Acceptable use policy

EN — This is a translation provided for convenience. The French version of this document is the binding version: in the event of any discrepancy in interpretation, the French text prevails, save where mandatory law in the Client's country of establishment requires otherwise. The French version is available at https://odres.io/politique-usage-acceptable.

Contents

Purpose and scope (1) · Guiding principles (2) · Prohibited uses (3) · Fair use limits and technical quotas (4) · Security obligations (5) · Responsible disclosure of vulnerabilities (6) · Reporting and handling of abuse (7) · Graduated measures and procedural safeguards (8) · Cooperation with the authorities (9) · Updating of the Policy (10) · General provisions (11) · Contact (12) .

1. Purpose and scope

1.1. Purpose. This Acceptable Use Policy (the "Policy" or "AUP") sets out the authorised and prohibited uses of the Solution, the fair use limits, the security obligations, the procedure for reporting abuse and the measures liable to be taken in the event of a breach.

1.2. Aim. The aim of the Policy is to preserve the security, integrity, availability and performance of the Solution for all of its users, to protect the rights of third parties and of data subjects, and to ensure compliance with the applicable legislation.

1.3. Definitions. Terms used with an initial capital letter have the meaning given to them in article 1 of the Terms of Use (document no. 05). The following are set out in particular:

• "Odres": ODRES GROUP SRL, publisher and supplier of the Solution.
• "Client": any undertaking, within the meaning of article I.1, 1° of the Belgian Code of Economic Law, which takes out a Subscription. The Contract is concluded exclusively between professionals (B2B); the Solution is not intended for consumers.
• "User": any natural person authorised by the Client to access the Solution by means of personal credentials (company officer, manager, supervisor, employee, accountant, service provider).
• "Solution": the Odres.io software platform, accessible in SaaS mode, including its interfaces, modules, API, mobile applications, documentation and updates. It is made available by means of the six applications ODRES ERP, OdStaff, OdKiosk, OdStock, OdClock and OdLabels, within the meaning of article 4.2 quinquies of the Terms of Use.
• "Establishment": each separate point of sale, operating unit or physical site of the Client covered by the Subscription. The number of Establishments covered constitutes, together with the Pack subscribed to and the Optional Modules activated, one of the two Tier Criteria.
• "Included Allowances", "Metered Services", "Active User", "AI Credit", "Processed Accounting Document", "Connected POS", "Storage", "Overage", "Tier", "Flat Fee", "Price Schedule" and "Unit Rate Card": within the meaning of article 1.2 bis of the General Subscription Terms (document no. 06). The Metered Services comprise five (5) counters: the Active Users, the AI Credits, the Processed Accounting Documents, the Connected POS and the Storage. These notions fall within the financial conditions of the Contract and not within this Policy, under the conditions of article 4.1 bis.
• "Leased Equipment": any equipment made available to the Client by Odres under a simple lease, in particular the use-by date label printer, within the meaning of article 21 quater and of Annex 3 to the General Subscription Terms.
• "Client Data": all data, content and files entered into the Solution by the Client or its Users, or generated on their behalf, including the Personal Data of which the Client is the controller.
• "Business Day": Monday to Friday, excluding Belgian statutory public holidays.
• "GDPR": Regulation (EU) 2016/679.

The connection of bank accounts is not a Metered Service: it is not subject to any counter, to any Included Allowance or to any technical limit under this Policy. It falls exclusively within article 18 bis of the General Subscription Terms. As no account information service provider has been designated to date, the functionality is not available.

1.4. Persons covered. The Policy applies:

1. to the Client, for the whole of its use of the Solution;
2. to each User to whom the Client grants access;
3. to any service provider, processor, integrator, accountant or third party to whom the Client gives access to the Solution, for whom the Client is answerable as for its own acts.

1.5. Channels covered. The Policy applies to any access to and any use of the Solution, by whatever channel: web interface, mobile applications, application programming interfaces (API), connectors, integrations, test, demonstration or pre-production environments.

1.6. Contractual status. The Policy constitutes an enforceable contractual annex. It is accepted by the User under the conditions provided for in article 3 of the Terms of Use — active, time-stamped acceptance, preceded by the effective making available of the text — and by the Client under the General Subscription Terms. No irrebuttable presumption of knowledge is established, in accordance with article VI.91/4, 4° of the Code of Economic Law.

1.7. Order of precedence. In the event of conflict, the order of priority, in decreasing order, is as follows:

1. Order Form — DOC 07;
2. Pre-Seed Special Conditions, where applicable — DOC 08;
3. Data Processing Agreement (DPA) — DOC 10;
4. Service Level Agreement (SLA) — DOC 11;
5. General Subscription Terms (CGA/CGV) — DOC 06;
6. Terms of Use (ToU) — DOC 05;
7. Acceptable Use Policy (AUP) — this document.

1.8. International scope. The Policy applies subject to the mandatory provisions of the Client's country of establishment or of the User's country of habitual residence, where those provisions afford greater protection and cannot be set aside by contract.

2. Guiding principles

2.1. Compliant professional use. The Solution is a professional tool intended for the management of establishments in the HORECA sector. It must be used in accordance with its intended purpose, with the documentation and with the reasonable instructions of Odres.

