Platform Terms and Data Processing Agreement

1. Purpose and scope

These Platform Terms govern the subscription to and use of the VoraPlex platform by businesses (the “Store”). Section 12 contains the Data Processing Agreement required by Article 28 of the General Data Protection Regulation (GDPR).

They supplement the website’s general Terms and Conditions and the Privacy Policy. In case of conflict regarding use of the platform, these Platform Terms prevail.

2. Parties and definitions

• VoraPlex: Liliana Isabel Marques Dores (trade name VoraPlex), sole trader, VAT no. PT226400115, Av. São Lourenço da Barrosa, Edf. Carmix, Ap. 201, 8500-510 Portimão, Portugal.
• Store: the business that subscribes to the platform and its authorised users (owner and operators).
• End Customer: the Store’s customer who joins the Store’s points programme.
• Programme: the points, rewards and communications programme set up by the Store on the platform.
• Dashboard: the Store’s management area on the platform.

3. Sign-up, plans and prices

• Plans correspond to the number of customers registered in the Store’s Programme (Start, Growth, Pro and Enterprise). Current prices are published at voraplex.com and in the Dashboard. VAT is added to prices at the legal rate.
• If the number of registered customers exceeds the limit of the chosen plan, VoraPlex may adjust the subscription to the corresponding tier, informing the Store beforehand.
• There are no setup fees. The platform runs in the browser and does not include equipment (hardware).
• All plans include 10 messages per month. The quota does not accumulate and renews on the 1st of each month. Additional SMS packs may be purchased, valid for 6 months, and are only used once the month’s quota has been exhausted.
• Some optional features (for example, the appointment agenda, automatic receipt reading or Google Business management) may be subject to their own conditions, stated in the Dashboard or in the quote.
• The account and services are activated after payment is confirmed.

4. Payment and invoicing

• Payment is made by card, securely through Stripe. Card details do not pass through VoraPlex’s servers.
• The subscription may be monthly or annual. With the annual option, 2 months are offered free. The amount is charged at the start of each period.
• For each charge, the corresponding invoice-receipt is issued and sent by email.
• In the event of non-payment, VoraPlex may suspend access and, if non-payment continues, cancel the subscription.

5. Term and cancellation

• The subscription renews automatically at the end of each period (monthly or annual) until cancelled.
• The Store may cancel at any time on the “Subscription” page of the Dashboard. Voluntary cancellation blocks access immediately.
• 30-day satisfaction guarantee. Each Store’s first paid subscription is covered by a guarantee of 30 calendar days, counted from the first payment. Within that period, the Store may cancel and request, by email to voraplex@voraplex.com, a full refund of that first payment, made by the same payment method. The guarantee does not apply to renewals, plan changes, SMS or other extras, and cannot be used more than once by the same Store, holder, VAT number or business. The details are set out in clause 6.2.1 of the Terms of Service.
• Outside the satisfaction guarantee referred to above, amounts already paid for the current period are not refunded, unless mandatory law provides otherwise.
• After cancellation, operational data is kept for 90 days to allow reactivation or export at the Store’s request. After that period it is deleted or anonymised, except for data that the law requires to be kept (for example, invoices).

6. Use of the platform by the Store

• The Store is responsible for the confidentiality of credentials and for the actions of its operators, who should have only the access they need.
• The Store defines the rules of its Programme (points, rewards, minimum amounts, campaigns) and undertakes to comply with them towards End Customers, clearly and transparently.
• The Store is solely responsible for the products, services and rewards it offers, and for its commercial relationship with its customers.
• To read the receipt QR code, the Store must correctly register its issuer VAT number.
• It is forbidden to use the platform for unlawful purposes, to send illegal, misleading or abusive content, or to try to access other stores’ data.

7. End Customers and points programme

• The End Customer joins with a mobile phone number and a PIN, without installing any app.
• Points are awarded for purchases registered at the Store, by reading the receipt QR code or by registration at the counter. Each receipt counts only once and must be read within the period and limits shown on the platform (currently, up to 72 hours after purchase and up to 5 receipts per day per customer).
• Redemptions are validated with the code shown on the phone or with the End Customer’s PIN.
• In the event of abnormal use, abuse or suspected fraud, the Store or VoraPlex may immediately suspend accumulation and use of rewards while checks are carried out, and cancel improper transactions.
• Taking part in the VoraPlex store network is optional.

8. Messages and SMS

• The Store may only send commercial communications to End Customers who have given their consent, under Portuguese Law no. 41/2004 and the GDPR, and must respect opt-out requests.
• The Store is responsible for the content of the messages it sends.
• Security messages (for example, verification codes) do not count towards the Store’s quota.

9. Availability and support

VoraPlex strives to keep the platform available and secure, but does not guarantee uninterrupted availability: interruptions may occur due to maintenance, updates or external factors. Support is provided by email at voraplex@voraplex.com.

