International English – Portuguese Law compliant.
Parties
his Software as a Service Subscription Agreement (the “Agreement”) is entered into by and between:
Provider: BIMWorkplace, Lda., a private limited liability company incorporated under the laws of Portugal, NIF 516313096, with registered office at Rua Luís Barroso, Nº 590, 4ºA, 4760-153 Vila Nova de Famalicão, Portugal (“Provider”); and
Customer: The entity accepting this Agreement or signing a Subscription Order (“Customer”).
This Agreement is subject to the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and, when applicable, the Brazilian Law No. 13.709/2018 (Lei Geral de Proteção de Dados Pessoais – LGPD), in accordance with the principles of transparency, purpose, and security established by Brazilian legislation.
.
Definitions
”Access Credentials” means any user name, identification number, password, license or security key, security token, personal identification number (PIN) or other security code, method, technology or device used, alone or in combination, to verify an individual’s identity and authorization to access and use the Hosted Services.
”Action” means any claim, action, cause of action, demand, lawsuit, arbitration, inquiry, audit, notice of violation, proceeding, litigation, citation, summons, subpoena or investigation of any nature, civil, criminal, administrative, investigative, regulatory or other, whether at Law, in equity or otherwise.
”Affiliate” of a Person means any other Person that, directly or indirectly, through one or more intermediaries, Controls, is Controlled by, or is under common Control with, the first Person.
”Authorized User” means each of the individuals authorized to use the Hosted Services and the other terms and conditions of this Agreement.
”Available” means the Hosted Services are available for access and use by Customer over the internet.
”BIMWorkplace” is a web-based collaborative platform which empowers teams with better coordination workflows. BIMWorkplace provides a central hub for all coordination information from design to construction. With information at your fingertips, you can access your data anytime, anywhere, either from a tablet or desktop. Charts and graphics helps understand data and your management performance through precise metrics.
”Control” (and the terms “Controlled by” and “under common Control with”) means the possession, directly or indirectly, of the power to direct or cause the direction of the management and policies of a Person, whether through the ownership of voting securities, by contract or otherwise.
”Customer” has the meaning set forth in the preamble.
”Customer Data” means, information, data and other content, in any form or medium, that is collected, downloaded or otherwise received, directly or indirectly from Customer by or through the Hosted Services.
”Customer Systems” means Customer’s information technology infrastructure, including computers, software, hardware, databases, electronic systems (including database management systems), networks and internet connectivity, whether operated directly by Customer or through the use of third-party services.
”Documentation” means any manuals, instructions or other documents or materials that Provider provides or makes available to Customer in any form or medium and which describe the functionality, components, features or requirements of the Services or Provider Materials, including any aspect of the installation, configuration, integration, operation, use, support or maintenance thereof.
”Governmental Authority” means any federal, provincial, territorial, municipal or foreign government or political subdivision thereof, or any agency or instrumentality of such government or political subdivision, or any self-regulated organization or other non-governmental regulatory authority or quasi-governmental authority (to the extent that the rules, regulations or orders of such organization or authority have the force of Law), or any arbitrator, court or tribunal of competent jurisdiction.
”Governmental Order” means any order, writ, judgment, injunction, decree, stipulation, award or determination entered by or with any Governmental Authority.
”Harmful Code” means any software, hardware or other technology, device or means, including any virus, trojan horse, worm, backdoor, malware or other malicious computer code, the purpose or effect of which is to: permit unauthorized access to, or to destroy, disrupt, disable, distort, or otherwise harm or impede in any manner any: computer, software, firmware, hardware, system or network; or any application or function of any of the foregoing or the security, integrity, confidentiality or use of any data Processed thereby; or prevent Customer from accessing or using the Hosted Services or Provider Systems as intended by this Agreement. Harmful Code does not include any Provider Disabling Device.
”IP Rights” means any and all registered and unregistered rights granted, applied for or otherwise now or hereafter in existence under or related to any patent, copyright, trade-mark, trade secret, database protection or other intellectual property rights laws, and all similar or equivalent rights or forms of protection in any part of the world.
”Law” means any statute, ordinance, regulation, rule, code, constitution, treaty, common law, Governmental Order or other requirement or rule of law of any Governmental Authority.
