End-User License Agreement

This translation is provided for convenience. If the language versions differ, the Polish version prevails.

This End-User License Agreement ("Agreement") is a legal agreement between you and Mateusz Janicki, publishing as EVoApps as an unregistered activity (działalność nierejestrowana), ul. Opacka 23/62, 80-330 Gdańsk, Poland ("Service Provider"), for the EVoShift apps for Android and iOS, the web app at evoshift.app and the services behind them ("Application").

By downloading, installing or using the Application, you agree to be bound by this Agreement. If you do not agree, do not download, install or use the Application.

1. License grant

The Service Provider grants you a personal, non-exclusive, non-transferable, limited license to use the Application on devices that you own or control, as permitted by the usage rules of the App Store or Google Play where you obtained it. A business may let its staff use the Application for its own operations.

2. Restrictions on use

You shall not, and shall not permit others to:

• license, sell, rent, lease, assign, distribute, transmit, host, outsource, disclose or otherwise commercially exploit the Application;
• modify, make derivative works of, disassemble, decrypt, reverse compile or reverse engineer any part of the Application, except as permitted by law;
• access data of a workplace you have not been invited to, or try to get around the Application's permissions;
• remove, alter or obscure any proprietary notice of the Service Provider or its licensors.

3. Your content and responsibilities

Data you enter remains yours or your employer's. A business using the Application is responsible for having a legal basis for the staff data it records, for informing its staff, and for keeping the employment records required by law.

Pay and cost calculations (gross and net pay, contributions, tax advances, employer cost, labour percentages) are estimates based on the data entered and the rules known to the Application at the time. They are a planning aid, not payroll, tax or legal advice. The business remains responsible for its payroll, tax returns and contributions and should check the figures before relying on them.

4. Intellectual property

The Application, including all copyrights, patents, trademarks, trade secrets and other intellectual property rights, is and shall remain the sole and exclusive property of the Service Provider.

5. Availability and changes

The Application is provided as is. The Service Provider works to keep it available and correct but does not guarantee uninterrupted or error-free operation, and may change or discontinue features.

6. Termination

This Agreement remains in effect until terminated by you or the Service Provider. You can stop using the Application and ask for your account to be deleted at any time. The Service Provider may suspend or terminate this Agreement for breach of it, or otherwise with reasonable notice.

7. Limitation of liability

To the maximum extent permitted by applicable law, the Service Provider shall not be liable for any special, incidental, indirect or consequential damages arising out of or related to your use of or inability to use the Application, including decisions taken on the basis of its calculations. Nothing in this Agreement limits liability that cannot be limited by law, or the rights of consumers under mandatory law.

8. Changes to this Agreement

The Service Provider may modify this Agreement. Material changes will be announced in the Application in advance; by continuing to use the Application after they take effect, you agree to the revised terms.

9. Data processing agreement (annex)

This annex is the data processing agreement under Art. 28 GDPR between the business using the Application ("Customer", controller) and the Service Provider (processor). It applies automatically when a Customer enters personal data of its staff or other persons into the Application.

1. Subject and duration. The Service Provider processes personal data to provide the Application for as long as the Customer's account exists, and afterwards only to delete it as set out in point 9.
2. Nature and purpose. Storing, organising, displaying, calculating, printing, sending and deleting data needed for rosters, working time, shift swaps, availability, absences, pay and cost calculations, reports and team management.
3. Data and data subjects. The Customer's staff and invited users: names, e-mail addresses, profile photos, roles and permissions, employment dates, shifts and working time, availability, absences (including sick leave, which is health data), pay rates, contract and payroll details, bonuses and deductions, phone numbers, addresses and bank account numbers. The Customer should not enter other special categories of data, and should keep absence reasons and attachments to what labour law requires.
4. Instructions. The Service Provider processes the data only on the Customer's documented instructions - these terms and the Customer's use of the Application's functions - unless EU or member state law requires otherwise, in which case it informs the Customer of that legal requirement before processing, unless that law forbids it. It informs the Customer if it believes an instruction infringes data protection law.
5. Confidentiality. Anyone authorised to process the data is bound to confidentiality.
6. Security. The Service Provider takes the measures required by Art. 32 GDPR, including encryption in transit and at rest, isolation of each workplace's data, access control by role and permission, separate storage of pay and contact details, tested access rules and monitoring of known vulnerabilities.
7. Sub-processors. The Customer gives general authorisation for the sub-processors listed in the privacy policy (Google, Apple, Twilio SendGrid). The Service Provider announces intended additions or replacements at least 14 days in advance on that page and in the Application; the Customer may object and, if no solution is found, terminate the agreement. Sub-processors are bound by equivalent data protection obligations; transfers outside the EEA rely on the EU-US Data Privacy Framework or the Commission's Standard Contractual Clauses.
8. Assistance. The Service Provider helps the Customer, as far as possible through the Application's functions (viewing, editing, printing, deleting), to answer data subjects' requests and to meet its obligations under Art. 32-36 GDPR. It notifies the Customer of a personal data breach without undue delay, and at the latest within 48 hours of becoming aware of it, with the information then available.
9. End of processing. When the Customer deletes its account or workplace, the data is deleted from the active systems, and from backups when they expire, unless law requires keeping it. Before that, the Customer can print or save its working-time and payroll reports.
10. Information and audits. The Service Provider makes available the information needed to demonstrate compliance with Art. 28 GDPR and allows for and contributes to audits by the Customer or an auditor it mandates, with reasonable notice and at the Customer's cost, primarily through written information and its providers' certifications.

10. Governing law and contact

This Agreement is governed by Polish law, without prejudice to mandatory consumer protection in your country of residence. Questions about this Agreement: contact@evoshift.app.