Terms of Service

Version 2026-11-04. The English version is binding.

These Terms of Service govern the use of Hourmark, a time tracking, expense, estimating and invoicing service provided by Chaordic GmbH, Langackerstrasse 5, 6330 Cham, Switzerland ("Provider", "we"). Annex A (Data Processing Agreement) forms part of these Terms.

1. Scope, parties and acceptance

These Terms form a contract between the Provider and the business that creates or is invited into an organization on Hourmark ("Customer"). The person accepting these Terms on the Customer's behalf represents that they are authorised to bind the Customer.
Business use only. Hourmark is offered exclusively to entrepreneurs, companies, public bodies and other persons acting in the course of a trade, business or profession. It is not offered to consumers. By accepting these Terms, the Customer confirms that it does not act as a consumer. Consumer protection provisions therefore do not apply.
These Terms apply to the exclusion of any terms and conditions of the Customer, even if the Provider does not expressly object to them. Deviating agreements are valid only if made in writing or text form by the Provider.
The Terms are accepted by ticking the corresponding box when signing up or accepting an invitation, or by using the Service. The Provider records the version accepted, by whom and when.

2. Definitions

"Service": the Hourmark software as a service at app.gethourmark.com, including its interfaces (API), documents it generates, emails it sends and its documentation, in the version available at any time.
"Organization": a separate workspace of the Customer within the Service.
"Users": the natural persons the Customer allows to use its Organization (owners, admins, managers, members), including persons who accept the Customer's invitations.
"Customer Data": all data entered, uploaded or generated by or for the Customer or its Users in the Service, including time entries, expenses, receipts, clients, rates, invoices, estimates, leave records and working-time records.

3. The Service

The Provider makes the Service available over the internet in its then current version. The functional scope is determined by the Service as available from time to time; descriptions on the website, in documentation or in marketing materials are not guarantees of characteristics (zugesicherte Eigenschaften) unless expressly designated as such in writing.
The Provider may develop, change, restrict or discontinue features at any time, provided the essential functions of time recording, invoicing and data export remain available or the Customer is given reasonable notice. Features designated as beta, preview or experimental are provided without any commitment and may be changed or withdrawn without notice.
The Service includes tools that support compliance with working-time, leave, tax, invoicing and record-keeping rules (for example working-time rule sets for the EU, Germany, Austria and Switzerland, tax rates and tax notes). These tools are aids only. They do not constitute legal, tax, payroll or accounting advice, they model the rules only to the extent described in the Service, and they may be incomplete, outdated or not applicable to the Customer's circumstances, including collective agreements, individual contracts or exemptions. The Customer remains solely responsible for compliance with the laws that apply to it and for checking every document, calculation, warning and report before relying on it, in particular every invoice before it is issued.
The Provider may use subcontractors to provide the Service.

4. Accounts, Users and security

The Customer shall provide accurate information and keep it current. Each User has a personal account; accounts and API tokens may not be shared.
The Customer is responsible for the selection, roles and permissions of its Users, for all activity in its Organization, and for its Users' compliance with these Terms. Acts and omissions of Users are attributed to the Customer.
The Customer shall keep credentials and API tokens confidential, protect its devices, and notify the Provider without delay of any suspected unauthorised use.

5. Fees

Use of the Service is free of charge unless a paid plan is agreed. Fees for paid plans, the billing period and the payment terms are those stated when the plan is ordered. Fees are exclusive of VAT, which is charged at the statutory rate where applicable.
The Provider may change fees with effect from the next billing period by giving at least 30 days' notice. If the Customer does not agree, it may terminate the plan with effect from the date the change takes effect.
If the Customer is in default of payment, the Provider may suspend access after a reminder with a deadline of at least 10 days.

6. Acceptable use

The Customer shall not, and shall ensure its Users do not:

use the Service in breach of applicable law or third-party rights, or to send unsolicited or unlawful messages;
upload malicious code, or attempt to gain unauthorised access to the Service, other organizations' data or the underlying systems;
probe, scan or test the vulnerability of the Service, or put an unreasonable load on it (including automated sign-ups or excessive API requests), except in a security test agreed in writing;
copy, resell, sublicense or reverse engineer the Service, except where the law expressly permits it.

The Provider may suspend Users or the Organization, in whole or in part, where there are concrete indications of a breach of this section, to the extent necessary to stop it, and will inform the Customer.

7. Customer Data, export and backups

The Customer retains all rights in the Customer Data. It grants the Provider the non-exclusive right to host, copy, process and display the Customer Data to the extent necessary to provide the Service. The Customer is responsible for the lawfulness of the Customer Data and of its processing, including the information of and legal basis for processing the personal data of its employees, contractors and clients.
Export. The Service allows owners and admins to download, at any time, an archive of the Organization's data, including its issued invoices and estimates as PDF and its time entries, expenses, payments, clients and leave records as CSV, and allows reports to be exported as CSV.
The Customer's own copies. The Service is not an archiving system for the purposes of statutory retention obligations (for example under Art. 958f of the Swiss Code of Obligations, the German Fiscal Code or comparable rules). The Customer is solely responsible for exporting and keeping copies of its data at intervals appropriate to its business and its legal retention duties, in particular of issued invoices and of working-time records.
The Provider makes backups of the Service for its own operational purposes and keeps them for up to 30 days. The Customer has no right to the restoration of individual data from these backups.

