Version 1.0 of 12 November 2026. This version stays at https://legal.technobyte.ai/groundroster/agreement/2026-11-12; the version in force is at https://legal.technobyte.ai/groundroster/agreement.
This Agreement is a contract between TECHNOBYTE SOFTWARE SRL, a company registered in Romania, with its registered office at Intrarea Busuiocului nr. 4A, Chiajna, Ilfov County, Romania, registered with the Trade Register under number J23/655/23.02.2017, tax identification number RO37096072 ("TECHNOBYTE", "we"), and the organisation in whose name a Subscription is bought ("Customer", "you").
You accept this Agreement when you buy a Subscription in Microsoft Marketplace, accept a private offer there or sign an Order, whichever comes first. Use of the Service without a purchase, for a trial or a pilot, needs an Order signed by both parties. The person who accepts confirms that they have the authority to bind the Customer. The Service is for businesses and other organisations: you confirm that you do not act as a consumer. If you want other terms, write to contact@technobyte.ai before you buy: we can agree them in a private offer.
1. Definitions
"Affiliate" means an entity that controls a party, is controlled by it, or is under common control with it.
"Customer Data" means all data that you or your Users enter into the Service, and the rosters, plans, assignments and reports that the Service produces from it for you.
"Documentation" means the description of the Service in its Marketplace listing and the user guidance that we make available for it, as updated from time to time.
"Fees" means the price of a Subscription.
"Marketplace" means Microsoft Marketplace, operated by Microsoft Corporation and its Affiliates ("Microsoft").
"Order" means a purchase of a Subscription in the Marketplace, a private offer that you accept there with any terms attached to it, or an order document signed by both parties.
"Plan" means the edition of the Service that an Order names, with its limits, such as the number of active employee records.
"Service" means GroundRoster, the software that we provide online for staff rostering, day-of-operations dispatch, ground support equipment and stand planning, listed in the Marketplace as "AVIONIQX Ground Operations".
"Subscription" means your right to use the Service under a Plan for a Subscription Term.
"Subscription Term" means the period for which an Order gives you a Subscription, and each renewal of it.
"Users" means the people you allow to use the Service.
"Working Day" means Monday to Friday, except public holidays in Romania.
2. The Service
2.1 Right to use. During each Subscription Term you may access and use the Service, and let your Users do so, for your own business operations and those of your Affiliates, within the limits of your Plan. This right is non-exclusive and cannot be transferred or sublicensed. You are responsible for what your Users and Affiliates do with the Service as for your own acts.
2.2 A planning tool. The Service calculates and proposes rosters, task assignments and plans from the data and rules that you set. It supports your planners and does not replace their judgement. You review every roster and plan before you publish it or act on it. You alone remain responsible for your operational decisions, for the safety of your operations, and for complying with the working-time, employment, health and safety, aviation and other rules, collective agreements and contracts that apply to you. We do not certify that a roster or plan complies with any of them.
2.3 No safety-critical reliance. The Service is not designed to be the only means of running or securing an operation in which an error or an interruption could lead to death, injury, or damage to aircraft, equipment or other property. You keep your own procedures for operating when the Service is unavailable or its output is wrong.
2.4 Availability and support. We use reasonable efforts to keep the Service available and to answer support requests sent to contact@technobyte.ai, in English, on Working Days. We may interrupt the Service for maintenance and updates. Unless an Order says otherwise, we promise no level of availability, no response or resolution time and no service credits.
2.5 Changes to the Service. We may change the Service at any time, including its functions, its interface, the technology and the suppliers behind it, and the place of hosting within the European Union. During a paid Subscription Term we will not remove a main function of the Service unless security, the law or a supplier's change requires it. If we do remove one, you may end the affected Subscription within 30 days of the change, and we refund the Fees you prepaid for the time after it ends. That is your only remedy for a change to the Service.
2.6 Services of others. The Service runs on Microsoft Azure, signs Users in with Microsoft Entra ID or with a password, and is bought through the Marketplace. We are not responsible for services that others provide to you or control, for your network and devices, or for how your Microsoft tenant is configured. Section 15.2 applies to our own subcontractors.
