Terms and Conditions of Service and Data Processing Agreement (DPA)

PART I. TERMS AND CONDITIONS OF USE

1. Nature of the Service and B2B Relationship

Cleverfy is a SaaS (Software as a Service) platform for time tracking and human resources management. Cleverfy's services are aimed exclusively at companies, professionals and self-employed individuals within the scope of their commercial or business activity (B2B relationship). Therefore, consumer protection regulations do not apply, including the right of withdrawal.

2. Capacity and Legal Representation

The person accepting these Terms and Conditions on behalf of the Client declares and warrants that they act as a duly authorised legal representative, with sufficient capacity to legally bind the company or organisation they represent. The Client assumes full responsibility for the actions of said representative.

3. Registration, Credentials and Security

The Client is solely responsible for maintaining the confidentiality of the passwords and administrator accounts of their Cleverfy workspace. Any action performed under the Client's credentials shall be presumed to be authorised by the Client. The Client must immediately notify Cleverfy of any unauthorised use of their accounts.

Cleverfy reserves the right to temporarily block accounts when there are well-founded indications that credentials have been compromised, in order to protect the integrity of the platform and the data of all users.

4. Plan Conditions, Payments and "Lifetime Deal"

• Free Trial: A 14-day trial is offered. Once the period ends, a plan subscription will be required. Extensions may be evaluated upon express request. Data entered during the trial period will only be retained if the Client subscribes to a paid plan; otherwise, it will be deleted 30 days after the end of the trial period.
• Subscription Model (Basic and Pro): The cost is calculated per active employee per month. Payment will be charged in advance (monthly or annually with a 20% discount). No refunds will be issued for unused periods.
• Lifetime Deal (LTD): Grants access to Pro Plan features through a one-time payment for the entire useful life of the Cleverfy product. Includes premium support (4h response) for the first 12 months; thereafter, standard support (24h) will apply. In the event of business cessation, 60 days' notice will be given for data export.
• Non-payment: In the event of non-payment, Cleverfy will notify the Client. After 5 calendar days without regularisation, access will be suspended. Data will remain blocked for 30 days before the definitive termination of the contract.

5. Cancellation and Contract Termination

The Client may cancel their subscription at any time from their account administration panel. Cancellation will take effect at the end of the current billing period, with access maintained until that date. No refunds will be issued for the remaining period.

After cancellation, the Client will have a period of 30 calendar days to export all their data. Once this period has elapsed, the retention and blocking procedure described in Part II, section 7 will apply.

Cleverfy reserves the right to terminate the contract immediately in the event of fraudulent use of the service, breach of these conditions or activities that compromise the security of the platform, with prior notification to the Client.

6. Service and Pricing Modifications

Cleverfy reserves the right to modify pricing or these conditions. Any changes will be notified to the account administrator at least 30 days in advance. If the Client does not accept the new conditions, they may cancel their subscription before they come into effect.

7. Warranties and Availability (SLA)

• Cleverfy guarantees a service availability of 99.5% per year, excluding scheduled maintenance (previously notified), force majeure events, or failures in third-party infrastructure providers.
• Cleverfy does not act as a labour law advisor. Compliance with the Workers' Statute (Estatuto de los Trabajadores) and collective agreements lies exclusively with the Client.

8. Force Majeure

Neither party shall be liable for delays or failures resulting from causes beyond their reasonable control, including but not limited to: natural disasters, pandemics, armed conflicts, acts of terrorism, widespread Internet or telecommunications failures, government actions, or failures of third-party infrastructure providers. The affected party shall notify the other as soon as possible and make reasonable efforts to resume the service.

9. Electronic Communications

Service communications: The Client agrees that Cleverfy may send service-related communications (notifications of changes to terms, security alerts, data breaches, scheduled maintenance and operational notices) to the account administrator's email address. These communications are not commercial in nature, are necessary for the proper performance of the contract and cannot be deactivated.

Product communications: Under Article 21.2 of Law 34/2002 on Information Society Services (LSSI), and within the framework of the existing contractual relationship, Cleverfy may send the Client communications relating to the adoption and optimal use of the service, including: onboarding tips, best practices, notices related to the status of their trial period or subscription, and new feature announcements relevant to their plan. The Client may object to receiving these communications at any time by sending an email to info@cleverfy.es.

10. Licence of Use

Cleverfy grants the Client a non-exclusive, non-transferable and revocable licence to access and use the platform for the duration of the subscription, exclusively for internal business use. In no event shall this licence be construed as an assignment or sale of the software. The Client may not sublicense, resell or make the platform available to third parties.

