Qornerstone Platform Terms of Use

2.1These Terms of Use govern access to and use of the Qornerstone Platform, which includes its various modules and applications such as Qommunity+, Qommunity Manager+, Q.Ops and Qornerstone leasing, strata, maintenance and finance modules. They apply to the Subscriber, to every Authorised User and to every End User, in each case from the moment of first access.

2.2The Provider. The Qornerstone Platform is supplied by one of two companies:

2.3IBASE owns all Intellectual Property Rights in the Qornerstone Platform. Qornerstone Pte Ltd holds a licence from IBASE to market, distribute and sub-license the Platform to Subscription Licence customers. In relation to QuickPay, IBASE holds the operating rights under its contract with our appointed payment partner and confers those rights on Qornerstone Pte Ltd.

2.4Your contract or subscription names the Provider for a given Subscriber. In these Terms, "we", "us" and "our" mean that Provider, and "you" means the Subscriber unless the context indicates an Authorised User or End User.

2.5Where a Subscriber holds both an Enterprise Licence and a Subscription Licence, these Terms apply separately to each, and each Provider is responsible only for what it supplies.

"Authorised User"

An individual authorised by the Subscriber to access the Platform in an administrative, management, finance, operations or site role, including employees, officers and agents of the Subscriber and of a Managed Property.

"Data"

All data and content uploaded to or generated on the Platform by or for the Subscriber, an Authorised User or an End User.

"End User"

An individual who accesses the Platform in a non-administrative capacity, including but not limited to a tenant, employees of the tenant, subsidiary proprietor, member of the household, council or management committee member, a third party contractor or its personnel, including a contractor issued with an electronic permit to work.

"Enterprise Licence"

A server-instance licence to the Platform granted by IBASE under a contract or subscription, permitting the Subscriber to onboard an unlimited number of Managed Properties subject to these Terms, and continuing for so long as the recurring fees are paid.

"Managed Property"

A property onboarded to the Platform by the Subscriber, including a strata development, commercial or industrial building, mall or single asset.

"Modules"

The functional components of the Platform listed in your contract or subscription.

"PDPA"

The Personal Data Protection Act 2012 and its subsidiary legislation.

"Personal Data"

Has the meaning given in the PDPA.

"Platform" or "Qornerstone Platform"

The Qornerstone property management software platform and all Modules, applications, portals and documentation forming part of it, including Qommunity Manager, the Qommunity resident application, technician and contractor applications, the QuickPay payment service, and any white-labelled application or portal developed or maintained by us for a Subscriber.

"Provider"

Has the meaning given in clause 2.2.

"Services"

The provision of access to the Platform together with the maintenance, support and hosting services described in your contract or subscription.

"Subscriber"

The entity named as customer in your contract or subscription, whether a managing agent, integrated facilities management company, management corporation, building owner or other party.

"Subscription Licence"

A monthly, per-property, per-Module licence granted by Qornerstone Pte Ltd under a contract or subscription.

4.1We grant you a non-exclusive, non-transferable right to access and use the Platform and the Modules identified in your contract or subscription, for the roles available to your licence type, for the term of your contract or subscription.

4.2Enterprise Licence. An Enterprise Licence comprises three entitlements, which are provided together and end together:

1. a licence to use the Platform, granted on a per server instance basis;
2. software maintenance and support, comprising bug fixes, security patches, functional improvements, new releases and the support service in section 8, for the maintenance and support periods stated in your contract or subscription; and
3. cloud hosting, comprising the hosted environment described in clause 7.2.

The licence in (a) continues for so long as the recurring fees for (b) and (c) are paid. It is not a perpetual licence. If those fees are not paid, the Enterprise Licence terminates in accordance with clause 4.4.

4.3Subscription Licence. A Subscription Licence is granted per Managed Property and per Module, for a monthly term that renews unless cancelled. Adding a Managed Property or a Module requires a new or amended subscription license and attracts additional fees.