2.7 Trials and pilots. If we let you use the Service free of charge, for a trial, a pilot or a preview, we may end that use at any time, section 11.1 does not apply to it, and our total liability for it is limited to EUR 1,000, subject to section 12.1.
3. Your responsibilities
3.1 Accounts. You decide who your Users are and what they may do. You keep sign-in details confidential, you set the security of your Users' Microsoft accounts, multi-factor authentication included, in your own Microsoft tenant, and you tell us without delay about any unauthorised use. You are responsible for all use of the Service through your accounts.
3.2 Your data. You are responsible for the accuracy, quality and lawfulness of Customer Data, and for having every right, legal basis, notice and consultation that is needed to put it into the Service, including towards your staff and their representatives. You do not load data that the Service is not built to hold, such as payment card data or medical records. When you ask for support, you do not send us personal data of your staff by e-mail.
3.3 Acceptable use. You and your Users will not: (a) sell, rent or otherwise make the Service available to anyone other than your Users; (b) copy, modify, decompile or reverse engineer the Service, except where the law gives you that right despite this clause; (c) get around the limits of your Plan or any technical or security measure, or test the security of the Service without our written consent; (d) use the Service to build or improve a competing product, or publish tests of its performance; (e) load malicious code, or content that is unlawful or infringes anyone's rights; or (f) use the Service in a way that endangers it or other customers, or that breaks the law, including sanctions and export control rules.
3.4 Plan limits. The Service counts your use against the limits of your Plan and may refuse additions beyond them. If your use exceeds your Plan, you move to a Plan that covers it within 30 days of our notice.
3.5 Records you must keep. The Service is not an archive. You export and keep, in your own systems, the records that the law requires you to keep, such as working-time records.
4. Fees and payment
4.1 Marketplace purchases. For an Order made in the Marketplace, the Fees, the currency, the billing frequency and the Subscription Term are those of the Plan or private offer that you accept. Microsoft invoices you and collects the Fees, as our agent or, in some countries, as a reseller. Payment to Microsoft discharges your debt to us for the amount paid. Microsoft's terms apply to invoicing, payment and taxes.
4.2 No refunds. Fees are due for the whole Subscription Term and are not refundable, except (a) where Microsoft's refund policy for the Marketplace gives you a refund, which at the date of this version is when you cancel within 72 hours of the purchase; (b) where this Agreement says so; or (c) where a law that cannot be set aside by contract requires it.
4.3 Other Orders. For an Order made outside the Marketplace, we invoice the Fees in advance, payable within 30 days of the invoice date in the currency of the Order. Fees exclude value added tax and other taxes, which you pay in addition. If the law requires you to withhold tax from a payment, you increase the payment so that we receive the full amount invoiced. Late amounts bear interest at the statutory penalty rate that Romanian law sets for late payment between professionals. You may not set off or withhold amounts against Fees unless we have accepted your claim in writing or a court has confirmed it.
4.4 Prices. We may change the price of a Plan. A change applies to you from the start of your next Subscription Term.
5. Term, renewal and cancellation
5.1 This Agreement applies from your acceptance until your last Subscription ends, and after that as section 7.5 says.
5.2 Renewal. A Subscription bought in the Marketplace renews for a further Subscription Term of the same length only if automatic renewal is switched on for it in Microsoft's portal, which is your choice. A Subscription under any other Order renews automatically for successive Subscription Terms of the same length, at the prices then current, unless either party gives the other written notice at least 30 days before the current Subscription Term ends.
5.3 Cancellation by you. You may cancel a Subscription at any time: in Microsoft's portal for a Marketplace purchase, or by written notice to us for any other Order. Your access ends when the cancellation takes effect. A cancellation gives no right to a refund and does not release you from Fees due for the rest of the Subscription Term, except as section 4.2 says. Your right to switch to another provider is set out in Annex 3.
6. Suspension
We may suspend your access to the Service, in whole or in part, at once and without liability to you: (a) while Microsoft reports your Subscription as suspended, or while Fees under another Order are more than 15 days overdue after a reminder; (b) where we have reasonable grounds to believe that your use, or one of your accounts, threatens the security or the operation of the Service or of other customers; (c) where you or your Users breach section 3.3; or (d) where the law, a court or an authority requires it. We tell you the reason as soon as we lawfully can, and we restore access when the cause has ended. A suspension does not reduce the Fees or extend the Subscription Term.
