General Terms and Conditions of Sale and Use

Version 5.0 of 1 November 2026
Replaces the version published on 9 April 2026 (referenced V4.3 in the version register)
SaaS services intended exclusively for businesses

Article 1. Identification and scope

The Shyfter services are provided by SHYFTER SA, whose registered office is located at Avenue Louise 240, 1050 Ixelles, Belgium, registered with the Crossroads Bank for Enterprises under number 0720.922.212, VAT BE0720.922.212, hereinafter “Shyfter”.

General contact and contractual notices: hello@shyfter.com.
Billing contact: finance@shyfter.com.
Data protection contact: rgpd@shyfter.com.

The processing that Shyfter carries out on its own behalf is described in its privacy policy, available at shyfter.com/en/privacy-policy.

These general terms and conditions govern the subscription to and use of the Shyfter platform, its applications, modules, integrations and related services.

They apply exclusively to customers acting in the course of their business, hereinafter the “Customer”.

The “Service” means the features and services actually subscribed to. “Users” means the persons authorised by the Customer to access the Service. “Customer Data” means the data, documents and content entrusted to Shyfter or generated on behalf of the Customer as part of the Service.

The “End Customer” means the company on whose behalf the Service is used when it is not itself Shyfter’s contracting party, in particular when the Service is subscribed to by a reseller, partner or service provider acting on its behalf. When the Customer acts on its own behalf, it is also the End Customer.

Article 2. Formation of the contract and acceptance

The contract consists of the accepted special conditions, the accepted order form or quote, these general terms and conditions and their annexes.

Subscribing to a SaaS Service does not require the signature of a separate contract. Acceptance may be given electronically, in particular when subscribing or accepting an offer.

The contractual documents are made available before the Customer commits, in a format that allows them to be stored and reproduced. Shyfter keeps the evidence establishing that they were communicated and accepted.

Payment for or use of the Service may help establish the contractual relationship, without constituting irrefutable proof of acceptance of terms that were not previously communicated.

The person subscribing on behalf of the Customer declares that they have the necessary authority.

In the event of conflict, the order of precedence is as follows: the expressly accepted special conditions, then the accepted offer or quote, then these general terms and conditions and their annexes. Annex 1 on personal data prevails for matters within its scope, subject to mandatory provisions.

The Customer’s general purchasing conditions or other terms, including those appearing on an order form, apply only if Shyfter has expressly accepted them in writing.

Each version of these general terms and conditions bears a number and a date. Previous versions are archived and provided on request.

An invoice does not, by itself, modify the terms already agreed.

Each customer legal entity is a separate contracting party, unless expressly agreed otherwise.

Article 3. Purpose and scope of the Service

Shyfter provides a remotely accessible software solution intended in particular for scheduling, time and human resources management, payroll preparation and, where the corresponding module is subscribed to and activated, the transmission of social security declarations.

The Service is offered in particular to employers established in Belgium and France. Country-specific features (in particular the Dimona in Belgium and the DPAE in France) are only available if they are included in the accepted offer.

The features, establishments, volumes, Users, options and services included are defined in the accepted offer.

Configuration, migration, training, support or custom development services are only included where expressly provided for.

Shyfter provides a technical tool. Unless a separate assignment is expressly agreed, Shyfter does not act as employer, social secretariat, payroll provider or accountant, nor as the Customer’s legal, tax or accounting adviser.

Features announced as future features do not constitute a commitment to deliver, unless a provision specifies their content and timing.

Article 4. Accounts, access and security

The Customer appoints an administrator responsible for managing access, permissions and contact details.

The administrator assigns rights appropriate to Users’ roles, removes access that is no longer needed and protects login credentials and authentication methods.

Sharing credentials to circumvent the subscribed limits or security rules is prohibited.

The Customer informs Shyfter without delay of any compromise or unauthorised use of which it becomes aware.

Shyfter implements the security measures for which it is responsible. The Customer’s obligations do not release Shyfter from its own obligations.

The Customer is responsible for the acts of the persons it authorises, within the limits of applicable law. It is not deemed responsible for fraudulent access attributable to a breach by Shyfter.

Article 5. Onboarding and cooperation

The Customer provides the information, data, access, mandates and approvals required for onboarding.

Where onboarding support is provided, the parties define their respective tasks and approval steps.

The Customer attends the agreed meetings or informs Shyfter of its unavailability within a reasonable time. A postponement or absence may delay the schedule.

No postponement or cancellation fee may be charged unless it has been communicated and accepted in advance.

Where onboarding is delayed by a matter within the Customer’s responsibility, Shyfter identifies the missing items and the foreseeable operational consequences.

Billing starts on the agreed date. The Customer’s failure to use the Service does not postpone this date when the Service has actually been made available.