4.4Termination for non-payment of recurring fees. If the recurring fees for maintenance and support, or for hosting, are not paid, we will give the Subscriber written notice. If the fees remain unpaid 30 days after that notice, the Enterprise Licence terminates, including the licence in clause 4.2(a). On termination the Subscriber must cease using the Platform, we cease hosting the instance, and section 19 governs export of Data. The one-time Enterprise licence fee and other one-time charges are not refundable on a termination under this clause. This clause does not limit our right to suspend under clause 20.1 or to terminate under clause 20.4.

4.5We may make the Platform available under a demonstration account for up to 30 days. These Terms govern that access. Demonstration accounts carry no service levels and no data retention commitment.

4.6You must not, and must not permit any person to:

1. resell, sub-license, rent or make the Platform available to a third party other than an Authorised User or End User in connection with a Managed Property;
2. copy, modify, decompile or reverse engineer any part of the Platform;
3. use the Platform to build a competing product;
4. circumvent access controls, usage limits or transaction identifiers;
5. upload malicious code or content that is unlawful, defamatory or infringing; or
6. use automated means to extract data at a scale that degrades performance for other users.

5.1The Subscriber is responsible for the acts and omissions of its Authorised Users and, in relation to a Managed Property, for provisioning and de-provisioning access as roles change.

5.2End Users access the Platform under these Terms. By registering for or using a resident, tenant, council or contractor account, an End User accepts these Terms and the Qornerstone Privacy Policy. Where an End User does not accept them, that End User must not use the Platform.

5.3Accounts are personal. Credentials must not be shared. Each of you must notify us without delay, and in any event within 24 hours, of any actual or suspected unauthorised access or compromise of credentials.

5.4We may suspend an individual account that we reasonably believe is compromised, is being used in breach of these Terms, or presents a security risk. We will tell the Subscriber where we do so.

5.5The Subscriber warrants that it is authorised to onboard each Managed Property and to grant access to the Authorised Users and End Users associated with it. Where the Subscriber acts as agent for an owner or a management corporation, the Subscriber warrants that it holds that principal's authority.

5.6Which provisions apply to whom. These Terms bind both Subscribers and individuals, but not every provision applies to every reader:

1. All users, including Authorised Users and End Users, are bound by: clause 4.6 (prohibited use), section 5 (users and accounts), section 12 (confidentiality), section 13 (intellectual property), section 16 (limitation of liability), section 18 (AI features), section 21 (changes) and section 23 (governing law), together with the QuickPay Terms of Use where they use QuickPay.
2. The Subscriber alone is bound by: section 6 (Subscriber obligations), section 9 (fees), clause 10.2 (Data licence), clause 11.3 (notification and consent), clause 15.1 (Subscriber indemnity), section 19 (export and migration) and section 20 (suspension and termination). An End User is not liable for the Subscriber's fees or its indemnity obligations.
3. Rights we grant the Subscriber, including the service levels in section 8, the rebates in clause 8.4, the audit right in clause 11.8, the indemnity in clause 15.2 and the export rights in section 19, are exercisable by the Subscriber only and not by an Authorised User or an End User.
4. Where a provision refers to "you", it means the Subscriber unless the context indicates an Authorised User or End User.

6.1You must use the Platform for lawful business purposes connected with the management of your Managed Properties, and in accordance with these Terms and applicable law.

6.2You are responsible for the accuracy, completeness and legality of Data you upload, and for the decisions you take on the basis of the Platform's output. Financial reports, ledgers and statements generated by the Platform are a record of what has been entered into it.

6.3You must maintain your own reconciliation and review controls. Do not treat the Platform as the sole record of receipt of funds; reconcile against bank statements.

6.4You must not attempt to undermine the security or integrity of our systems, or probe, scan or test them without our prior written consent.

7.1We will provide the Services with reasonable skill and care and in a professional manner, and will take reasonable steps to protect the Platform against unauthorised access, malicious code and tampering.

7.2We host the Platform on Microsoft Azure with servers located in Singapore.