7. Termination
7.1 For breach. Either party may terminate this Agreement or an affected Subscription by written notice if the other party materially breaches this Agreement, or breaches it repeatedly, and does not put the breach right within 30 days of a written notice that describes it. If you terminate under this section, we refund the Fees you prepaid for the time after the termination; section 12 applies to anything more.
7.2 By us at once. We may terminate this Agreement or a Subscription by written notice with immediate effect if (a) you repeatedly or seriously breach section 3.3; (b) Fees remain unpaid 30 days after a suspension for non-payment began; or (c) providing the Service to you would break the law, including sanctions rules.
7.3 By us on notice. We may terminate this Agreement or a Subscription without cause by giving you at least 90 days' written notice, for example if we stop offering the Service or a Plan. We then refund the Fees you prepaid for the time after the termination takes effect.
7.4 By you on switching. Annex 3 applies.
7.5 Effects. When a Subscription ends, your right to use the Service ends. Fees that fell due before the end stay due. A termination under section 7.1 by us, or under section 7.2(a) or (b), gives no right to a refund; after a termination under section 7.2(c) we refund the Fees you prepaid for the time after it, unless its cause lies with you. Customer Data is kept, made available and deleted as Annex 3 says. Sections 3.5, 4, 7.5 and 8 to 17, the Annexes as far as they deal with the time after the end, and anything else that by its nature is meant to continue, survive the end of this Agreement.
8. Customer Data and personal data
8.1 Your data stays yours. You keep all rights in Customer Data. You give us the right to host, copy, transmit, display and otherwise process it as far as needed to provide, secure and support the Service and to comply with the law.
8.2 Personal data. Where Customer Data contains personal data, you are its controller and we process it for you as your processor under Annex 1. For personal data that we handle on our own account, such as the details of the person who buys a Subscription and our correspondence with you, our privacy notice at https://legal.technobyte.ai/groundroster/privacy applies.
8.3 Security. We apply the measures described in Annex 2. We may change them as long as the overall level of protection does not decrease.
8.4 Statistics. We may collect technical data about how the Service runs and is used, and use it to operate, secure and support the Service and to check compliance with this Agreement. We may use statistics drawn from it that do not identify you or any person to improve the Service.
8.5 Return and deletion. Annex 3 says how you get a copy of Customer Data and when it is deleted. After a Subscription ends we keep Customer Data for 30 days, during which you can ask us for a copy, and then delete it.
9. Confidentiality
9.1 Each party keeps confidential the non-public information of the other party that it receives under this Agreement and that is marked as confidential or would reasonably be understood to be confidential. It uses that information only to perform this Agreement or to exercise its rights under it, and shares it only with staff, Affiliates, advisers and subcontractors who need it and are bound to protect it.
9.2 This does not cover information that is or becomes public without a breach of this Agreement, that the receiving party already had or develops independently, or that it lawfully receives from someone else. A party may disclose what the law, a court or an authority requires, after telling the other party where the law allows.
9.3 These duties last for the term of this Agreement and for five years after it ends, and for trade secrets for as long as they remain secret. Customer Data is protected by section 8 and Annexes 1 and 2 instead of this section.
10. Intellectual property
10.1 Ours. We and our licensors own the Service, the Documentation, and every improvement, configuration, template and piece of know-how that we create, including while supporting you. You receive only the rights that this Agreement expressly gives you. Open-source components in the Service are licensed under their own terms.
10.2 Feedback. If you or your Users give us suggestions or other feedback, we may use them without restriction and without payment.
10.3 Reference. We may name you as a customer, with your name and logo, on our websites and in our sales material. You may withdraw this permission at any time by e-mail.
11. Warranty
11.1 What we promise. During a paid Subscription Term the Service will work substantially as its Documentation describes.