”Losses” mean all losses, damages, liabilities, deficiencies, claims, actions, judgments, settlements, interest, awards, penalties, fines, costs or expenses of whatever kind, including legal fees, disbursements and charges, and the cost of enforcing any right to indemnification hereunder and the cost of pursuing any insurance providers.
”Party” (and the term “Parties”) shall refer to either Customer or Provider, or both.
”Permitted Use” means any use of the Services by Customer for the benefit of Customer solely in or for Customer’s internal business operations or for any and all lawful purposes.
”Person” means an individual, corporation, partnership, unlimited liability company, Governmental Authority, unincorporated organization, trust, association or any other entity.
”Personal Information” means any information that, individually or in combination, does or can identify a specific individual or by or from which a specific individual may be identified, contacted or located.
”Process” means to take any action or perform any operation or set of operations that the Hosted Services are capable of taking or performing on any data, information or other content, including to collect, receive, input, upload, download, record, reproduce, store, organize, compile, combine, log, catalog, cross-reference, manage, maintain, copy, adapt, alter, translate or make other derivative works or improvements, process, retrieve, output, consult, use, perform, display, disseminate, transmit, submit, post, transfer, disclose or otherwise provide or make available, or block, erase or destroy, and “Processing” and “Processed” have correlative meanings.
”Provider” has the meaning set forth in the preamble.
”Provider Disabling Device” means any software, hardware or other technology, device or means (including any back door, time bomb, time out, drop dead device, software routine or other disabling device) used by Provider or its designee to disable Customer’s access to or use of the Hosted Services automatically with the passage of time or under the positive control of Provider or its designee.
”Provider Materials” means the Service Software, Documentation and Provider Systems and any and all other information, data, documents, materials, works and other content, devices, methods, processes, hardware, software and other technologies and inventions, including any deliverables, technical or functional descriptions, requirements, plans or reports, that are provided or used by Provider or any Subcontractor in connection with the Services or otherwise comprise or relate to the Services or Provider Systems.
”Provider Personnel” means all individuals involved in the performance of Services as employees, agents or independent contractors of Provider or any Subcontractor.
”Provider Systems” means the information technology infrastructure used by or on behalf of Provider in performing the Hosted Services, including all computers, software, hardware, databases, electronic systems (including database management systems) and networks, whether operated directly by Provider or through the use of third-party services.
”Receiving Party” means a Party that receives or acquires Confidential Information directly or indirectly under this Agreement.
”Representatives” means, with respect to a party, that party, its Affiliates, and their respective employees, officers, directors, consultants, agents, independent contractors, subcontractors and legal advisors.
”Service Software” means the Provider software application or applications and any third-party or other software that Provider provides remote access to, and use of, as part of the Hosted Services, and all new versions, updates, revisions, improvements and modifications of the foregoing.
”Territory” means the World.
”Third-Party Materials” means materials and information, in any form or medium, including any software, documents, data, content, specifications, products, equipment or components of or relating to the Services that are not proprietary to Provider.
Individual Accounts
Each user must have an individual account associated with a unique email address. User accounts and access credentials are personal, non-transferable, and may not be shared or reused.
BIMWorkplace reserves the right to audit account usage and to suspend or terminate access in case of misuse or credential sharing, without refund of fees already paid.
Services
Provider shall make the Services available 24/7 with a 99.9% monthly uptime commitment, subject to scheduled maintenance and Force Majeure.
Hosting, operation, maintenance, and updates remain under Provider’s control.
Customer retains control over its systems and Authorized Users.
Data Location: Customer Data will be hosted within the European Economic Area (EEA) by default. Transfers outside the EEA shall follow valid safeguards (e.g., Standard Contractual Clauses) under the Data Processing Agreement (Annex C).
Subprocessors: Provider may use approved subprocessors and remains fully liable for their actions.
Subscription and Fees
The Subscription Term commences on the effective date of the Subscription Order.
Payment Terms. All subscription fees are payable in advance and immediately upon issuance of the invoice. Access to the Services and activation of licenses is conditional on full payment. No license or access shall be granted until payment is confirmed.
Fees are invoiced in EUR (or BRL if expressly agreed), plus applicable VAT/ISS.