2.2. Lawfulness. All use must comply with the applicable law, in particular as regards data protection, employment law, intellectual property, market practices, information security and criminal law.

2.3. Fairness and proportionality. Uses must remain fair towards Odres, the other clients, the Users and third parties, and proportionate to the legitimate needs of the business.

2.4. Shared resources. The Solution relies on a shared infrastructure. Each use must preserve the ability of the other users to access the service under normal conditions.

2.5. Cascading responsibility. The Client remains responsible, towards Odres, for compliance with this Policy by all persons to whom it grants access.

2.6. No general monitoring obligation. Odres carries out no general monitoring of content and uses. The controls described in this Policy are targeted, proportionate and triggered by a report, an automated technical alert, a finding of anomaly or an order of an authority.

3. Prohibited uses

The following uses are prohibited. The list is illustrative and not exhaustive; a use not expressly referred to remains prohibited if it contravenes the principles of article 2.

3.1. Unlawful activities and unlawful content

It is prohibited:

1. to use the Solution to prepare, facilitate, commit or conceal an offence;
2. to enter, store, transmit or disseminate unlawful content, in particular content of a terrorist or child-pornographic nature, content inciting hatred, violence or discrimination, revisionist content, or content constituting a criminally punishable infringement;
3. to use the Solution for the purposes of money laundering, terrorist financing, tax or social security fraud, undeclared work or concealment of revenue;
4. to falsify, alter or delete payment collection, cash register or accounting data with a view to evading a legal, tax or social security obligation;
5. to use the Solution in breach of any applicable international sanctions regime, embargo or restrictive measure.

3.2. Infringement of the rights of third parties

It is prohibited:

1. to infringe the intellectual property rights of third parties, in particular by entering into the Solution content, images, recipes, texts, trade marks or software in respect of which the Client or the User does not hold the necessary rights;
2. to infringe the privacy, image, honour or reputation of any person;
3. to disclose confidential information or trade secrets belonging to a third party;
4. to impersonate a natural or legal person, or to give the impression of a non-existent affiliation with Odres or with a third party.

3.3. Security, intrusion and circumvention

It is prohibited:

1. to access or attempt to access accounts, environments, data, logs or functionalities to which access has not been authorised, including the environment of another client;
2. to circumvent, disable or attempt to neutralise any security, authentication, encryption, access control, quota, rate limiting, filtering or logging measure;
3. to carry out intrusion tests, vulnerability analyses, port scans, load tests, injections, brute force attacks, denial of service attacks or any other offensive action, without the prior and express written authorisation of Odres defining the scope, the time window and the arrangements;
4. to introduce or propagate malicious code, viruses, worms, Trojan horses, ransomware, keyloggers or remote control devices;
5. to exploit a discovered vulnerability, beyond what is strictly necessary to demonstrate it, in disregard of article 6;
6. to use the Solution as a relay, gateway, anonymising network or command and control infrastructure with a view to an action directed against a third-party system;
7. to communicate to Odres, or to request from a User, bank access credentials. Odres at no time requests, collects, stores or transmits them; any request to that effect must be reported to support@odres.io in accordance with article 7.2 bis of the Terms of Use.

It is recalled that unauthorised access to a computer system and computer sabotage are liable to constitute offences under articles 550bis and 550ter of the Belgian Criminal Code.

3.4. Automated extraction and reverse engineering

It is prohibited:

1. to carry out automated extraction, harvesting or bulk downloading of data (scraping, crawling) by means of robots, scripts or automated agents, otherwise than through the API made available and within the documented limits;
2. to extract or re-use a qualitatively or quantitatively substantial part of the content of the databases of the Solution, within the meaning of articles XI.306 et seq. of the Code of Economic Law;
3. to decompile, disassemble, analyse the object code or carry out any form of reverse engineering on the Solution, save within the strict limits of the mandatory exceptions provided for in articles XI.299 and XI.300 of the Code of Economic Law, and on condition that a written request for interoperability information has first been sent to Odres, at the address contact@odres.io, and has remained without a useful reply within a reasonable period;
4. to use all or part of the content of the Solution for the purposes of training, fine-tuning or evaluating artificial intelligence models, Odres expressly reserving its rights within the meaning of article 4(3) of Directive (EU) 2019/790.

3.5. Making available to third parties and commercial exploitation

It is prohibited:

1. to resell, lease, lend, sub-license, distribute or market all or part of the access to the Solution;
2. to operate the Solution on a service-provision, service-centre, outsourcing or shared-bureau basis on behalf of a third party not covered by the Subscription;
3. to grant access to a person falling outside the scope authorised by the Order Form, or to extend use to an Establishment not declared in the Account and not covered by the Subscription, in accordance with article 6.4.7 of the General Subscription Terms;
4. to share credentials, to use an account of which one is not the holder or to make use of a generic or collective account in disregard of article 7.3 of the Terms of Use.

3.6. Competitive use and comparative analysis

It is prohibited:

1. to access the Solution with a view to designing, developing or marketing a competing product or service, or to reproducing its functionalities, architecture or user experience;
2. to carry out a comparative analysis (benchmark) intended for publication or external dissemination without the prior written agreement of Odres; the internal use of a comparative assessment by the Client, for the sole purposes of its purchasing or renewal decision, remains lawful;
3. to access the Solution on behalf of a competitor of Odres or while concealing such a capacity.