8. Availability and support

The Provider endeavours to keep the Service available but does not guarantee any particular availability, response time or that the Service will be uninterrupted or error-free, unless a service level is expressly agreed in writing. Maintenance, updates, security measures and events outside the Provider's control (including failures of the internet, of hosting or email providers, and force majeure) may cause interruptions.
Support is provided by email on a reasonable-efforts basis.

9. Warranty

The Service is provided "as is" and "as available". The Customer acknowledges that software cannot be produced free of errors and that the Service may contain defects, may not work as intended in every situation, and may produce incorrect results.
To the fullest extent permitted by law, the Provider excludes all warranties, express or implied, including any warranty of merchantability, fitness for a particular purpose, accuracy of calculations or results, compliance with any law, and non-infringement, as well as any statutory warranty for defects (including under Art. 197 et seq. and Art. 368 of the Swiss Code of Obligations). This exclusion does not apply to defects the Provider has fraudulently concealed.
The Provider will nevertheless endeavour, within a reasonable time, to remedy reproducible defects that the Customer reports in sufficient detail. This is the Customer's sole remedy for defects of the Service.

10. Limitation of liability

The Provider is liable without limitation for damage caused intentionally or through gross negligence, and for personal injury.
Any other liability of the Provider, its bodies, employees and auxiliary persons (Art. 101 of the Swiss Code of Obligations), on whatever legal ground, is excluded to the fullest extent permitted by law. This includes in particular liability for slight and medium negligence, for indirect and consequential damage, lost profit, lost revenue, unrealised savings, business interruption, claims of third parties, fines and penalties, and damage arising from errors in the Service, features not working as intended, incorrect calculations, warnings, reports or documents, or the loss, corruption or unavailability of data.
Where liability cannot be excluded under section 10.2, it is limited, per calendar year, to the fees the Customer paid to the Provider for the Service in the twelve months before the event giving rise to the claim, or CHF 100 if the Customer uses the Service free of charge. For loss of data, liability is in any case limited to the effort that would have been needed to restore the data from copies the Customer was required to keep under section 7.3.
Claims against the Provider must be asserted in writing within three months of the Customer becoming aware of the damage, and in any case within one year of the event giving rise to it, failing which they lapse, to the extent permitted by law.
Nothing in these Terms limits liability that cannot be limited under mandatory law, including liability under applicable data protection law to the extent it is mandatory.

11. Indemnification

The Customer shall indemnify and hold harmless the Provider against all claims of third parties, including Users, employees, clients and authorities, and the reasonable costs of legal defence, arising from the Customer Data, from the Customer's or its Users' use of the Service in breach of these Terms or of the law, or from the Customer's failure to meet its obligations as controller under data protection law.

12. Data protection

The Provider processes the personal data of Users for its own purposes (for example account management, security and communication) as controller, as described in the Privacy Policy.
The Provider processes personal data contained in the Customer Data on behalf of the Customer as processor, in accordance with Annex A (Data Processing Agreement), which implements Art. 28 GDPR and Art. 9 of the Swiss Federal Act on Data Protection (FADP).

13. Confidentiality

Each party shall keep confidential the non-public information of the other party that it obtains in connection with the Service and use it only for the purposes of this contract. This duty survives the end of the contract for three years and does not apply to information that is or becomes public without breach, was already known, is independently developed, or must be disclosed by law or by order of an authority.

14. Term, termination and deletion

The contract runs for an indefinite period. The Customer may terminate it at any time by deleting its Organization in the Service (owner only) or by notice to the Provider; paid plans end at the end of the paid billing period, without refund. The Provider may terminate with 30 days' notice, and for free use with 14 days' notice.
Either party may terminate with immediate effect for good cause, in particular if the other party materially breaches these Terms and fails to remedy the breach within a reasonable deadline, or in the case of the Customer's insolvency.
Before deleting an Organization, the Customer should download the archive (section 7.2). Deleting an Organization deletes its Customer Data permanently and cannot be undone; copies in backups expire within the period stated in section 7.4. Where the Provider terminates the contract, it will give the Customer at least 30 days to export its data, except in the case of termination for good cause caused by the Customer.
Accounts that are never verified are deleted automatically after the period stated in the Service, together with organizations that no other person has joined and that hold no issued documents.

15. Changes to these Terms

The Provider may amend these Terms for valid reasons, in particular changes in the law, in case law or in the Service. It will notify the Customer of the changes at least 30 days before they take effect, by email or in the Service. If the Customer does not object in writing before the changes take effect and continues to use the Service, the changes are deemed accepted; the Provider will point this out in the notice. If the Customer objects, either party may terminate the contract with effect from the date the changes take effect.

