WTMS Terms of Service
§ 1. General provisions
- These terms of service (the Terms) set out the rules for the provision by electronic means of the services of the WTMS system: a platform for managing field work, working time, photographic documentation, equipment and materials. These are the terms referred to in Article 8 of the Act of 18 July 2002 on the Provision of Electronic Services (ustawa o świadczeniu usług drogą elektroniczną).
- The service provider is inProjects spółka z ograniczoną odpowiedzialnością sp. k., with its registered office in Szczecin, ul. Harcerzy 3, 71-465 Szczecin, entered in the register of entrepreneurs of the National Court Register (KRS) kept by the District Court Szczecin-Centrum in Szczecin, 13th Commercial Division of the National Court Register, under KRS number 0000650754, NIP 854-240-20-87, REGON 321193708 (inProjects or we).
- Contacting inProjects:
- general matters: [email protected], tel. +48 91 886 18 38,
- technical support and complaints: [email protected],
- personal data protection (Data Protection Officer): [email protected],
- correspondence address: ul. Harcerzy 3, 71-465 Szczecin.
- The Services are intended exclusively for entrepreneurs and other entities conducting business or professional activity who use them in connection with that activity. The Services are not intended for consumers within the meaning of Article 221 of the Polish Civil Code (Kodeks cywilny). A person concluding the Agreement on behalf of the Customer represents that they are duly authorised to do so.
- The Terms are made available free of charge at https://wtms.app/en/terms/ in a form that allows them to be downloaded, stored and printed.
- If inProjects and the Customer have concluded a separate agreement in written or electronic form (e.g. an implementation agreement, a pilot agreement or an individual offer), its provisions take precedence over the Terms. In all other respects the Terms apply.
§ 2. Definitions
Capitalised terms used in the Terms have the following meanings:
- Platform or WTMS
- the WTMS software made available by inProjects in the SaaS model. It comprises the web panel, the Mobile Application, workstation applications (kiosk, warehouse tablet) and application programming interfaces (API).
- Mobile Application
- the WTMS application for Android and iOS devices, made available in the Google Play and App Store stores or in another manner indicated by inProjects.
- Website
- the inProjects websites dedicated to WTMS in the wtms.app domain, including the information page, the Demo Instance registration form and the login gateway login.wtms.app.
- Customer
- an entrepreneur or other entity referred to in § 1(4) that has concluded the Agreement with inProjects or registered a Demo Instance.
- Instance
- a separate environment of the Platform assigned to the Customer, with its own database, available at an address in the wtms.app domain. One or more Organisations may operate within an Instance.
- Organisation
- a logically separated part of an Instance (e.g. a company, a branch or a project) with a separate set of data, Users and permissions.
- Demo Instance or Demo
- a free, time-limited test Organisation set up independently via a form on the Website, on the terms described in § 5.
- User
- a natural person to whom the Customer has granted access to the Platform, in particular an employee, associate or subcontractor of the Customer.
- Customer Administrator
- a User to whom the Customer has granted permissions to manage the Organisation, Users, roles and configuration.
- Account
- the set of a User’s data and permissions in the Platform, accessible after authentication by password, QR code, RFID card or another method made available in the Platform.
- Agreement
- the agreement for the provision of the Services concluded between inProjects and the Customer on the terms of the Terms, also comprising the Annexes, the Price List and the accepted Order.
- Order
- the selection of a Plan, a billing period and any additional services made by the Customer on the Website or in the Platform, or confirmed by the parties in another manner.
- Subscription
- a paid, renewable right to use the Platform within the scope of the selected Plan.
- Plan
- a variant of the Subscription specifying the fee and limits, in particular data storage space, the number of User Accounts, the annual number of new tasks, the number of address points, the number of equipment and material records, the maximum file size and the data retention period.
- Price List
- the current list of Plans, fees and limits published on the Website.
- Customer Data
- all data and content entered into the Platform by the Customer or Users or generated in the Platform on their behalf, including photographs, photograph metadata, working time records, orders, addresses, forms, documents and personal data.
- Payment Provider
- an entity providing payment services through which the Customer pays for the Subscription (§ 8(3)).
- Business Days
- Monday to Friday, excluding statutory public holidays in Poland.