7.3We maintain an information security management system certified to ISO 27001 by an independent third party auditor.

7.4We will retain Data for at least three calendar months from the date it is uploaded, and for the period stated in clause 11.9.

8.1We target availability of the hosted Services of at least 99.5% in each calendar month, measured excluding scheduled maintenance, emergency maintenance and Force Majeure Events.

8.2We classify incidents by Business Impact Level and respond as follows:

8.3We give at least two working days' notice of scheduled preventive maintenance. Emergency maintenance for critical issues is carried out as soon as possible, with notice given where practicable.

8.4If monthly uptime falls below target, the Subscriber may claim a rebate against the recurring fees for that month, on written request made within 30 days of the end of the month:

For Enterprise Licence customers, the monthly recurring fee means one twelfth of the annual maintenance, support and hosting fee. Rebates are the sole remedy for failure to meet the service levels stated in this section.

8.5These service levels apply to the standard Platform. They do not apply to customised modules, reports or integrations developed for a particular Subscriber, to demonstration accounts, or to any period during which recurring fees are overdue.

8.6If a disruption cannot be resolved within two working days, we will provide a reasonable alternative means for the Subscriber to continue essential operations until service is restored.

9.1Fees are set out in your contract or subscription and may comprise one-time licence fees, implementation and data migration fees, customisation fees, recurring maintenance, support and hosting fees, monthly subscription fees, optional add-on fees, and transaction charges for services such as QuickPay.

9.2All fees are exclusive of GST and other applicable taxes, which the Subscriber pays in addition.

9.3Monthly subscription fees are payable in advance. Invoices are issued electronically and are payable in full by bank transfer within 15 days of the invoice date, unless your contract or subscription says otherwise.

9.4Recurring maintenance, support and hosting fees under an Enterprise Licence are payable annually in advance on each anniversary of the commencement date, at the tier corresponding to the number of Managed Properties onboarded at the time of renewal.

9.5We may vary recurring fees by up to 10% on each twelfth-month anniversary of the service start date, on written notice. Variations above that require the Subscriber's agreement, and the Subscriber may terminate on 30 days' notice if it does not agree.

9.6Late payments accrue interest at 2% per month, accruing daily from the due date until payment. We may recover reasonable costs of collection.

9.7We may suspend access where fees remain unpaid 14 days after written notice. Suspension does not relieve the Subscriber of the obligation to pay.

9.8Card payment platform fee. Where card payments are enabled, we charge a platform fee of 0.3% of the value of each card transaction processed through the Platform. It is invoiced monthly in arrears and is exclusive of GST. It is charged in addition to the Card Partner's own charges under clause 14.7, which the Card Partner bills separately.

9.9Platform fees for PayNow collection through QuickPay are set out in the QuickPay Terms of Use. Card payments are not part of QuickPay.

10.1The Subscriber owns all Data, including all rights, title and interest in it. Nothing in these Terms transfers ownership of Data to us.

10.2The Subscriber grants us a non-exclusive licence to host, copy, transmit, store, back up, display and process Data to the extent necessary to provide the Services, to comply with law and to exercise our rights under these Terms.

10.3A Super Admin user from your organisation may export Data through the Control Panel in editable CSV format at any time during the term.

10.4We may compile anonymised and aggregated statistics derived from use of the Platform for the purposes of operating, securing, supporting and improving it. Such statistics must not identify the Subscriber, any Managed Property, any Authorised User or any End User, and must not be disclosed in a form from which any of them could reasonably be identified.

11.1All parties must comply with the PDPA in connection with the Platform.

11.2Roles. The Subscriber is the organisation in respect of Personal Data contained in Data. We act as the Subscriber's data intermediary, processing that Personal Data on the Subscriber's behalf and on its instructions for the purpose of providing the Services. We act as an organisation in our own right in respect of (a) registration and account data collected by us directly from an End User, (b) the Subscriber's business contact and account data, and (c) our own support, security and billing records. Our collection and use of data in that capacity is described in the Qornerstone Privacy Policy at qornerstone.com/privacy-policy.

