Terms of Service

1. Who these terms are between

Meulenbase (the “Service”) is operated by Rafael Meulenbelt, an individual based in the Netherlands (“we”, “us”). These terms apply between us and:

• each organisation that uses the Service (a “Customer”); and
• each person who uses the Service, for example as an employee of a Customer (a “User”, “you”).

A User accepts these terms by creating an account, accepting an invitation or using the Service. A Customer accepts them when a person it has authorised invites Users or lets them use the Service for it.

The Service is for business use only: you use it for your trade, business or profession and not as a consumer. If a Customer and we have signed a separate written agreement about the Service, that agreement prevails where it differs from these terms.

2. The Service

The Service lets Customers upload, process, translate, consolidate and report their financial and operational data, and connect it to their other systems. We currently provide it without charge. These terms create no duty to pay; any charge would need a separate agreement made in advance.

The Service is under active development. Features can be added, changed or removed, and features marked as a preview can be less reliable. We may set reasonable limits, for example on storage, file size or the number of requests, to keep the Service working for everyone.

3. Accounts and access

• Access is by invitation only. Give accurate details and keep them up to date.
• Keep your password and API keys secret, do not share your account, and use only your own account.
• You are responsible for what happens under your account, unless you told us that it was being misused. Tell us at once at [email protected] if you suspect unauthorised use.
• The Customer's administrators decide who has access and what each User can see and do. The Customer is responsible for those choices, for removing access when someone leaves, and for its Users complying with these terms.

4. Acceptable use

You must not use the Service, or let anyone else use it, to:

• break any law or regulation, or infringe anyone's rights, including privacy and intellectual property rights;
• upload malware, or content that is unlawful, harmful or that you have no right to share;
• access, probe, scan or test the Service, its systems or other Customers' data without our written permission, or get around its security, access controls or limits;
• disrupt or overload the Service, or access it by automated means other than the API access you were given;
• copy, resell, sublicense or make the Service available to third parties, or use it to build a competing product;
• decompile or reverse engineer the Service, except where the law allows it despite this restriction;
• upload special categories of personal data (for example health data), personal data of children, or data subject to export controls (for example technical data controlled under the EU dual-use rules, the US Export Administration Regulations or ITAR), unless we agreed to it in writing in advance.

You must not use the Service in breach of sanctions that apply to you, to the Customer or to us. We may suspend access at once to stop or prevent a breach of this section.

5. Customer Data

“Customer Data” is all data that a Customer or its Users put into the Service, or that the Service collects from the Customer's connected systems.

• Ownership: the Customer keeps all rights in its Customer Data. It gives us the right to host, copy, process, transmit and display Customer Data only as needed to provide, secure and support the Service, and as the law requires. We do not sell Customer Data, use it for advertising or use it to train artificial intelligence models.
• Responsibility: the Customer is responsible for its Customer Data: its accuracy, completeness and lawfulness, and having every right, consent and legal basis needed to put it into the Service, including informing employees and others whose personal data it contains. The Customer is also responsible for the settings it chooses, such as mappings, rules, exchange rate sources, hierarchies and permissions.
• Confidentiality: we keep Customer Data confidential. We look at it only to provide or support the Service, when the Customer asks us to, to investigate a security issue or misuse, or when the law requires it.
• Backups: we keep backups for our own recovery only (see the Privacy Policy). They are not an archive for the Customer, which should keep its own copies of its source data and of the reports it relies on.
• At the end: until its access ends, a Customer can export its data with the Service's export functions. After that, at the Customer's request and at the latest 90 days after its access ends, we delete its Customer Data, except copies in backups, which expire within 7 days, and data the law requires us to keep.