- GDPR
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation).
- Privacy Policy
- the document published at https://wtms.app/en/privacy/ describing the processing of personal data in connection with WTMS.
§ 3. Types and scope of the Services
- Under the Terms, inProjects provides the following services (the Services):
- provision of the Platform under the Subscription, within the scope of the Plan and the modules made available to the Customer. In particular, this includes:
- recording of working time and attendance (including via a kiosk with an RFID reader),
- handling of orders and tasks,
- photographic documentation with geolocation and a photo map (PhotoGIS),
- records of equipment, tools, materials and the warehouse,
- records of fuel and expenses,
- import of projects from files and spreadsheets,
- export of data and documentation,
- provision of the Mobile Application to the Customer’s Users,
- the Demo Instance (§ 5),
- technical support (§ 12),
- information services on the Website: provision of content about WTMS, a contact form and scheduling of meetings.
- provision of the Platform under the Subscription, within the scope of the Plan and the modules made available to the Customer. In particular, this includes:
- The current description of functions and modules is available on the Website and in the Platform documentation. The scope of functions available to the Customer depends on the Plan and the agreed modules.
- Additional services, such as implementation, training, data migration, bespoke integrations or software development work, are provided on the basis of a separate Order or agreement.
- inProjects may make available functions marked as test functions (“beta”, “preview”). Such functions may be changed or withdrawn without observing the periods set out in § 12(5).
§ 4. Technical requirements
- The following are required to use the Platform:
- a device with internet access,
- a current version of Google Chrome, Mozilla Firefox, Microsoft Edge or Safari with JavaScript enabled and with the cookies necessary for the panel to function enabled,
- an active e-mail address,
- for the Mobile Application: a device running Android or iOS in the version indicated in the app store, with a camera and a GPS receiver; an internet connection is required to transmit data,
- for a kiosk or warehouse tablet: a device and an RFID reader compliant with the requirements provided by inProjects.
- The Mobile Application may operate in offline mode. Data saved offline are stored on the device and transmitted to the Platform once the connection is restored. Until they are transmitted, the holder of the device is responsible for them.
- The Customer and Users are prohibited from supplying unlawful content, including content that infringes the rights of third parties, and files containing malicious software.
- The risks associated with the use of electronic services are described in Annex No. 1.
§ 5. Demo Instance
- The Demo Instance allows the Customer to test the Platform free of charge before purchasing a Subscription. The Demo is not intended for conducting actual business operations.
- Registration. To set up a Demo, you must:
- provide in the Website form the company name, the proposed subdomain name and a business e-mail address; optionally a telephone number and the interface language,
- pass an automated verification protecting against bots,
- confirm the e-mail address with a one-time code sent to that address,
- accept the Terms and read the Privacy Policy,
- set a password via the activation link sent by e-mail.
- inProjects may refuse to set up a Demo or may close it, in particular where:
- the data provided are untrue,
- an address from a temporary e-mail service has been used,
- registration limits have been exceeded,
- abuse or automated activity is suspected,
- the maximum number of active Demo Instances has been reached.
- Nature of the Demo. Each Demo is a separate Organisation with its own subdomain in the wtms.app domain. The registering person receives the Customer Administrator role and may invite further Users. The Demo may contain sample configuration and dictionary data prepared by inProjects. It does not contain data of other customers. Demo addresses are not indexed by search engines.
- Duration. The Demo lasts for the period indicated in the registration form and in the activation message, as standard 7 days from the setting of the password. The activation link is valid for the time indicated in the message. inProjects may extend the Demo at its own discretion.
- After the Demo period expires, access to the Organisation is blocked. We then retain the Demo data for a further 90 days. If the Customer concludes the Agreement during that time, it may continue working on the Demo data, provided that inProjects confirms this possibility. After 90 days, the Demo together with all its data is permanently deleted, with no possibility of recovery. User Accounts that do not belong to any other Organisation are also deleted.
- Prohibition on entering production data. The Demo is intended exclusively for testing. The Customer undertakes not to enter into the Demo:
- personal data of employees, associates or customers, including photographs showing the image of persons and photographs from actual work locations,
- trade secrets,
- other production data.