3.7. Load and volumes

It is prohibited:

1. to generate a volume of requests, connections, write operations, uploads or processing operations that is manifestly disproportionate in the light of normal professional use;
2. to exceed on a lasting basis the limits defined in article 4 after notification by Odres;
3. to use the Solution as generic storage or backup space, unconnected with the operation of the Establishments;
4. to implement computing, mining or indexing operations unrelated to the intended purpose of the Solution.

3.8. Unsolicited communications and CRM, loyalty and marketing modules

It is prohibited to use the CRM, loyalty, booking or marketing communication modules:

1. to send electronic communications for the purposes of direct advertising without the prior, free, specific, informed and unambiguous consent of the recipient, where such consent is required by article XII.13 of the Code of Economic Law, Directive 2002/58/EC and the GDPR;
2. without allowing the recipient to object, free of charge and by a simple means, to the receipt of further communications, or without processing such objection without delay;
3. without clearly identifying the sender, the commercial nature of the message and a valid contact address;
4. by concealing, falsifying or misappropriating the identity of the sender or the origin of the message;
5. to send messages to addresses obtained by automated extraction, purchase of non-compliant files or any other unlawful collection;
6. to send messages at an excessive volume or frequency, liable to damage the reputation of the shared sending infrastructure.

The Client remains the Controller of the data of its end customers and of the lawfulness of the campaigns which it disseminates.

3.8 bis. Online reviews — prohibition of filtering according to the rating and of incentivised reviews

The Solution includes online review functionalities: inviting the consumer to publish a review on the establishment's public form, reading the published reviews and publishing the manager's replies. These functionalities are implemented by the Client, as Controller, in relation to consumers: Book VI of the Code of Economic Law is therefore fully applicable to it, as are the rules specific to the review platform which it connects.

3.8 bis.1. The two prohibitions. The Client and the User are prohibited:

(a) from filtering, withholding or redirecting reviews according to the rating given — in particular by directing to the public review form those consumers who have given a favourable rating and to a private channel, an internal form, a complaints address or an exchange with the manager those consumers who have given an unfavourable rating. The invitation to publish a review must be identical for all consumers, whatever the rating given: same screen, same button, same wording, same point in the journey;

(b) from making the obtaining of a benefit, a prize, a discount, loyalty points or an entry into a game conditional upon the publication of a review, upon proof of such publication, upon the content of the review published or upon the rating given. The benefit may be neither promised, nor granted, nor refused by reason of the publication of a review or of its content.

3.8 bis.2. Why these two prohibitions are not of the same nature.

1. Filtering according to the rating is prohibited in all circumstances. Sorting reviews so as to allow only the most favourable ones through amounts to distorting consumer reviews and to presenting the public with a selective image of the establishment. Such a practice falls within the list of commercial practices deemed unfair in all circumstances (article VI.100 of the Code of Economic Law, transposing Annex I to Directive 2005/29/EC as modified by Directive (EU) 2019/2161): it is prohibited without any assessment of the circumstances, of the intention or of the effect being necessary. No commercial justification, no stated wish to "deal with dissatisfaction first" and no consent of the consumer can render it lawful.
2. The incentivised review is a matter for a case-by-case assessment. Making a prize or a discount subject to the publication of a review distorts the representativeness of the reviews published and deprives the reader of material information: the review which he reads was obtained in exchange for a benefit. This practice falls within the misleading practices, by act or by omission, of articles VI.97 to VI.99 of the Code of Economic Law, the unfairness of which is assessed on a case-by-case basis, having regard to the scale of the inducement, to its visibility and to its effect on the decision of the average consumer.
3. Above all: the rules of the review platform prohibit it without qualification. Irrespective of the legal classification and of any assessment of proportionality, the terms of use and the content rules of the online review platform prohibit both filtering according to the rating and reviews obtained in exchange for consideration, without exception and without any tolerance threshold. The sanction is applied by the platform itself: deletion of the reviews concerned, or even deletion or suspension of the establishment's listing. That sanction strikes the Client, whose visibility and local reputation depend on that listing, and not Odres. The Client may not therefore invoke against Odres any measure taken by the review platform by reason of a use contrary to this article, without prejudice to the liability of Odres in the event of fraud, gross negligence or breach of an essential obligation of the Contract.

3.8 bis.3. Design rule rendering the use compliant. A review journey complies with this Policy where the following cumulative conditions are met:

1. access to the prize, to the game, to the discount or to any other benefit does not in any way depend on going through the review form: the consumer obtains the benefit by the same route, within the same time and on the same conditions, whether or not he publishes a review, whether or not he opens the form, and whatever the rating he has given;
2. the invitation to publish a review is a separate proposal, presented as such, which the consumer may ignore without losing anything — neither the prize, nor the entry, nor the loyalty points, nor the benefit announced;
3. the invitation is identical for all, whatever the rating: no conditional display, no different button, no different text and no additional step according to the rating given;
4. the internal handling of dissatisfaction is additional to the invitation and never a substitute for it: the alert sent to the manager where a low rating is given, and the resulting re-contact of the consumer, are lawful on condition that the invitation to publish the review has been presented to that consumer in the same manner as to the others;
5. no message, no display and no configuration suggests that the publication of a review, or the content of that review, improves the chances of winning, the value of the prize or access to any benefit whatsoever.

