Terms of Service

1. The Provider and the parties

These Terms of Service (the “Terms”) govern the use of the OPEREX industrial shift-log (shift diary) SaaS provided under the operex.eu domain (the “Service”).

Provider:

• Name: Mészáros János egyéni vállalkozó (sole trader, Hungary)
• Support email: support@operex.eu
• Website: https://operex.eu
• Further identification data (registered address, registration and tax number) are in the Legal notice.

Hosting provider:

• Name: Hetzner Online GmbH
• Address: Industriestr. 25, 91710 Gunzenhausen, Germany
• Company reg.: HRB 6089, Amtsgericht Ansbach

By using the Service, the Subscriber (the “Subscriber”) expressly accepts these Terms and the Privacy policy.

2. Description of the Service

OPEREX is a B2B industrial shift-log platform for continuous-process, hazardous facilities (chemicals, refineries, energy, steel): shift handover, event log, task and order management, with an ISO 45001 §10.2 audit trail. Each Subscriber receives its own workspace (typically a dedicated subdomain, e.g. plant.operex.eu).

The Service is module-based: individual modules (e.g. shift log, Operations Analytics) are switched on and priced separately. Deployment is a separate dimension: the default is the shared cloud isolated with row-level security (RLS), with an optional dedicated / on-premise / air-gapped (Enterprise) deployment. The specific available features and limits depend on the modules switched on and the chosen deployment model.

The Service operates as SaaS (Software as a Service): the Provider operates the platform, while the Subscriber is responsible for the content and accuracy of the data entered into the system.

3. Access, registration and acceptance of the Terms

OPEREX is currently in a pilot / early-access phase, and registration is invitation-only. New user accounts are created by invitation from the tenant (Subscriber).

The Service is for business (B2B) use and is not available to consumers; the registering person must be of legal age, have legal capacity, be authorised to act on behalf of the relevant business, and provide accurate information.

The Terms are freely available on the website before the contract is concluded, and the Subscriber expressly accepts them by concluding the contract (accepting access or signing an individual quote). The Provider sends earlier effective versions on request.

4. Subscription, fees and billing

The payment and billing provider has not yet been selected. OPEREX is in a pilot / early-access phase — there is no live paid subscription yet. The payment provider, together with the related billing and data-processing terms, will be added to this document before paid billing goes live.

When paid subscriptions go live, this section will be extended with pricing, the billing cycle, renewal and cancellation rules, and refund terms. Pilot-phase access may be governed by a separate agreement (the “Pilot Agreement”).

5. Subscriber obligations

• Provide accurate information on registration and (for paid billing) invoicing
• Use the Service lawfully and in good faith
• Provide appropriate privacy information to its own employees / data subjects (since the Subscriber is the controller of the operational data)
• Keep account credentials secure and not share them with third parties
• Provide and keep up to date a working security / contact email address (notifications are sent there — see section 8)
• Refrain from any activity that endangers the operation, security or other users of the Service

Important — industrial responsibility: OPEREX is a software tool that supports shift management and documentation. Using the Service does not relieve the Subscriber of its statutory and standards obligations regarding facility operation, occupational safety, process safety and emergency response. The Subscriber remains responsible for safety decisions and regulatory compliance.

6. Provider obligations

• Operate the Service continuously and with due care (except for planned maintenance windows)
• Process data in compliance with the GDPR per the Privacy policy and the Data Processing Agreement
• Provide support at support@operex.eu with a reasonable response time
• Inform affected parties in the event of a material service outage

7. Availability and backup

Under the standard terms the Provider gives no contractual availability commitment (SLA), response-time guarantee or binding recovery time objective (RTO); an individual contract (e.g. Enterprise) may set these out. Operating the Service with due care is an independent obligation (section 6).

The data is backed up regularly (every 6 hours) to an off-site location, which means a recovery point objective (RPO) of about 6 hours; the backup details are in section 7 of the DPA. The standard terms include no 24-hour human on-call service. The Provider announces planned maintenance in advance where practicable.

8. Security and incident notification

The technical and organisational measures applied by the Provider are described in section 7 of the DPA and on the Security page.

Security incident. If the Provider detects a security incident affecting the Subscriber’s environment — whether or not it involves personal data (e.g. unauthorised access, breach of tenant isolation, unrecoverable data loss, prolonged outage) — it will notify the Subscriber without undue delay and no later than 24 hours after detection, by email to the contact address the Subscriber has given, including with partial information, and will state when further information is expected. For incidents involving personal data, section 8 of the DPA also applies. Regulatory reporting obligations (e.g. an early warning under cybersecurity law) rest with the Subscriber; the Provider supplies the information available to it for that purpose.

Cooperation with the Subscriber’s supplier risk management. On the Subscriber’s written request the Provider supplies security information and questionnaire answers, notifies changes of sub-processors as set out in section 6 of the DPA, and permits verification as set out in section 12 of the DPA. This is information, not a statement of legal compliance: the Subscriber is responsible for meeting its own obligations.

Vulnerability reports: security@operex.eu (see the security.txt file). Good-faith research that does not disrupt operation will not be a ground for legal action.