- Limitations. The Demo is provided “as is”, without any guarantee of availability, support, performance or backups. Certain integrations and automated tasks may not work in the Demo. inProjects may limit the functions, the number of registrations, the number of attempts and the disk space of the Demo.
- Sales contact. After registration, the inProjects sales team receives information about the setting up of the Demo (company name, Demo address, contact details) and may contact the Customer regarding the Demo and a possible purchase. Details are described in the Privacy Policy.
- The Customer may end the Demo at any time by sending a request to [email protected]. In such a case we delete the Demo without waiting for the period referred to in paragraph 6 to expire.
§ 6. Account, Instance and Users
- Upon conclusion of the Agreement, inProjects makes available to the Customer an Instance or an Organisation and a Customer Administrator Account. The Customer Administrator creates and deletes User Accounts, assigns roles and permissions and configures the Organisation.
- User Accounts are created by the Customer and on its behalf. The Customer is responsible for:
- the selection of the persons to whom it grants access,
- the scope of their permissions,
- the actions of Users as for its own actions,
- promptly revoking access for persons who have ceased to cooperate with the Customer.
- Login credentials, including passwords, QR codes, RFID cards and one-time codes, are confidential. The Customer and Users must protect them against access by unauthorised persons. Any suspected disclosure must be promptly reported to inProjects and the login credentials invalidated (e.g. by changing the password, generating a new QR code or blocking the card).
- The following are prohibited:
- creating Accounts or Demos by automated means,
- sharing a single Account among several persons, except for workstation accounts provided for in the Platform (e.g. kiosk),
- circumventing the Plan limits.
- inProjects technical and administrative accounts may have access to the Instance to the extent necessary for its maintenance, support and security, on the terms of Annex No. 2.
§ 7. Conclusion of the Agreement and Subscription
- The Agreement is concluded when the Customer places an Order, accepts the Terms and inProjects confirms the Order by e-mail or in the Platform. In the case of a Subscription paid in advance, the Agreement is concluded subject to successful payment.
- The Subscription is concluded for the billing period selected in the Order: monthly or annual. If the Plan provides for monthly invoicing with an annual commitment, the Customer undertakes to use and pay for the Subscription for 12 months.
- The Subscription renews automatically for successive periods of the same length unless the Customer or inProjects terminates it no later than 30 days before the end of the current period. For a monthly Subscription this period is 7 days. Notice of termination is given in the Platform or by e-mail to [email protected].
- The Customer may upgrade to a higher Plan at any time. The change takes effect upon confirmation and the fee is adjusted pro rata. A downgrade to a lower Plan takes effect from the next billing period, provided that the Customer Data fit within the limits of the lower Plan.
- Exceeding the Plan limits does not result in any automatic charge to the Customer. In such a case inProjects contacts the Customer and proposes a change of Plan. If the Customer does not change the Plan within 30 days, inProjects may block the addition of new data above the limit.
- Special offers, pilots and individual terms are set out in a separate Order or agreement.
§ 8. Fees and payments
- Subscription fees are determined by the Price List in force on the date the Order is placed. All prices are net prices in the currency indicated in the Price List. VAT is added to the prices in accordance with applicable law; where appropriate, the reverse charge mechanism applies.
- The Subscription fee is payable in advance for each billing period, unless the Order provides otherwise.
- Payments are handled by the Payment Providers indicated when the Order is placed, in particular:
- Stripe Payments Europe, Ltd. (Ireland),
- PayU S.A.,
- PayPro S.A. (Przelewy24),
- Krajowy Integrator Płatności S.A. (Tpay),
- Autopay S.A.
- In the case of recurring payments, the Customer authorises inProjects and the Payment Provider to automatically charge the designated payment instrument with the fee for subsequent billing periods. The Customer may change the payment instrument or withdraw the authorisation at any time. This does not release the Customer from the obligation to pay for the current period.
- The Customer accepts the issuing and sending of invoices in electronic form. Where required by law, invoices are issued in the National e-Invoicing System (KSeF).
- If payment is delayed, inProjects may charge statutory interest for delay in commercial transactions. After 7 days from a request for payment have elapsed without effect, inProjects may suspend access to the Platform until the amount due is paid. Suspension does not result in the deletion of Customer Data.