11.2 Your remedy. If it does not, and you tell us in writing without undue delay, with enough detail for us to reproduce the fault, we correct the fault or give you a reasonable way around it. If we cannot do so within a reasonable time, you may terminate the affected Subscription, and we refund the Fees you prepaid for the time after it ends. To the extent the law allows, these are your only remedies for a fault in the Service; where a fault is also a breach of Annex 1 or of section 8.3, section 12 applies instead of this sentence.
11.3 What is not covered. Section 11.1 does not cover faults caused by Customer Data, by use contrary to this Agreement or the Documentation, by your systems or network, or by services of others.
11.4 Nothing more. Our obligations under this Agreement are obligations of means: we commit to use the skill and care of a diligent software provider, not to achieve a particular result, unless this Agreement expressly says otherwise. Except for section 11.1, and to the extent the law allows, we give no warranty or guarantee of any kind, express, implied or statutory, including of fitness for a particular purpose, of uninterrupted or error-free operation, or that a roster or plan produced with the Service is correct, complete, optimal or compliant with any rule.
12. Limitation of liability
12.1 What is not limited. Nothing in this Agreement excludes or limits a party's liability for damage that it causes intentionally or through gross negligence, for harm to a person's physical or mental integrity or health, or for anything else for which the law does not allow liability to be excluded or limited.
12.2 Excluded losses. Subject to section 12.1, we are not liable, on any legal ground, for: (a) loss of profit, revenue, business, contracts, goodwill or expected savings; (b) the cost of interrupted, delayed or disrupted operations, including costs, penalties or compensation in connection with flights, aircraft, passengers, airlines or airports, and the cost of overtime or replacement staff; (c) damage to aircraft, vehicles, equipment or other property in your operations; (d) loss or corruption of data, beyond restoring it from the backups we hold; (e) fines and penalties imposed on you; (f) claims against you by your staff, your customers or other third parties; or (g) any indirect or consequential loss. Points (d), (e) and (f) do not apply to loss that results from our breach of Annex 1 or of section 8.3; for that loss section 12.3 alone applies.
12.3 Cap. Subject to section 12.1, our total liability for all claims arising out of or in connection with this Agreement from events in any Contract Year, on any legal ground, is limited to the Fees for 12 months of the Subscription that was running on the day of the first of those events: the Fees for its Subscription Term if that term is one year, and otherwise those Fees converted to 12 months. "Contract Year" means each period of 12 months that starts on the day your first Subscription began or on an anniversary of that day.
12.4 How the limits work. The limits in this section apply to all our liability to you, your Affiliates and your Users together, whether in contract, in tort, under an indemnity, under a statutory duty or otherwise, including liability under the Annexes. They also protect our Affiliates, staff and subcontractors. Nobody other than you may bring a claim against us under this Agreement; a claim that concerns your Affiliates or Users is brought by you and falls under the same limits as if the loss were yours.
12.5 Your part. You take reasonable steps to avoid and limit loss, including by keeping the procedures of section 2.3 and the records of section 3.5, and you tell us about a claim without undue delay. We are not liable for loss that you could have avoided by doing so.
12.6 Basis of the price. You accept that the Fees reflect this allocation of risk and that we would not provide the Service at these Fees without it.
12.7 Time limit for claims. Subject to section 12.1, you lose the right to claim compensation for a loss if you do not notify us of the claim in writing, with its grounds, within 12 months of the day you became aware, or should have become aware, of the loss and of the event that caused it. For a loss that consists of a claim made against you, the period starts on the day you receive that claim. This is a forfeiture period (termen de decădere) within the meaning of Article 2.545 of the Romanian Civil Code.
13. Claims by third parties
13.1 Claims about the Service. If a third party claims that the Service infringes its intellectual property rights, or we believe that it might, we may, at our choice and cost, obtain the right for you to keep using the Service, change or replace the Service so that it no longer infringes, or terminate the affected Subscription and refund the Fees you prepaid for the time after it ends. Subject to section 12, this is all we owe you for such a claim.
13.2 Claims about your data and use. You will defend us, our Affiliates, staff and subcontractors against any claim by a third party, including your staff, their representatives and authorities, that arises from Customer Data that is unlawful or infringes a right, from your rosters, plans and operational decisions, or from a breach of this Agreement or of the law by you or your Users. You will pay the damages and costs that result, including reasonable lawyers' fees and, as far as the law allows, fines. We tell you about the claim without undue delay, let you conduct the defence, and help at your cost. You may not settle a claim in a way that imposes an obligation or an admission on us without our written consent. This section does not apply to the extent that a claim results from our breach of this Agreement or of the law.
