3, 4.4, 29.3 and 30.3, the Customer may terminate the Agreement free of charge, in writing, with effect from the date on which the change takes effect or at the latest within the following thirty days. The Provider then refunds, pro rata temporis, the fees paid in advance for the period not provided. In the case of article 4.4, the Provider has the same right of termination, with the same refund.

25.4. Breach by the Provider. In the event of a serious breach by the Provider of an essential obligation that is not remedied within thirty days of a written and specific formal notice, the Customer may terminate the Agreement in writing. The Provider refunds, pro rata temporis, the fees paid in advance for the period not provided, without prejudice to article 22.

25.5. Breach by the Customer. The Provider may terminate the Agreement in writing, without compensation: (a) in the event of persistent non-payment under the conditions of article 12.3; (b) in the event of a serious breach by the Customer that is not remedied within fifteen days of a formal notice; (c) immediately, in the event of unlawful or fraudulent use of the Service or of a serious breach of article 8 compromising the security of the Service or of other customers. Fees paid remain due to the Provider and sums owed become payable.

25.6. Insolvency. Subject to the mandatory rules of Book XX of the Code of Economic Law, either party may terminate the Agreement in the event of bankruptcy, liquidation or cessation of business of the other party.

25.7. Effects. The end of the Agreement, for whatever reason, terminates the access rights of the Customer and of the Users, subject to the transition and export period under article 27. Articles 11, 17.4, 19, 20, 22, 27, 33 as well as Annex 1, for the duration of the processing, survive the end of the Agreement.

Article 26. Suspension

26.1. The Provider may suspend all or part of the access to the Service, to the extent strictly necessary, in the event of a serious risk to the security or integrity of the Service or of the data, of unlawful use or use contrary to article 8, of an order from an authority or of late payment in accordance with article 12.

26.2. The Provider informs the Customer of the suspension and of the reason for it, in advance where circumstances permit, and lifts it as soon as its cause has ceased. A justified suspension gives rise to no right to compensation.

Article 27. Switching providers, return and deletion of data

27.1. Permanent export. Throughout the term of the Agreement, the Customer may export its Exportable Data by means of the functions of the Service, in particular reports and the inspection export with a manifest and an integrity check, in a structured, commonly used and machine-readable format.

27.2. Transition period. When termination takes effect, whatever its cause, the Company Space switches to restricted mode for a period of thirty calendar days. During this period, the Customer may consult and export its Exportable Data. The Provider provides it with reasonable assistance, without switching charges, to enable it to migrate to another provider or to its own systems. If this period is technically unfeasible, the Provider informs the Customer within fourteen working days of its request, giving reasons, and sets an alternative period not exceeding seven months.

27.3. Portability and interfaces. The Provider describes in the Documentation the export formats, the categories of Exportable Data and the procedure for switching providers. It charges no switching charges or data extraction charges. Assistance going beyond the standard export functions may be the subject of a separate quotation, accepted by the Customer.

27.4. Responsibility for export. It is the Customer's responsibility to carry out its exports before the end of the transition period. The Provider has no obligation to retain the Customer Data beyond that period.

27.5. Deletion. At the end of the transition period, or earlier upon written request from the Customer, the Provider deletes the Customer Data from the production environment. They disappear from the backups at the end of their rotation cycle, and cannot be restored in the meantime, save where required by a legal obligation. Upon request, the Provider confirms the deletion in writing. Data for which the Provider is the controller (article 17.3) are retained for the periods set out in its privacy notice.

Article 28. Discontinuation of the Service by the Provider

28.1. The Provider may at any time decide to permanently cease providing the Service, in whole or in part, for any reason whatsoever, subject to at least sixty days' notice given to the Customer on a Durable Medium.

28.2. During the notice period, the Service remains accessible under reasonable conditions and the Customer has the export functions available. Article 27 applies upon expiry of the notice period, the thirty-day transition period running from the date of discontinuation.

28.3. The Provider refunds the Customer, pro rata temporis, the fees actually paid in advance for the period after the date of discontinuation. This refund is the only amount due in respect of the discontinuation of the Service, without any other compensation, subject to article 22.6.

28.4. This article does not limit the suspension or immediate termination permitted by the Agreement or by law, in particular in the event of force majeure.

Article 29. Assignment

29.1. Assignment by the Provider. The Customer hereby consents to the Provider assigning or transferring, in whole or in part, the Agreement and the rights and obligations arising from it to a third party, in particular in the context of a transfer of Cloketa, of a business or of a line of business, of a merger, a demerger, a contribution or any other reorganisation.

29.2. The Provider informs the Customer of the assignment on a Durable Medium, no later than thirty days after it takes place. The assignee takes over the Provider's obligations under the Agreement, including those of Annex 1. From the assignment, the Provider is released from its obligations for the future.

29.3. If the assignment entails a substantial and adverse change in the conditions of the Service or of the processing of data, in particular hosting outside the European Economic Area, the Customer may terminate the Agreement in accordance with article 25.3.

