General Terms and Conditions (GTC)

Effective as of: 02/11/2026

Service Provider: B Consulting Kft. (registered office: 1102 Budapest, Kőrösi Csoma Sándor út 18-20.; reg. no.: 01-09-067467; tax no.: 10387355-2-42; e-mail: kozpont@bconsulting.hu)

Software/Service: “B OnSite” - a cloud-based, modular digital operations management system (multi-tenant SaaS).

Relation of this GTC to the Master Licence Agreement: These GTC form an integral appendix to the B OnSite Master Licence Agreement. In the event of any discrepancy, the provisions of the Master Licence Agreement shall prevail.

1. Definitions and Scope

1.1 Definitions. “Software/Service”: the B OnSite SaaS; “Client”: the party signing the Master Licence Agreement; “User”: a natural person authorised by the Client; “Subscription”: time-based service access linked to the selected package and module configuration, subject to periodic fees; “Billing Cycle Date”: the first day of the invoicing period; “SLA”: Clause 5 of these GTC; “GDPR”: Regulation (EU) 2016/679.
1.2 Personal and material scope. These GTC apply to all Clients and to the entire modular service portfolio of B OnSite.
1.3 Formation of the legal relationship. The legal relationship is formed upon execution of the Master Licence Agreement by both Parties and payment of the first instalment when due; if the licence is made available to the Client earlier, the relationship is formed upon the activation of the access rights.
1.4 Preconditions. The Client shall ensure the equipment and stable internet connection necessary for proper use; any on-premise or hybrid components, integrations and bespoke developments are subject to separate quotation and agreement.

2. Nature of the Service (SaaS)

2.1 B OnSite is a cloud-based, multi-tenant, modular digital operations management service, activated with the modules selected by the Client.
2.2 The Service Provider grants a non-exclusive, non-transferable right to use the Software solely for the Client’s internal business purposes. The source code, database schemas, interfaces and know-how are the intellectual property of the Service Provider.
2.3 Hosting and operation of the Software are provided in a data centre designated by the Service Provider; operation of on-premise components is not included in the subscription.

3. Module System and Functions

3.1 Package options: Basic, Standard, Premium, Custom.
3.2 Subscription period options: Monthly, Semi-annual, Annual, Custom.
3.3 Selectable modules:

• HR & Document Management: corporate and employee documents, permissions, expiries, search.
• Occupational Safety: training records, permits, medical fitness, automated reminders.
• Digital Training: online courses and exams, completion tracking, certificates.
• Guard Service: presence of the security company’s staff based on gate movements (who is on site and since when), with a query for a chosen point in time.
• Client & Subcontractor Portal: partner/subcontractor data, permissions, access, documentation.
• Access Control: person and vehicle access, permission management; compatibility as per integration specification.
• Freight/Cargo Gate Control: entry management, consignment data, automated recording and checks.
• Reporting & Performance Measurement: reports (presence, work hours, expiring documents, site permissions, summary statistics), with Excel export for some of them; work types with quantity units and a quantity statement by period, site and area; area-based QR recording of work is optional, as an auxiliary feature only.
• Visitor Management: pre-registration, check-in/out, declarations.
• Integrations & Automations: as per Client’s requirements and specifications.

3.4 Detailed technical descriptions and integration compatibility lists are available on the Service Provider’s documentation portal (www.bonsite.hu). Bespoke requirements qualify as additional services.

4. Subscription, Fees, Invoicing, Indexation

4.1 Fees and schedule. Fees are set out in the accepted quotation and/or the Master Licence Agreement and are payable in advance for the selected period (monthly/semi-annual/annual).
4.2 Indexation. The Service Provider may annually adjust fees automatically by the previous year’s CPI as published by the Hungarian Central Statistical Office (KSH).
4.3 Currency/exchange rate. Invoicing is in HUF; where fees are calculated in foreign currency, the MNB (Central Bank of Hungary) mid-rate applies; price changes may be passed on to the Client.
4.4 Annual fee adjustment. The Service Provider may adjust the licence and service fees annually by the annual consumer price index (inflation) published by the Hungarian Central Statistical Office (KSH) for the calendar year preceding the year concerned. The Service Provider may also modify fees on the basis of changes in the scope of services, operating costs or third-party infrastructure fees; in such a case it shall notify the Client in writing at least 30 days before the modification takes effect. The fee adjustment applies automatically and does not constitute an amendment of the agreement.
4.5 Invoicing and communications. Electronic invoices; notifications via e-mail or the client portal.
4.6 Delay and costs. In case of late payment, statutory default interest under Section 6:155 of the Hungarian Civil Code applies, and collection/administrative cost allowances may be charged.
4.7/a Late payment charge. If the Client fails to settle the invoice within 15 days after the payment deadline (grace period), the Service Provider may charge a late payment surcharge equal to 33% of the relevant monthly subscription fee. This charge is applied in addition to the statutory default interest under Clause 4.6 and is intended to compensate for the additional administrative and operating costs arising from the delay.
4.7 Non-payment protocol (3-7-30).
(a) 3 days’ delay: suspension (access restricted);
(b) 7 days’ delay: shutdown (temporary discontinuation);
(c) 30 days’ delay: termination of the contractual relationship and deletion of account/data pursuant to Clause 8.4.
4.8 No right of set-off/withholding. The Client’s payment obligation is independent of fault reports or ongoing case handling.