14. Changes to this Agreement
14.1 We may change this Agreement for a valid reason: a change in the law or in the requirements of an authority, of Microsoft or of the Marketplace; a change to the Service, the Plans, our suppliers or our sub-processors; security; or the correction of an error or of unclear wording.
14.2 We give you at least 30 days' notice of a change, by e-mail or in the Service. A change that is materially to your disadvantage applies to you only from the start of your next Subscription Term that begins after the notice period, unless the law, an authority or Microsoft requires it sooner.
14.3 If you do not agree to a change, you may cancel the Subscription before the change applies to you. If the change is materially to your disadvantage and applies during a Subscription Term that you have paid for, we refund the Fees you prepaid for the time after the cancellation. If you keep using the Service after a change applies to you, you have accepted it. A change to a clause listed in section 17 applies to you only once you have accepted it expressly in writing, for example in a new Order; until then the earlier wording applies to you.
15. General
15.1 Events beyond control. Neither party is liable for a failure or delay caused by an event beyond its reasonable control, such as a failure of Microsoft's cloud, identity or Marketplace services, of telecommunications or power, an attack on computer systems that reasonable security measures did not prevent, an act of an authority, a strike, an epidemic, war or a natural event. This does not excuse a payment. A sub-processor's failure to meet its data protection obligations is not such an event as far as section 6 of Annex 1 makes us answer for it. If such an event stops the Service for more than 60 days in a row, either party may terminate the affected Subscription, and we refund the Fees you prepaid for the time after the termination.
15.2 Assignment and subcontractors. You may not assign or transfer this Agreement, or any right under it, without our written consent. We may assign this Agreement to an Affiliate or to whoever takes over our business or the Service; you agree to that in advance, and the assignment takes effect when we notify you of it. We may use subcontractors and remain responsible for them.
15.3 Sanctions and export. You confirm that you, your Affiliates and your Users are not subject to sanctions of the European Union, the United Nations, the United Kingdom or the United States, and that you will not use the Service in or for a country, an organisation or a person that is.
15.4 Notices. We send notices to the e-mail address of the person who bought the Subscription or of your administrators in the Service. You send notices to contact@technobyte.ai. A notice by e-mail is received on the next Working Day after it is sent.
15.5 The whole agreement. This Agreement, with its Annexes and each Order, is the whole agreement between the parties about the Service and replaces earlier statements about it. You confirm that you have not relied on a statement that is not written in it; this does not limit liability for fraud. Your purchase terms and other conditions do not apply, even if we do not reject them. If documents conflict, this order applies: the terms attached to a private offer or written in a signed Order; Annex 1, for personal data; Annex 3, for switching and exit; the body of this Agreement; Annex 2; the Documentation. The text shown in the Marketplace is part of this Agreement; if the two differ, the version of this Agreement that the text names prevails.
15.6 Microsoft. Microsoft is not a party to this Agreement and has no obligation or liability under it.
15.7 Electronic form and evidence. The parties accept electronic form for this Agreement and for notices under it. The records of the Marketplace and of the Service about your acceptance, your Orders and your use are evidence between the parties, unless they are shown to be wrong.
15.8 Severability and waiver. If a provision of this Agreement is invalid or cannot be enforced, the rest stays in force and that provision applies to the fullest extent the law allows. A party gives up a right only in writing.
15.9 No third-party rights. The parties are independent contractors. Nobody other than the parties has rights under this Agreement, except that section 12 also protects the persons it names.
15.10 Language. This Agreement is made in English. A translation is for convenience only.
16. Law and courts
16.1 Romanian law governs this Agreement and any non-contractual obligation connected with it, without regard to its conflict-of-law rules. The United Nations Convention on Contracts for the International Sale of Goods does not apply.
