Terms and Conditions of Use — THOMAS by Bitsideas

Drafting note: this document is the definitive clause set. It is a translation of the authoritative Spanish version (`terminos-y-condiciones.md`); in the event of any discrepancy between the two, the Spanish version governs, since Colombian law and Bogotá courts are the chosen framework (clause 18). Bitsideas LLC is a U.S. company that provides the Service to companies in Colombia and other Latin American countries. Colombian law and the courts of Bogotá D.C. were chosen as the default framework (clause 18) because the Service originated in, and is most heavily regulated around, Colombian occupational health and safety rules (clause 3.2) — not because Colombia is the only market. This is a reasonable legal strategy for a single-law, single-forum, multi-country master agreement, but it should be confirmed with counsel, especially if any country where Bitsideas sells imposes mandatory consumer-protection or forum rules that cannot be contracted around. Bitsideas LLC's identifying data (EIN, registered address) were taken from its public record with the Florida Division of Corporations (Sunbiz.org, filing L21000359862) — verify it is still current before publishing. A final review by licensed counsel is recommended before publication.

Last updated: August 14, 2026 Service provider: Bitsideas LLC, a limited liability company organized under the laws of the State of Florida, United States of America, EIN 61-2001549 (state filing L21000359862), with its principal address at 7630 NW 25 Street # 2B, Miami, FL 33122, United States ("Bitsideas", "we", "us"), which offers the Service to Client companies in Colombia and other countries. Product: THOMAS by Bitsideas, a SaaS platform for managing an Occupational Health and Safety Management System (the Colombian "SG-SST") (the "Service" or "THOMAS").

1. Definitions

For purposes of these Terms and Conditions (the "Terms"):

• "Client": the legal entity that registers on THOMAS, subscribes to a

plan, and whose workers, contractors and worksites are managed through the Service.

• "User": any individual who accesses the Service under an account linked

to the Client, including administrators, OHS supervisors, superintendents and other roles enabled by the Client.

• "Portal Contractor": the Client's contractor or supplier company that,

without creating an account or logging in, accesses the Contractor Self-Service Portal through a unique access link (see clause 3.4) to upload its OHS compliance documentation.

• "Client Data": all information that the Client, its Users, or Portal

Contractors enter, upload or generate within the Service.

• "Parties": Bitsideas and the Client, together.

2. Acceptance of this agreement

These Terms, together with the Personal Data Processing Policy published on the same site, constitute the entire agreement between Bitsideas and the Client for the use of THOMAS. By checking the acceptance box during registration, clicking "Buy Subscription" or an equivalent button, or by actually using the Service, the Client and the individual acting on its behalf represent that they:

• Have read and accepted these Terms and the Privacy Policy in full;
• Have sufficient authority to bind the Client contractually (as legal

representative, attorney-in-fact, or equivalent authorization); and

• That the Client is a legal entity (a company), not an individual consumer

— the Service is offered under a B2B (business-to-business) model.

In accordance with Colombian Law 527 of 1999 on electronic commerce, electronic acceptance of this document has full validity and binding force, equivalent to a handwritten signature.

3. Description of the Service

3.1. Nature of the Service

THOMAS is a multi-company (multi-tenant) SaaS platform for managing an occupational health and safety system, including, depending on the plan contracted, the following modules: hazard identification and risk assessment matrix (GTC 45 / ISO 45001), PDCA-cycle document management, safe/unsafe behavior observations, incident and workplace accident investigation, road safety and Strategic Road Safety Plan (PESV), calculation of man-hours worked and frequency/severity indicators, chemical safety and hazardous waste management (RESPEL), contractor management (including the Contractor Self-Service Portal described in clause 3.4), and a downloads center for formats and reports.

3.2. Scope and limits of the Service

THOMAS is a technology tool that supports the Client's occupational health and safety management. It does not replace the professional judgment of a licensed occupational health and safety officer, does not constitute legal or technical advice on occupational health and safety matters, and does not by itself guarantee compliance with the occupational health and safety regulations applicable to the Client in its own country. Several THOMAS modules (the GTC 45 risk matrix, man-hours/frequency-index/severity-index calculations, PESV) are built on methodologies and regulatory thresholds of Colombian origin (among others, Decree 1072 of 2015 and Resolution 0312 of 2019); when the Client operates in a country other than Colombia, it is the Client's responsibility to assess whether those methodologies are applicable or equivalent to local occupational health and safety rules, or whether it needs adjustments, its own judgment, or additional tools to meet its local obligations. In any case, the Client is solely responsible for:

• Validating that its use of the platform, and the operational decisions it

makes based on the information the platform generates, comply with the regulations applicable to its economic activity, sector, risk level and country of operation;

• Having competent personnel (a valid occupational health and safety license

or professional registration in its country, where applicable) to interpret and act on the information managed in the Service; and

• Complying with its obligations to its workers' compensation authority, the

relevant ministry, and other competent authorities in its country, regardless of its use of THOMAS.

3.3. Availability of features

Bitsideas may introduce, modify, improve or discontinue Service features at any time, seeking to communicate material changes affecting features actively used by the Client with reasonable advance notice. The exact set of modules available to the Client depends on the plan contracted.

