Terms and conditions

1. Who we are

SubstrX is an online platform of ProjectNet (sole proprietorship), located at Meidoornlaan 3, 4286 CV Almkerk, the Netherlands, registered with the Dutch Chamber of Commerce under number 98078062, VAT number NL005208277B54 ("we"). Contact: support@substrx.com.

2. Definitions

Service: the online platform SubstrX, used to record coating inspections and to produce and share reports.

Customer: the company or organisation (the firm) that creates an account and enters into the agreement with us.

User: any person with an account within the customer's firm, such as the owner and invited colleagues.

Customer data: all data that the customer or users enter or upload in the service, such as projects, measurements, photos, documents, contacts and reports.

3. Applicability

These terms apply to all use of the service and to every agreement between us and the customer. The customer's own general terms and conditions do not apply.

The service is intended exclusively for professional use by companies and organisations, not for consumers. By creating an account, the customer declares that it acts in the course of a profession or business.

The person who creates the account declares that they are authorised to represent the customer.

4. Account and users

The agreement is concluded as soon as the customer has created an account, accepted these terms and confirmed the email address.

Login details are personal. An account may not be used by more than one person. The customer ensures that users comply with these terms and is responsible for all use through the firm's accounts.

The customer reports any misuse or suspected misuse of an account to us immediately.

5. Trial period, subscription and prices

A new firm can use the service free of charge for the first 30 days (trial period), without registering a payment method. During or after the trial period the customer can take out a monthly or yearly subscription and register a payment method. Nothing is charged during the trial period; a subscription taken out after the trial period starts immediately.

If the customer has taken out a subscription during the trial period, it starts automatically after the trial period and the first term is charged, unless the customer cancels no later than the last day of the trial period. Cancelling during the trial period is free of charge and can be done in the account or by email. In that case we send a reminder by email no later than 7 days before the trial period ends.

If the customer has not registered a valid payment method at the end of the trial period, access is limited to viewing existing data until a subscription is taken out.

A subscription is per user and is taken out monthly or yearly. The applicable prices are shown on the pricing page and exclude VAT. The number of users on the subscription follows the number of users in the firm; if a user is added or removed during a term, this is charged or credited pro rata on the next invoice.

A monthly subscription is tacitly renewed for one month at a time and can be cancelled at any time with effect from the end of the current month. A yearly subscription is tacitly renewed for one year and can be cancelled with effect from the end of the current yearly term.

We may change the prices. We announce a price increase at least 30 days in advance. If the customer does not agree, the customer can cancel the subscription with effect from the date on which the increase takes effect.

6. Payment

Before the first payment, the customer enters its company details completely and correctly: company name, address, country, the registration number from the business register and, for a customer in the European Union, the VAT number. We check VAT numbers in VIES, the VAT Information Exchange System of the European Commission. For a customer in another EU member state with a valid VAT number, the reverse charge applies and the customer accounts for the VAT; without a valid VAT number we charge Dutch VAT. We do not charge Dutch VAT to a customer outside the EU. The customer reports changes to these details in good time.

Subscriptions are invoiced in advance for each term and collected automatically using the registered payment method. Payments are processed by our payment service provider Stripe; we do not receive or store card or account details ourselves. The customer receives invoices electronically, by email and in subscription management. An invoice that cannot be paid automatically must be paid within 14 days of the invoice date.

In case of late payment we may, after a reminder, suspend access to the service until payment has been made in full. Customer data is retained during that period.

7. Use of the service

The customer uses the service only to record inspections and to produce and share reports, and complies with the law in doing so.

It is not permitted to: (a) use the service for spam, phishing or unsolicited messages, including via report emails or invitations; (b) store or share content that is unlawful or infringes the rights of others; (c) circumvent or test security, limits or access restrictions without our written permission; (d) read out or load the service in an automated way, or disrupt its operation; (e) copy, imitate or reverse engineer the software, except where the law permits.

Limits apply to ensure fair and secure use, including on storage (fair use: 25 GB per user), file size, the number of changes, uploads, invitations and emails per unit of time. We may adjust these limits where necessary for the security or continuity of the service.

In the event of a breach of this article we may suspend access immediately and, in the event of a serious or repeated breach, terminate the agreement.

8. Reports, standards and responsibility

The service is a tool. Calculations, checks, limit values and standard texts support the inspector but do not replace professional judgement. The customer and the inspector remain fully responsible for the accuracy of measurements, assessments, conclusions and the content of every report, and for the decision to finalise and send a report.

References to standards and guidelines (such as ISO, EN, NACE, SSPC and ASTM) are for identification only. The service contains no texts of standards and does not replace the standards. The customer ensures that users have the applicable version of the standards they apply. We do not guarantee that interpretations, limit values or test methods in the service are correct, complete or up to date.

The service is not a certification or inspection body. Reports are drawn up by and under the responsibility of the customer, not by ProjectNet.

A share link gives anyone who has the link access to the report, list of non-conformities or handover dossier for which the link was created, without an account. The customer decides with whom the link is shared and can revoke it. Emails with reports, lists of non-conformities and handover dossiers to contacts are sent on behalf of the customer; the customer ensures that it may email those contacts and that the addresses are correct.

9. Data and intellectual property

Customer data remains the customer's. The customer permits us to store, process and display customer data to the extent necessary to provide, secure and improve the service. We do not use customer data for other purposes and do not sell it.

All rights to the service, the software, the design and our own texts remain with us or our licensors. For the duration of the agreement, the customer receives a non-exclusive, non-transferable right to use the service.

The customer declares that it holds the rights to the data, photos, logos and documents it uploads.

10. Privacy and security

For personal data in the customer data, the customer is the controller and we are the processor. The data processing agreement in the annex below forms part of these terms.