A delay attributable to Shyfter that prevents the Service from being made available cannot be treated as a normal activation.

Use of the Service does not constitute a waiver of the right to report a defect.

Article 6. Data and settings

The Customer is responsible for the lawfulness, accuracy, completeness and updating of the data it provides, as well as for the settings it chooses or approves.

This responsibility covers in particular identities, identification numbers, contracts, statuses, schedules, hours worked, absences, calculation rules, recipients and authorisations.

The Customer checks that the configuration is suited to its organisation and obligations. It carries out the necessary checks before any use producing administrative, social security or financial effects.

Shyfter does not systematically verify the legal or factual compliance of Customer Data. Automated checks do not constitute an exhaustive validation.

Where Shyfter carries out a configuration or import, its obligations are limited to the agreed assignment and the information received. It must nevertheless perform that assignment correctly.

Approval by the Customer does not cover an error that could not reasonably have been detected at the time of that approval.

Where the Service allows documents to be signed electronically, the Customer chooses the level of signature offered and checks that it is suitable for the nature of the document and the applicable legal requirements, in particular for employment contracts.

Article 7. Social security declarations (Dimona, DPAE and others)

This article applies to any module for transmitting social security declarations, in particular the immediate employment declaration (Dimona) to the ONSS in Belgium and the pre-hiring declaration (DPAE) to URSSAF or MSA in France, hereinafter the “declarations”.

The Customer, as employer or person legally required to declare, remains responsible for fulfilling its social security obligations, for their accuracy and for meeting deadlines.

Using a declaration module does not transfer this capacity to Shyfter and does not, by itself, constitute a general mandate to manage the Customer’s social security obligations.

The module requires in particular:

• its subscription and activation;
• the necessary authorisations and mandates;
• the correct identification of the employer and workers;
• complete statuses, dates, hours and settings;
• compliance with the rules that trigger transmissions;
• the monitoring and handling of responses and rejections.

The Customer checks the available statuses and confirmations. A schedule, a clock-in, a transmission request or an alert email does not, by itself, prove that a declaration has been accepted by the competent body.

In the absence of confirmation, or in case of rejection, blocking or unavailability, the Customer takes the necessary steps to meet its obligations, in particular through another authorised channel or with its social secretariat, payroll provider or accountant, while avoiding duplicates.

Subject to Article 23, Shyfter is not liable for missing, late, rejected or incorrect declarations resulting from incomplete or incorrect settings, inadequate data, the absence of a mandate, an act or omission of the Customer, a failure to check statuses or an external event not attributable to Shyfter.

In such situations, fines, surcharges, adjustments and social security or financial consequences remain the responsibility of the Customer under the applicable rules.

The mere finding of a missing or late declaration does not demonstrate a breach by Shyfter. Any liability is assessed in light of the cause, the obligations subscribed to and Article 23.

Article 8. Alerts and notifications

Alerts and reminders are assistance tools. They do not replace the checks the Customer must carry out.

Depending on the settings and the persistence of an anomaly, the same issue may trigger several notifications, possibly to several recipients.

The Customer keeps its contact details up to date and organises the follow-up of messages, including checking filters and spam folders.

The technical sending of a message does not necessarily prove that it was received or read. The absence of an alert does not confirm compliance or prove that no action is required.

Shyfter remains responsible for the operation of the notification mechanisms expressly included in the Service, within the limits of the contract.

Article 9. Availability, support and maintenance

The Service is provided under a best-efforts obligation. Unless a separate service level commitment applies, Shyfter does not guarantee continuous availability, error-free operation or a specific response or recovery time.

Interruptions, slowdowns or limitations may result in particular from maintenance, updates, incidents, security constraints, networks or external services.

Planned maintenance likely to interrupt the Service is, as far as possible, announced in advance and scheduled outside peak usage hours.

Unavailability does not automatically entitle the Customer to compensation, a refund or termination. Its consequences are assessed in accordance with the contract, any specific commitments subscribed to and mandatory provisions.

Subject to Article 23, Shyfter is not liable for interruptions or consequences that are not attributable to it.

The Customer organises continuity procedures suited to its business, in particular for obligations subject to legal deadlines.

Shyfter provides support through the channels and under the conditions communicated at subscription. It handles requests diligently, taking into account their severity and impact.

The Customer provides the information useful for analysis and reasonably cooperates in resolving incidents.

Article 10. Updates, changes and third-party services

The Service evolves continuously. Shyfter may automatically deploy fixes, updates, improvements, technical adjustments and interface changes.

These routine changes require neither the Customer’s prior consent, nor an announcement before deployment, nor individual communication after deployment. Shyfter is not required to provide a report on each change.