3.8 bis.4. Configuration and evidence. The Client shall refrain from any configuration of the Solution, from any content drafted by it and from any instruction given to its teams which has as its object or effect the circumvention of the prohibitions of this article. Odres makes available, in the Documentation, the information and consent-collection texts displayed to consumers, which may be adapted by the Client under its own responsibility; their modification may not result in a journey contrary to this article.

3.8 bis.5. Replies to reviews. The public reply to a review remains free as to its content, subject to articles 3.1, 3.2 and 3.9. Where the Client makes use of the drafting assistance provided for in article 14 of the Terms of Use, the reply is published only after its validation by the manager, who remains its sole author and sole responsible party.

3.9. Staff data and monitoring of workers

It is prohibited:

1. to use the staff management, scheduling, time-clocking, geolocation or logging modules for the purposes of permanent, generalised or disproportionate monitoring of workers;
2. to implement such processing without prior information of the workers and without compliance with the applicable information and consultation procedures, in particular those resulting from Belgian employment law and from collective labour agreements no. 68 and no. 81 where they are applicable;
3. to divert HR data from its declared purpose, in particular for unannounced disciplinary purposes, behavioural profiling or discriminatory selection;
4. to record, in fields not provided for that purpose, data falling within article 9 of the GDPR (in particular a medical reason for absence, trade union membership, religious beliefs or biometric data) or within article 10 of the GDPR;
5. to base, without significant human intervention, a decision relating to recruitment, remuneration, appraisal, assignment, sanction or termination of an employment relationship on a result produced by an artificial intelligence functionality, in accordance with article 14 of the Terms of Use, article 18 quater.5 of the DPA and without prejudice to article 22 of the GDPR and to Regulation (EU) 2024/1689;
6. to use the measurement of the number of Active Users for the purposes of individual appraisal: that measurement is based on a binary indicator of monthly activity intended solely for billing and involves no analysis of behaviour, connection time or productivity.

3.10. Integrity of the Solution and of the Leased Equipment

It is prohibited:

1. to remove, conceal or alter the notices of ownership, copyright, trade mark or version;
2. to modify, adapt or create a derivative work of the Solution;
3. to interfere with the update, security telemetry or logging mechanisms;
4. to use an obsolete, modified or circumvented version of a mobile application;
5. as regards the Leased Equipment: to assign, lend, sublet, pledge, modify, dismantle it or have it repaired by a third party, and to use it otherwise than in accordance with its intended purpose, in accordance with Annex 3, point A.3.3, of the General Subscription Terms.

4. Fair use limits and technical quotas

4.1. Principle. Use of the Solution means reasonable use, consistent with the intended purpose of the service and proportionate to the scope subscribed to. The purpose of the limits set out below is to guarantee fairness of access to a shared infrastructure. They do not constitute a discretionary power of assessment on the part of Odres: they are objective, measurable and communicated.

4.1 bis. Interaction with the contractual Included Allowances — mandatory distinction

4.1 bis.1. Two distinct regimes. The limits of this Policy and the Included Allowances fall within two distinct legal regimes, which are in no case to be confused:

(a) the Included Allowances attached to the Tier subscribed to — the volumes, comprised within the Flat Fee, of the five (5) counters of Metered Services, namely the Active Users, the AI Credits, the Processed Accounting Documents, the Connected POS and the Storage — constitute financial conditions of the Contract. They are set by the Price Schedule (Annex 1 to the General Subscription Terms), reproduced in the Order Form, and governed by article 21 bis of the General Subscription Terms. Exceeding them gives rise exclusively to billing at the Unit Rate Card (Annex 2), with the exception of the AI Credits, which are not billed as an Overage but topped up at the Client's initiative, the artificial intelligence processing service being simply suspended upon exhaustion of the balance;

(b) the fair use limits defined in this article constitute non-chargeable technical limits, intended to preserve the stability, security and fairness of access to a shared infrastructure. They relate exclusively to non-chargeable resources — frequency and throughput of application programming interface calls, individual size of uploaded files, upload frequency, duration and number of sessions, volume of exports, volume of communications sent and number of connectors — and give rise to no additional billing. None of them relates to any of the five counters of Metered Services.

4.1 bis.2. Prohibition of duplication. No limit of this Policy has as its object or effect the restriction, capping, suspension or conditioning of the use of a contractually subscribed Included Allowance, or any duplication of a Metered Service counter. Conversely, the exhaustion of an Included Allowance does not constitute a breach of this Policy and may not give rise to any of the graduated measures of article 8.

4.1 bis.3. No cross-sanction. Exceeding a limit of this article may not give rise to billing; exceeding an Included Allowance may not give rise to any measure of limitation, suspension or termination under this Policy, subject only to the monthly Overage cap freely set by the Client in accordance with article 21 bis.5 of the General Subscription Terms, the implementation of which falls exclusively within those Terms.