5. Service Levels (SLA), Maintenance and Support

5.1 Availability. Target monthly availability: 99.5%, excluding planned maintenance windows.
5.2 Incident handling (response times): P1 Critical 2h | P2 High 4h | P3 Medium 12h | P4 Low 24h (business hours: Mon-Fri 08:00-16:00 CET; P1-P2 may be reported 24/7). Incident classification is performed by the Service Provider’s IT team following due analysis of the fault/report; re-classification may be applied with justification.
5.3 Maintenance. Once per month, with at least 24 hours’ prior notice; urgent security actions may be performed without prior notice.
5.4 Service credit (exclusive remedy). If the SLA target is demonstrably not met, the Service Provider shall, at its discretion, grant a service credit or apply remedial measures; the cap is 10% of the monthly subscription fee for the month concerned, and this excludes any other compensation.
5.5 Client cooperation. The Client shall provide all information, accesses and reproduction steps necessary for fault reporting and investigation.

6. Acceptable Use and Client Obligations

6.1 Lawful use. Any unlawful use of the Software is prohibited, including unsolicited messaging, malware, circumvention of access controls, and denial-of-service attacks.
6.2 Accesses. The Client is responsible for granting/revoking user permissions and protecting authentication data.
6.3 Infrastructure. The Client ensures compatible client devices and continuous internet access.
6.4 Data quality. The Client is solely responsible for the lawfulness, accuracy and completeness of data it records/transfers.
6.5 Testing/pen-test. External security testing requires the Service Provider’s prior written consent and a mutually agreed time window.

7. Intellectual Property, Licence and Restrictions

7.1 IP rights. The Software, documentation, manuals, screenshots, APIs and interfaces are the exclusive intellectual property of the Service Provider.
7.2 Prohibitions. Reverse engineering, modification, copying, sublicensing, leasing, or sharing access with third parties is prohibited.
7.3 Open-source components. The Software may contain OSS components; their licences prevail for the respective components.
7.4 Usage data. The Service Provider may collect telemetry and usage data for service improvement and quality assurance, with personal data anonymised.

8. Suspension, Termination and Data

8.1 Suspension and shutdown. In accordance with Clause 4.7, the Service Provider may suspend, then shut down the service.
8.2 Immediate termination (by the Service Provider). In case of material breach, unauthorised use, information-security risk, export-control or sanctions exposure, the Service Provider may terminate with immediate effect by a reasoned notice.
8.3 Ordinary termination (by the Client). The Client may terminate the subscription at any time by ordinary notice given in writing. The termination takes effect at the end of the billing cycle in progress when the notice is received; the Client is obliged to pay the fee for that billing cycle in full (if it has not yet been paid, the termination does not release the Client from paying it), and any fee already paid is not refunded for the remaining part of that cycle.
8.4 Data return and deletion. Upon termination, the Client may request machine-readable export of its data within 30 days of termination. On day 30, the Service Provider shall permanently delete the Client’s data and account and destroy backups in line with rotation.
8.5 Retention and evidence. Deletion is logged by the Service Provider and - upon request - certified to the Client.

9. Liability, Warranty, Limitation of Damages

9.1 Warranty. The Service Provider warrants the proper usability of the Software; failures of third-party systems, network outages, Client-side infrastructure or data-quality issues do not constitute defective performance by the Service Provider.
9.2 Limitation of liability. The Service Provider’s aggregate liability - on any legal ground - shall not exceed the amount of the last monthly subscription fee for the relevant period.
9.3 Exclusions. No compensation for loss of profit, indirect/consequential loss, third-party claims, loss due to data loss, loss arising from lack of data-protection legal basis, or force majeure.
9.4 Damage prevention and cooperation. The Client shall act in accordance with the duty to mitigate loss and cooperate in remediation.