9. Intellectual property and Subscriber data

The OPEREX software, its source code, design and documentation are the intellectual property of the Provider. The Subscriber receives a non-exclusive, non-transferable right to use the Service for the duration of the subscription. Data entered into the system by the Subscriber (shift logs, entries) remains the property of the Subscriber, and the Provider uses it solely to provide the Service, on the Subscriber’s instructions.

10. Confidentiality

The parties treat non-public business, technical and operational information of the other party learned in the course of performance (including the Subscriber’s operational data) as confidential, and disclose it to third parties only as needed for performance (e.g. the sub-processors under the DPA) or where required by law. Confidentiality survives termination.

11. Limitation of liability

The Provider supplies the Service on an “as-is” basis. The Provider is not liable for:

• the accuracy, completeness or truthfulness of content entered into the system by the Subscriber;
• operational, occupational-safety or process-safety decisions — these are the Subscriber’s responsibility (see section 5);
• damage arising from the outage or failure of third-party services (Hetzner, Cloudflare, Resend, Zoho, Anthropic, DeepL, the future payment processor), to the extent of the terms applicable to them;
• force majeure events (see section 16).

Save for intentional or grossly negligent conduct, harm to life, bodily integrity or health, and any case where the law prohibits limiting liability, the Provider’s liability for damages excludes, to the extent the law allows, lost profit and indirect loss, and is limited overall to the amount actually paid by the Subscriber in the 12 months preceding the event causing the damage. During a free (pilot) period, or where nothing was paid in those 12 months, the liability cap is three months of the fee agreed between the parties.

12. Data protection

The detailed rules for processing personal data are set out in the Privacy policy. The Provider acts as a controller for its own Subscriber data and as a processor for the Subscriber’s operational data; the detailed rules for the latter, under Article 28 GDPR, are set out in the Data Processing Agreement (DPA), which forms an integral part of these Terms.

13. Term, suspension and termination

• Term. The contract is for an indefinite period unless the individual quote or the Pilot Agreement sets a fixed term.
• Termination for convenience. Either party may terminate in writing with 30 days’ notice, unless the individual quote or the Pilot Agreement provides otherwise.
• Termination for cause. Either party may terminate with immediate effect if the other party materially breaches the contract and does not remedy the breach within a reasonable time after written notice.
• Suspension. The Provider may temporarily restrict or suspend access where necessary to protect the security of the Service, the Subscriber or other subscribers, or where the Subscriber materially breaches the contract; it notifies the Subscriber beforehand where practicable and otherwise without delay afterwards. Access is restored when the cause ceases.
• Data after termination. See section 14 and section 11 of the DPA.

14. Data return and switching

On termination, or when moving to another provider or to its own (on-premise) system, the Subscriber is entitled to the return of its data. The intention to switch must be notified in writing with at most 2 months’ notice; a 30-day transition period then applies, during which the Service remains available unchanged and the Provider reasonably assists the switch. If the transition period is technically unfeasible, the Provider says so with reasons and offers a reasonable longer period.

Data return is complete: every tenant data table in machine-readable (NDJSON) and spreadsheet-readable (CSV) form, with a file inventory and per-file SHA-256 checksums (details in section 11 of the DPA). On request the Provider provides a full description of the exportable data categories and formats. The Provider charges nothing extra for the standard export; for custom, non-standard migration work it gives an individual quote. At the end of the transition period the Subscriber may request deletion of its data, as set out in section 11 of the DPA.

15. Amendments to the Terms

The Provider may amend these Terms unilaterally because of changes in law, developments of the Service, security or operating conditions. Subscribers will be notified by email at least 30 days before any change takes effect (the same period applies to amendments of the DPA). If the Subscriber does not accept the change, it may terminate the contract before the effective date without giving reasons and without consequence; if it does not terminate and keeps using the Service, the amendment is deemed accepted. A change required by law or directly protecting security may take effect on shorter notice, with the reason stated.

16. Force majeure

Neither party is liable for a breach caused by an unavoidable event beyond the parties’ control (e.g. natural disaster, regulatory action, war, a general outage of the internet or energy supply needed to provide the Service, a cyber-attack beyond the parties’ reasonable control). The party relying on it notifies the other without delay of its start and end and acts reasonably to limit the damage.

17. General provisions

• Order of precedence. In case of conflict, the individual contract (quote, Pilot Agreement, Enterprise contract) prevails over the DPA and these Terms on the matters it covers; on the processing of personal data the DPA prevails over these Terms.
• Language. The Hungarian version of the Terms is authoritative; the English version is a courtesy translation. Where the parties’ individual contract is in another language, that language governs the matters it covers.
• Notices. The parties may give notices by email: to the Provider at the support address above, to the Subscriber at the contact and security addresses it has given.
• Assignment. The Subscriber may not transfer its rights and obligations under the contract without the Provider’s consent; the Provider may transfer the contract to its legal successor by notifying the Subscriber.
• Severability. If a provision of the Terms is invalid, the others remain in force and the parties replace the invalid provision with the valid one closest to its purpose.

18. Complaint handling

Subscribers may submit complaints at support@operex.eu; the Provider will investigate and respond in writing within 30 days.

19. Governing law and disputes

These Terms are governed by Hungarian law, without prejudice to mandatory provisions of law. The parties will seek to resolve disputes primarily by negotiation; failing that, the Hungarian court with subject-matter and territorial jurisdiction over the Provider’s registered seat has jurisdiction.