This rule does not remove the information obligations imposed by law or expressly provided for in the contract, in particular regarding personal data, price changes or substantial changes to contractual commitments.

Changes may not deprive the subscribed Service of its essential features. Substantial unfavourable changes follow Article 22.

Integrations also depend on the external services concerned. Their own terms apply to their services.

Shyfter remains responsible for its own scope and for its subcontractors, within the limits of the contract and the law.

Automated suggestions, documents and results, in particular those produced by artificial intelligence, must be checked before use. They do not constitute personalised professional advice.

Automatic scheduling proposes schedules based on availability, observed working patterns and the legal and collective agreement constraints configured in the Service. These proposals are an aid: the Customer checks them, modifies them where necessary and approves them before publication. The fact that the Service takes legal constraints into account does not guarantee that the schedule complies with applicable labour law, which remains the Customer’s responsibility.

Artificial intelligence features are described in the Service documentation. They may use third-party providers identified in the register of sub-processors (Annex 1, Article 8). Users are informed when they interact with an artificial intelligence system. The Customer may request that these features be deactivated for its account. No decision producing effects on a worker is taken by these features without the Customer’s involvement.

Article 11. Prices, prepayment and automatic billing

Prices are expressed in euros excluding taxes, unless otherwise stated. Applicable taxes are added.

The offer specifies the billing frequency, billable units, limits and additional services.

Subscriptions are invoiced in advance for the relevant monthly or annual period. The period covered appears on the invoice.

Unless otherwise agreed in the special conditions, payment is due no later than the start of that period. A payment facility does not change the term of the commitment.

Invoices are generated and sent automatically, according to the subscription settings, to the billing contact details provided by the Customer, in the legally required format.

The Customer keeps these details up to date and checks the invoices received or made available to it.

Failure to read an invoice does not postpone its due date. A reported difficulty in receiving invoices is examined and a copy may be provided.

Automatic billing does not prevent an error from being corrected or the right to dispute.

One-off services and overages are invoiced at the rates communicated and accepted in advance.

Article 12. Payment, reminders and unpaid amounts

Payment is made by a method accepted by Shyfter.

The Customer reports any dispute within a reasonable time, identifying the items concerned and its reasons. The undisputed portion remains payable on the due date.

Reminders, formal notices and suspension measures may be triggered and executed automatically, based on the recorded due dates and payments.

Before a suspension for non-payment, a formal notice grants an additional fifteen calendar days to settle the situation. It states that access may be automatically blocked when that period expires.

Subject to mandatory provisions, no human intervention or further reminder is required to carry out the announced suspension when the conditions are met.

The Customer may send proof of payment or report an error. Shyfter examines serious disputes and corrects unjustified measures.

Interest and recovery costs are limited to the amounts legally due in commercial transactions, in particular under the Belgian law of 2 August 2002. No cumulation may result in double compensation.

A serious and reasoned dispute is examined before any suspension relating to the disputed amounts. It does not authorise non-payment of amounts unrelated to the dispute.

Article 13. Term and automatic renewal

13.1 Monthly subscription

The monthly subscription is entered into for one month and renews automatically for successive one-month periods.

Either party may give notice of its intention not to renew it. The subscription ends on the first monthly renewal date falling at least thirty calendar days after receipt of the notice.

13.2 Annual subscription

The annual subscription is entered into for a fixed term of twelve months.

It renews automatically on each renewal date for a new fixed term of twelve months, unless written notice of non-renewal is received at least thirty calendar days before the annual renewal date. The notice is sent by email to hello@shyfter.com or by the means provided for this purpose in the Service; Shyfter acknowledges receipt.

Shyfter sends a reminder of the renewal date and of the option not to renew at least forty-five calendar days before that date. This reminder may be fully automated. It may be included in an email sending an invoice, provided that it appears in the subject line and at the top of the message, separately from the invoice itself.

If this reminder has not been sent within the required time, the Customer may still refuse the renewal until the renewal date or, if that date has already passed, during the fifteen days following the actual sending of the reminder. Services actually used during that period remain payable pro rata.

13.3 Fixed annual commitment

The Customer has no general contractual right of early termination for convenience.

Stopping use of the Service, a reduction in activity, an organisational change or a preference for another solution do not, by themselves, entitle the Customer to cancel the commitment or to a refund of the annual price.

Late notice of non-renewal takes effect on the following renewal date, subject to the reminder mechanism described above and to mandatory rights.

13.4 Exceptions

The agreed commitments do not prevent:

• termination by Shyfter under Article 17;
• legal remedies in case of a sufficiently serious breach;
• mandatory rights, in particular regarding switching providers;
• a written agreement between the parties.

These exceptions do not constitute a general right to exit without financial consequences.

