Terms of Service

Ultimate BMS (“we”, “us”) is operated by CORTEX SOLUTIONS (PTY) LTD, registration no. K2022501626, 236 Frederick Drive, Northcliff, Republic of South Africa. Email: admin@ultimate-bms.com. “You” is the business that signs up, and “Users” are the people you allow to use the service.

Payment is handled by Paddle.com Market Ltd, our merchant of record. Your payment contract is with Paddle; your contract for the software and support is with us.

You accept these terms by ticking the box at signup. This is an electronic agreement under the Electronic Communications and Transactions Act 25 of 2002, and we keep a record of the version you accepted and when. You confirm that you sign up on behalf of a business and have authority to bind it.

We may change these terms. We will email your account administrator at least 30 days before a material change takes effect. If you do not agree, you may cancel before it takes effect and the old terms apply until then. Continued use after that date is acceptance.

Subject to payment and these terms, we grant you a non-exclusive, non-transferable, non-sublicensable licence, for as long as your subscription is active, to use Ultimate BMS on your dedicated instance for your internal business purposes, for up to the number of users your plan allows (see the pricing page). The software is licensed, not sold, and we keep all rights not expressly granted.

You must not, and must not let anyone else:

• copy, modify or create derivative works of the software, except as the law allows;
• reverse engineer or decompile it, except where the law expressly permits;
• resell, rent, lease or give third parties access to it, including as a bureau service;
• use it to build or train a competing product or AI model, or publish benchmarks;
• share a login between people, or let one seat be used by several people;
• attempt unauthorised access, introduce malicious code, or run security or penetration tests without our written consent (unauthorised access may be an offence under the Cybercrimes Act 19 of 2020); or
• use it in breach of any law, including POPIA.

You are responsible for your Users, for keeping logins confidential, for removing access when someone leaves, and for the security of your own devices and networks. Tell us immediately about suspected unauthorised use. We may check seat usage from system reports; if you exceed your plan's user limit you must upgrade.

Prices and what each plan includes are on the pricing page when you buy. Plans renew automatically each billing period until you cancel. Prices exclude VAT where VAT applies. If payment fails, we may suspend access after a 7-day grace period.

You may cancel at any time from the portal; cancellation takes effect at the end of the paid period with no pro-rata refund. A full refund is given within 14 days of first payment, and proactively if provisioning fails or the instance is unusable. See the refund policy. We may change prices for future periods on 30 days' notice.

Each plan includes an amount of AI credit that resets every billing period and does not roll over. Purchased top-ups do not expire and are used after included credit. When credit runs out, AI features pause until the next period or a top-up; the rest of the software keeps working.

AI features use third-party AI providers (see sub-processors). AI output is generated automatically and may be wrong or unsuitable. It is not legal, financial or other professional advice. You must review it before relying on it, and you remain responsible for decisions you make, including ensuring human involvement where section 71 of POPIA requires it. We do not use your data or AI output to train AI models, and our provider terms prohibit it. We may change or suspend AI features, or change a provider, where the law, a provider or a security risk requires it.

Support is by email during business hours (08:00 to 17:00 on South African business days). Response times depend on your plan's support level shown on the pricing page. Plans with a service level carry the availability target stated for that plan.

Users can log a support request from inside the software (Assistant, Support tab). A request is only sent when the user clicks Send. It includes what the user types plus technical details to help us fix problems: browser and device, the screen they were on, recent error messages and the addresses of failed requests (never their contents), and a screenshot the user can untick before sending. Screenshots are not taken on Payroll or Budget pages. A screenshot shows whatever is on screen, so Users should not include one if it shows information they do not want us to see. We use this information only to answer and resolve the request, and keep it for as long as we need it to support you. We email the person who logged the request to confirm we received it, and replies appear in the software and by email.

We back up your instance according to your plan. We may do scheduled maintenance in your maintenance window and urgent security maintenance at any time.

Your data stays yours. You give us a licence to host, copy and process it only to provide the service. For personal information in your data you are the responsible party and we are your operator under POPIA; the Data Processing Addendum is the written contract required by section 21 of POPIA and prevails on that subject.

