These terms apply when you use our applications or hire us for consultancy work. By using our services you confirm that your use is covered by a valid agreement between us and your organization.

• What the service includes
• Uptime and response commitments (SLA)
• Who can access what data
• How support works
• Pricing and billing

If anything in these general terms conflicts with your individual agreement, the individual agreement wins.

• What we're going to do, and what we're not
• Who's responsible for what
• Confidentiality
• Fees and how they're invoiced
• Who owns the code and any other IP
• Limits on liability

• Use them for legitimate business — no illegal stuff
• Respect the security controls we put in place
• Keep your login credentials to yourself
• Give us accurate information when you sign up or configure things

If we see misuse or unauthorized access, we may suspend or close access without warning.

We handle personal data under GDPR and our privacy policy below. Customer data is yours (or the data controller's) — not ours.

We don't use customer data for marketing or any kind of profiling.

Uptime, response times, support hours, and maintenance windows are set out in each customer's individual service agreement.

We do planned maintenance from time to time. We'll tell you in advance when we can.

Our software, documentation, and underlying technology stay ours unless we've agreed otherwise in writing.

You get a right to use the software as described in your agreement — that's it.

Both sides agree to keep each other's confidential information confidential, as set out in the applicable agreement or consultancy contract.

Our liability is capped at what's written in your individual agreement or contract. We're not on the hook for losses caused by misuse, unauthorized access, or events we can't reasonably control.

Access to our applications can be suspended or ended in line with your agreement, including if:

• the contract ends
• there's a security risk
• the terms are seriously breached

Once access ends, it ends.

We may update these terms now and then. If a change actually matters to you as a customer, we'll let you know through the usual channels.

Unless your agreement says otherwise, these terms are governed by the law of the jurisdiction in which the agreement was entered into.

This policy explains what personal data we collect when we deliver our services, why we have it, and what we do with it. We only collect what we actually need to run the service, support our customers, and meet our contractual and legal obligations.

We process personal data under GDPR, on one of these grounds:

• Because we have a contract with you (or your employer)
• Because we have to by law
• Because we have a legitimate business interest
• Because you've given us consent

We don't use your data for unrelated marketing or profiling without asking first.

Only what we need to deliver the service — typically:

• Contact details (name, phone, email)
• Company and account information
• Records of our communication and your use of the service
• Technical and usage data needed for the system to function

We don't intentionally collect sensitive personal data unless the law requires it.

Strictly business stuff:

• Running and supporting the services you're subscribed to
• Sending you notifications and system updates
• Responding when you contact us
• Keeping the system secure and reliable
• Meeting legal and audit requirements

We don't sell customer data. We don't hand it to third parties for marketing.

Communications from us are about:

• The services you're subscribed to
• Your contract or operational matters
• Security, maintenance, or system notices

No unrelated advertising.

All personal data is stored inside the EU, either:

• in Microsoft Azure datacenters in Europe, or
• on our own infrastructure in the EU

We use standard technical and organizational measures to protect it from loss, unauthorized access, and misuse.

We keep personal data only as long as we need it to:

• do the thing we collected it for
• meet legal, financial, or regulatory requirements (e.g. accounting records)

When we no longer need it, we delete or anonymize it.

Only trusted service providers who need it to help us deliver the service. They're all bound by GDPR-compliant data processing agreements.

We don't transfer data outside the EU unless the proper safeguards are in place.

Under GDPR you can:

• Ask what data we have on you
• Ask us to correct or delete it
• Object to or restrict how we process it
• Get a copy in a portable format
• Withdraw consent (where applicable)
• Complain to your data protection authority

Use our normal contact details to make a request.

The usual industry-standard stuff:

• Access control and authentication
• Encryption where it makes sense
• Logging and monitoring
• Sensible development and operational practices

We may update this policy when the law or how we work changes. The current version will always be on this page.

This explains how we use cookies on our applications. Short version: we only use the ones we actually need to log you in and keep you logged in.

A small text file your browser stores when you visit a website. Some are necessary for the site to work — like the one that remembers you're logged in so you don't have to type your password on every click.

Only for things the application can't work without:

• Authentication — checking that it's really you when you sign in
• Session management — keeping you logged in while you work
• Security — protecting your account from misuse

We don't use cookies for:

• Advertising
• Third-party marketing
• Tracking your behavior
• Analytics unrelated to running the system

All of them are first-party — set by us, not by anyone else.

Under GDPR and the ePrivacy Directive, strictly necessary cookies don't need consent — they're required for the service you're actively asking to use.

You can, but the app won't work — you won't be able to log in.

Cookies only hold what's needed to authenticate you and keep your session going. Nothing more.

Everything else is handled under our privacy policy.

We may update this when the cookies we use change. The current version is always here.

We want our apps and websites to work for everyone, including people who use assistive technology. We aim to meet the relevant accessibility rules — mainly the EU Web Accessibility Directive (EN 301 549), and WCAG 2.1 Level AA. Where ADA applies, we follow that too.

In practice that means:

• Working with screen readers and other assistive tech
• Enough color contrast, text that scales
• Full keyboard navigation — nothing mouse-only
• Layouts that don't move around between pages
• Labels and instructions that actually explain things

Accessibility is never finished. We keep at it as we build new features. If something doesn't work for you, please tell us — feedback from real users is how we find the gaps.

The standards we try to meet:

• EU Web Accessibility Directive (Directive (EU) 2016/2102)
• EN 301 549
• WCAG 2.1 Level AA
• Americans with Disabilities Act (ADA), where relevant

Email us. Tell us what page or feature is giving you trouble, and how. We'll look at it and get back to you.

When Sigma-Tau handles personal data on behalf of a customer, we act as the data processor and you (the customer) are the data controller. This section describes how that works.

Only what's needed to deliver the agreed services — nothing else. The detailed scope is set out in the individual customer contract, and everything is handled under GDPR.

Standard technical and organizational measures: controlled access, secure operations, the usual stuff. Confidentiality, integrity, and availability are the three things we look after.

If we use a sub-processor (for example a hosting provider), they're under the same kind of agreement. We don't transfer data outside the EU unless the proper legal safeguards are in place.

If you want details about how we process your data or what controls we have in place, just contact us through the usual channels and we'll walk you through it.