For data we process as controller ourselves, such as account data, our privacy and cookie statement applies.

We take appropriate technical and organisational measures to secure customer data, including encrypted connections, access restriction per firm and abuse prevention.

11. Availability and maintenance

We make every effort to keep the service available, but do not guarantee uninterrupted or error-free operation. We carry out maintenance outside office hours where possible.

We may change and improve the service. We do not remove essential functions that the customer uses without timely prior notice.

We take reasonable measures against data loss, but cannot guarantee recovery in all cases. We advise the customer to keep its own copy (PDF) of final reports.

12. Liability

Our total liability is limited to the amount the customer paid for the service in the 12 months before the event causing the damage. During the trial period our liability is limited to € 100.

We are not liable for indirect damage, including consequential loss, lost profit, lost savings, damage due to business interruption, loss of data and damage resulting from decisions made on the basis of reports or calculations from the service.

These limitations do not apply in the event of intent or wilful recklessness on the part of our management.

Any right to compensation lapses if the customer has not reported the damage to us in writing within 12 months after it arose.

The customer indemnifies us against claims by third parties, including the customer's clients and contacts, relating to customer data, the content of reports or use of the service in breach of these terms.

13. Force majeure

We are not obliged to perform if this is impossible due to force majeure. Force majeure also includes failures or outages at our suppliers and hosting providers, internet or power failures, and cyber attacks despite reasonable security.

14. Term and termination

The agreement is entered into for an indefinite period and ends by cancellation under article 5, including during the trial period.

We may terminate the agreement with 3 months' notice, or immediately in the event of the customer's bankruptcy or a serious breach of these terms.

After the agreement ends, the customer can still view the customer data and save reports as PDF for 30 days. After that we delete the customer data within 60 days, including from backups, unless the law requires us to keep it longer.

15. Changes to these terms

We may change these terms. We announce material changes at least 30 days before they take effect, by email or in the service. If the customer does not agree, the customer can terminate the agreement with effect from the date the change takes effect.

16. Final provisions

If a provision of these terms is void or voidable, the other provisions remain in force. The void provision is replaced by a valid provision with as nearly as possible the same purpose.

We may transfer the agreement to a successor of the service; we will inform the customer about this.

These terms and the agreement are governed by Dutch law. Disputes are submitted to the competent court of the District Court (rechtbank) of Zeeland-West-Brabant, the Netherlands.

These terms are also available in Dutch, German and French. In case of differences, the Dutch text prevails.

Annex: Data processing agreement

1. Roles. For personal data in the customer data, the customer is the controller and we are the processor within the meaning of the General Data Protection Regulation (GDPR).

2. Subject and duration. We process personal data only to provide the service, for as long as the agreement runs and until the data has been deleted in accordance with article 14.

3. Types of data and data subjects. Names, email addresses and job details of users, inspectors and contacts of the customer and its clients; qualifications and certificates of inspectors; photos and documents that may show persons or contain personal data; and any further data the customer enters. The customer does not enter special categories of personal data unless strictly necessary for the inspection.

4. Instructions. We process personal data only on the documented instructions of the customer. This agreement and the customer's use of the service constitute those instructions. We inform the customer if, in our opinion, an instruction infringes the GDPR.

5. Confidentiality. Everyone who has access to personal data on our behalf is bound by confidentiality.

6. Security. We take appropriate technical and organisational measures in accordance with article 32 GDPR, including: encrypted connections (HTTPS), separation of data per firm with access rules in the database, passwords stored in encrypted form, access limited to administrators who need it, limits against abuse, and storage in data centres in the EU.

7. Sub-processors. The customer gives general authorisation to engage sub-processors. The current sub-processors are listed below. We announce a new or replacement sub-processor at least 30 days in advance; the customer may object on reasonable grounds and, if we offer no solution, terminate the agreement. We impose the same obligations on sub-processors as in this data processing agreement.

Supabase Inc. (US): database, file storage and sign-in. Data is stored in an EU data centre (Frankfurt, Germany).

Vercel Inc. (US): hosting of the website and the app. Processing takes place in the EU (Frankfurt) where possible; Vercel's global network may handle requests via other locations.

Resend Inc. (US): sending emails, such as confirmations, invitations and report emails.

Cloudflare Inc. (US): security check (Turnstile) against automated abuse when signing up and logging in, and storage of a daily backup of files (photos, documents, logos) in an EU data centre.

GitHub Inc. (US, part of Microsoft): management of the source code and running the daily backup job. Files are only passed through to the backup, not stored at GitHub.

Stripe Payments Europe, Ltd. (Ireland): payments, subscriptions and invoices. Payment details go directly to Stripe; Stripe is also a controller in its own right for processing payment details and preventing fraud.

8. Transfers outside the EU. Some sub-processors are established in the United States. Transfers take place on the basis of the EU-US Data Privacy Framework or the standard contractual clauses of the European Commission, with supplementary measures where necessary.

9. Data subject rights. We forward requests from data subjects to the customer. We reasonably assist the customer in responding to such requests; the customer can view, change and delete much of the data itself in the service.

10. Data breaches. We notify the customer of a personal data breach without undue delay and no later than 48 hours after discovering it, with the information the customer needs for any notification to the supervisory authority and data subjects.

11. Assistance and audits. On request we provide the customer with the information needed to demonstrate compliance with article 28 GDPR and reasonably cooperate with a data protection impact assessment. An audit by an independent expert is possible by arrangement, at the customer's expense, at most once a year, unless there are indications of a serious shortcoming.

12. End. After the agreement ends we delete the personal data in accordance with article 14, unless the law requires us to keep it. On request we confirm the deletion.

13. Liability. The liability provisions of article 12 apply to this data processing agreement, to the extent permitted by law.