Out-of-scope costs (e.g., travel, on-site services) will be invoiced separately.
Provider may adjust fees upon renewal with 30 days’ prior written notice.
Customer Responsibilities
Maintain secure Access Credentials.
Ensure Authorized Users comply with this Agreement.
Prevent submission of Prohibited Data.
Maintain Customer backups of critical data.
Notify Provider of any unauthorized access or security incidents.
Security and Data Protection
The BIMWorkplace processes user personal data in compliance with the General Data Protection Regulation (GDPR – EU 2016/679) and, where applicable, with the Brazilian General Data Protection Law (Lei nº 13.709/2018 – LGPD).
Data Hosting: Customer Data is hosted on servers located in Virginia, United States, with international transfers subject to the European Commission’s Standard Contractual Clauses (SCCs) and equivalent safeguards under the GDPR and LGPD.
Security Measures:
Provider maintains industry-standard technical and organizational security measures, including:
- Encryption in transit (TLS 1.2+) and at rest (AES-256);
- Role-based access controls and authentication;
- Regular backups with defined RPO/RTO;
- Vulnerability management and monitoring;
- Business continuity and disaster recovery plans.
Breach Notification:
Provider shall notify Customer without undue delay and within 72 hours of becoming aware of a data breach, providing all legally required details.
A Data Processing Agreement (Annex C) compliant with GDPR and LGPD, including SCCs and subprocessors list, forms an integral part of this Agreement.
Intellectual Property
All IP Rights in the Services remain with Provider.
All rights in Customer Data remain with Customer.
Customer grants Provider a limited licence to process Customer Data solely for service delivery and improvement.
Feedback: Customer grants Provider a royalty-free licence to use feedback for improving the Services.
Acceptable Use
Customer must not:
- Upload malware, unlawful, or infringing content.
- Use the Services for competitive analysis or building competing products.
- Interfere with or disrupt Provider Systems.
(Detailed Acceptable Use Policy forms Annex A.)
Support and SLA
Availability: 99.9% uptime monthly.
Planned Maintenance: ≥72h prior notice.
Service Credits: defined in Annex B.
Support:
- Hours: business hours Portugal/Brazil.
- Priority P1: response within 4h.
- Priority P2: within 1 Business Day.
- Priority P3: within 3 Business Days.
- Channels: email, ticket portal.
Term and Termination
Either Party may terminate for uncured material breach after 30 days’ notice.
Provider may suspend Services for non-payment after 10 days’ notice, security risks, or legal requirement.
On termination:
- All access ceases immediately.
- Data Export. Customer may export its data in standard formats (CSV/JSON, native project files) only during the Subscription Term. No export will be available after termination or expiration.
- Provider will permanently delete Customer Data from production and backups after termination, subject to legal retention obligations.
Surviving provisions: Confidentiality, IP, Liability, Data Protection, Governing Law.
Warranties
Each Party warrants authority to enter this Agreement.
Provider warrants Services will be performed with reasonable skill and care.
Customer warrants rights to its Data and lawful use.
Beta Features: provided “as is”, without SLA or warranties.
Indemnification
Provider IP Indemnity: Provider indemnifies Customer against third-party IP infringement claims, with remedies (procure rights, replace, or terminate with refund).
Customer Indemnity: Customer indemnifies Provider against claims from Customer Data, misuse, or violation of Law.
Limitation of Liability
Neither Party liable for indirect or consequential damages.
Aggregate liability capped at fees paid in the 12 months preceding the claim.
Exclusions (no cap): wilful misconduct, gross negligence, confidentiality breaches, data protection violations, IP indemnity, death or personal injury.
Force Majeure
Neither Party is liable for delays caused by events beyond reasonable control (natural disasters, strikes, war, outages, government actions).
Amendments
Material adverse amendments apply only upon renewal, with 30 days’ prior notice. Customer may opt not to renew without penalty.
Governing Law and Jurisdiction
This Agreement shall be governed by and construed in accordance with the laws of Portugal.
Exclusive jurisdiction lies with the Courts of Braga, Portugal.
For Customers located in Brazil, BIMWorkplace ensures compliance with the principles of the Lei Geral de Proteção de Dados Pessoais (LGPD – Law No. 13.709/2018), without prejudice to the Portuguese jurisdiction applicable to this Agreement.
