HSE-OS — Terms of Service

Version 1.0 · effective 1 November 2026

Draft — have it reviewed by a lawyer licensed in Iraq before use.

These Terms apply to paying customers of HSE-OS Online (hosted by the Provider) and HSE-OS On-Premise (installed on the Customer's own server). Please read Section 21 (What HSE-OS is not) carefully. It explains the limits of what HSE-OS does for your safety management.

1. Who we are and how these Terms work

1.1 These Terms are made between Essa Jawad Kadhim, trading as HSE-OS, of Basra, Republic of Iraq (the "Provider"), and the company or organisation named as the customer in the Order Form (the "Customer").

1.2 The "Agreement" between the Provider and the Customer is made up of these documents:

(a) the signed Order Form;
(b) the Data Processing Agreement (the "DPA");
(c) these Terms of Service (the "Terms");
(d) the Privacy Policy, which explains how personal data is handled; and
(e) the Safety and Legal Notice.

1.3 If these documents conflict, they apply in this order: the Order Form (only for the package, number of workplaces, hosting option, term, price and dates), then the DPA (for personal data), then these Terms, then the Privacy Policy, then the Safety and Legal Notice.

1.4 The Agreement starts when both parties sign the Order Form, or when the Customer pays the first invoice, whichever happens first.

1.5 The person who signs the Order Form for the Customer confirms that he or she has authority to bind the Customer.

1.6 Other HSE-OS products have their own terms:

(a) the demo, and the "Request a demo" form at https://demo.hse-os.com and the "Request the service" form at https://plans.hse-os.com, are covered by the Demo Terms (a service request sent through the website is not an Order Form and does not start the Agreement);
(b) the offline HSE Workspace is covered by the HSE Workspace Licence (offline-licence); and
(c) a free pilot is covered by the Pilot Agreement, together with these Terms as described in it.

2. Definitions

In the Agreement these words have these meanings:

2.1 "Authorised User" — a person to whom the Customer gives a HSE-OS account. This includes the Customer's employees and contractors, and the representatives of the Customer's clients (for example, client HSE auditors) that the Customer invites.

2.2 "Crew Member" — any person whose information is entered into HSE-OS, for example a worker at one of the Customer's workplaces, a contractor, a visitor or an injured person.

2.3 "Customer Data" — all information and files that the Customer or its Authorised Users enter, upload or create in HSE-OS. It includes Personal Data about Crew Members, HSE records, incident records, certificates, timesheets, pay information, photos, documents and the activity log of who did what.

2.4 "Fees" — the amounts payable for the Service, as shown in the Order Form.

2.5 "Health Data" — Personal Data about a person's physical or mental health, including injury details, medical and fitness-for-work certificates and similar records.

2.6 "Hosted Service" or "HSE-OS Online" — HSE-OS run by the Provider on cloud servers chosen by the Provider, reached either:

(a) at a web address controlled by the Provider (for example, yourcompany.hse-os.com) — "Our server, our address"; or
(b) at a web address controlled by the Customer (for example, hse.yourcompany.com) — "Our server, your address".

2.7 "Licence Key" — the code issued by the Provider that activates HSE-OS for a period of time.

2.8 "On-Premise Installation" or "HSE-OS On-Premise" — HSE-OS installed on a server owned, rented or controlled by the Customer, at a web address controlled by the Customer ("Your server, your address") or at a name under hse-os.com that the Provider points to the Customer's server ("Your server, our address"), and used under a yearly Licence Key.

2.9 "Order Form" — the signed order that names the Customer, the Package, the number of Workplaces, the hosting option, the Subscription Period, the Fees and the Start Date.

2.10 "Package" — the HSE-OS package chosen in the Order Form (for example Starter, Small Fleet, Fleet 5, Fleet 10 or Fleet 20) and the number of Workplaces it covers.

2.11 "Personal Data" — any information about an identified or identifiable living person.

2.12 "Service" — the Hosted Service or the On-Premise Installation (as chosen in the Order Form), together with the HSE-OS Software, updates and support described in these Terms.

2.13 "Software" or "HSE-OS" — the HSE-OS HSE, crew, certificate and records software, including its code, design, screens, report formats, templates, documentation and user guides.

2.14 "Start Date" — the date the Service starts, as shown in the Order Form.

2.15 "Subscription Period" — the period of 1, 6 or 12 months paid in advance, as shown in the Order Form, and each renewal period.