4.1 bis.4. Banking connection. The connection of bank accounts constitutes neither a Metered Service nor a resource subject to the limits of this article. It falls exclusively within article 18 bis of the General Subscription Terms, under which the cost of the authorised provider is re-invoiced to the Client euro for euro, on production of supporting documents and without mark-up. No technical limitation under this Policy may restrict its use.

4.1 bis.5. Scope. This provision reproduces and supplements article 21 bis.8.2 of the General Subscription Terms. It is adopted having regard to article VI.91/5, 1° of the Code of Economic Law: the characteristics of the service and the price agreed may not be indirectly modified by way of a technical limit. In the event of conflict between this Policy and the financial provisions of the General Subscription Terms, the latter shall prevail, in accordance with article 1.7.

4.2. Applicable limits. Subject to different provisions in the Order Form, and excluding any resource constituting a Metered Service within the meaning of article 4.1 bis:

These values constitute firm commitments of Odres for the duration of the current Subscription Period. They are reproduced and kept up to date in the Documentation, accessible from the Client's Account and published on the site https://odres.io, under the heading "Technical limits". Any modification is governed by article 4.3.

Resources expressly excluded from the table above. The five (5) counters of Metered Services do not constitute fair use limits and do not appear in the table above:

1. the number of Active Users;
2. the number of AI Credits consumed;
3. the number of Processed Accounting Documents;
4. the number of Connected POS;
5. the volume of Storage occupied by the Client Data, files, images and documents.

Nor do the following appear in the table above:

1. the number of bank accounts connected, the banking connection falling within article 18 bis of the General Subscription Terms (article 4.1 bis.4);
2. the number of Establishments covered and the Pack subscribed to together with the Optional Modules activated, which constitute the two Tier Criteria within the meaning of article 6.4.3 of the General Subscription Terms;
3. the depth of data history consultable online, which constitutes a characteristic of the Tier subscribed to.

Items 1 to 5 fall exclusively within the Price Schedule and article 21 bis of the General Subscription Terms. The measurement of their consumption is governed by the guarantees of transparency, alert and challenge provided for therein, and not by this article. In particular, the volume of Storage and the number of Active Users may not be the subject of any technical limitation under this Policy: exceeding them falls within the Unit Rate Card alone.

4.3. Modification of the limits. Odres may modify the technical limits for a valid reason — development of the infrastructure, security, fairness of access, development of the offering, constraint imposed by a supplier — subject to a notice period of at least thirty (30) days, extended to three (3) months where the modification has a substantial and unfavourable impact on the scope subscribed to. Where the modification substantially and unfavourably reduces the limits applicable to the scope subscribed to, the Client may terminate the Subscription without charge or indemnity, by written notification sent before the effective date, the sums paid in advance being refunded pro rata. This provision is made pursuant to article VI.91/5, 2° of the Code of Economic Law.

4.4. Exceedance. In the event of an exceedance, Odres:

1. informs the Client thereof, indicating the resource concerned, the measurement recorded and the applicable limit;
2. invites the Client to regularise the position within a period of ten (10) Business Days;
3. may, failing regularisation, apply a proportionate technical limitation (throttling, queuing, capping) relating solely to the resource concerned;
4. proposes, where the exceedance reflects a lasting need, an extension of the scope subscribed to on the pricing conditions in force, where applicable by means of a change of Tier carried out under the conditions of article 8 of the General Subscription Terms, which in any event requires a positive act of the Client and may not result from the mere finding of a technical exceedance.

4.5. Critical exceedance. In the event of an exceedance of such a magnitude that it immediately compromises the stability, security or availability of the Solution for other clients, Odres may apply, without notice, an immediate limitation, strictly circumscribed and limited in time. The Client is informed thereof without undue delay, with an indication of the grounds, of the extent and of the foreseeable duration of the measure.

4.6. No billing for exceeding the technical limits. Exceeding a limit defined in this article gives rise to no additional billing, whatever its magnitude: only the technical and graduated measures of articles 4.4, 4.5 and 8 may be applied in response. No billing may result from a technical limit without the Client's prior agreement on the applicable conditions, formalised in the Order Form or by amendment.

This provision has no application to Overages of Metered Services, which are billed at the Unit Rate Card under the conditions expressly accepted by the Client in article 21 bis of the General Subscription Terms and in the Order Form. No provision of this Policy founds, extends or restricts such billing.

4.7. Measurement and transparency. Odres makes available to the Client, within the Solution or on request, the measurement data enabling the consumption recorded to be verified. In the event of a challenge, the Parties shall jointly examine the measurements recorded.

5. Security obligations

5.1. Obligations of the User

5.1.1. The User shall keep his credentials strictly confidential, shall not share them with anyone and shall not record them on any medium or equipment accessible to third parties.

5.1.2. He shall choose a strong password, distinct from those used for other services, and shall activate multi-factor authentication where it is offered or required.

5.1.3. He shall ensure the security of his equipment: session locking, security updates, protection against malicious software, absence of unauthorised access.

5.1.4. He shall log out expressly at the end of any session opened on shared equipment.

5.1.5. He shall notify without delay and at the latest within twenty-four (24) hours of their discovery, to his administrator and to Odres at the address support@odres.io, any loss, theft, disclosure or suspected compromise of his credentials, any unauthorised access and any security anomaly observed.