6. Personal data processed for the Customer

For personal data in Customer Data, the Customer is the controller and we are its processor under article 28 of the EU General Data Protection Regulation (GDPR), and its data intermediary under Singapore's Personal Data Protection Act. This section is our data processing agreement with the Customer. We will:

1. process that personal data only on the Customer's documented instructions, which are these terms, the Customer's use and settings of the Service and its written instructions, unless the law requires otherwise; we will tell the Customer if we believe an instruction breaks data protection law;
2. make sure everyone who processes it for us is bound by confidentiality;
3. protect it with appropriate technical and organisational measures (see the Privacy Policy);
4. use other processors only as listed in the Privacy Policy, which the Customer authorises. We will announce a new or replaced processor at least 30 days in advance; the Customer may object on reasonable grounds and, if we cannot meet the objection, stop using the Service. We bind each processor to equivalent data protection obligations and remain responsible to the Customer for them;
5. help the Customer, as far as reasonably possible, to answer people exercising their rights, and with its duties on security, breach notification, data protection impact assessments and prior consultation;
6. notify the Customer without undue delay, and where possible within 48 hours, after we become aware of a personal data breach affecting its personal data, with the information we have;
7. at the end of the Service, delete or return the personal data at the Customer's choice, as described in Customer Data, unless the law requires us to keep it;
8. give the Customer the information needed to show that we meet this section, and allow audits by the Customer or an auditor it appoints who is bound by confidentiality: with reasonable notice, at most once a year unless a breach or a supervisory authority requires more, and at the Customer's cost.

Details of the processing:

• Subject, purpose and duration: providing the Service to the Customer, for as long as the Customer uses it and until the data is deleted as described above.
• Types of personal data: whatever the Customer chooses to put in; typically names, work contact details, employee numbers, job titles, working hours and clock times, approvals and signatures in business records, HR and payroll details, and contact details of the staff of customers and suppliers.
• People concerned: the Customer's Users, employees and contractors, and the staff of its customers and suppliers.
• Location: the European Union (AWS, Frankfurt), or the Customer's own database or storage where it chooses one. Transfers outside the European Economic Area happen only with the safeguards described in the Privacy Policy.

7. Your figures and your decisions

The Service is a software tool. We do not give accounting, audit, tax, legal, financial or investment advice, and the Service does not replace the Customer's own review, its accountants or its auditors.

What the Service produces, including consolidations, eliminations, currency translations, measures, reports and dashboards, depends on the data, mappings, rules, rates and settings the Customer provides or chooses. Exchange rates come from third-party sources, such as the European Central Bank, as those sources publish them.

• The Customer must check everything the Service produces before relying on it.
• The Customer alone is responsible for its financial statements, filings, tax returns and other reports, for compliance with IFRS, US GAAP and other rules, and for the decisions it takes. We are not responsible for decisions taken or actions based on output of the Service.
• The maintenance, purchasing, shipping and sales views are for information only. They are not a system of record for airworthiness, maintenance release, safety or regulatory decisions; use your approved systems and procedures for those.

8. Availability and changes to the Service

We aim to keep the Service available, but we do not promise any level of availability, speed or support. It can be interrupted for maintenance, updates, failures of our providers or other reasons outside our control. We try to announce planned maintenance in the platform.

We may change, suspend or stop any feature. If we decide to stop the whole Service, we will give Customers at least 30 days' notice where reasonably possible, so they can export their data.

9. Third-party services and connected systems

The Service runs on third-party providers and can connect to systems the Customer chooses, such as its ERP, HR or maintenance software, or a carrier's tracking service. We are not responsible for those systems, their availability, their data or changes to them.

When the Customer gives us access details for a connected system, it confirms that it may use that system this way under its agreement with the system's provider, and it authorises us to access the system on its behalf as far as the connection needs. The Customer can withdraw that access at any time by removing or changing the access details.

10. Intellectual property

We, or our licensors, keep all rights in the Service, its software, design and documentation. While a Customer uses the Service, we give it and its Users a limited, non-exclusive, non-transferable right to use the Service for the Customer's internal business purposes, in line with these terms. Reports and exports the Service makes from Customer Data belong to the Customer.

If you send us ideas or feedback, we may use them freely and without any obligation to you. Open-source components in the Service are subject to their own licences.