2.16 "Third-Party Services" — services not provided by the Provider, such as Telegram, e-mail services, cloud hosting, Cloudflare, domain registrars, WhatsApp and the Customer's own server or network providers.

2.17 "Writing" or "written" includes e-mail.

3. The Service

3.1 The Provider will provide the Service described in the Order Form for the Subscription Period, in line with the Agreement.

3.2 The Service lets the Customer keep records of crew, certificates, HSE activity, incidents, timesheets, training, rotations and related files, and can send reminders and notifications.

3.3 Workplaces. In HSE-OS the Customer's records are organised in departments and their sub-departments (for example, the rigs of a Drilling or Workover department, or the units or sites of another department). A "Workplace" is each sub-department, or a department that has no sub-departments; the base camp is not counted. The Customer may use HSE-OS for the number of Workplaces in its Package. If the Customer uses HSE-OS for more Workplaces, the Provider may invoice the extra-workplace fee from the date the extra Workplace was added.

3.4 Accounts. Unless the Order Form says otherwise, the Package has no limit on the number of Authorised User accounts.

3.5 Hosting options.

(a) Our server, our address. The Provider hosts HSE-OS and provides the web address.
(b) Our server, your address. The Provider hosts HSE-OS. The Customer provides and keeps its own domain name and makes the DNS changes the Provider asks for. The Provider is not responsible if the address stops working because of the Customer's domain, DNS or registrar.
(c) Your server, your address. HSE-OS is installed on the Customer's server. Section 19 (On-Premise Installation) also applies.
(d) Your server, our address. HSE-OS is installed on the Customer's server, and the Provider points a name under hse-os.com (for example, yourcompany.hse-os.com) to that server. The Customer keeps the server reachable as the Provider instructs. The Provider may remove the name when the Licence Key ends or is cancelled. Section 19 (On-Premise Installation) also applies.

3.6 Languages. HSE-OS screens are offered in English, Arabic and Chinese. A translation inside the Software may contain mistakes. The Customer should check important records in the language in which they were entered.

3.7 Storage on the Provider's servers. With "Our server, our address" and "Our server, your address", the Package includes 10 GB of storage: the Customer's files and its database counted together. The Customer may buy extra storage in steps of 10 GB, at US$10 a month for each step, invoiced for the whole Subscription Period chosen (1, 6 or 12 months) and shown in the Order Form; extra storage added during a Subscription Period is invoiced for the rest of that period. The storage limit is part of the Licence Key. HSE-OS warns the HR Manager when 80% and 95% of the storage is used. When the limit is reached, HSE-OS stops accepting new files and imports until the storage is increased or space is freed; nothing is deleted, and the Customer can still open, export, back up and delete its data. The Provider does not delete Customer Data because the storage is full. There is no storage limit for an On-Premise Installation ("Your server" options): the Customer's own server sets its space.

4. Accounts and Authorised Users

4.1 The Customer chooses who becomes an Authorised User and what role and access each one has.

4.2 The Customer is responsible for everything done under its accounts, and for the acts and omissions of its Authorised Users, as if they were the Customer's own.

4.3 Each account is for one named person. Authorised Users must not share passwords or accounts.

4.4 The Customer must:

(a) keep passwords secret and use two-step login where it is available and practical;
(b) remove or disable accounts quickly when a person leaves or no longer needs access; and
(c) tell the Provider promptly if it suspects that an account has been misused.

4.5 The Customer's main administrator (normally the HR Manager) is the Provider's main contact for the account, unless the Order Form names someone else.

4.6 Password reset code. When the Customer asks (for example, because its HR Manager forgot his password or lost the phone used for two-step login), the Provider may issue a one-time reset code, valid for 24 hours and only on the Customer's own HSE-OS server for its HR Manager's account, with which the HR Manager chooses a new password himself; the Provider never sees, keeps or sends the password.

5. Customer responsibilities

5.1 Accurate data. The Customer is responsible for the accuracy, completeness and quality of Customer Data. HSE-OS shows, counts and reminds based only on what is entered.

5.2 Lawful basis for Crew Members' data. The Customer is responsible for having a lawful basis to collect and use Crew Members' Personal Data, including Health Data, ID copies, photos, pay data and nationality. Where the law requires it, the Customer must inform Crew Members and obtain their consent.

5.3 Only necessary data. The Customer must enter only the Personal Data it needs for its purposes, and must limit Health Data to what is necessary.

5.4 Own compliance. The Customer remains fully responsible for its own HSE management system, its legal and regulatory duties, its contracts with its clients, its permits and licences, and its decisions about people, equipment and work.