16.2 The courts that have jurisdiction at TECHNOBYTE's registered office in Romania have exclusive jurisdiction over any dispute arising out of or in connection with this Agreement. If your registered office is in a Member State of the European Union or in a State bound by the Lugano Convention, we may also bring proceedings against you in the courts of that place. Either party may ask any competent court for interim or protective measures.
17. Clauses you expressly accept
In accordance with Article 1.203 of the Romanian Civil Code, you declare that you have read and understood, and that you expressly accept: sections 2.2, 2.3 and 2.6 (what we are not responsible for), 2.4 (no service levels), 2.5 (changes to the Service; your only remedy), 2.7 (trials and pilots), 4.2, 5.3 and 7.5 (no refunds), 4.3 (no set-off), 5.2 (automatic renewal), 6 (suspension), 7.2 and 7.3 (termination by TECHNOBYTE), 11 (one warranty; your only remedies), 12 (limitation of liability and the time limit for claims), 13 (infringement claims; your duty to defend us and to pay), 14 (changes to this Agreement), 15.1 (events beyond control), 15.2 (assignment), 15.5 (no reliance on other statements), 15.7 (electronic form and evidence) and 16 (Romanian law and the Romanian courts); in Annex 1, sections 5, 6 and 12 (security measures accepted; sub-processors; liability); in Annex 3, sections 6 to 8 (deletion 30 days after the end; no refund when you switch).
Annex 1: Data processing terms
These terms apply where we process personal data in Customer Data for you. They are the contract that Article 28 of Regulation (EU) 2016/679 (the "GDPR") requires. Words that the GDPR defines have the same meaning here.
Roles. You are the controller of the personal data, or you act for its controller with its authority. We are the processor.
The processing.
Subject matter and purpose: providing the Service to you: storing Customer Data, calculating and showing rosters, task assignments and plans, sending notifications inside the Service, keeping the audit trail, and looking into your data when you ask us for support.
Duration: the Subscription Term and the time until deletion under Annex 3.
Nature: hosting, storage, calculation, display, transmission to your Users, deletion.
Data subjects: your employees, agency workers and contractors, and your other Users.
Types of personal data: identification and contact details (employee number, name, e-mail address, phone number); employment details (team, contract type and hours, hire date, agency); account data (e-mail address, display name, role, sign-in identifiers, password hash); qualifications and their validity; shifts, tasks, working times and shift swaps; preferences; leave requests and attendance, with their type, dates and comments; photos uploaded as proof of a task; notifications; and audit entries (who did what and when, with the IP address for password sign-ins).
Special categories: the Service does not need special categories of personal data. Leave types and absence reasons, such as sick leave, can reveal information about health. You decide whether to record them, and you are responsible for the legal basis.
Your instructions. We process the personal data only on your documented instructions. This Agreement and your use and configuration of the Service are your complete instructions; any other instruction needs our written agreement and may be charged. We may also process the data where the law of the European Union or of a Member State to which we are subject requires it, and we tell you beforehand unless that law forbids it. We tell you immediately if we think an instruction infringes data protection law. We have no duty to check your instructions for their lawfulness.
Our people. The persons we authorise to process the personal data are bound to confidentiality.
Security. We take the measures that Article 32 of the GDPR requires of a processor. At the date of this version they are the measures in Annex 2. A fuller description, which also says what is not in place, is available from us on request, in confidence, before you buy. You have assessed the measures, with those limits, and accept them as appropriate to the risk of the processing that you intend.
Sub-processors. You give us a general authorisation to engage sub-processors. Those engaged at the date of this version are listed in Annex 2. We tell you at least 30 days before we add or replace one, by e-mail or in the Service. You may object in writing within 14 days, on reasonable grounds that relate to data protection. If we cannot resolve your objection, you may terminate the affected Subscription before the change takes effect, and we refund the Fees you prepaid for the time after the termination; that is your only remedy. We bind each sub-processor by contract to data protection obligations equivalent to these terms, and we remain fully liable to you for the performance of its data protection obligations, up to the limit of section 12.3 of the Agreement.
Location and transfers. We store Customer Data in the European Union. You instruct us to allow the sub-processors of Annex 2 to transfer personal data outside the European Economic Area where their terms provide for it, under a transfer mechanism that Chapter V of the GDPR allows. We make no other transfer without your instruction.