5.1.6. He shall refrain from exporting, copying or transferring Client Data beyond the requirements of his duties and the means authorised by the Client.

5.1.7. He shall disclose to no one, and in particular to no person presenting himself as a member of the Odres staff, his login credentials or his bank access credentials.

5.2. Obligations of the Client

5.2.1. The Client shall appoint one or more administrators and shall keep up to date the list of persons authorised to interact with Odres.

5.2.2. It shall allocate roles and permissions in accordance with the principles of minimisation and need to know, and shall carry out a periodic review of accesses, at least twice (2) a year.

5.2.3. It shall revoke, without undue delay, the accesses of persons leaving its workforce, changing duties or no longer required to have access.

5.2.4. It shall bring this Policy to the attention of all Users and shall ensure compliance with it.

5.2.5. It shall implement appropriate security measures on its own systems, networks and equipment, in particular patch management, protection against malicious software and the securing of payment collection terminals.

5.2.6. It shall notify Odres, at the address support@odres.io, without undue delay and at the latest within twenty-four (24) hours of their discovery, of any security incident affecting or liable to affect the Solution or the Client Data hosted.

5.2.7. It shall cooperate in good faith with the investigations conducted by Odres and shall communicate, within the limits of what is necessary and lawful, the information of use for the handling of the incident.

5.2.8. It shall ensure the custody and safekeeping of the Leased Equipment and shall cover it under its business insurance, under the conditions of Annex 3 to the General Subscription Terms.

5.3. Obligations of Odres

5.3.1. Odres implements appropriate technical and organisational measures, described in Annex 3 to the Data Processing Agreement, in accordance with article 32 of the GDPR.

5.3.2. Odres notifies the Client of any personal data breach affecting the Client Data without undue delay and at the latest within forty-eight (48) hours, under the conditions of article 13 of the DPA.

5.3.3. Odres maintains a capability for detecting, logging and responding to incidents, and cooperates with the Client in the handling thereof.

5.3.4. This Policy has neither as its object nor as its effect the transfer to the Client or to the User of the burden of the security obligations incumbent upon Odres.

6. Responsible disclosure of vulnerabilities

6.1. Principle. Odres encourages the responsible reporting of security vulnerabilities affecting the Solution.

6.2. Reporting channel. Any report is to be sent to support@odres.io. The reporting arrangements, together with, where applicable, the public encryption key of Odres, are published in the security.txt file accessible at the address https://odres.io/.well-known/security.txt, in accordance with RFC 9116.

6.3. Content of the report. The report shall include, in so far as possible: a description of the vulnerability, its estimated impact, the steps for reproducing it, the date and time of the tests, the accounts or environments concerned and the contact details of the reporter.

6.4. Undertakings of the reporter. The reporter undertakes:

1. to limit his investigations to what is strictly necessary to demonstrate the existence of the vulnerability;
2. to refrain from any action liable to impair the availability, integrity or confidentiality of the Solution or of the data of others, in particular any load test, denial of service or modification of data;
3. not to access, copy, extract, retain or disclose data belonging to a client or to a third party, and to delete without delay any data to which he may have had incidental access;
4. not to disclose the vulnerability publicly before a patch has been deployed or, failing that, before the expiry of a period of ninety (90) days from the acknowledgement of receipt, save written agreement to the contrary;
5. to make no claim for financial consideration as a condition of the report.

6.5. Undertakings of Odres. Odres:

1. acknowledges receipt of the report within a period of two (2) Business Days;
2. carries out an initial assessment within a period of ten (10) Business Days;
3. informs the reporter of developments in the handling of the matter at reasonable intervals;
4. shall refrain from bringing any judicial or disciplinary action against a reporter who has acted in good faith and in strict compliance with article 6.4;
5. may, at its discretion and with the reporter's agreement, mention him on an acknowledgements page.

6.6. Belgian legal framework. Compliance with the conditions set out in article 6.4 is such as to fall within the framework of the coordinated vulnerability disclosure policy promoted by the Centre for Cybersecurity Belgium. Failure to comply with those conditions exposes the reporter to the penalties provided for in articles 550bis and 550ter of the Belgian Criminal Code.

6.7. No bug bounty programme. Odres does not, to date, operate any reward programme (bug bounty). The existence of such a programme, where applicable, shall be published in the security.txt file referred to in article 6.2 and brought to the attention of the Clients.

7. Reporting and handling of abuse

7.1. Reporting channel. Any breach of this Policy, any allegedly unlawful content and any abusive use may be reported to support@odres.io, by any User, any Client or any third party.

7.2. Content of the report. In order to be usefully handled, the report shall include:

1. a reasoned explanation of the grounds on which the use or the content is alleged to be abusive or unlawful;
2. the precise location of the item concerned (identifier, environment, time stamp, dated screenshot);
3. the name and electronic mail address of the reporter, except where the report concerns an offence referred to in articles 3 to 7 of Directive 2011/93/EU;
4. a declaration of good faith as to the accuracy and completeness of the information submitted.

7.3. Acknowledgement of receipt. Odres acknowledges receipt of any complete report within a period of two (2) Business Days.