5.5 Own equipment. The Customer is responsible for its own devices, browsers, internet connection and network, and for keeping them secure.

5.6 Own copies. The Customer should regularly export or download copies of the records it must keep by law or contract.

5.7 Cooperation. The Customer will give the Provider the information and access reasonably needed to set up and support the Service.

6. Acceptable use

6.1 The Customer and its Authorised Users must not:

(a) use the Service for any unlawful purpose, or to store content that is unlawful, defamatory, or infringes someone else's rights;
(b) enter Personal Data without a lawful basis;
(c) upload viruses, malware or harmful code;
(d) try to get unauthorised access to the Service, to other customers' data, or to the Provider's systems;
(e) test, scan or attack the security of the Service without the Provider's written permission;
(f) overload the Service, or use automated tools to scrape or load it, except the normal functions of HSE-OS;
(g) bypass, disable or interfere with the Licence Key, licence checks, limits or security features;
(h) copy, resell, rent, sublicense or give the Service to anyone other than Authorised Users; or
(i) use the Service to build a competing product.

6.2 The Provider may remove content or suspend accounts that break this Section, as described in Section 25 (Suspension for other reasons).

7. Fees and payment

7.1 The Fees are in the Order Form. They follow the Provider's price list at the date of the Order Form.

7.2 Payment in advance. The Customer pays the Fees for each Subscription Period (1, 6 or 12 months) in advance, before the Subscription Period starts or by the due date on the invoice.

7.3 Setup fees. Setup fees (for example, for "Our server, your address", "Your server, our address" or another On-Premise Installation) are paid once, in advance, and are not refundable once the setup work has started.

7.4 Payment methods. The Customer pays by Qi Card, Zain Cash or bank transfer, all in US dollars, to the account details in the invoice.

7.5 Currency, taxes and charges. Prices are in US dollars. Prices do not include taxes, duties, bank charges, transfer fees or currency exchange costs. The Customer pays these, so that the Provider receives the full invoiced amount. If the law requires the Customer to deduct tax, the Customer must give the Provider the official proof of the deduction.

7.6 Price changes. The Provider may change its prices. A new price applies only from the next Subscription Period, and only if the Provider has given at least 30 days' written notice before the end of the current Subscription Period.

7.7 Disputed invoices. If the Customer disputes an invoice in good faith, it must tell the Provider in writing before the due date and pay the part it does not dispute.

8. Late payment

8.1 If an invoice is not paid by its due date, the Provider will send a reminder.

8.2 Suspension after 15 days. If the invoice is still unpaid 15 days after its due date, the Provider may suspend the Hosted Service (or withhold Licence Keys, updates and support for an On-Premise Installation) until it is paid. The Provider will tell the Customer before it suspends.

8.3 Nothing deleted for 60 days. During a suspension for late payment, the Provider will not delete any Customer Data for 60 days from the day the suspension starts.

8.4 When the Customer pays all overdue amounts, the Provider will restore the Service within a reasonable time, normally within one working day.

8.5 If the overdue amounts are still unpaid at the end of the 60 days, the Agreement ends. The Provider will send a final written notice and may then delete the Customer Data without a further retention period.

8.6 During a suspension the Customer may ask for an export of its Customer Data. The Provider may first ask the Customer to pay Fees that are overdue for any period in which the Service was already provided.

8.7 A suspension does not change the end date of the Subscription Period.

9. Term and renewal

9.1 The first Subscription Period starts on the Start Date and lasts 1, 6 or 12 months, as shown in the Order Form.

9.2 Renewal. At least 30 days before the end of each Subscription Period, the Provider will send a renewal invoice for the same Package and length, at the price that applies under Section 7.6. The renewal invoice is due on the last day of the current Subscription Period. The Agreement renews when the Customer pays it.

9.3 If the renewal invoice is paid late, the new Subscription Period still starts on the day after the previous one ended. Section 8 (Late payment) applies to the late renewal invoice.

9.4 Not renewing. If the Customer does not want to renew, it should tell the Provider in writing before the end of the Subscription Period. The Agreement then ends at the end of that Subscription Period, and Section 13 (Customer Data) applies.

9.5 Changing package. The Customer may move to a bigger Package or add Workplaces during a Subscription Period. The Provider will invoice the difference for the rest of that Subscription Period. A move to a smaller Package takes effect from the next Subscription Period.