- inProjects may change the Price List. The change applies to ongoing Subscriptions from the next billing period and requires notifying the Customer at least 30 days in advance. A Customer who does not accept the new prices may terminate the Subscription with effect at the end of the current period.
- Fees for a billing period that has commenced are non-refundable, except where the Agreement is terminated for reasons attributable to inProjects. In that case we refund the proportionate part of the fee for the unused period.
§ 9. Customer obligations
- The Customer undertakes to use the Platform in accordance with the law, the Terms and the documentation. In particular, the Customer undertakes not to:
- attempt to gain unauthorised access to the Platform, other Instances or data of other customers,
- carry out penetration or load tests without the written consent of inProjects,
- disrupt the operation of the Platform or place an excessive load on it, including through mass automated API requests exceeding the documented limits,
- decompile, disassemble or reverse engineer the Platform code, except where permitted by mandatory provisions of law,
- resell, sublicense or make the Platform available to third parties without the consent of inProjects,
- use the Platform to create a competing product.
- Obligations of the Customer as employer and data controller. The Customer decides what data about Users and third parties are collected in the Platform and for what purpose. The Customer is responsible in particular for:
- having a legal basis for the processing of personal data entered into the Platform,
- fulfilling the information obligations towards Users and other data subjects (Articles 13 and 14 GDPR), including informing Users that the Mobile Application records GPS location, time and technical parameters in the metadata of photographs taken, and that the Platform records working time and the history of actions,
- where the Customer uses the Platform to monitor employees in a manner constituting monitoring within the meaning of labour law: meeting the requirements of those provisions (in Poland, among others, the Polish Labour Code (Kodeks pracy), Articles 222 and 223), including specifying the purpose, scope and method of monitoring in the work regulations or in an announcement and notifying employees in advance,
- compliance with the provisions on working time records; the Platform is a supporting tool, and the Customer is responsible for the correctness of the records,
- the lawfulness of the content of photographs, including respect for the image of persons and legally protected secrets,
- handling requests from data subjects with respect to Customer Data.
- The Customer warrants that it has the right to enter Customer Data into the Platform, including files, projects and spreadsheets imported from external systems, and that their processing in the Platform does not infringe the rights of third parties or any agreements by which the Customer is bound.
- The Customer shall indemnify inProjects against claims of third parties (including Users and supervisory authorities) arising from the Customer’s breach of paragraphs 1-3, provided that inProjects promptly notifies the Customer of the claim and enables it to participate in the defence. The Customer shall bear the reasonable costs of such defence.
§ 10. Customer Data
- Customer Data belong to the Customer. inProjects acquires no rights to them other than the right to process them to the extent necessary to provide the Services, maintain security and perform legal obligations.
- The data of each Customer are stored in a separate Instance with a separate database. Organisations within a single Instance are logically separated from one another. The WTMS production infrastructure is maintained in the inProjects server room in the territory of Poland.
- inProjects makes regular backups of Customer Data solely for the purpose of restoring the Platform after a failure. Backups do not replace data export by the Customer.
- Retention period. The Plan specifies how long Customer Data are stored in the Platform during the term of the Agreement (e.g. 24 months). We may delete or archive data older than this period, but we will first notify the Customer at least 30 days in advance and enable it to export them. Records deleted by Users are moved to a recycle bin, from which the Customer may restore them until they are permanently deleted.
- Export. Throughout the term of the Agreement, the Customer may export Customer Data using the Platform’s functions (e.g. export of documentation to a ZIP archive, spreadsheets, reports). At the Customer’s request, inProjects prepares an export of the full content of the Organisation in a commonly used format; if this requires additional work, inProjects may charge a fee at rates agreed with the Customer.
- After the Agreement ends, access to the Platform is blocked. For 30 days after the Agreement ends, the Customer may request an export of Customer Data. After that period, we delete Customer Data from the Platform within a further 60 days, and from backups in accordance with their rotation cycle. This does not apply to data that we must continue to retain under provisions of law, e.g. billing data.
- inProjects may use anonymised statistical data on the use of the Platform (e.g. the number of tasks, load, response times) to develop and maintain the Platform. Such data do not allow the Customer, Users or other persons to be identified.