10. What VoraPlex does not do

• It does not issue invoices or receipts for the Store’s sales and does not replace its invoicing software.
• It does not handle the Store’s accounting or tax obligations.
• It does not supply equipment.
• It does not guarantee commercial results or customer take-up, which depend on the Store.
• It does not store End Customers’ payment data.
• It does not resolve disputes about the Store’s products or services.

11. Liability

To the extent permitted by law, VoraPlex is not liable for indirect damages, loss of profit or business interruption, and its total liability to the Store is limited to the amount paid by the Store in the 12 months preceding the event giving rise to it. These limitations do not apply in cases of wilful misconduct or gross negligence, nor do they exclude rights that the law does not allow to be excluded.

12. Data Processing Agreement (GDPR, Art. 28)

This section is the processing contract provided for in Article 28(3) of the GDPR between the Store and VoraPlex. Acceptance of these Terms at sign-up counts as acceptance of this Agreement, in electronic form (Art. 28(9)).

12.1 Roles of the parties

• The Store is the controller of its End Customers’ data within its Programme: purchases registered at the Store, points, rewards, history, segments and messages.
• VoraPlex is the processor of that data and processes it only on behalf of the Store and according to its documented instructions, which are the settings and actions made in the Dashboard and these Terms.
• VoraPlex is an independent controller of the data needed for the End Customer’s account on the platform (phone number, PIN, authentication), for security and fraud prevention, for the Store’s invoicing and for the website, under the Privacy Policy.

12.2 Subject matter, duration, nature and purpose

Providing the Store with the points and rewards programme, purchase records, customer CRM, statistics, the agenda (when enabled) and message sending. Processing lasts while the subscription is active and, after cancellation, for the 90-day period set out in section 5.

12.3 Categories of data subjects and data

• Data subjects: the Store’s End Customers and the Store’s authorised users.
• Data: name (when provided), mobile phone number, purchase data (date, amount, store, document number and receipt ATCUD), points, rewards and redemptions, history, communication preferences, bookings (when the agenda is enabled) and technical access data.
• The platform does not ask for or store the End Customer’s VAT number or the End Customers’ payment data.
• The Store undertakes not to record special categories of data (for example, health data) on the platform, including in free-text fields.

12.4 VoraPlex’s obligations

• Process the data only on the Store’s documented instructions, including regarding international transfers, unless required by law, and inform the Store if it considers that an instruction infringes the law.
• Ensure that persons authorised to process the data have committed to confidentiality.
• Apply appropriate technical and organisational measures (Art. 32), namely: encrypted communications (HTTPS), role-based access control (owner and operators), PIN for redemptions, logging of relevant actions, separation of each Store’s data and routines to clean up obsolete data.
• Assist the Store in responding to data subjects’ requests to exercise their rights and in complying with Articles 32 to 36 of the GDPR.
• Notify the Store, without undue delay and, where possible, within 48 hours, after becoming aware of a personal data breach affecting its data.
• At the end of the services, and at the Store’s choice, delete or return the data, without prejudice to retention required by law.
• Make available to the Store the information necessary to demonstrate compliance with this article and allow audits, with reasonable notice and at the Store’s expense.

12.5 Sub-processors

The Store gives VoraPlex general authorisation to use the following sub-processors, subject to data protection obligations equivalent to those of this Agreement:

• Web hosting provider engaged by VoraPlex: hosting of the platform and databases.
• SMSAPI (LINK Mobility Poland, European Union): sending SMS and verification codes.

VoraPlex informs the Store at least 30 days in advance of the addition or replacement of sub-processors. The Store may object on reasonable grounds and, failing agreement, cancel the subscription without penalty. The updated list is available on request.

Stripe (payments) and the KeyInvoice invoicing software process the Store’s billing data, under VoraPlex’s responsibility, and not End Customers’ data.

12.6 International transfers

Data is only transferred outside the European Economic Area with the safeguards provided for in Chapter V of the GDPR.

12.7 The Store’s obligations

• Ensure it has a legal basis for the processing and, where necessary, the End Customers’ consent, in particular for commercial communications.
• Inform End Customers about the processing of their data (Arts. 13 and 14 of the GDPR).
• Give only lawful instructions and respond to data subjects’ requests, with VoraPlex’s assistance.

13. Changes

VoraPlex may amend these Terms to reflect legal, technical or commercial changes. Material changes are notified to the Store at least 30 days in advance. If the Store does not agree, it may cancel the subscription before they take effect.

14. Governing law, ADR and Complaints Book

These Terms are governed by Portuguese law. The courts of the district of Faro (Portimão) have jurisdiction over any dispute, without prejudice to applicable mandatory rules.

In the event of a consumer dispute, the consumer may refer to the Algarve Consumer Dispute Arbitration Centre or to CNIACC. More information on the Portuguese Consumer Portal. The Electronic Complaints Book is available at www.livroreclamacoes.pt.

15. Contact

For questions about these Terms or about data protection: voraplex@voraplex.com · +351 964 857 666 · Av. São Lourenço da Barrosa, Edf. Carmix, Ap. 201, 8500-510 Portimão, Portugal.