We keep appropriate technical and organisational measures to protect your data, and will tell you without undue delay about a security compromise affecting your personal information. We collect aggregate operational telemetry as described in the Privacy Policy, never the contents of your records. You are responsible for keeping any records the law requires you to keep and for exporting them; you can export your data at any time while your subscription is active.

We warrant that we may license the software, that it will perform materially as described in its documentation, and that we use reasonable industry-standard measures to keep it free of malicious code. If you report a material fault in writing and we do not correct it within 30 days, you may cancel and receive a refund of fees paid for the period after cancellation.

Otherwise, to the extent the law permits, the service is provided “as is” and other warranties are excluded. We do not promise it will be uninterrupted or error-free. You warrant that you have a lawful basis under POPIA for the personal information you capture, and that your data does not infringe anyone's rights.

All rights in the software, documentation, updates and anything we create for you, and in feedback you give us, belong to us or our licensors. You get only the licence in clause 3, and you let us use feedback freely. We may use anonymised usage data to run, secure and improve the service; it will not identify you or any person.

We will defend you against a third-party claim that the software infringes South African intellectual property rights, and pay damages finally awarded, if you promptly notify us, let us control the defence and co-operate. This does not cover claims arising from your data, from changes we did not make, or from combining the software with other products. You indemnify us against third-party claims arising from your data or your breach of clause 4.

Either of us may cancel if the other commits a material breach and does not fix it within 20 business days of written notice. We may suspend or cancel at once for non-payment (after the grace period in clause 5), for breach of clause 4, or if you are placed in liquidation or business rescue.

When your subscription ends you must stop using the software. After cancellation or non-payment we keep your latest backup in cold storage for 3 months, emailing you at days 60 and 76 and on the day it is deleted, after which it is permanently deleted. You may delete it sooner from the portal. Clauses that by nature continue (including 4, 10, 12 and 13) do so after termination.

Please read this clause carefully. It limits what you can claim from us.

To the extent the law permits, neither of us is liable for indirect or consequential loss, or for loss of profit, revenue, goodwill or anticipated savings, even if foreseeable. We are not liable for loss or corruption of data except for our obligation to restore your most recent backup.

Each party's total liability to the other under these terms is limited to the fees you paid us in the 12 months before the event giving rise to the claim. For breach of our data-protection and security obligations, our total liability is limited to two times that amount. These limits do not apply to fraud, gross negligence or wilful misconduct, your obligation to pay fees, infringement of our intellectual property, the indemnities in clause 10, or liability the law does not allow to be limited. Nothing here limits rights you have under the Consumer Protection Act 68 of 2008 that cannot lawfully be excluded.

These terms are governed by the laws of the Republic of South Africa. Give written notice of a dispute and senior representatives will meet within 10 business days to try to resolve it. If it is unresolved after 30 days, either of us may refer it to mediation under the rules of the Arbitration Foundation of Southern Africa (AFSA), and if still unresolved after a further 30 days, to arbitration under AFSA rules in [CITY] before a single arbitrator. The award is final and binding.

Either of us may seek urgent interim relief, and we may sue to recover a liquidated amount, in the High Court of South Africa, [DIVISION].

These terms and the documents they link to are the whole agreement and replace earlier proposals. We vary them under clause 2; any other variation must be in writing and signed by both of us. Failure to enforce a right is not a waiver. If a provision is unenforceable, the rest stays in force. Neither of us is liable for delay caused by events beyond our reasonable control (other than payment); if one lasts over 60 days either of us may terminate.

You may not transfer your rights without our written consent. We may transfer ours to an affiliate or successor on notice, and may use subcontractors but remain responsible for them. Our address for notices is 236 Frederick Drive, Northcliff, and admin@ultimate-bms.com; notices to you go to your account administrator's email. An email is received on the next business day. If a change in law (including on AI or data protection) requires a change to the service or these terms, we may make it. Nothing here creates a partnership or agency.