§ 11. Integrations with third-party services
- The Platform enables integrations with services of third parties. This applies in particular to:
- Google Workspace (Google Drive and Google Sheets) for storing photographs and synchronising spreadsheets,
- map, geocoding and spatial data services (e.g. Mapbox, OpenStreetMap, MapTiler),
- import of data from XLSX and CSV files and Google Sheets.
- If an integration operates on an account with a third-party service that belongs to the Customer (e.g. the Customer’s Google Workspace), the Customer itself concludes an agreement with the provider of that service and is responsible for its configuration. Data are transferred to that service on the Customer’s instruction. inProjects is not responsible for the operation of third-party services or for the processing of data by their providers.
- If an integration operates on an account belonging to inProjects, the service provider is a sub-processor on the terms of Annex No. 2.
- A change to or withdrawal of a service by its provider may limit or disable the operation of an integration. This does not constitute non-performance of the Agreement by inProjects.
§ 12. Availability, support and changes to the Platform
- inProjects exercises due diligence to ensure that the Platform is available 24 hours a day, 7 days a week. The target availability of the Platform in a calendar month is 99.5%. The following are not counted towards this indicator:
- planned work announced at least 48 hours in advance and carried out, where possible, outside the hours of 7:00-18:00 on Business Days,
- urgent security-related work,
- interruptions caused by force majeure, the Customer, Users or third-party services (§ 11).
- Technical support is available on Business Days from 9:00 to 16:00 Polish time, by e-mail at [email protected]. Reports of issues preventing use of the Platform are handled with priority. Detailed service levels (SLA) may be set out in a separate agreement.
- The Mobile Application is updated through the app stores. The Customer should ensure that Users use the current version. inProjects may discontinue support for versions older than the two most recent major versions.
- inProjects continuously develops the Platform and may change its functions, appearance and architecture, provided that this does not materially reduce the scope of the Services paid for by the Customer.
- We give at least 30 days’ notice of changes that materially restrict functions used by the Customer. A Customer who does not accept such a change may terminate the Agreement with immediate effect and receive a refund of the proportionate part of the fee for the unused period.
§ 13. Intellectual property and licence
- All rights to the Platform, the Mobile Application, the Website, the documentation, the WTMS and inProjects marks and to their components belong to inProjects or its licensors.
- For the term of the Agreement, inProjects grants the Customer a non-exclusive, non-transferable licence, without the right to grant sublicences, to use the Platform by the Customer and its Users. The licence covers the territory of the entire world and solely the internal needs of the Customer’s business, within the scope of the Plan. The licence for the Demo is valid for the duration of the Demo.
- Open source software used in the Platform is subject to its own licences.
- The Customer may provide inProjects with comments and suggestions for improvements. inProjects may use them without restriction and without remuneration. This does not affect the Customer’s rights to Customer Data.
§ 14. Liability
- The Parties are liable for non-performance or improper performance of the Agreement on general principles, subject to the limitations set out in this section.
- The total liability of inProjects towards the Customer under the Agreement, regardless of the legal basis, is limited to the amount of the net fees actually paid by the Customer for the Services in the 12 months preceding the event giving rise to the damage.
- inProjects is not liable for lost profits, loss of revenue, customers or goodwill, or for indirect damage.
- In particular, inProjects is not liable for:
- the content and correctness of Customer Data,
- decisions made by the Customer on the basis of data from the Platform, including personnel and payroll decisions,
- the accuracy of GPS location, which depends on the device, reception conditions and system settings,
- loss of data saved offline on a device that have not been transmitted to the Platform,
- the consequences of the Customer or Users disclosing login credentials to third parties,
- the operation of third-party services, telecommunications networks and the Customer’s devices.
- With respect to the Demo, as a free service, inProjects is liable only for damage caused intentionally.
- The limitations of liability in paragraphs 2-5 do not apply to:
- damage caused intentionally,
- personal injury,
- other cases in which a limitation of liability is not permitted by law.
- The Parties exclude the liability of inProjects under the statutory warranty for defects (rękojmia) to the extent permitted by law (Article 558 § 1 of the Civil Code). This does not limit the Customer’s right to submit a complaint in accordance with § 16.