Helping you. Taking into account the nature of the processing:
Requests from data subjects that reach us are passed on to you; we do not answer them ourselves. The Service gives you functions to view and correct the data and to export reports. Where a request needs something for which the Service has no function, we carry it out on your written instruction within a reasonable time, as far as this is possible.
We assist you in meeting your obligations under Articles 32 to 36 of the GDPR (security, breach notification, data protection impact assessments, prior consultation), taking into account the information available to us.
Help that goes beyond the functions of the Service and our standard documents may be charged at our current rates.
Personal data breach. We notify you without undue delay after we become aware of a personal data breach that affects your data, with the information we have, and we update you as we learn more. Our notice is not an admission of fault or liability.
End of the processing. Annex 3 applies. After the Subscription ends we keep the personal data for 30 days, give you a copy if you ask within that time, and then delete it. Copies in backups are overwritten within a further 35 days. We may keep data that the law requires us to keep.
Showing compliance. On request, and not more than once a year unless a personal data breach has occurred or an authority requires it, we give you all information necessary to show that we comply with these terms, starting with our security documentation and written answers to reasonable questions. If that is not enough, you may audit our compliance, yourself or through an independent auditor who is bound to confidentiality and is not our competitor, on 30 days' notice, during working hours, without disturbing our operations and at your cost, including our time at our current rates. An audit does not extend to the premises or systems of Microsoft; for those we give you the audit reports and certifications of Microsoft that are available to us.
Liability. Section 12 of the Agreement applies to our liability under this Annex. Nothing in this Agreement limits the rights of data subjects or the powers of authorities. Each party bears the fines imposed on it for its own infringement; section 13.2 of the Agreement applies to a fine imposed on us because of yours, as far as the law allows.
Your obligations. Section 3.2 of the Agreement applies. You give us only instructions that the law allows.
Annex 2: Security measures and sub-processors
Measures at the date of this version
Hosting and location. Microsoft Azure, in TECHNOBYTE's own subscription. The database and its backups are in the Azure region France Central; the application, its technical logs and its secrets are in Germany West Central. An Azure policy limits resources to these two regions.
Encryption. In transit between browsers and the Service, and between the application and the database: TLS 1.2 or higher. At rest: Azure's storage encryption, with keys managed by Microsoft.
Separation of customers. Every record belongs to one organisation. The application checks on each request that the caller belongs to that organisation, and automated tests verify this.
Access. Users sign in with their organisation's Microsoft account or with a password, which is stored only as a hash. Repeated failed sign-ins are blocked for a time. Roles limit what each User can do. Nobody at TECHNOBYTE has standing access to the production database. The application and the deployment pipelines use Azure identities without passwords, and secrets are kept in Azure Key Vault. Changes that TECHNOBYTE support makes in your organisation are written to your audit trail; reading is not recorded.
Logging. An audit trail in the Service records sign-ins and changes. Technical logs are kept for 30 days.
Backups. Point-in-time backups of the database, kept for 35 days in the same region as the database.
Development. Changes are built, tested and scanned automatically before they are deployed: automated tests, a scan for secrets, a dependency audit and a vulnerability scan of the container image.
Incidents. A written incident procedure.
TECHNOBYTE holds no security certification of its own. A fuller description of these measures, which also says what is not in place, is available from us on request, in confidence.
Sub-processors at the date of this version
| Sub-processor | Service | Location |
|---|---|---|
| Microsoft Ireland Operations Limited (Ireland) | Hosting on Microsoft Azure: application, database, backups, logs, secrets | France Central (France) and Germany West Central (Germany) |
| Microsoft Ireland Operations Limited (Ireland) | Sign-in with Microsoft Entra ID, in your own Microsoft tenant | As set by your Microsoft tenant |
Another supplier in the delivery chain. GitHub hosts the source code of the Service and runs its build and deployment pipelines. It stores no Customer Data. While a deployment runs, its pipeline holds administrative credentials to the infrastructure.