11. No warranties

We provide the Service “as is” and “as available”. To the extent the law allows, we give no warranties or guarantees of any kind, express or implied, including that the Service will be uninterrupted, timely, secure or error-free, that its output will be accurate or complete, that it will be fit for a particular purpose, or that data will never be lost or corrupted.

12. Limitation of liability

We provide the Service without charge, and these limits reflect that.

• To the extent the law allows, we are not liable for indirect or consequential loss; loss of profit, revenue, savings, business, goodwill or opportunity; loss, corruption or inaccuracy of data; errors in output of the Service or decisions based on it; fines, penalties or claims of authorities or third parties against a Customer; business interruption; or the cost of substitute services.
• Our total liability for all claims together, arising from or related to the Service or these terms, whatever the legal basis (contract, tort or otherwise), is limited to EUR 100. If a Customer pays us under a separate agreement, the limit is the higher of EUR 100 and what it paid us in the 12 months before the event that caused the loss.
• We are only liable if we are given written notice of the failure without delay, with a reasonable period to remedy it, and we still fail to remedy it within that period.
• A claim against us lapses if it is not brought before a court within one year after the claimant became aware, or should reasonably have become aware, of the event that caused it.
• These limits apply to Customers and Users alike, and also protect the people and providers we engage.
• Nothing in these terms limits liability that the law does not allow to be limited, such as liability for our own intent or deliberate recklessness (opzet of bewuste roekeloosheid), or for death or personal injury caused by our negligence.

13. Indemnity

The Customer will indemnify us and hold us harmless against claims of third parties (including its employees, Users, customers, suppliers and auditors, and people whose data is in its Customer Data), and against the related costs, including reasonable legal fees, arising from:

• its Customer Data, or our processing of it in line with the Customer's instructions and these terms;
• a breach of these terms or of the law by the Customer or its Users;
• the Customer's use of output of the Service; or
• the Customer's connected systems and the access details it gave us.

This does not apply to the extent a claim is caused by our intent or deliberate recklessness.

14. Suspension and termination

• A Customer may stop using the Service at any time by telling us. A User may ask us at any time to close their account.
• We may suspend or end the access of a User or Customer, at once where needed, if they break these terms, if there is a security risk, if the law or an authority requires it, or if the Customer stops using the Service. Where we may, we tell the Customer why.
• We may end the Service for a Customer for any reason with 30 days' notice.
• When access ends, the right to use the Service ends and Customer Data is handled as described under Customer Data. The sections on Customer Data, personal data, figures and decisions, intellectual property, warranties, liability, indemnity, law and the general provisions continue to apply.

15. Events outside our control

We are not responsible for failure or delay caused by events outside our reasonable control, such as failures of hosting, network or email providers, cyberattacks despite reasonable security measures, power or internet outages, natural disasters, war, epidemics, strikes or measures of authorities.

16. Changes to these terms

We may change these terms. We will announce material changes by email or in the platform at least 30 days before they take effect, unless a change is required by law or urgently needed for security, in which case it may take effect sooner. A Customer that does not agree may stop using the Service before the change takes effect; using the Service after that date means accepting the change. The date at the top shows the current version.

17. Governing law and disputes

These terms, and every dispute arising from or related to them or to the Service, are governed by the law of the Netherlands. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

We will first try to settle a dispute together. If that fails within 30 days, the dispute will be decided exclusively by the competent court in the Netherlands.

18. General

• These terms, the Privacy Policy and any separate written agreement are the whole agreement about the Service. If they conflict, a separate written agreement comes first, then these terms, then the Privacy Policy.
• We may transfer our rights and obligations under these terms to a company we control or to a new operator of the Service, after telling the Customer. Customers and Users may transfer theirs only with our written consent.
• If a provision is invalid, the rest stays in force, and the invalid provision is replaced by a valid one that comes as close as possible to its purpose.
• If we do not enforce a right at once, we have not given it up.
• We may send notices by email to the Customer's administrators or Users, or in the platform. Send notices to us at [email protected].
• These terms are written in English. A translation is for convenience only; the English text prevails.

19. Contact

Rafael Meulenbelt, Meulenbase, the Netherlands. Email: [email protected].