§ 15. Suspension and termination of the Agreement
- inProjects may suspend access to the Platform, in whole or for selected Accounts:
- in the event of delay in payment, on the terms of § 8(6),
- in the event of a material breach of the Terms by the Customer or a User, if the Customer does not remedy the breach within 7 days of being requested to do so,
- immediately and without prior request, if this is necessary to protect the security of the Platform, data or third parties (e.g. in the event of an Account takeover, an attack originating from the Customer’s Instance or unlawful content). In such a case we promptly inform the Customer of the reason.
- The Customer may terminate the Subscription on the terms of § 7(3). Either Party may terminate the Agreement with immediate effect if the other Party materially breaches the Agreement and does not remedy the breach within 14 days of a written or e-mail request.
- inProjects may terminate the Agreement for good cause with 90 days’ notice. Good cause includes, in particular, the discontinuation of the Platform’s development or a change in the law preventing the provision of the Services. In such a case we refund the proportionate part of the fee for the unused period.
- The consequences of the termination of the Agreement with respect to Customer Data are set out in § 10(6).
- User Accounts are deleted by the Customer Administrator. A User who wishes to delete their Account or data should contact the Customer as their employer or principal. We will forward any request addressed to inProjects to the Customer.
§ 16. Complaints
- Complaints concerning the Services should be submitted by e-mail to [email protected] or in writing to the address of inProjects.
- A complaint should contain:
- the Customer’s name and the Instance address,
- the contact details of the person submitting the complaint,
- a description of the problem, the date on which it occurred and, where possible, screenshots or steps to reproduce it.
- A complaint may be submitted within 30 days of the day on which the Customer became aware of the reason for it.
- inProjects confirms receipt of the complaint and considers it within 14 days of its receipt. If the complaint is incomplete, the period runs from the date it is completed. We send the response to the e-mail address from which the complaint was submitted.
§ 17. Confidentiality
- Each Party shall keep confidential any information about the other Party obtained in connection with the Agreement that is not publicly available, in particular Customer Data, commercial terms and technical information about the Platform.
- The confidentiality obligation does not apply to information disclosed:
- pursuant to provisions of law or at the request of a competent authority,
- to a Party’s advisers bound by professional secrecy,
- to subcontractors to the extent necessary to perform the Agreement.
- The confidentiality obligation continues during the term of the Agreement and for 3 years after its termination. With respect to trade secrets, it continues for as long as they retain that character.
- inProjects may name the Customer (name and logo) on the list of WTMS customers, unless the Customer objects.
§ 18. Personal data
- With respect to personal data entered into the Platform by the Customer and Users (in particular data of the Customer’s employees and customers), the Customer is the controller and inProjects is the processor. The entrustment of data processing is governed by Annex No. 2, which constitutes the contract referred to in Article 28(3) GDPR. Conclusion of the Agreement constitutes conclusion of this data processing agreement.
- inProjects is the controller of the personal data of persons representing the Customer and contact persons, persons registering a Demo, users of the Website, and of technical data processed for security and billing purposes. The rules for processing these data are described in the Privacy Policy.
§ 19. Force majeure
- The Parties are not liable for non-performance or improper performance of the Agreement caused by force majeure, i.e. an external event that could not have been foreseen or prevented with due diligence. Examples include:
- war, natural disasters, fire, flood,
- epidemic,
- acts of public authority,
- widespread failures of power or telecommunications networks,
- large-scale cyber attacks, despite the application of appropriate safeguards.
- A Party affected by force majeure shall promptly notify the other Party. If force majeure lasts longer than 30 days, either Party may terminate the Agreement with immediate effect.
§ 20. Amendments to the Terms
- inProjects may amend the Terms for good cause. Good cause includes in particular:
- a change in the law or a decision of an authority,
- a change in the scope or manner of providing the Services,
- a change of Payment Providers or sub-processors,
- security considerations,
- the need to clarify provisions.
- We notify Customers of an amendment to the Terms by e-mail or in the Platform at least 14 days before it enters into force. Amendments resulting solely from provisions of law or beneficial to the Customer may enter into force earlier.