10. Data Protection and Processing (GDPR Article 28)

10.1 Roles. The Client is the data controller; the Service Provider is the data processor.
10.2 Instructions and purpose limitation. Processing is based solely on the Client’s written instructions and limited to what is necessary to operate the subscribed modules.
10.3 Security (GDPR Art. 32). TLS 1.2+ in transit, AES-256 at rest, access logging, role segregation, daily encrypted backups, regular vulnerability management.
10.4 Incident management. Notification to the Client within 72 hours of detection, including the nature and impact of the incident and measures taken.
10.5 Support for data subject rights. The Service Provider shall reasonably cooperate as instructed by the Client; target timeframe: 5 business days.
10.6 Sub-processors. The Service Provider may engage sub-processors under equivalent commitments; 15 days’ prior notice shall be given, the Client may object within 10 days.
10.7 Data location and transfers. Processing is primarily within the EEA; transfers outside the EEA only with GDPR Articles 44-49 safeguards (e.g. SCCs, EU-US Data Privacy Framework).
10.8 Data return/deletion. As per Clause 8.4; where statutory retention applies, limited retention is permitted and documented.
10.9 Audit. The Client may initiate an audit once per year upon reasonable prior arrangement; the audit must not disrupt the service. Compliance may be evidenced by certificates/reports (e.g. ISO/IEC 27001:2022). Audit costs are borne by the Client.
10.10 Data Processing Agreement. The detailed rules of data processing are set out in the Data Processing Agreement forming Schedule 2 to the Master Licence Agreement; in data protection matters, in the event of any discrepancy, the Data Processing Agreement prevails.
10.11 Own processing. Information on the Service Provider’s own processing (website, sales, client relationship) is given in the Privacy Notice available at www.bonsite.hu.

11. Quality Management and Certifications

The Service Provider operates in line with ISO 9001, ISO 14001 and ISO/IEC 27001:2022 requirements; certificates and scopes can be presented upon request.

12. Amendments, Notices, Service of Process

12.1 Amendment of the GTC. The Service Provider may unilaterally amend the GTC (e.g. due to legal changes, security/operational reasons, feature expansion). The Client shall be notified at least 15 days in advance by e-mail or via the client portal. The Client may terminate the subscription with ordinary notice before the effective date; Clause 8.3 applies to such termination: it takes effect at the end of the billing cycle in progress, the Client is obliged to pay the fee for that cycle, and any fee already paid is not refunded for the remaining part of the cycle. If the Client terminates before the effective date, the GTC as in force before the amendment continue to apply to the Client until the termination takes effect. If the Client does not terminate before the effective date, the amendment shall be deemed accepted.
12.2 Notices. Written form includes duly signed postal items, courier-delivered documents and electronic messages sent to the official e-mail address specified in the agreement.
12.3 Service presumption. Postal items marked “not sought/refused/moved” shall be deemed served on the 5th business day following the second delivery attempt; e-mails are deemed served at the time of sending.

13. Subcontractors, Force Majeure, Compliance

13.1 Use of subcontractors. The Service Provider may involve subcontractors and is liable for their acts as for its own.
13.2 Force majeure. In the event of circumstances beyond reasonable control (e.g. widespread network outage, natural event, regulatory prohibition), liability is excluded and performance deadlines extend proportionately.
13.3 Compliance. The Client complies with applicable labour, occupational safety, data-protection and sectoral rules; the Software does not constitute legal compliance advice.

14. Third-Party Systems and Integrations

14.1 The Service Provider shall not be liable for the availability or changes of any third-party systems (e.g. SPICA, Hikvision, HR system); in case of incompatibility, operational/technical solutions are subject to separate agreement.
14.2 API quotas and throttling rules apply; overuse is subject to additional fees.

15. Export Control and Sanctions

The Client warrants that it is not a prohibited or sanctioned entity; the service may not be used for any purpose that would breach export-control or sanctions restrictions. Any such breach constitutes grounds for immediate termination.

16. Governing Law and Disputes

This agreement is governed by Hungarian law. The Parties shall first seek an amicable settlement; failing this - subject to value thresholds - the courts having jurisdiction at the Service Provider’s registered seat shall have exclusive competence.

17. Final Provisions and Order of Precedence

17.1 Entire agreement. The Master Licence Agreement, these GTC and the Data Processing Agreement together constitute the entire agreement of the Parties and supersede all prior statements.
17.2 Precedence. In case of conflict, the Master Licence Agreement prevails; regarding fees, modules and SLA parameters, the then-current GTC configuration shall apply.
17.3 Severability. Invalidity of any provision shall not affect the validity of the remainder; the Parties shall replace the invalid provision with one that most closely reflects its purpose.

No signature required.
These GTC become binding on the Client upon signing the Master Licence Agreement and/or by using the service.