7.4. Investigation. Odres investigates the report diligently, objectively, non-arbitrarily and proportionately. It may, within the limits of what is necessary and lawful:

1. examine the technical logs and the usage metadata;
2. question the Client concerned and request explanations from it;
3. seek additional information from the reporter.

Odres accesses the content of the Client Data only in so far as strictly necessary, in compliance with the Data Processing Agreement and subject to the applicable confidentiality obligations.

7.5. Involvement of the Client. Where the item reported originates from a User, Odres informs the Client concerned and invites it to act within a period of five (5) Business Days, except where urgency, manifest unlawfulness, an imminent security risk, a legal obligation or an order of an authority requires immediate action.

7.6. Reasoned decision. Odres notifies its reasoned decision to the reporter and, where applicable, to the Client and the User concerned, indicating the measures taken and the internal remedies available.

7.7. Abusive reports. Odres may, after warning, suspend the handling of manifestly unfounded reports emanating repeatedly from the same reporter.

7.8. Interaction with the legal notice. The point of contact designated under articles 11 and 12 of Regulation (EU) 2022/2065 is set out in the Legal notice (DOC 02). Reports sent to that point of contact are handled in accordance with the procedure described in this article.

8. Graduated measures and procedural safeguards

8.1. Principle of gradation

8.1.1. The measures taken by Odres in the event of a breach are graduated and proportionate to the gravity, duration, repeated character and consequences of the breach, as well as to the diligence shown by the person concerned.

8.1.2. Odres shall adopt the least restrictive measure capable of bringing the breach to an end and of preventing its repetition.

8.2. Scale of measures

8.3. Procedural safeguards

Any measure of levels 2 to 6 shall comply with the following safeguards:

8.3.1. Written statement of reasons. The measure is notified in writing and indicates the breach found, the provision disregarded, the matters of fact relied upon, the nature and extent of the measure and its foreseeable duration.

8.3.2. Prior formal notice of default. Save in the event of established urgency, imminent security risk, manifest unlawfulness or legal obligation, the measure is preceded by a formal notice of default inviting regularisation within a period of ten (10) Business Days.

8.3.3. Right to be heard. The person concerned may submit written observations to the address support@odres.io. Odres examines them and replies thereto with reasons within a period of ten (10) Business Days. The submission of observations does not suspend a measure taken on security grounds, but Odres re-examines that measure upon receipt thereof.

8.3.4. Proportionality and scope. The measure is confined to what is necessary. A total suspension of the Client's access is imposed only where a targeted measure is insufficient.

8.3.5. Limited duration and re-examination. Any suspension is imposed for a fixed duration, renewable by reasoned decision. Odres re-examines the measure at reasonable intervals and lifts it without undue delay as soon as its cause has ceased to exist.

8.3.6. Preservation of data. For the duration of a suspension, the Client Data is retained and is neither deleted nor altered. The Client retains the ability to exercise its rights of retrieval and portability under the conditions provided for by the General Subscription Terms, the Service Level Agreement and Regulation (EU) 2023/2854. No suspension may be used as an obstacle to switching provider, or be made subject to the return of the Leased Equipment or to the payment of its Residual Value.

8.3.7. Financial consequences. A suspension imposed for a breach attributable to the Client does not suspend its payment obligations. Conversely, where a measure is wrongly imposed or is lifted for want of an established breach, the Client shall obtain, upon request, compensation proportionate to the duration of unavailability, in accordance with the arrangements of the Service Level Agreement.

8.3.8. Right of review. The person concerned may request the re-examination of the measure by a person who did not take the initial decision, by writing to contact@odres.io. This internal remedy is without prejudice to any judicial remedy. No provision of this Policy has the effect of causing the Client or the User to waive a remedy, any such provision being void pursuant to article VI.91/4, 2° of the Code of Economic Law.

8.3.9. No discretionary power. Odres has no discretionary power to interpret this Policy or the Contract. The classifications adopted are subject to judicial review and the burden of proving the breach lies with Odres.

8.3.10. Reservation of rights. The exercise or non-exercise of the measures provided for in this article does not constitute a waiver of any other right or remedy, in particular of the right to obtain compensation for the damage suffered.

8.4. Indemnification

8.4.1. The Client shall indemnify Odres against claims of third parties, including data subjects and authorities, resulting directly from a breach of this Policy attributable to the Client or to a User to whom it has granted access.

8.4.2. This indemnity is subject to Odres: (i) informing the Client of the claim without undue delay, (ii) allowing the Client to take part therein and to be consulted on the defence strategy, and (iii) not settling without its prior written agreement, which may not be refused without reasonable grounds.

8.4.3. The indemnity does not cover the part of the claim resulting from a fault of Odres, from a breach by Odres of its own obligations or from an instruction of Odres.

9. Cooperation with the authorities

9.1. Principle. Odres cooperates with the competent administrative and judicial authorities within the limits of the applicable law.

9.2. Communication of data. Odres communicates Client Data to an authority only on the basis of a requisition, an injunction or a decision that is regular and enforceable. It verifies its formal validity, the competence of the authority and the extent of the request, and limits the communication to what is strictly required.