3.4. Contractor Self-Service Portal

As part of the Contractor Management module, the Client can generate unique access links that allow its contractor companies (the "Portal Contractors") to upload their own compliance documentation (workers' compensation affiliation, payroll contribution filings, insurance policies, PPE matrix, inductions, certifications) without needing to create a User account. Access to this portal is based on possession of a unique, non-guessable link (token); the Client is responsible for distributing that link only to the corresponding contractor company. No document uploaded by a Portal Contractor is approved automatically: every submission remains in "Under Review" status until an authorized User of the Client evaluates and approves or rejects it. Bitsideas is not a party to the contractual relationship between the Client and its contractors, and does not validate the accuracy or currency of uploaded documents beyond what the platform itself automatically reports (for example, expiration dates).

4. Client accounts and responsibilities

• The Client is responsible for the accuracy, quality and legality of the

Client Data, including data of its own workers, contractors and third parties that it enters or authorizes to be entered into the platform.

• The Client is responsible for obtaining any personal data processing

authorizations required from its workers and third parties before entering their information into the Service (see Privacy Policy, section 2).

• The Client is responsible for the confidentiality of its Users'

credentials, for the correct assignment of roles and permissions, and for actions taken under its Users' accounts.

• The Client must notify Bitsideas without undue delay of any unauthorized

use of its accounts of which it becomes aware, through the channels indicated in clause 15.

• The Client will designate at least one User with an account administrator

role, who will be the valid channel for Bitsideas' contractual communications to the Client.

5. Prohibited uses

The Client and its Users agree not to, and not to allow third parties to:

• Use the Service for purposes other than the Client's own legitimate

occupational health and safety management;

• Attempt to breach the platform's multi-tenant isolation between

companies, access another Client's data, or perform security testing not authorized in writing by Bitsideas;

• Reverse-engineer, decompile, or attempt to extract the Service's source

code, except to the extent mandatorily permitted by law;

• Resell, sublicense, or make the Service available to unauthorized third

parties as if it were their own, without Bitsideas' written agreement;

• Upload unlawful or defamatory content, or content that infringes third

parties' intellectual property or personal data rights; or

• Use automated means (scraping, bots) to extract data from the Service

outside the export functions provided by the platform itself.

Breach of this clause entitles Bitsideas to suspend access under clause 11, without prejudice to any other legal remedies available.

6. Subscription, pricing and billing

• The Service is provided under a recurring paid subscription model (monthly

or annual, depending on the billing cycle chosen), priced according to the plan and the number of workers registered by the Client at the time of contracting, at the prices published on the site at that time.

• Payments are processed through Stripe, Inc. Bitsideas does not store full

credit or debit card numbers; that information is captured and tokenized directly by Stripe.

• The subscription renews automatically at the end of each billing cycle for

the same period, unless the Client cancels it under clause 6.4 before the renewal date.

• The Client may cancel automatic renewal at any time from the subscription

panel; cancellation prevents the next charge but does not generate a refund for the period already billed, except as provided in clause 7.

• If the Client's number of active workers exceeds its current plan's limit,

Bitsideas may adjust the fee to the corresponding plan starting with the next billing cycle, upon prior notice.

• Published rates may be adjusted with at least thirty (30) days' advance

notice by email to the account administrator; the adjustment applies starting with the billing cycle following the notice.

• Failure to pay may result in suspension of access to the Service under

clause 11, upon prior notice, without relieving the Client of amounts owed or of any late-payment interest applicable under law.

7. Cancellation and refund policy

• The Client may cancel its subscription at any time; access to the Service

continues until the end of the already-paid period.

• As this is a business-to-business (B2B) contract for an immediately and

continuously performed digital service, the right of withdrawal under article 47 of Colombian Law 1480 of 2011 — which applies to consumer relationships with individuals — does not apply.

• Bitsideas may, at its discretion, grant partial or full refunds in cases of

proven billing error, duplicate charges, or prolonged Service unavailability attributable to Bitsideas that exceeds the thresholds described in clause 8. Any refund request must be sent through the channels in clause 15 within thirty (30) days of the disputed charge.

8. Service availability

Bitsideas makes commercially reasonable efforts to keep the Service continuously available, but does not guarantee uninterrupted or error-free availability. The Service may be subject to scheduled maintenance windows, which will be announced with reasonable advance notice when foreseeable, as well as unscheduled interruptions due to technical causes, infrastructure provider issues, or force majeure (clause 14). Bitsideas does not currently offer a formal Service Level Agreement (SLA) with service credits; any specific availability commitment must be agreed in writing in a separate commercial addendum for plans that require one.

9. Intellectual property

• The software, interface, design, the THOMAS brand, the Bitsideas name and

other distinctive elements of the platform are owned by Bitsideas LLC or its licensors, and are protected under Colombian and international intellectual property law. These Terms do not transfer any intellectual property right in the Service to the Client, beyond a limited, non-exclusive, non-transferable license to access and use THOMAS during the subscription term.