10. Cancellation and refunds

10.1 Cancellation by the Customer. The Customer may cancel at any time by written notice. Cancellation takes effect at the end of the Subscription Period that is already paid. Until then, the Customer can keep using the Service.

10.2 No refunds for the paid period. Fees paid for a Subscription Period are not refundable, in whole or in part, including if the Customer stops using the Service early. The only exceptions are:

(a) where the applicable laws of the Republic of Iraq require a refund;
(b) where the Provider ends the Agreement under Section 10.4 (Provider stops offering HSE-OS); and
(c) where the Customer ends the affected Service under the DPA after objecting to a new sub-processor.

In cases (b) and (c) the Provider refunds the Fees prepaid for the remaining whole months of the Subscription Period.

10.3 Ending for breach. Either party may end the Agreement by written notice if the other party seriously breaks it and does not fix the breach within 15 days after receiving written notice describing it. If the Provider ends the Agreement because of the Customer's breach, no Fees are refunded.

10.4 Provider stops offering HSE-OS. The Provider may end the Agreement on at least 60 days' written notice if it stops offering the Service to all customers.

10.5 Pilots are free. A free pilot under a Pilot Agreement has no Fees, so there is nothing to refund.

11. Availability and maintenance

11.1 The Provider will use reasonable efforts (best effort) to keep the Hosted Service available 24 hours a day.

11.2 No guaranteed uptime. The Provider does not guarantee any level of availability or uptime, and does not promise that the Service will be free of interruptions or errors, unless the parties sign a separate service level agreement (SLA).

11.3 Maintenance. The Provider may need to stop the Service for maintenance, updates or security fixes. Where possible, it will do planned maintenance outside normal working hours in Iraq and give notice in advance in the Software, by WhatsApp or by e-mail.

11.4 Urgent work. The Provider may carry out urgent maintenance without notice when needed to protect the Service or Customer Data.

11.5 Things outside the Provider's control. The Service depends on the internet, electricity, Third-Party Services and the Customer's own equipment. The Provider is not responsible for interruptions caused by them, including internet shutdowns ordered by authorities.

12. Support

12.1 Support is included in every Package. It covers:

(a) questions about how to use HSE-OS;
(b) investigating and fixing faults in the Software; and
(c) updates and new versions of the Software that the Provider makes generally available.

12.2 Support is given by WhatsApp and e-mail, every day from 9:00 to 17:00 Baghdad time. The Provider will respond as soon as reasonably possible. Response and fix times are not guaranteed unless a separate SLA says so.

12.3 Support does not include data entry, data clean-up, custom development, custom report formats, on-site visits, or training beyond the initial handover. The Provider may offer these for an extra fee agreed in writing.

12.4 To give support, the Provider may need to view parts of the Customer Data. It will do so only as described in Section 13.6.

13. Customer Data

13.1 The Customer owns its data. As between the parties, the Customer owns all Customer Data. The Provider gets no ownership rights in it.

13.2 Permission to process. The Customer gives the Provider permission to host, copy, process, back up and display Customer Data only as needed to provide, secure and support the Service, and as described in the DPA.

13.3 Export. During the Agreement, the Customer can export many records itself (for example, to Excel). On written request, the Provider will also provide a full export of the Customer Data (records and uploaded files) in a common format, normally within 14 days.

13.4 After the Agreement ends. The Provider will keep the Customer Data for 60 days after the Agreement ends, so the Customer can ask for an export. This does not apply where Section 8.5 applies.

13.5 Deletion. After those 60 days, the Provider will delete the Customer Data from the Hosted Service. Copies in backups are deleted as the backups expire, within 12 months after that (daily backups are kept for 14 days, weekly backups for 8 weeks and monthly backups for 12 months). The Provider may keep a copy only where the applicable law requires it, and then keeps it confidential and secure.

13.6 Provider access. The Provider and its staff will access Customer Data only:

(a) to provide, maintain and secure the Service;
(b) to give support that the Customer asked for;
(c) to prevent or investigate a security incident or misuse; or
(d) where the law or a competent authority requires it, in which case the Provider will tell the Customer unless the law forbids it.

13.7 Usage statistics. The Provider may use technical and usage information that does not identify the Customer or any person (for example, error counts, software version and numbers of Workplaces, accounts and records) to run, support and improve HSE-OS.

13.8 On-Premise. For an On-Premise Installation, the Customer Data is stored on the Customer's server. The Customer controls it, backs it up and deletes it. Sections 13.3 to 13.5 apply only to copies the Provider holds.