9.3. Information of the Client. Odres informs the Client of any request of an authority relating to its data, as soon as possible and prior to any communication where that is possible, save where a legal provision, a judicial decision or an imperative investigative necessity prohibits it. Odres then invites the authority to address the Client directly where that is feasible.

9.4. Challenge. Where a request appears manifestly excessive, imprecise or devoid of legal basis, Odres shall pursue the avenues of challenge reasonably available.

9.5. Reporting of offences. Where Odres identifies matters giving rise to a presumption of a serious offence, it may make the reports required or permitted by law. Where applicable, the preservation of the evidence is ensured under conditions guaranteeing its integrity.

9.6. Register. Odres keeps an internal register of the requests of authorities received and of the action taken in response. Aggregated information may be published.

9.7. Data location and transfers outside the European Economic Area. The application, the database and the files — including HR documents and attachments — are hosted in the European Union. Three ancillary functions use providers established in the United States: the routing of push notifications, the reading of and reply to online reviews, and the artificial intelligence functions; to these are added the video players of the Training module, upon the launch of a video, and the functions of the Stripe group performed from the United States. Those transfers are based on the standard contractual clauses of the European Commission (implementing decision (EU) 2021/914) and, where the provider is certified thereunder, on the EU–US Data Privacy Framework. Push notifications carry no data from the database — notification text and device token only — and online reviews are data published by their author on the platform of the recipient. The complete chain of providers, their processing location and the basis adopted for each are set out in article 13.7 of the Terms of Use and in annex 2 to the Data Processing Agreement, which prevails. Any communication to an authority involving a transfer outside the European Economic Area is in addition carried out under the conditions provided for by Chapter V of the GDPR and by the Data Processing Agreement.

10. Updating of the Policy

10.1. Valid reason. Odres may modify this Policy only for a valid reason, namely:

1. a development in the applicable legislative, regulatory or case-law provisions;
2. a decision, recommendation or injunction of a competent authority;
3. a technical, functional or security development of the Solution;
4. the emergence of new forms of abusive use or of new threats;
5. the modification of the technical limits under the conditions of article 4.3;
6. the correction of a clerical error or of a drafting imprecision.

10.2. Notice period. Any substantial modification is notified with a notice period of at least thirty (30) days before it takes effect, by electronic mail sent to the Client and to the Users, by message within the Solution or by publication accompanied by a notification. That notice period may be reduced where the modification is required by a legal obligation of immediate application or by an imperative of security; the reduction is justified in the notification.

10.3. Information. The notification indicates the subject matter of the modification, its reason, its effective date and the address at which the modified version may be consulted. A summary of the substantial changes is made available.

10.4. Acceptance. The modified Policy is the subject of a new active acceptance by the User under the conditions provided for in article 3 of the Terms of Use. No irrebuttable presumption of acceptance may result from the mere continuation of use, in accordance with article VI.91/4, 4° of the Code of Economic Law.

10.5. Client's right of termination. Where the modification substantially and unfavourably restricts the conditions of use of the Solution, the Client may terminate the Subscription without charge or indemnity, by written notification sent before the effective date of the modification, the sums paid in advance for the subsequent period being refunded pro rata.

10.6. Applicable version. The version applicable to a given dispute is that in force and accepted at the date of the facts in dispute. Previous versions are retained and communicated upon written request sent to contact@odres.io.

11. General provisions

11.1. Partial invalidity. If a provision of this Policy is declared void, unlawful or inapplicable, it shall be deemed not to have been written to the sole extent of the invalidity, without affecting the other provisions. The Parties shall endeavour in good faith to substitute for it a valid provision of equivalent effect. The invalidity of a term under articles VI.91/1 to VI.91/10 of the Code of Economic Law does not affect the Contract as to the remainder, in accordance with article VI.91/6 of the same Code.

11.2. Waiver. The fact of not relying on a breach or of not exercising a right constitutes neither a waiver, nor an acceptance, nor a novation. Any waiver must be express, in writing and limited to the particular case to which it relates.

11.3. Entire agreement. This Policy, together with the documents referred to in article 1.7, constitutes the entirety of the agreement of the Parties on its subject matter.

11.4. Assignment. The Client and the User may not assign the rights and obligations arising from this Policy. Odres may assign it under the conditions provided for in article 21.4 of the Terms of Use.

11.5. Notices. Notifications under this Policy are made under the conditions provided for in article 21.5 of the Terms of Use.

11.6. Language. This Policy is drawn up in French. Any translation is provided for convenience; in the event of any discrepancy, the French version prevails, subject to the mandatory provisions requiring the use of another language.

11.7. Governing law and jurisdiction. This Policy is governed by Belgian law, to the exclusion of its conflict-of-laws rules and of the Vienna Convention of 11 April 1980 on Contracts for the International Sale of Goods. Any dispute falls within the exclusive jurisdiction of the courts and tribunals of the judicial district of Hainaut, Charleroi division, without prejudice to the right of Odres to bring proceedings before any other court having jurisdiction. The Parties shall first attempt, in good faith, an amicable settlement for thirty (30) days from the written notification of the dispute. These provisions apply subject to the mandatory provisions of the Client's country of establishment.

12. Contact