Article 14. Permitted use and prohibitions

The Customer uses the Service in accordance with its intended purpose, the subscribed scope and applicable laws.

The following are prohibited in particular:

• fraudulent or unlawful use;
• identity theft;
• deliberate falsification of data or declarations;
• unauthorised access to the accounts or data of third parties;
• circumvention of security measures;
• introduction of malicious software;
• deliberate actions compromising the availability or integrity of the Service;
• unauthorised extraction of third-party data;
• resale or commercial provision without authorisation;
• continuing a substantially non-compliant use after specific notice.

Security testing requires prior agreement on its scope, unless otherwise provided by law.

An unintentional error or incomplete configuration does not, by itself, constitute fraud.

Article 15. Respect for people and staff

The parties maintain professional and respectful exchanges.

The Customer ensures that its representatives and contacts refrain, towards Shyfter’s staff and service providers, from:

• threats, intimidation or harassment;
• insults or discriminatory remarks;
• sexist behaviour or remarks;
• humiliating or degrading personal attacks, whether serious or repeated;
• abusive pressure personally targeting an employee;
• malicious dissemination of factual accusations they know to be false.

These obligations cover all communication channels, including public communications relating to the contractual relationship.

Informal address, a disagreement or criticism do not, by themselves, constitute a breach. Their context and their association with humiliating or intimidating behaviour may be taken into account.

The Customer retains the right to make a complaint, to publish a review in good faith, to refer matters to the authorities and to take legal action.

Shyfter may interrupt an abusive exchange and require that it continue in writing or with a designated contact. An appropriate channel remains available for legitimate requests.

Shyfter imposes equivalent obligations of respect on its teams.

Article 16. Suspension of access

Shyfter may suspend all or part of the access:

• after the formal notice for non-payment has expired;
• in the event of a persistent substantial breach;
• immediately, to prevent or stop a serious and current risk to people, data or systems;
• in compliance with a legal obligation or binding decision.

Suspension may be automatic. Its automation does not exempt it from compliance with contractual and legal conditions.

The measure is proportionate. Where sufficient, Shyfter limits the suspension to one User or one feature.

The Customer is informed of the reasons, the consequences and the conditions for restoring access, in particular by an automated message or information in the Service, unless security requirements or a legal prohibition prevent this.

A channel is available to report an error and obtain a review. An unjustified measure is corrected without undue delay.

Suspension may prevent the automated operations and transmissions concerned. The Customer ensures their continuity by appropriate means.

Data recovery rights are preserved, if necessary through an alternative secure channel.

Suspension does not constitute termination. Amounts previously due remain payable; other financial consequences are assessed according to the cause, duration and respective responsibilities.

Article 17. Termination for breach

17.1 Remediable breach

In the event of a substantial breach, the injured party sends a written formal notice describing the facts, the expected corrective action and the possibility of termination.

If the breach remains uncorrected fifteen calendar days after receipt, that party may terminate the contract by reasoned written notice.

Abusive behaviour towards people must stop upon receipt of the formal notice.

The repetition of substantially identical behaviour after a formal notice may justify termination without a new cure period, where the seriousness and circumstances make this measure proportionate.

17.2 Particularly serious breach

Termination without notice or cure period may take place where the seriousness of the breach makes it reasonably impossible to continue the contract and the legal conditions are met.

Proven fraud, an intentional attack, malicious disclosure of data or serious threats may in particular fall within this situation.

The notice specifies the facts and the effective date. The terminating party keeps the supporting evidence.

17.3 Scope and challenge

The measure concerns the affected contracts and accounts. It does not automatically extend to another legal entity merely because they share directors or shareholders.

Each party retains the right to challenge the measure and to seek compensation under the conditions provided by law.

Article 18. Financial consequences of the end of the contract

Where Shyfter terminates under Article 17 because of a breach by the Customer, prepaid amounts corresponding to the period after the actual end of the Service are retained by Shyfter as liquidated damages, given the commitment subscribed to and the resources allocated for that period. Shyfter may, at its discretion, refund all or part of them.

In the event of a refund, the calculation is based on the price actually paid, including discounts, and the number of days remaining in the invoiced period. A credit note is issued and the refund is made within thirty days of Shyfter’s decision.

One-off services that have been properly performed remain payable. Services not performed that have become pointless are adjusted.

The mere non-use of an annual subscription does not give rise to any refund.

Where early termination results from a breach attributable to Shyfter or from a mandatory right, the consequences are determined in accordance with the law and, where applicable, Article 20.

Shyfter may claim compensation for a proven greater loss. The amounts retained are then set off against that compensation; no double compensation is permitted.

A refund or commercial gesture does not, by itself, constitute an admission of liability or a waiver of any remedy. A settlement requires a separate and explicit agreement.