14. Backups

14.1 For the Hosted Service, the Provider makes regular automatic backups of the Customer Data (daily, weekly and monthly) and keeps them for a limited time: daily backups for 14 days, weekly backups for 8 weeks and monthly backups for 12 months.

14.2 HSE-OS also lets the Customer make and download its own encrypted backup files, and send them to accounts it chooses (for example, by Telegram, where this feature is turned on).

14.3 Backups reduce the risk of data loss but cannot remove it. If Customer Data is lost or damaged because of the Provider, the Provider's only duty is to use reasonable efforts to restore it from the latest available backup.

14.4 Backup recovery key. The Customer's backup files are locked with a recovery key. The Customer must keep its recovery key file and password safe. HSE-OS may send the Provider a sealed (encrypted) copy of the recovery key, so that the Provider can help if the key is lost. The Provider will use that copy only on the written request of the Customer's main administrator.

14.5 The Provider is not responsible for backups made, stored or sent by the Customer, or for backups of an On-Premise Installation.

15. Security

15.1 The Provider uses reasonable technical and organisational measures to protect Customer Data on the Hosted Service. They are described in the DPA (Annex B). They include encrypted connections (HTTPS) between users' browsers and the Service's web address, passwords stored only as strong hashes, optional two-step login, role-based access, an activity log of who did what, encrypted backups, and restricted administrator access.

15.2 Limits. No system is completely secure. The Provider cannot guarantee that Customer Data will never be accessed, lost or changed without permission.

15.3 The Customer is responsible for the security of its own devices, networks and accounts, for choosing who gets access, and (for an On-Premise Installation) for the security of its server.

15.4 If the Provider becomes aware of a personal data breach affecting Customer Data, it will tell the Customer as set out in the DPA (within 72 hours of becoming aware).

16. Personal data

16.1 For Crew Members' Personal Data in Customer Data, the Customer is the controller and the Provider is the processor. The DPA applies and forms part of the Agreement.

16.2 For its own business information (for example, account and billing contacts, licence records, server and security logs, demo and service requests sent through the website forms, and demo logs), the Provider is the controller. The Privacy Policy explains this.

17. Confidentiality

17.1 "Confidential Information" means non-public information that one party shares with the other in connection with the Agreement and that a reasonable person would see as confidential. Customer Data is the Customer's Confidential Information. The Software (except what is visible to normal users), prices offered to the Customer and the terms of the Order Form are the Provider's Confidential Information.

17.2 Each party will:

(a) use the other's Confidential Information only for the Agreement;
(b) not disclose it, except to its own staff, advisers and sub-processors who need to know it and are bound by confidentiality; and
(c) protect it with at least reasonable care.

17.3 This does not apply to information that is already public (not through a breach), that the receiving party already lawfully had, that it developed independently, or that it received lawfully from a third party.

17.4 A party may disclose Confidential Information if the law or a competent authority requires it. Where allowed, it will tell the other party first.

17.5 These duties continue for 3 years after the Agreement ends. For Customer Data and for the Provider's source code, they continue for as long as the information is held.

18. Intellectual property and licence

18.1 The Provider owns HSE-OS. The Provider owns all rights, including copyright, in the Software and everything the Provider creates for the Service. The Agreement does not transfer any of these rights to the Customer.

18.2 Licence to use. During each paid Subscription Period, the Provider gives the Customer a non-exclusive, non-transferable right to use the Software, and to let its Authorised Users use it, for the Customer's own internal business, for the number of Workplaces in its Package.

18.3 Restrictions. Except where the applicable law allows it and this cannot be excluded by contract, the Customer must not:

(a) copy, modify, translate or create works based on the Software;
(b) reverse engineer, decompile or disassemble the Software;
(c) remove or change any copyright, brand or licence notices; or
(d) sell, rent, lend, sublicense or distribute the Software.

18.4 Customer materials. The Customer keeps all rights in its own logos, documents and templates that it uploads. The Customer gives the Provider permission to use them only to provide the Service.

18.5 Feedback. If the Customer or its Authorised Users suggest improvements, the Provider may use them freely, without payment. The Provider will not name the Customer as the source without permission.

18.6 Reference. The Provider may name the Customer as a HSE-OS customer (name only, without logo) unless the Customer tells the Provider in writing that it does not agree.

19. On-Premise Installation

19.1 This Section applies only to an On-Premise Installation.

19.2 Customer's server. The Customer provides and pays for the server, its operating system, network, internet access, domain name, security certificate and electricity. The server must meet the Provider's written technical requirements.