Miscellaneous
- Independent contractors; no partnership or agency.
- Customer may not assign rights without consent.
- Invalid terms do not affect the remainder.
- Notices must be in writing (courier, hand, or confirmed email).
- This Agreement and its Annexes form the entire agreement.
Annexes
- Annex A – Acceptable Use Policy
- Annex B – Service Level Agreement (SLA & Support)
- Annex C – Data Processing Agreement (GDPR/LGPD, SCCs, subprocessors)
- Annex D – Security Policy
- Annex E – Data Export Procedure & OSS Notices
Annex A – Acceptable Use Policy (AUP)
This Acceptable Use Policy (the “Policy”) sets out rules governing Customer’s and Authorized Users’ use of the Services. Capitalized terms have the meaning set out in the Agreement.
1. General Principles
- The Services may only be used for lawful purposes and in accordance with the Agreement.
- Customer is responsible for all use of the Services by its Authorized Users.
2. Prohibited Conduct
Customer and Authorized Users shall not:
- Illegal Use
- Use the Services to violate applicable Law, including data protection, export control, intellectual property, or competition laws.
- Security & Integrity
- Introduce malware, viruses, trojans, worms, or any other harmful code.
- Attempt to probe, scan, or test vulnerabilities of the Services without prior written consent.
- Interfere with or disrupt Provider Systems or networks connected to the Services.
- Misuse of Data
- Upload or process Prohibited Data (including special categories of personal data under GDPR without legal basis, data of children without valid consent, or any data prohibited by applicable Law).
- Collect or harvest data from the Services without authorization.
- Abuse of Services
- Circumvent security features, license restrictions, or payment obligations.
- Copy, modify, frame, or mirror the Services without prior written consent.
- Use the Services to provide services to third parties that compete with Provider.
- Unlawful or Harmful Content
- Upload or transmit content that is defamatory, obscene, discriminatory, offensive, threatening, or otherwise unlawful.
3. Enforcement
- Provider may monitor compliance with this Policy.
- Provider may suspend or terminate access to the Services immediately if Customer or Authorized Users breach this Policy, without prejudice to other rights under the Agreement.
4. Reporting Violations
Suspected violations of this Policy should be reported to [info@bimworkplace.com].
5. Changes
Provider may update this Policy from time to time to reflect legal, technical, or business changes. The latest version will be made available to Customer.
Annex B – Service Level Agreement (SLA & Support)
This Service Level Agreement (“SLA”) forms part of the Agreement between Provider and Customer. Capitalized terms have the meaning set out in the Agreement.
1. Service Availability
- Commitment: Provider will make the Services Available 99.9% of each calendar month.
- Exclusions: Availability excludes:
- Scheduled maintenance (with at least 72h prior notice);
- Emergency maintenance (not exceeding 2 hours per month);
- Downtime caused by Force Majeure, Customer Systems, or third-party connectivity failures;
- Suspension in accordance with the Agreement.
2. Service Credits
If monthly Availability falls below the commitment, Customer may request the following credits against future invoices:
| Monthly Uptime | Credit (% of monthly fees) |
| ≥ 99.0% and < 99.9% | 5% |
| ≥ 98.0% and < 99.0% | 10% |
| < 98.0% | 20% |
- Credits must be requested in writing within 30 days after the relevant month.
- Credits are Customer’s sole and exclusive remedy for unavailability.
3. Support Services
Provider will provide Customer support via email and ticketing system during Business Hours (Portugal and Brazil time zones).
3.1 Support Hours
- Monday to Friday, 09:00–18:00 local time (excluding national holidays).
3.2 Severity Levels and Response Times
| Priority | Description | Target Response Time | Target Resolution (best efforts) |
| P1 – Critical | Service unavailable or major functionality unusable affecting all users | 4 hours | Workaround or fix within 1 Business Day |
| P2 – High | Significant degradation affecting multiple users | 1 Business Day | Fix within 3 Business Days |
| P3 – Normal | Minor issues or functionality limitations | 3 Business Days | Fix in next scheduled update |
| P4 – Low | General queries, “how-to” questions, requests for enhancements | 5 Business Days | As agreed / roadmap |
4. Customer Responsibilities
- Provide accurate incident descriptions and necessary logs/screenshots.