Article 19. Operational end and data recovery

The notice of termination specifies the effective date, the features and automations that will stop and the arrangements for data recovery.

The Customer arranges for its operations, in particular social security operations, to be taken over by itself or by an authorised provider.

The end of the Service does not result in the immediate deletion of data.

The Customer has sixty calendar days, free of charge, to recover its data, starting from the actual end of the Service or, if later, from the end of the legally applicable transition period.

Data is accessible in read-only mode or through a secure method offering equivalent recovery when direct access is impossible or presents a documented risk.

Data is returned in commonly used and usable formats suited to the nature of the data. Exportable data and its formats are listed in Annex 2.

Throughout the term of the contract, the Customer may export its Customer Data using the Service’s export features, at no additional cost.

The deletion arrangements are set out in Annex 1. An extension may be agreed, without reducing the safeguards required by law.

Article 20. Switching providers and annual commitment

Shyfter complies with the mandatory obligations applicable to switching between data processing service providers, in particular those of European Regulation 2023/2854.

The Customer sends a written request specifying its scope and any authorised third parties.

Where this regime applies, the notice period for initiating the switch does not exceed two months. The transition takes place without undue delay, in principle within the following thirty calendar days. Any extensions comply with the legal conditions and are justified and scheduled.

Shyfter provides the assistance required by law, maintains the security and continuity within its scope and confirms the termination of the contract resulting from the process.

Exportable data includes the input data, output data and metadata covered by this right. Exclusions protecting the rights of third parties, intellectual property and trade secrets are limited and explained.

The categories of exportable data, the excluded categories, the formats, procedures and known limitations are set out in Annex 2, which is provided before subscription and kept accessible.

Shyfter publishes on its website information on the jurisdiction to which the infrastructure used for the Service is subject and on the measures taken against access by foreign public authorities that does not comply with Union law.

A mandatory exit right does not turn the annual commitment into a subscription that can be freely terminated without financial consequences.

Where an early termination fee is legally permitted, it corresponds to the direct and reasonably foreseeable loss caused by the termination. It is capped at the price excluding taxes remaining until the end of the term, after deducting costs saved and reasonably avoidable losses.

Shyfter provides a reasoned statement. The prepayment corresponding to the unused period is set off against the balance legally due. Any surplus is refunded. No double compensation is permitted.

No fee is due where it is prohibited by law, in particular where a breach by Shyfter gives rise to a right of termination without such a fee.

Operations that are legally free of charge are not invoiced. Only optional additional services, separate from these obligations and accepted in advance, may be invoiced.

Article 21. Intellectual property and confidentiality

Shyfter and its licensors retain their rights in the software, interfaces, documentation, trademarks and elements of the Service.

The Customer has a non-exclusive right of use, limited to the agreed term, business needs and scope.

Unauthorised reproduction, resale and exploitation are prohibited, subject to legal exceptions.

The Customer retains its rights in its data and content, subject to the rights of individuals and third parties. It authorises their processing to the extent necessary for the contract.

Each party protects the other’s confidential information and limits access to it to the persons who need it.

This does not apply to information that is lawfully public, lawfully obtained from a third party or independently developed.

A mandatory disclosure is limited to what is necessary and, where permitted, preceded by notice to the other party.

Confidentiality continues for five years after the end of the contract and, for personal data and trade secrets, for as long as legally required.

Article 22. Changes to prices and contractual terms

The price of a committed annual period may not be increased unilaterally, except for changes in taxes or an expressly accepted change in scope.

New annual rates are communicated at least sixty days before the renewal date, so that the Customer can refuse the renewal within the required period.

If they are not communicated within that period, a price increase does not apply to the next renewal without the Customer’s express consent.

For the monthly subscription, a price increase is announced at least sixty days before it applies.

Contractual changes are justified, in particular by a change in the law, a security requirement or a development of the Service.

Substantial unfavourable changes during an annual period require the Customer’s consent, unless the adjustment is imposed by a mandatory rule.

Publishing a text or merely mentioning it on an invoice is not sufficient to modify existing contracts. An individual notice may, however, accompany an invoice, under the conditions of Article 29.

Routine technical updates under Article 10 do not, merely by being deployed, constitute a change to the contractual terms requiring notice.

No change applies retroactively to prior events.

Article 23. Liability and limitations

Shyfter provides a technical tool and does not assume the legal obligations attached to the Customer’s capacity as employer, declarant or controller.

Shyfter is not liable for consequences attributable to the Customer’s data, choices, omissions, failure to check or use, nor for external events that it was not required to prevent or control under the contract.

This exclusion covers in particular, in these circumstances, the consequences of missing or late declarations, adjustments, operating losses and business interruptions.

Unavailability, an incorrect result or a missing declaration is not, by itself, sufficient to establish Shyfter’s liability.