19.3 Installation. The Provider installs HSE-OS for the setup fee. The Customer gives the Provider the remote or on-site access needed. The Provider will use that access only for installation, updates and support.

19.4 Customer's responsibilities. The Customer is responsible for the security, operation, monitoring and availability of its server, and for its own backups. The Provider is not responsible for loss of or damage to Customer Data on the Customer's server, unless caused by the Provider's intentional wrongdoing or gross negligence.

19.5 Yearly licence. HSE-OS On-Premise runs under a yearly Licence Key. When the Licence Key expires and is not renewed, HSE-OS shows a warning for a grace period of 7 days and then locks. When locked, users can sign in only to the licence page. Nothing is deleted. Renewing the licence opens HSE-OS again.

19.6 Licence check. Once a day, HSE-OS On-Premise contacts the Provider's licence server to check and renew its Licence Key. This check sends only the installation ID, the licence number, the HSE-OS version, the web address, and the numbers of sub-departments, accounts and crew profiles. It never sends names, certificates, salaries, files or other Customer Data. A server without internet can be activated by typing a Licence Key that the Provider provides.

19.7 Updates. During each paid licence year, the Customer may receive the updates the Provider makes generally available. The Provider or the Customer installs them as agreed.

19.8 After the Agreement ends. The Customer must stop using HSE-OS and, on request, delete or return the Software. The Customer may keep its Customer Data. On request, and on payment of any overdue Fees, the Provider will issue a temporary Licence Key for up to 60 days, so that the Customer can export its Customer Data.

19.9 Usage and server status reports. This Section 19.9 applies to every HSE-OS server, including the Hosted Service. Every hour, each licensed HSE-OS server that has internet sends the Provider a short usage and server status report. It contains numbers only: the installation ID, the licence number, the HSE-OS version, the web address, the company name and the hosting option; the number of accounts (in total, used in the last day, week and month, and per role); the numbers of workplaces, crew profiles, incidents, inspections, daily reports and certificates; the number and size of files of each kind (PDF, pictures, Word, Excel, PowerPoint, video, other), the files added in the last day and week, and the space the files folder uses; the database size; the server's processor, load, memory and disk use and how long it has been running; the time of the last successful backup and the number of messages that could not be sent in the last day. Since version 16.2 it also contains daily activity counts and the server's state: for the last day, and for yesterday and today, the number of sign-ins and of people who signed in, the number of records added and changed in each section (incidents, inspections, drills, daily reports, crew and equipment certificates, crew profiles, training, timesheets, letters, rota, site reports) and the number and size of files added per kind; the average and highest processor, memory, disk use and load over the last 24 hours (measured every 5 minutes on the server) and how much the disk, database and files folder grew; and the server's state, checked every hour on the server: Ubuntu and kernel version, waiting updates and security updates, whether a restart is needed, running time, Docker version, the state of HSE-OS's own containers, and the time and size of the last backup. These are counts and versions only, kept on the same terms. It never contains names, e-mail addresses, file names, file contents, or any crew, company or HSE record. The Provider uses these reports only to give support, to plan server capacity, to warn the Customer of problems (for example, a disk that is nearly full) and to check the licence. The Provider keeps the hourly figures for 14 days and one set of figures per day for 400 days, and then deletes them. The Customer's HR Manager can see on the Licence page of HSE-OS ("What HSE-OS sends to your provider") exactly what is sent and when it was last sent, including the last report itself. A server without internet sends no reports; instead, the Customer downloads the usage report as a file on the Licence page once a month and sends it to the Provider. Each report carries a check code made from the Licence Key, so that the Provider can confirm that it comes, unchanged, from the Customer's licensed server.

20. Third-Party Services

20.1 The Service uses or connects to Third-Party Services, including:

(a) cloud hosting chosen by the Provider (for the Hosted Service);
(b) Cloudflare, which carries web traffic to the Service and helps protect it;
(c) Telegram, for optional notifications and backup delivery;
(d) an e-mail sending service, for optional e-mail notifications; and
(e) WhatsApp and e-mail, for support.

20.2 Telegram and e-mail notifications are optional. When the Customer or an Authorised User turns them on, the information in the messages (for example, a person's name and a certificate's expiry date) passes through and is stored by that Third-Party Service under its own terms and privacy policy.