- Assign qualified personnel as primary contact.
- Maintain up-to-date Customer Systems and supported environments.
5. Exclusions
This SLA does not cover:
- Issues caused by Customer Systems, third-party integrations, or misuse of Services;
- Beta or trial features explicitly identified as non-production;
- Performance issues due to internet congestion outside Provider’s control.
6. Changes
Provider may amend this SLA from time to time to reflect improvements or legal/technical updates. The latest version will be made available to Customer.
Annex C – Data Processing Agreement (DPA)
This Data Processing Agreement (“DPA”) forms part of the Agreement between Provider and Customer. Capitalized terms have the meaning set out in the Agreement.
1. Roles of the Parties
- Customer is the Data Controller (or “Controller” under GDPR / “Controller” under LGPD).
- Provider is the Data Processor (or “Operator” under LGPD) when Processing Customer Personal Data.
2. Scope of Processing
Provider shall:
- Process Customer Personal Data only on documented instructions from Customer, including transfers of Personal Data to third countries;
- Process only for the purpose of providing and improving the Services;
- Not retain Personal Data longer than necessary to provide the Services, except as required by law.
3. Security
Provider shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including at least:
- Encryption in transit and at rest;
- Access controls with authentication and role-based permissions;
- Regular backups and business continuity procedures;
- Vulnerability management and security monitoring.
4. Subprocessors
- Provider may engage subprocessors for hosting, support, and ancillary services.
- Provider will maintain an up-to-date list of subprocessors.
- Customer may subscribe to updates. Objections must be raised within 15 days.
5. International Data Transfers
Customer Data is stored and processed on servers located in Virginia, United States. Such transfers outside the European Economic Area are governed by the European Commission’s Standard Contractual Clauses (SCCs) and appropriate technical and organizational safeguards. For Brazilian Customers, such transfers comply with the LGPD provisions on international transfers of personal data. Provider shall maintain updated records of subprocessors involved in these transfers and will make them available to Customer upon request.
If Personal Data is transferred outside the EEA, UK or Brazil, Provider shall ensure adequate safeguards, such as:
- EU Standard Contractual Clauses (SCCs);
- UK IDTA or Addendum;
- LGPD-approved contractual clauses or adequacy decisions.
- On request, Provider will provide copies of transfer safeguards.
6. Assistance
Provider shall assist Customer in:
- Responding to data subjects’ requests;
- Conducting data protection impact assessments;
- Meeting security, breach notification, and compliance obligations.
7. Breach Notification
- Provider shall notify Customer without undue delay and within 72 hours of becoming aware of a Personal Data Breach.
- The notification shall include details of the breach, affected data, and measures taken.
8. Audit Rights
- Customer may audit Provider’s compliance once per year (or more if required by law) with 30 days’ prior notice, subject to confidentiality.
- Provider may provide third-party certifications (e.g., ISO 27001, SOC 2) to satisfy audit requests.
9. Return or Deletion of Data
- Upon termination of the Agreement, Provider shall delete or return all Customer Personal Data (as elected by Customer), unless retention is required by law.
10. Liability
Liability under this DPA follows the rules set out in the Agreement.
11. Acceptance
By completing the signup process and clicking “I Agree”, Customer confirms acceptance of this Agreement (including its Annexes) and acknowledges that it is legally binding as of the date of acceptance.
Provider: BIMWorkplace, Lda., NIF 516313096
Rua Luís Barroso, Nº 590, 4ºA, 4760-153 Vila Nova de Famalicão, Portugal
Customer: The entity or individual identified during the signup process.
Appendix 1 – Standard Contractual Clauses (EU Commission Decision 2021/914)
The following Standard Contractual Clauses (SCCs) apply to international transfers of Customer Personal Data to third countries outside the European Economic Area, pursuant to Regulation (EU) 2016/679 (GDPR). The SCCs are incorporated herein in full, as adopted by the European Commission on 4 June 2021 (Decision 2021/914).
Applicable Module: Module 2 (Controller to Processor). Annexes I, II, and III of the SCCs are completed as follows:
Annex I – List of Parties
Data Exporter: Customer, as identified in the Subscription Agreement.