Subject to applicable law, indirect damages are excluded. However, damage is not deemed indirect merely because it relates to a social security declaration or to data.

For ordinary damages attributable to Shyfter, its aggregate liability is capped at the amount excluding taxes paid or payable for twelve months of the Service concerned. If the contract started less than twelve months ago, the annualised contract price is used as the reference.

The exclusions and caps do not apply to fraud (dol) or gross negligence of Shyfter, its employees or agents, to harm to life or physical integrity, to liabilities that cannot be limited by law, or where they would deprive an essential obligation of its substance.

Within these limits, the exclusions and caps apply regardless of the basis of the claim, whether contractual or non-contractual.

They do not limit the rights of data subjects or the powers of authorities.

Expressly provided refunds and data return obligations are not treated as capped damages.

Each party reasonably mitigates its loss. Liability is assessed according to the respective causes and contributions.

Article 24. Third-party claims

A party informed of a claim likely to involve the other party notifies it within a reasonable time and allows it to participate effectively in its defence.

No admission or settlement may bind the other party without its consent.

Costs and awards are allocated according to the established liabilities and legal limits.

No general guarantee automatically transfers to the Customer the consequences of a breach specific to Shyfter, or vice versa.

Article 25. Force majeure

A party is not liable for a failure to perform attributable to an event constituting force majeure under applicable law.

It informs the other party as soon as possible and takes reasonable measures to limit the consequences.

An outage, a cyberattack or the unavailability of a supplier does not automatically constitute force majeure.

If an essential impediment lasts more than thirty days with no reasonable prospect of recovery, either party may terminate the affected services by written notice.

Services not provided and prepaid amounts are adjusted in accordance with the law. The return of data is organised to the extent technically possible.

Article 26. Notices and evidence

Communications are sent to the registered contact details, which are kept up to date.

Invoices, reminders, formal notices, renewal confirmations and suspension notices may be issued automatically.

Formal notices and terminations are communicated on a durable medium that makes it possible to establish their content and receipt. An additional means is used where necessary.

Technical logs and electronic exchanges may serve as evidence, subject to their reliability and the right to challenge them.

No unilateral record constitutes irrefutable evidence.

Article 27. General provisions

The parties remain legally independent.

An assignment of the contract may not reduce the Customer’s essential guarantees. Its consent is obtained where legally required. The Customer hereby agrees that Shyfter may transfer the contract to an affiliated company within the meaning of the Belgian Code of Companies and Associations, subject to prior written notice and without reducing its guarantees.

The use of a subcontractor does not release Shyfter from its obligations. Data processing follows Annex 1.

Failure to exercise a right does not constitute a waiver.

If a provision is invalid, the others remain in force to the extent that the contract can be maintained. The parties seek a lawful provision that respects its purpose, without reinstating an unfair term.

Article 28. Governing law and disputes

The contract is governed by Belgian law, subject to applicable mandatory rules.

The parties seek an amicable solution in good faith and may agree on mediation.

This process is not a precondition for going to court, does not prevent urgent measures and does not suspend legal time limits without an agreement or applicable provision.

Subject to mandatory rules on jurisdiction, the competent courts of the judicial district of Brussels have jurisdiction over disputes.

Article 29. Entry into force and existing contracts

This version applies to subscriptions entered into from its date of publication.

Existing contracts remain governed by the version they accepted until their next renewal date.

For an annual subscription entered into under a previous version, Shyfter individually notifies this version to the Customer, on a durable medium, at least sixty days before the renewal date. The notice may accompany an email sending an invoice, provided that the subject line and the beginning of the message clearly announce it and that this version is attached or accessible via a link. This notice clearly states that, unless the Customer refuses, the contract will be tacitly renewed for a new fixed term of twelve months under the terms of this version, including the automatic renewal provided for in Article 13.2.

The Customer may refuse this renewal by written notice received at least thirty days before the renewal date; the contract then ends on the renewal date. Failing refusal within that period, the contract is tacitly renewed under the terms of this version.

If the renewal date falls less than sixty days after the notice, the next renewal follows the rules of the previous version, and this version applies from the following renewal date under the conditions above.

For a monthly subscription, this version is notified at least sixty days before it applies. The Customer may terminate the subscription before that date, free of charge.

The language versions of these terms and conditions are translations. In the event of any discrepancy, the French version prevails.

Annex 1. Personal data processing agreement

1. Roles of the parties

For the data of employees, workers and other staff members processed in the Service on behalf of the customer company, the End Customer is the controller. Shyfter acts solely as processor for these operations.

The End Customer determines the purposes of the processing and the essential means, in particular the data subjects, the necessary data, the permitted uses, the recipients and the retention periods.