- A Customer who does not accept the amendments may, before the date on which they enter into force, terminate the Agreement with effect on that date. In such a case we refund the proportionate part of the fee for the unused period.
- Previous versions of the Terms are available on the Website.
§ 21. Final provisions
- The Agreement is governed by Polish law. The United Nations Convention on Contracts for the International Sale of Goods (CISG) does not apply.
- Disputes arising from the Agreement shall be resolved by the common court competent for the registered office of inProjects. This does not apply where mandatory provisions of law provide otherwise.
- If the Customer is a natural person conducting a sole proprietorship who concludes the Agreement directly related to that business activity but not of a professional nature for that person, that person is entitled to the protection provided for such entrepreneurs under Polish law (among others, Article 3855 of the Civil Code). Provisions of the Terms that conflict with that protection do not apply to that person.
- The Terms are available in Polish, English and German. In the event of any discrepancies, the Polish version is binding.
- If any provision of the Terms proves to be invalid or ineffective, the remaining provisions remain in force. The invalid provision shall be replaced by the rule closest to the economic purpose of the Parties.
- The Customer may not transfer rights or obligations under the Agreement to a third party without the consent of inProjects. inProjects may transfer the Agreement to a legal successor or to an entity taking over the business related to WTMS, notifying the Customer thereof.
- The Terms are effective from 1 October 2026.
Annex No. 1. Risks associated with the use of electronic services
Pursuant to Article 6 of the Act on the Provision of Electronic Services, we provide information about the particular risks associated with the use of services provided by electronic means and about the function and purpose of the software or data that inProjects introduces into the Customer’s ICT system.
- Typical risks include:
- malicious software (viruses, worms, Trojan horses, spyware and ransomware),
- phishing for login credentials, including fake messages impersonating WTMS or inProjects,
- interception of data transmitted over unsecured Wi-Fi networks,
- Account takeover due to a weak or reused password or the loss of a device with a logged-in Mobile Application or QR code,
- spam.
- To reduce the risk, you should:
- use an up-to-date operating system, browser and anti-virus software,
- use strong and unique passwords,
- not share QR codes or RFID cards,
- lock the screen of mobile devices,
- log in only on pages in the wtms.app domain with a valid TLS certificate.
- Software and data introduced:
- The WTMS panel stores cookies and data in browser storage (sessionStorage, localStorage) in the browser. They are used to maintain the session, protect against CSRF attacks and remember interface settings.
- The Mobile Application stores on the device an authentication token, a local database for offline mode and the photographs taken until they are transmitted.
- Details are described in the Privacy Policy.
Annex No. 2. Terms of entrustment of personal data processing
This annex constitutes an agreement for the entrustment of personal data processing within the meaning of Article 28(3) GDPR (the Data Processing Agreement (DPA)). It is concluded between the Customer as controller (the Controller) and inProjects as processor (the Processor).
1. Subject matter, nature and purpose of processing
- The Controller entrusts the Processor with the processing of personal data entered into the Platform (including the Demo) by the Controller and Users. The purpose is to provide the Services in accordance with the Agreement.
- The nature of processing includes:
- storage, organisation and making available of data,
- creation of backups,
- processing of photographs (thumbnails, reading metadata, overlaying captions),
- geocoding of addresses and coordinates,
- synchronisation with integrations configured by the Controller,
- generation of reports and exports,
- sending e-mail notifications,
- deletion of data.
- Processing continues for the term of the Agreement and the period described in § 10(6) of the Terms, and in the case of the Demo for the period set out in § 5(6).
2. Types of data and categories of data subjects
| Categories of data subjects | Types of data (depending on configuration and modules) |
|---|---|
| Users: employees, associates and subcontractors of the Controller |
|
| End customers of the Controller and other persons connected with work locations |
|
| Contact persons of entities cooperating with the Controller | first name, surname, company name, contact details, invoice number, amounts. |
The Platform is not intended for processing special categories of data (Article 9 GDPR) or data relating to criminal convictions (Article 10 GDPR). The Controller should not enter such data unless the parties agree otherwise separately.