29.4. Assignment by the Customer. The Customer may not assign the Agreement without the prior written consent of the Provider, which may not refuse it without legitimate grounds. Such consent is not required in the event of a merger or demerger of the Customer, provided that the Provider is informed thereof within thirty days.

Title VIII — Amendments and final provisions

Article 30. Amendment of the Agreement

30.1. The Provider may amend the Agreement for a valid reason, in particular changes in the Service, legislation, case law, recommendations of an authority, its subcontractors or its security practices.

30.2. Amendments that do not reduce the Customer's rights or that are required by law take effect upon notification or on the date indicated.

30.3. Any other amendment is notified to the Customer on a Durable Medium at least thirty days before it takes effect. A Customer that refuses it may terminate the Agreement in accordance with article 25.3. In the absence of termination before it takes effect, or in the event of acceptance within the Service, the new version applies.

30.4. Each version is identified by a number, an effective date and a digital fingerprint. Accepted versions remain available for consultation by the Customer within the Service.

Article 31. Communications

31.1. Communications to the Customer are validly sent by e-mail to the Administrators, to the billing address or by notification within the Service. The Customer keeps these addresses up to date.

31.2. Communications to the Provider are sent to [email protected] or through the support module. Communications relating to data protection are sent to [email protected].

31.3. A formal notice or a termination may be notified by e-mail with acknowledgement of receipt, by the function provided for that purpose within the Service or by registered post.

Article 32. Miscellaneous

32.1. Independence. The parties act as independent contractors. The Agreement creates no relationship of subordination, agency, partnership or representation between them.

32.2. Partial invalidity. If a provision is held to be null and void or unenforceable, it is deemed reduced to the maximum extent permitted by law or replaced by the valid provision closest to its economic purpose. The other provisions remain applicable.

32.3. No waiver. Failure to exercise a right does not constitute a waiver of that right.

32.4. Change of circumstances. Each party assumes the risk of a change of circumstances within the meaning of article 5.74 of the Civil Code, the application of which is excluded. Price and Service adjustments remain governed by articles 4, 13 and 30.

32.5. Languages. The Agreement may be made available in French, Dutch, English and German. In the event of any discrepancy, the French version prevails.

Article 33. Governing law and disputes

33.1. The Agreement is governed by Belgian law.

33.2. Before bringing any legal action, save in cases of urgency or proceedings to recover an undisputed debt, the more diligent party notifies the dispute in writing. The parties have thirty days to seek an amicable solution; they may resort to mediation.

33.3. Failing agreement, any dispute relating to the Agreement falls within the exclusive jurisdiction of the courts and tribunals of the judicial district of the Provider's registered office.

Annex 1 — Data Processing Agreement (article 28 of the GDPR)

This annex governs the processing that the Provider (the "processor") carries out on behalf of the Customer (the "controller"). It prevails over any other provision of the Agreement on data protection matters.

1. Description of the processing

2. Documented instructions

2.1. The processor processes the data only on documented instructions from the Customer, including with regard to transfers, unless required to do so by Union or Belgian law; in such a case, it informs the Customer before the processing, unless the law prohibits such information.

2.2. The Customer's documented instructions consist of: the Agreement, the settings and actions carried out in the Service by authorised Users, and any additional written instruction accepted by the processor. An instruction involving specific development or cost may be the subject of a quotation.

2.3. The processor immediately informs the Customer if, in its opinion, an instruction infringes the GDPR or another data protection provision. It may suspend the execution of that instruction until it is confirmed or modified.

3. Confidentiality

The processor ensures that persons authorised to process the data are bound by a contractual or statutory obligation of confidentiality, access the data only to the extent necessary and are made aware of data protection.

4. Security

The processor implements the measures described in Annex 2 in accordance with article 32 of the GDPR. The Customer acknowledges that they provide a level of security appropriate to the risk, taking into account the nature of the data processed.

5. Sub-processors

5.1. The Customer gives a general authorisation for the engagement of the sub-processors listed in Annex 2 and of their replacements or additions.

5.2. The processor informs the Customer of any intended addition or replacement at least thirty days in advance, by e-mail to the Administrators or within the Service, save in the event of a security or continuity emergency, in which case it informs the Customer without delay.

5.3. The Customer may object to the change, in writing and on reasonable grounds relating to data protection, within fifteen days of being informed. The parties seek a solution in good faith. Failing this, the Customer may terminate the Agreement before the change takes effect, with a pro rata temporis refund of the fees paid in advance for the period not provided; this right constitutes its sole remedy.

5.4. The processor imposes on each sub-processor, by contract, data protection obligations offering sufficient guarantees that are at least equivalent to those of this annex. It remains liable to the Customer for the performance of those obligations, in accordance with article 28(4) of the GDPR.

6. Transfers outside the European Economic Area

6.1. Production data and backups are hosted in the European Economic Area.

6.2. A transfer to a third country takes place only if it is indicated in Annex 2 and covered by an adequacy decision, standard contractual clauses of the European Commission or another safeguard provided for in Chapter V of the GDPR, supplemented where necessary by additional measures.