Annex 3: Switching and exit
This Annex sets out your rights under Chapter VI of Regulation (EU) 2023/2854 (the "Data Act") and what happens to Customer Data when a Subscription ends. Sections 1 to 3 of this Annex apply where, and as far as, Chapter VI of the Data Act applies to the Service and to you; that Chapter does not apply to a free trial, pilot or preview that is a non-production version for testing and evaluation for a limited time. Sections 4 to 10 of this Annex apply to every Subscription.
Your right to switch. You may at any time notify us in writing that you want to do one or more of the following: (a) switch to a service of the same type from another provider, giving us that provider's details; (b) move to your own infrastructure; (c) have your exportable data erased. Your notice starts a notice period of two months.
Transition. When the notice period ends, a transition period of up to 30 calendar days begins. You may extend it once, by written notice, to a period that you consider more appropriate. During the notice period and the transition period this Agreement stays in force, the Fees remain due, and we: (a) give you, and third parties you authorise, reasonable assistance; (b) act with due care to maintain business continuity and keep providing the Service; (c) tell you about the risks to continuity on our side that we know of; (d) keep the security of Annex 2 in place, including during the transfer and during the retrieval period; and (e) support your exit strategy for the Service, including by giving you all relevant information. If the transition cannot technically be completed in 30 days, we tell you within 14 Working Days of your notice, explain why, and name another period of not more than seven months; the Service continues throughout that period.
If your Subscription Term would end before the transition period ends, say so in your notice. We then keep the Service open for you until the transition period ends, and you pay the Fees for that extra time pro rata to the price of your Plan. If you cancel the Subscription in the Marketplace before the transition period has ended, the notice period and the transition period end on that day and the retrieval period starts.
End of the contract. The Subscription and this Agreement are considered terminated, and we tell you so, (a) when the switch is complete, or (b) at the end of the notice period, if you chose erasure only. We then cancel the Subscription in the Marketplace, or ask you to.
What you can take with you. All Customer Data: your organisation, stations and settings, including the rules and settings you entered; employee records, user accounts and roles; qualifications; preferences; shift templates, patterns, roster periods and assignments; shift swaps; demand data; flights and aircraft visits; tasks, their assignments and actual times; leave and attendance; equipment and stand data and plans; notifications; the audit trail; and uploaded photos. This list is complete. The Service has export functions for reports, in CSV and PDF. On request we also give you a complete copy in a structured, commonly used and machine-readable format (CSV or JSON files, and image files for photos): in a switch before the transition period ends, and otherwise within 30 days of your request. You bring no digital assets of your own into the Service, so there are none to port.
What is not exported. Data that is specific to how the Service works inside and whose disclosure would put our trade secrets or security at risk: internal logs, security settings, password hashes and tokens, and the software and the solver's own built-in calculation rules and configuration. Identifiers needed to link exported records to each other, and the rules and settings you entered, are exported.
Retrieval period. For 30 calendar days after the transition period ends, or after a Subscription ends in any other way, we keep Customer Data and give you the copy described in section 4 of this Annex if you ask for it in writing. We do not erase the data before we have given you a copy that you asked for in that time. Access to the Service itself ends when the Subscription ends.
Erasure. After the retrieval period we erase all Customer Data from the Service. Copies in backups are overwritten within a further 35 days. A record that the Subscription existed and that its data was erased remains. On request we confirm the erasure in writing.
Charges. We charge nothing for switching or for the copy. Work that goes beyond this Annex, such as converting data to another provider's format, loading it there, or further copies, is charged at a price agreed with you in advance. The Fees for the Service continue to apply until the contract terminates. A Subscription Term is a fixed term: the Fees for it are the price of that term and stay due in full if the contract ends under this Annex before the term does. We impose no other charge or penalty for leaving early.
Information. The procedures, formats and data structures for export, and the restrictions and technical limits that we know of, are described at https://legal.technobyte.ai/groundroster, which we keep up to date. At the date of this version the infrastructure of the Service is in France and Germany, is provided by Microsoft Ireland Operations Limited, whose parent company is established in the United States, and is operated by us from Romania. It is subject to the law of the European Union, of France, of Germany and of Romania. The current place and jurisdiction, and a description of our measures against access to non-personal data by authorities of third countries, are at the same address.
Good faith. Both parties, and the new provider, cooperate in good faith to make the switch work.