• The Client retains full ownership of the Client Data. Bitsideas will not

use Client Data for purposes other than providing the Service, except with the Client's express authorization (for example, to generate aggregated, anonymized statistics that do not allow the Client or its workers to be identified).

• The Client grants Bitsideas a limited license to store, process and

display Client Data to the extent strictly necessary to provide the Service.

10. Confidentiality

Both Parties agree to keep confidential any non-public information of the other Party to which they gain access in connection with the contractual relationship (including Client Data and commercial, technical and financial information), and not to use it for purposes other than performing the Service, unless disclosure is required by a competent authority, in which case the required Party will notify the other as soon as the law allows. This obligation survives termination of the agreement for a period of two (2) years.

11. Suspension and termination

• The Client may cancel its subscription at any time under clause 6.4;

cancellation applies at the end of the then-current billing cycle.

• Bitsideas may suspend access to the Service, in whole or in part, in the

event of: (i) non-payment following notice and a reasonable grace period; (ii) breach of these Terms, in particular the prohibited uses in clause 5; or (iii) use that presents a reasonably identified security risk to the Client, to other clients on the multi-tenant platform, or to the integrity of the Service.

• Bitsideas will notify the Client before suspending access, unless the

urgency of the security risk makes immediate suspension reasonable, in which case notice will be given without undue delay after the suspension.

• Upon termination of the relationship for any reason, the Client may request

export of its Client Data within thirty (30) calendar days following termination; after that period, if no request is made, Bitsideas may permanently delete it from its production systems, subject to the backup retention periods described in the Privacy Policy and any applicable legal retention obligation.

12. Limitation of liability

To the maximum extent permitted by Colombian law:

• The Service is provided "as is" and "as available," without warranties

that it will be free of errors, interruptions or vulnerabilities, beyond the reasonable efforts described in these Terms.

• Bitsideas will not be liable for operational, technical or regulatory

compliance decisions that the Client or its Users make based on information generated by the platform; such responsibility rests exclusively with the Client and its occupational health and safety personnel, in accordance with clause 3.2.

• Bitsideas will not be liable for indirect damages, lost profits, lost

business opportunity, or consequential damages arising from use of, or inability to use, the Service.

• Bitsideas' total aggregate liability to the Client for any claim related to

the Service, regardless of its cause, is limited to the amount actually paid by the Client to Bitsideas in the twelve (12) months preceding the event giving rise to the claim.

• Nothing in this clause is intended to exclude or limit liability that

cannot be excluded or limited under applicable Colombian law, including cases of willful misconduct or gross negligence by Bitsideas.

13. Indemnification

The Client will hold Bitsideas harmless from third-party claims arising from: (i) the Client Data, including its lawfulness and the corresponding processing authorizations; (ii) use of the Service in violation of these Terms or applicable law; or (iii) the Client's relationship with its own workers, contractors, or Portal Contractors.

14. Force majeure

Neither Party will be liable for failure or delay in performing its obligations (other than payment obligations) when such failure results from force majeure or an unforeseeable event under article 64 of the Colombian Civil Code, including widespread failures of cloud infrastructure providers, Internet connectivity outages beyond Bitsideas' control, natural disasters, acts of government authority, or social or armed conflict.

15. Notices and contact

Contractual communications between the Parties will be made by email: Bitsideas will use the email of the account administrator registered by the Client, and the Client will use [email protected]. For general technical and commercial support, the Client may use the channels published on the site.

16. Assignment

The Client may not assign its contractual position without Bitsideas' prior written consent. Bitsideas may assign this agreement in connection with a merger, acquisition, or substantial sale of assets, upon reasonable notice to the Client.

17. Entire agreement

These Terms and the Privacy Policy constitute the entire agreement between the Parties regarding their subject matter, and supersede any prior understanding, oral or written, on the same matter. If any clause is held invalid or unenforceable by a competent authority, the remaining clauses will remain in full force.

18. Governing law and dispute resolution

Bitsideas provides the Service to Clients in Colombia and in other Latin American countries. Notwithstanding that Bitsideas is a company organized in the State of Florida, United States, and regardless of the Client's country of domicile, the Parties agree to submit this agreement to a single legal and jurisdictional framework to simplify its performance: the law and courts of Colombia, the Service's country of regulatory origin (clause 3.2). These Terms are governed by and construed in accordance with the laws of the Republic of Colombia, without prejudice to any mandatory consumer-protection or forum rules that the law of the Client's country may establish on a non-waivable basis. Any dispute arising from these Terms that is not resolved through direct negotiation within thirty (30) days of its arising will be submitted to the ordinary jurisdiction of the competent courts of Bogotá D.C., unless the Parties agree in writing to submit it to arbitration before the Arbitration and Conciliation Center of the Bogotá Chamber of Commerce, in accordance with its rules.

19. Amendments

Bitsideas may amend these Terms at any time, with at least fifteen (15) calendar days' prior notice by email to the account administrator for material changes. Continued use of the Service after the effective date of the changes constitutes acceptance of them; if the Client disagrees, it may cancel its subscription under clause 6.4 before that date.

20. Contact

For questions about these Terms, write to [email protected].