6.3. For push notifications, the processor transmits to the notification services of browser and operating system providers only minimal content, end-to-end encrypted in accordance with the Web Push protocol, and technical identifiers.

7. Assistance to the Customer

7.1. Data subjects' rights. The processor makes available, within the Service, functions enabling the Customer to respond to requests for access, rectification, erasure, restriction and portability. It forwards to the Customer, without delay, any request received directly from a data subject and does not respond to it itself, save on the Customer's instruction.

7.2. Impact assessments and consultations. The processor provides the Customer with the information reasonably available to help it carry out an impact assessment or a prior consultation of the supervisory authority.

7.3. Cost. Assistance is free of charge where it relies on the standard functions of the Service and the Documentation. Substantial assistance beyond that may be invoiced at a reasonable rate, communicated in advance, unless it is made necessary by a breach on the part of the processor.

8. Data breaches

8.1. The processor notifies the Customer of any Data Breach as soon as possible and no later than forty-eight hours after becoming aware of it.

8.2. The notification describes, to the extent that such information is available, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. The information may be provided in phases.

8.3. The Customer remains solely responsible for notification to the Data Protection Authority and to the data subjects. Notification by the processor does not constitute an admission of liability.

9. Demonstration of compliance and audits

9.1. The processor makes available to the Customer the information necessary to demonstrate compliance with article 28 of the GDPR, primarily by means of this annex, Annex 2, a standard security questionnaire and the attestations or certifications of its sub-processors.

9.2. If this information is insufficient, the Customer may have an audit carried out, no more than once in any twelve-month period, subject to thirty days' written notice, by an independent auditor bound by secrecy and not a competitor of the processor. The audit takes place during business hours, without disrupting the Service or compromising the security or confidentiality of other customers' data. It is at the Customer's expense, including the time reasonably spent by the processor.

9.3. The frequency limit does not apply to an audit required by a supervisory authority or following a Data Breach attributable to the processor.

10. Requests from authorities

The processor informs the Customer of any request for access to the data from an authority, unless prohibited by law. It discloses only the data strictly required and challenges manifestly unlawful requests.

11. End of the processing

At the end of the Agreement, the processor enables export and then deletes the data in accordance with article 27 of the Agreement, unless a legal obligation requires their retention.

12. Records and liability

The processor maintains the record provided for in article 30(2) of the GDPR. The liability of the parties under this annex is governed by article 22 of the Agreement, without prejudice to the rights of data subjects and to each party's direct obligations towards the supervisory authority.

Annex 2 — Security measures and sub-processors

A. Technical and organisational measures

B. Sub-processors processing Customer Data

C. Service providers for the Provider's own processing

For the processing for which it is the controller (article 17.3), the Provider uses in particular Stripe (Stripe Payments Europe Limited, Ireland) for payments and Brevo for communications. These service providers are described in the Provider's privacy notice.

The up-to-date list is available within the Service and on www.cloketa.eu. Changes to it follow the procedure in point 5 of Annex 1.

Annex 3 — Terms of Use for Users

Welcome to Cloketa. Your employer uses Cloketa, a service of Be The Wave SRL (CBE 0839.986.742), to record working time. These terms explain how to use Cloketa properly. They cost you nothing and do not change your employment contract.

1. Who does what? Your employer decides how Cloketa is used in your company: schedules, breaks, places of work, geolocation, access rights and retention periods. It is the controller of your working-time data. Be The Wave SRL hosts and operates Cloketa on its behalf. Be The Wave SRL is the controller of your account data used for login and security.

2. Your access is personal. Keep your login credentials, PIN codes and QR codes to yourself. Never clock in or out for a colleague and never let anyone clock in or out for you. Enable multi-factor authentication when it is offered to you. Report any lost device or any suspicious access to your employer.

3. Accurate records. Record the work you perform in good faith. If a day is incorrect, propose a correction with a clear reason. The original value, your reason and the decision remain visible in the history.

4. No sensitive data in comments. Never enter medical information, a diagnosis or any other sensitive data in a reason, a comment or an attachment. For example, write "authorised absence" rather than the medical reason.

5. Location. Your employer may define places of work and, if it so decides, request your position at the time you clock in or out. In that case, it must inform you beforehand. Cloketa does not track your movements outside clock-ins and clock-outs. Your browser asks for your permission before any location is determined; refusing may prevent you from clocking in or out if your employer has made location mandatory.

6. Fair use. Do not attempt to circumvent security, to access data not intended for you or to disrupt the service.

7. Availability. Cloketa is an online service that may be temporarily unavailable. In that case, follow your employer's fallback procedure and then regularise your clock-ins and clock-outs.

8. Your data and your rights. To exercise your rights (access, rectification, erasure, restriction, objection, portability) in respect of your working-time data, contact your employer first. For your account data, write to [email protected]. You may lodge a complaint with the Data Protection Authority. Cloketa's privacy notice and the information provided by your employer describe the processing.

9. End of access. Your employer may deactivate your access, for example at the end of your contract. If you use Cloketa for several companies, each access is managed separately.

10. Changes and governing law. These terms may change; a new version will be presented to you. They are governed by Belgian law.