Data Importer: BIMWorkplace, Lda., NIF 516313096, Rua Luís Barroso, Nº 590, 4ºA, 4760-153 Vila Nova de Famalicão, Portugal.
Annex II – Technical and Organisational Measures
Measures include: encryption in transit and at rest, access controls, backups, vulnerability management, incident response procedures, and audit logging.
Annex III – List of Subprocessors
The following subprocessors are currently authorized by the Data Importer (BIMWorkplace, Lda.) to process Customer Personal Data in connection with the Services:
- Microsoft Azure – Hosting and infrastructure provider (storage, compute, networking).
- Location: Virginia, United States.
- Safeguards: Standard Contractual Clauses (EU Commission Decision 2021/914); encryption in transit and at rest; GDPR and LGPD compliance.
No other subprocessors are engaged at this time.
Annex D – Security Policy & Data Export Procedure
1. Security Policy
1.1. General Principles
Provider applies industry-standard technical and organizational measures to protect Customer Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.
1.2. Data Encryption
- All data in transit is encrypted using TLS 1.2 or higher.
- All data at rest is encrypted using AES-256 or equivalent.
1.3. Access Control
- Role-based access is enforced; only authorized Provider personnel may access systems on a need-to-know basis.
- Multi-factor authentication is required for administrative access.
1.4. Backup and Continuity
- Daily backups are maintained and stored in geographically redundant facilities.
- Provider regularly tests restoration procedures to ensure business continuity.
1.5. Vulnerability Management
- Provider maintains a program for patching, monitoring, and mitigating vulnerabilities.
- Security audits and penetration tests may be conducted periodically.
1.6. Incident Management
- Security incidents are logged and investigated promptly.
- Provider will notify Customer of any Data Breach without undue delay and in any case within seventy-two (72) hours, in line with GDPR and LGPD requirements.
2. Data Export Procedure
2.1. Export Rights
- Customer may export its Data during the active Subscription Term using standard export features provided by the Service.
- No export is available after termination of the Agreement.
2.2. Export Formats
- Provider supports export in standard industry formats (e.g., IFC, CSV, XLSX, PDF, or other generally accepted open formats).
- Export is limited to Customer Data; system data, logs, or proprietary Provider materials are excluded.
2.3. Export Process
- Data exports must be initiated by the Customer’s Account Administrator via the Service interface.
- Provider may impose reasonable technical limitations to ensure service stability and security.
2.4. Deletion after Termination
- Following contract termination and expiration of any applicable retention period required by law, all Customer Data will be irreversibly deleted from Provider’s systems, except where retention is mandated by applicable law.
Provider: BIMWorkplace, Lda., NIF 516313096
Rua Luís Barroso, Nº 590, 4ºA, 4760-153 Vila Nova de Famalicão, Portugal
Annex E – OSS Notices & Feedback License
1. Open Source Software (OSS) Notices
1.1. OSS Components
The Service may include or interoperate with components licensed under open source licenses. These components are provided under their respective license terms, which may grant Customer additional rights beyond this Agreement.
1.2. No Restriction on OSS Rights
Nothing in this Agreement shall limit or restrict Customer’s rights under the applicable open source licenses. Copies of OSS licenses and attributions are available upon request.
1.3. Provider Responsibility
Provider remains solely responsible for ensuring that inclusion of OSS components does not subject Customer Data or proprietary Provider software to open source “copyleft” obligations.
2. Feedback License
2.1. Voluntary Feedback
Customer may, at its discretion, provide suggestions, ideas, or feedback regarding the Service (“Feedback”).
2.2. License Grant
By providing Feedback, Customer grants Provider a worldwide, royalty-free, irrevocable, perpetual license to use, modify, and incorporate such Feedback into the Service or other products, without obligation of attribution or compensation.
2.3. Confidentiality
Feedback does not constitute Customer Confidential Information unless expressly agreed otherwise in writing.
Provider: BIMWorkplace, Lda., NIF 516313096
Rua Luís Barroso, Nº 590, 4ºA, 4760-153 Vila Nova de Famalicão, Portugal
Customer: The entity or individual identified during the signup process or in the Subscription Order.