11. Prohibited Uses

The Client agrees not to:

• Reverse engineer, decompile or disassemble Cleverfy's software.
• Share access credentials with third parties outside the Client's organisation.
• Use the service for illegal, fraudulent or bad faith purposes.
• Introduce viruses, malware or any malicious code into the platform.
• Attempt to access other clients' data or restricted areas of the system.
• Use the service in a manner that compromises its availability, security or performance for other users.

12. Intellectual Property and Trademark Use

Cleverfy retains exclusive ownership of the code, design, algorithms and brand of the software. The Client retains all rights over the data entered. The Client authorises Cleverfy to use their logo or trade name as a corporate reference (Case Studies), and may revoke this permission at any time by written communication.

13. Limitation of Liability

Except in cases of wilful misconduct or gross negligence, Cleverfy's maximum aggregate liability for any claim arising from the use of the service shall be strictly limited to the amounts paid by the Client during the 6 months preceding the event giving rise to the damage.

14. Severability and Jurisdiction

If any clause is declared void, the remainder of the contract shall remain in full force and effect. The parties submit to the Courts and Tribunals of the city of Barcelona, with express waiver of any other jurisdiction, applying Spanish law.

PART II. DATA PROCESSING AGREEMENT (DPA)

This Annex complies with the requirements of Article 28 of Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law LOPDGDD 3/2018.

1. Purpose, Nature and Data Types

Cleverfy (Processor) shall process data on behalf of the Client (Controller) exclusively to provide the SaaS service.

• Data processed:
  • Identification data: first name, surname, email, DNI/NIF, start date, profile photo (optional).
  • Organisational data: department, workplace, role, on-site/remote modality and remote work percentage.
  • Time records: clock-in time, clock-out time, breaks, work mode and classification of hours (regular, overtime, supplementary, night and holiday hours).
  • Standby and on-call time: type, start/end time, duration and notes.
  • Flexibility and work-life balance measures: type of measure, reason and application period.
  • Absences: requests, balances (accrued, used, reserved days), attached supporting documents.
  • Modification history: requester, approver, original and modified values, request status.
  • Geolocation: only when expressly activated by the administrator; location is captured only at the moment of clocking in/out and no continuous tracking of the worker's position is performed.
  • Technical data: mobile device identifiers, push notification subscriptions and kiosk mode clock-in PIN.
• Duty of Confidentiality: Cleverfy guarantees that all persons authorised to process personal data (employees, collaborators) have signed binding confidentiality agreements.

2. Authorised Sub-processors and Changes

The Client provides general authorisation for the subcontracting of the following providers:

• Amazon Data Services Spain, S.L. (Hosting - Spain Region).
• Amazon Web Services EMEA SARL (Transactional emails).
• Crisp IM SARL (Technical support).
• Stripe Payments Europe, Ltd. (Payment processing).
• Google Ireland Ltd. (Usage analytics).

Changes: Cleverfy will inform the Client of any addition or replacement of sub-processors with 15 days' notice. The Client may object on justified data protection grounds. If the objection cannot be resolved, the Client may terminate the contract.

3. International Transfers

Primary data is hosted within the EEA (Spain). If any sub-processor's operations (e.g. global support) involve transfers outside the European Economic Area, Cleverfy guarantees that they will be carried out under the Data Privacy Framework or through the signing of the European Commission's Standard Contractual Clauses (SCCs).

4. Security Measures and Audits

• Security: Encryption of data in transit (TLS) and at rest, environment isolation and recurring backups.
• Audits: Upon the Client's request, Cleverfy will make available the necessary information to demonstrate compliance with its obligations. If the Client requires an on-site or third-party technical audit, the costs shall be borne by the Client and the audit will be scheduled so as not to disrupt Cleverfy's normal operations.

5. Security Breach Notification

Cleverfy will notify the Controller of any personal data security breach without undue delay and, in any case, within a maximum period of 48 hours after becoming aware of it. The notification will include the nature of the breach, categories of data affected and corrective measures applied.

6. Assistance and Data Subject Rights

Given that the platform has self-management tools, the Client will directly handle requests from their employees. If Cleverfy receives a direct request from an employee (right of access, erasure, etc.), it will forward it to the Client as soon as possible, without responding directly.

7. Data Retention and Blocking

Upon termination of the contractual relationship:

1. The Client may export all their records.
2. Subsequently, Cleverfy will keep the data blocked for a period of 4 years, in strict compliance with the limitation period for labour infringements under Spanish law (LISOS — Ley sobre Infracciones y Sanciones en el Orden Social).
3. During the blocking period, the data will only be available to Judges, Courts or Public Administrations (Labour Inspectorate). Once the period has elapsed, irreversible deletion will be carried out.

Last updated: 26 February 2026