3. Obligations of the Processor
- The Processor:
- processes data only on documented instructions from the Controller. Instructions are constituted by the Agreement, the configuration of the Platform made by the Controller and the actions of Users in the Platform. The Processor may process data without instructions where required to do so by Union or Member State law; in such a case it informs the Controller before processing begins, unless that law prohibits this,
- promptly informs the Controller if, in its opinion, an instruction infringes the GDPR or other data protection provisions,
- ensures that persons authorised to process the data have committed themselves to confidentiality or are under a statutory obligation of confidentiality,
- applies the security measures required by Article 32 GDPR (point 4),
- complies with the conditions for engaging sub-processors (point 5),
- assists the Controller, insofar as possible and by appropriate technical and organisational measures, in responding to requests from data subjects. The Platform enables the Controller to access, correct, export and delete data on its own. The Processor forwards any request addressed directly to it to the Controller without undue delay and does not handle it on its own without instructions,
- assists the Controller in ensuring compliance with the obligations under Articles 32-36 GDPR, taking into account the nature of processing and the information available to the Processor,
- after the end of the provision of the Services, deletes or returns the data in accordance with point 7,
- makes available to the Controller the information necessary to demonstrate compliance with the obligations under Article 28 GDPR and allows for audits (point 6).
- The Processor maintains a record of categories of processing activities referred to in Article 30(2) GDPR.
4. Security measures
The Processor applies in particular:
- data isolation: each Customer has a separate Instance with its own database, and Organisations are logically separated from one another,
- maintenance of the production infrastructure in the inProjects server room in the territory of Poland, with physical access control,
- encryption of data in transit (TLS),
- storage of passwords in the form of cryptographic hashes, rotation of QR codes at login, limiting the number of login attempts and requests,
- role-based access control on the Controller’s side and access by the Processor’s personnel limited to the necessary minimum,
- event and change logs (audit) and monitoring of errors and performance on the Processor’s infrastructure,
- regular backups and recovery procedures,
- regular software updates and vulnerability management,
- staff training and confidentiality undertakings.
5. Sub-processors
- The Controller grants the Processor a general authorisation to engage sub-processors. Their current list is available in the Privacy Policy (section “Recipients of data and sub-processors”).
- The Processor informs the Controller by e-mail or in the Platform of any intended addition or replacement of a sub-processor at least 14 days in advance. Within that period the Controller may raise a justified objection. If the parties do not agree on a solution, the Controller may terminate the Agreement with effect on the date the change is introduced and receive a refund of the proportionate part of the fee for the unused period.
- The Processor imposes on a sub-processor data protection obligations no less stringent than those arising from the Data Processing Agreement and is liable to the Controller for their performance.
- Providers of third-party services integrated on the Controller’s account (§ 11(2) of the Terms) are not sub-processors of the Processor.
- Data are transferred to a third country only where the conditions of Chapter V GDPR are met, e.g. on the basis of an adequacy decision (including the EU-U.S. Data Privacy Framework) or standard contractual clauses.
6. Audit
- The Controller may verify the compliance of processing with the Data Processing Agreement. In the first instance, it does so by means of written questions and requests for documentation, to which the Processor responds within 14 days.
- An on-site audit may take place no more than once a year, unless a personal data breach has occurred. Audit conditions:
- notice given at least 14 days in advance,
- conducted on Business Days and in a manner that does not disrupt the Processor’s business,
- an auditor bound by a confidentiality obligation and not being a competitor of the Processor,
- the costs of the audit are borne by the Controller.
7. Personal data breaches and end of processing
- The Processor notifies the Controller of a personal data breach without undue delay, and no later than within 48 hours of becoming aware of it. The notification contains the information referred to in Article 33(3) GDPR to the extent then available; the Processor provides the remaining information in phases. Notification to the supervisory authority and communication to data subjects are made by the Controller.
- After the Agreement ends, the Processor enables the export of data and subsequently deletes them, on the terms and within the periods set out in § 10(6) of the Terms. In the case of the Demo, the periods set out in § 5(6) of the Terms apply. At the Controller’s request, the Processor confirms the deletion of the data.
- The Processor’s liability under the Data Processing Agreement is subject to the limitations set out in § 14 of the Terms to the extent permitted by Article 82 GDPR.
- Matters not governed by the Data Processing Agreement are governed by the Terms and the GDPR.