20.3 The Provider is not responsible for the availability, security or acts of Third-Party Services that are not its sub-processors, or for messages that are delayed, blocked or not delivered.

20.4 The Customer must not rely on notifications as the only way to track expiry dates, deadlines or actions. The dashboards and lists in HSE-OS should be checked regularly.

21. What HSE-OS is not — important safety notice

21.1 HSE-OS is a record-keeping and reminder tool. It helps the Customer store and organise information and see what may need attention.

21.2 HSE-OS does not replace:

(a) the Customer's HSE management system;
(b) competent persons (for example, HSE professionals, supervisors, medical staff, trainers and certifying bodies);
(c) the Customer's legal and regulatory duties and its duties to its clients;
(d) permits to work, risk assessments, toolbox talks, inspections or job safety analyses; or
(e) emergency response procedures and plans.

21.3 Decisions stay with the Customer. The Customer and its competent persons make all decisions, including about:

(a) whether a certificate is valid, genuine or acceptable;
(b) whether a person is fit for work, trained or competent;
(c) whether equipment is safe or fit for use;
(d) incident classification, investigation, reporting and corrective actions; and
(e) reports and statistics given to clients or authorities.

21.4 Results depend on data. Figures, statistics (for example, rates per 200,000 man-hours), colours, statuses, reminders and reports are calculated only from the data entered. If the data is wrong, missing or late, the results will be wrong. Automatic reading of scanned certificates (OCR) can make mistakes and must be checked.

21.5 No responsibility for incidents. The Provider is not responsible for any incident, accident, injury, illness, death, environmental damage, equipment damage, certificate decision, fit-for-work decision, work stoppage, regulatory outcome, fine or penalty, whether or not HSE-OS was used, and whether or not a record, reminder or notification was correct, shown or delivered. This Section is subject to Section 23.4.

22. Warranties and disclaimers

22.1 Each party confirms that it has the right to enter into the Agreement.

22.2 The Provider will provide the Service with reasonable care and skill. If the Service does not work materially as described in the user guides, the Customer should tell the Provider, and the Provider will use reasonable efforts to fix it. This is the Customer's main remedy for faults.

22.3 Except as stated in the Agreement, the Service is provided "as is" and "as available". To the extent the law allows, the Provider gives no other promises or warranties, express or implied, including that the Service will be uninterrupted, error-free, fit for a particular purpose, or will meet any legal, client or certification requirement.

23. Limitation of liability

23.1 Cap. The Provider's total liability to the Customer under or in connection with the Agreement, for all claims together, is limited to the Fees the Customer actually paid to the Provider in the 6 months before the event that caused the first claim. If no Fees were paid in that period, the cap is USD 100.

23.2 No indirect loss. The Provider is not liable for any indirect, special or consequential loss, or for any of these losses, whether direct or indirect:

(a) loss of profit, revenue, business, contracts or opportunity;
(b) rig downtime or standby costs;
(c) penalties, deductions or claims from the Customer's clients;
(d) fines or penalties from authorities;
(e) loss of goodwill or reputation; or
(f) loss or corruption of data, except the duty to restore from backup in Section 14.3.

23.3 These limits apply however the liability arises, including in contract, tort (including negligence), breach of statutory duty, or otherwise.

23.4 What is not limited. Nothing in the Agreement limits or excludes any liability that cannot be limited or excluded under the applicable laws of the Republic of Iraq, including liability for fraud, intentional wrongdoing or gross negligence, where the law does not allow it to be limited.

23.5 The Customer accepts that the Fees reflect these limits, and that the Customer is better placed to insure against the risks of its own operations.

24. Indemnity by the Customer

24.1 The Customer will defend the Provider and pay the Provider back for all claims, losses, damages, fines, costs and reasonable legal fees that arise from:

(a) Customer Data, including any claim that the Customer had no lawful basis to collect or use it, or that it infringes someone's rights;
(b) use of the Service by the Customer or its Authorised Users in breach of the Agreement or the law;
(c) claims by Crew Members, the Customer's clients, contractors or authorities that relate to the Customer's operations, HSE decisions, incidents or records; or
(d) the Customer's breach of Section 6 (Acceptable use).

24.2 The Provider will tell the Customer promptly about any such claim, let the Customer control the defence, and give reasonable help at the Customer's cost. The Customer must not settle a claim in a way that admits fault by the Provider without the Provider's written consent.