16. Miscellaneous

The Customer may not assign or transfer rights or obligations under this contract without the Provider's prior written consent. The Provider may transfer the contract to an affiliated company or to a successor of the Service.
Notices to the Provider are to be sent to [email protected]; notices to the Customer are sent to the email address of the Organization's owner.
Should any provision of these Terms be or become invalid, the remaining provisions remain unaffected. The invalid provision shall be replaced by a valid provision that comes as close as possible to its economic purpose; in particular, a limitation of liability that is invalid in part shall apply to the maximum extent permitted.
These Terms are drawn up in English. Translations are for convenience only; the English version prevails.

17. Governing law and jurisdiction

This contract is governed by the substantive laws of Switzerland, excluding its conflict-of-laws rules and the United Nations Convention on Contracts for the International Sale of Goods (CISG). The exclusive place of jurisdiction is Cham, canton of Zug, Switzerland. The Provider may also bring proceedings at the Customer's registered office.

Annex A: Data Processing Agreement

This Annex applies where the Provider processes personal data contained in the Customer Data on behalf of the Customer (the "Controller"; the Provider: the "Processor"), within the meaning of Art. 28 GDPR and Art. 9 FADP.

A.1 Subject matter, duration, nature and purpose

The Processor processes personal data to provide the Service (hosting, storage, computation of reports, rates, working-time findings and leave balances, generation of documents, sending of emails on the Controller's instructions, and support) for the term of the contract and until deletion under A.9.

A.2 Data subjects and categories of data

Data subjects: the Controller's Users, employees and contractors, the Controller's clients and their contact persons, and other persons whose data the Controller enters.
Categories: identification and contact data; employment data (roles, cost rates, work patterns, employment start and end); working time and its start, end and breaks; leave and absences; expenses and receipts; rates, invoices, estimates and payments; working-time findings and acknowledgements; audit log entries.
Special categories: leave records may reveal health data (for example sick leave). The Controller decides whether to record such data and is responsible for its legal basis; by default the Service shows other Users only "Away" instead of the leave type.

A.3 Instructions

The Processor processes the data only on the documented instructions of the Controller, which are given by these Terms and by the Controller's configuration and use of the Service, unless required to do otherwise by law; in that case it informs the Controller beforehand unless the law prohibits it. The Processor informs the Controller if it considers an instruction to infringe data protection law.

A.4 Confidentiality

The Processor ensures that the persons authorised to process the data are bound to confidentiality.

A.5 Security

The Processor implements appropriate technical and organisational measures (Art. 32 GDPR, Art. 8 FADP), including: separation of each Organization's data enforced in the database (row-level security); encryption in transit (TLS); passwords and access tokens stored only as hashes; role-based permissions; an audit log of significant changes; protection against automated sign-ups; and regular updates of the software and its dependencies. The Processor may adapt the measures to technical progress, provided the level of protection is not reduced.

A.6 Sub-processors

The Controller gives general authorisation to engage sub-processors. The current sub-processors are listed in the Privacy Policy. The Processor informs the Controller at least 30 days before adding or replacing a sub-processor; the Controller may object on reasonable data protection grounds, and, failing agreement, terminate the contract with effect from the change. The Processor imposes on each sub-processor data protection obligations equivalent to this Annex.

A.7 Transfers abroad

The Customer Data is hosted in the European Union. Transfers to countries without an adequate level of data protection take place only with appropriate safeguards, in particular the EU Standard Contractual Clauses (as recognised by the Swiss Federal Data Protection and Information Commissioner) or, where applicable, certification under the EU-U.S. or Swiss-U.S. Data Privacy Framework.

A.8 Assistance and notification

The Processor assists the Controller, taking into account the nature of the processing, in responding to data subjects' requests (much of which the Controller can do itself in the Service, including export), and in its obligations regarding security, breach notification, impact assessments and prior consultation. The Processor may charge reasonable costs for assistance beyond the functions of the Service.
The Processor notifies the Controller without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting the Customer Data, with the information available to it.

A.9 Deletion and return

The Controller can export the data at any time (section 7.2 of the Terms). When the Organization is deleted, the Processor deletes the data, unless the law requires storage; copies in backups are deleted within the period stated in section 7.4.

A.10 Audits

The Processor makes available the information necessary to demonstrate compliance with this Annex. The Controller may carry out audits, including inspections, by itself or by an auditor bound to confidentiality, at most once a year, with at least 30 days' notice, during business hours and without undue disruption, at its own cost. The Processor may first answer with documentation and, where available, certifications.

A.11 Liability and precedence

The limitations of liability in section 10 of the Terms apply to this Annex to the extent permitted by applicable data protection law. In the event of conflict between this Annex and the rest of the Terms regarding the processing of personal data, this Annex prevails.