Shyfter processes this data on its behalf and on its documented instructions. Providing the software does not transfer to Shyfter the responsibilities of the employer or the controller.

Where Shyfter’s contracting party itself acts on behalf of an End Customer, it guarantees that it is authorised to engage Shyfter as a sub-processor and to give it the necessary instructions.

Shyfter retains its own obligations as a processor under the GDPR.

For its separate processing relating to commercial management, billing and compliance with its legal obligations, Shyfter acts as controller and provides the corresponding information.

2. Subject matter, duration and operations

This annex covers the processing necessary for the subscribed features: team management, scheduling, time clocking, working time, absences and medical certificates, attendance sheets, creation and signature of contracts and HR documents, payroll preparation, messaging, communications, social security declarations (Dimona, DPAE), logging and, where used, artificial intelligence features.

The operations include collection, recording, organisation, structuring, hosting, consultation, modification, calculations, authorised transmission, export and deletion.

It applies during the Service, the transition, data recovery and data deletion.

The data subjects include staff, administrators, managers, business contacts and, where the modules provide for it, candidates and other persons whose data is lawfully entrusted.

3. Categories of data

The data may include:

• identities and contact details;
• professional identifiers and national identification number (NISS in Belgium, NIR social security number in France) where permitted by law;
• contractual and professional data (role, skills, permits, workwear size, reference of the social secretariat or payroll provider);
• schedules, clock-ins, hours worked and absences;
• photos taken when clocking in and geolocation data, where the Customer activates these options;
• information about the device used to clock in;
• payroll information, statuses and responses to declarations (Dimona, DPAE);
• medical certificates and absence documentation;
• documents, messages, signatures and supporting documents;
• notification preferences, permissions, logins and operation logs.

Clocking in is done with a personal code. The Service does not process any biometric data and does not perform any facial recognition.

Health data is limited to the features and legal conditions that justify it. Shyfter applies enhanced safeguards to it, in particular restricted access.

Biometric data, criminal data or other particularly sensitive data are not authorised merely by accepting these terms and conditions. They require an expressly agreed scope and appropriate safeguards.

4. Obligations of the controller

The Customer, or the End Customer on whose behalf it acts, determines the legal bases, informs data subjects, minimises data and sets appropriate retention periods.

It ensures the accuracy of the data, controls permissions and authorises transmissions to recipients.

It handles requests to exercise rights and fulfils the obligations attached to its capacity as controller.

It may not transfer these responsibilities to Shyfter merely by using the Service.

5. Instructions and permitted uses

Shyfter processes data on documented instructions, including with regard to international transfers, unless otherwise required by law. In that case, Shyfter informs the Customer of that legal requirement before processing, unless the law prohibits such information on important grounds of public interest.

The contract, the activated features and documented requests constitute the initial instructions.

If an instruction appears to infringe data protection law, Shyfter informs the Customer and suspends the operation concerned pending a lawful clarification.

Shyfter does not sell the data entrusted to it and does not use it for independent advertising.

It does not reuse the data to train a general artificial intelligence model without a separate agreement and an appropriate legal basis. The artificial intelligence providers used by Shyfter are required not to use the data entrusted to train their models.

The Customer authorises Shyfter to produce aggregated and anonymised statistics from Customer Data, in particular to improve the Service and publish sector studies. These statistics cover groups large enough to rule out the identification of any individual or Customer, never name a Customer without its consent and are never subject to any re-identification attempt. The Customer may object in writing at rgpd@shyfter.com.

6. Confidentiality

Shyfter limits access to the persons who need it for their tasks.

Authorised persons are bound by a confidentiality obligation and receive appropriate awareness training.

Permissions are adjusted or removed when roles change or people leave.

7. Security

In accordance with Article 32 of the GDPR, Shyfter implements technical and organisational measures proportionate to the risks, including in particular:

• identity and permission management;
• protection of communications and authentication;
• logical separation of Customers’ data;
• logging of sensitive operations;
• backup, restoration and continuity;
• vulnerability and update management;
• handling and documentation of incidents;
• control of providers and maintenance access;
• secure deletion;
• regular testing of the effectiveness of the measures.

The applicable technical description is provided before processing begins and kept available. It specifies the protections, backups and deletion periods actually implemented.

The measures may evolve without individual notice of each technical adjustment, provided that they do not substantially reduce the agreed level of protection and that legal information obligations are respected.

No certification is deemed obtained unless it is expressly identified.

8. Sub-processors

The Customer gives a general authorisation to use the providers identified in the register provided before processing begins.

The register specifies their identity, role, operations, processing locations and any transfer safeguards. It forms part of the contractual documentation. Its current version is available online and provided on request at rgpd@shyfter.com.