25. Suspension for other reasons

25.1 The Provider may suspend all or part of the Service, or any account, immediately and without liability, if it reasonably believes this is needed:

(a) because of a security threat or an attack on the Service;
(b) because the Customer or an Authorised User seriously breaks Section 6 (Acceptable use);
(c) to prevent harm to the Service, to other customers or to any person; or
(d) because the law or a competent authority requires it.

25.2 The Provider will limit the suspension to what is reasonably needed, tell the Customer as soon as practical, and restore the Service once the reason has been dealt with.

25.3 Customer Data is not deleted because of a suspension under this Section.

26. Changes to the Service and these Terms

26.1 The Provider may improve and change the Software over time. It will not make a change that materially reduces the main functions of the Customer's Package during a paid Subscription Period, unless the change is needed for legal, security or third-party reasons.

26.2 The Provider may update these Terms, the Privacy Policy and the DPA. It will give at least 30 days' written notice of material changes.

26.3 Material changes take effect from the start of the Customer's next Subscription Period. A change needed for legal, security or third-party reasons may take effect at the end of the 30-day notice.

26.4 If the Customer does not accept a change, it may choose not to renew under Section 9.4.

26.5 The version number and effective date at the top of each document show which version applies.

27. Events outside a party's control

27.1 Neither party is liable for a delay or failure to perform caused by events outside its reasonable control. Examples are war, armed conflict, terrorism, civil unrest, government action, internet shutdowns, power cuts, natural disasters, epidemics, fire, and failures of Third-Party Services or telecommunications networks.

27.2 This does not excuse the Customer from paying Fees for the Service that was provided.

27.3 If such an event stops the Service for more than 30 days in a row, either party may end the Agreement by written notice.

28. Governing law and disputes

28.1 The Agreement is governed by the applicable laws of the Republic of Iraq.

28.2 Talk first. If a dispute arises, the parties will first try to settle it amicably. Either party may start this by sending a written notice describing the dispute. Senior representatives of both parties will meet or talk within 15 days of that notice.

28.3 Courts of Basra. If the dispute is not settled within 30 days after the notice, either party may take it to the competent courts in Basra, Republic of Iraq. The courts of Basra have exclusive jurisdiction.

28.4 Nothing in this Section stops a party from asking a court for urgent relief, for example to protect its intellectual property or Confidential Information.

29. Language

29.1 These Terms are written in English. They may be translated into Arabic or other languages. If there is any conflict or difference between the English version and a translation, the English version prevails.

30. Notices

30.1 Formal notices under the Agreement (for example, about breach, ending, suspension or changes) must be in writing and sent by e-mail or delivered by hand:

(a) to the Provider at [email protected], or by hand to the Provider's address in Section 1.1; and
(b) to the Customer at the e-mail address and address in the Order Form.

30.2 An e-mail notice is treated as received on the next working day in Iraq after it is sent, unless the sender receives a message that it was not delivered.

30.3 Day-to-day messages (for example, about support, reminders or maintenance) may also be sent by WhatsApp (Provider: +964 776 780 8363) or shown inside HSE-OS.

30.4 Each party must tell the other in writing if its contact details change.

31. General

31.1 Entire agreement. The Agreement is the whole agreement between the parties about the Service. It replaces all earlier discussions, proposals and brochures. Each party confirms that it has not relied on any statement that is not in the Agreement. The Customer's own purchase order terms do not apply, even if attached to an order.

31.2 Transfer. The Customer may not transfer the Agreement without the Provider's written consent. The Provider may transfer the Agreement, by written notice, to a company that it owns or controls, or to a buyer of the HSE-OS business, provided the new party agrees to be bound by the Agreement.

31.3 Sub-processors and subcontractors. The Provider may use subcontractors and sub-processors to provide the Service, as set out in the DPA. The Provider remains responsible for their work under the Agreement.

31.4 Severability. If any part of the Agreement is found invalid or unenforceable, the rest stays in force, and the invalid part is replaced by a valid one that is as close as possible to the original intention.

31.5 No waiver. If a party does not enforce a right immediately, it does not give up that right.

31.6 Independent parties. The parties are independent. The Agreement does not create a partnership, agency or employment relationship.

31.7 Survival. Sections that by their nature should continue after the Agreement ends continue, including Sections 7 (for unpaid Fees), 13, 17, 18, 21, 22, 23, 24, 28, 29 and 30.

31.8 Electronic signature. The Order Form may be signed electronically or by scanned signature, to the extent the applicable laws of the Republic of Iraq allow.

Contact: [email protected] · WhatsApp +964 776 780 8363