Shyfter informs the Customer of any intended addition or replacement of a sub-processor before it takes effect, by a dated update of the online register, together with information in the Service or by email.

The Customer may raise a reasoned objection relating to data protection in writing at rgpd@shyfter.com. The parties seek a reasonable solution in good faith, for example deactivating the feature concerned for the Customer’s account. The objection does not, by itself, give rise to a right of early termination or a refund; the Customer retains the option not to renew the contract under the conditions of Article 13.

Shyfter imposes on its sub-processors, by contract, the same data protection obligations as those set out in this annex, and remains fully liable for their performance under the conditions of the GDPR.

9. Location and transfers

The hosting, backup and remote access locations are listed in the documentation and the register of providers.

Any transfer outside the European Economic Area is based on a valid mechanism and, where necessary, on an assessment and supplementary measures.

Shyfter provides the relevant safeguards and, on request, a summary of the transfer impact assessment carried out for each recipient established outside the European Economic Area.

Requests for access by authorities are verified in accordance with applicable law. The Customer is informed where permitted and disclosure is limited to what is necessary.

10. Data breaches

Shyfter informs the Customer without undue delay after becoming aware of a breach affecting the data entrusted to it, and no later than forty-eight hours.

As far as possible, the initial information is provided within twenty-four hours, without waiting for the investigation to be completed.

The information is supplemented progressively: nature of the breach, data and data subjects concerned, likely consequences, measures taken and contact.

Shyfter documents the incident in a breach register, provided to the Customer on request insofar as it concerns the Customer, and cooperates in limiting its effects.

The controller decides on the notifications to authorities and data subjects for which it is responsible. Shyfter only acts in its place on instruction or legal obligation.

11. Assistance and data subject rights

Shyfter provides the assistance required for data subject requests, security, impact assessments and prior consultations, taking into account the processing and information available.

A request received directly from an individual is forwarded to the Customer without undue delay. Shyfter only responds on the merits on instruction or legal obligation.

Ordinary assistance and assistance required because of a breach by Shyfter are not invoiced additionally.

Exceptional assistance beyond contractual and legal obligations may be subject to a prior quote, without delaying a mandatory or urgent measure.

12. Information and audits

Shyfter provides the information necessary to demonstrate compliance with its obligations and allows the required audits, including inspections.

The parties give priority to available documents and reports, without removing the right to a justified additional verification.

Audits are organised with reasonable notice, under confidentiality and while protecting other Customers. Urgency, a serious incident or a request from an authority may justify a shorter notice period.

The arrangements and any costs may not render the right of audit illusory.

13. Return and deletion

At the end of the Service, the controller chooses between return and deletion, subject to legally required retention.

Unless lawfully instructed otherwise, data remains available for the sixty days provided for in Article 19.

At the end of that period, data is deleted from active systems within a maximum of thirty days.

Residual backup copies are isolated from ordinary use and deleted or rendered unrecoverable no later than ninety days after deletion from active systems.

A restoration must not permanently reintroduce data whose deletion was required.

An instruction for early deletion is handled within the legal time limits, after checking authorisation and providing information on its consequences.

Any mandatory retention is limited to the data, purposes and periods required. Shyfter specifies its legal basis and restricts access.

Billing data or items strictly necessary for the defence of a right may fall under separate processing subject to their own legal bases and periods.

Shyfter confirms on request the operations carried out and the applicable exceptions.

14. Continuation of safeguards

The confidentiality and security obligations continue for as long as entrusted data is retained.

Shyfter’s capacity as processor does not limit the rights of data subjects, the powers of authorities or mandatory liabilities.

Any amendment to this annex complies with the contractual rules and may not reduce the safeguards required by law.

This annex applies together with the national laws supplementing the GDPR, in particular the Belgian law of 30 July 2018 and French law no. 78-17 of 6 January 1978 (“Informatique et Libertés”). The competent supervisory authority for the Customer is that of its main establishment (Data Protection Authority in Belgium, CNIL in France).

Where the End Customer is established outside the European Union, this annex also applies with regard to local data protection legislation, in particular Moroccan law no. 09-08 for Customers established in Morocco. The Customer completes the formalities incumbent upon it with the competent local authority.

Annex 2. Exportable data and formats

1. Exportable data

2. Excluded data

The following are excluded from export: the source code, algorithms and internal settings of the Service, the data of other Customers, security data whose disclosure would expose the Service (keys, secrets, infrastructure logs), and data for which Shyfter is the controller on its own behalf. These exclusions are limited to what is strictly necessary.

3. Procedure

Routine exports are carried out by the Customer from the Service. For a full export or a change of provider, the Customer sends a written request to hello@shyfter.com in accordance with Article 20. Shyfter provides the export within a period compatible with the transition period provided for in that article.