11.3Subscriber responsibilities. The Subscriber is responsible for notifying individuals and obtaining consent, or establishing that it may rely on deemed consent or an exception under the PDPA, for the collection, use and disclosure of Personal Data through the Platform. This applies to tenants and their employees, residents, unit owners, occupiers and their household members, council members, and third party contractors and their personnel. The Subscriber must not upload Personal Data that is not required for the management of a Managed Property.

11.4Our obligations as data intermediary. We will:

1. process Personal Data only to provide the Services and as otherwise instructed by the Subscriber, and not sell, rent or use it for our own marketing;
2. make reasonable security arrangements to protect it against unauthorised access, collection, use, disclosure, copying, modification, disposal and similar risks;
3. ensure our personnel with access are bound by confidentiality obligations and are trained on data protection;
4. not retain it longer than necessary for the purpose, or for legal, tax or regulatory retention; and
5. not transfer it outside Singapore without the Subscriber's consent, and where a transfer is made, only on terms providing a standard of protection comparable to the PDPA.

11.5Sub-processors. We engage the following categories of sub-processor: cloud hosting (Microsoft Azure, Singapore); e-invoicing network access (InvoiceNow / Peppol); hardware vendors appointed by us to supply, operate, support or maintain smart access and smart visitor management solutions, including access control readers, intercom panels, kiosks, licence plate recognition cameras and, where an estate has enabled it, facial recognition access devices; and, where the Provider is Qornerstone Pte Ltd, platform operation and support by IBASE Technology Pte Ltd. We engage each sub-processor on terms that include data protection obligations no less protective than this section 11, and we remain responsible to the Subscriber for a sub-processor's processing of Personal Data on our behalf. A current list is available on request. We will give 30 days' notice before adding a sub-processor that will process Personal Data, and the Subscriber may object on reasonable data protection grounds. Our appointed payment partner, the Card Partner, and any other bank, payment institution, regulated financial institution or network operator with which the Platform interoperates are not our sub-processors. They receive Personal Data as recipients in their own right, act under their own licences and regulatory obligations, and determine their own purposes and means of processing it. We are not able to impose data protection or other obligations on them, we do not control them, and we are not responsible for their acts or omissions or for their handling of Personal Data. Their own terms and privacy notices govern that handling.

11.6Data breach. We will notify the Subscriber without undue delay, and in any event within 24 hours, of becoming aware of a data breach affecting Personal Data we process as data intermediary. The notification will contain the information reasonably available to us to enable the Subscriber to assess whether the breach is notifiable and to make any notification required to the Personal Data Protection Commission and to affected individuals within the timeframes prescribed under the PDPA. We will co-operate on assessment, containment and remediation, and will not notify affected individuals or make a public statement identifying a Subscriber or a Managed Property without first consulting the Subscriber, unless required by law or by a regulator.

11.7Access and correction. Where we receive an access, correction or withdrawal request from an individual relating to Personal Data we process as data intermediary, we will notify the Subscriber within 3 Business Days, will not respond substantively except to acknowledge and redirect the request, and will provide reasonable assistance to enable the Subscriber to respond within the statutory timeframe.

11.8Audit. Once in any 12-month period, on 30 days' written notice, the Subscriber may request evidence of our compliance with this section 11. We may satisfy the request by providing our current ISO 27001 certificate, a summary of our most recent independent security assessment and responses to a reasonable written questionnaire. An on-site audit may be conducted only where a regulator requires it or following a data breach affecting the Subscriber, during business hours, subject to confidentiality and at the Subscriber's cost.

11.9Return and deletion. On expiry or termination we retain Data for three months, during which the Subscriber may export it under clause 10.3. At the end of that period we delete or anonymise Personal Data, except to the extent retention is required by law, by a payment partner, or for the establishment or defence of legal claims. Retained data remains subject to this section 11 and section 12.

11.10Biometric data and facial recognition. This clause applies where a Managed Property enables facial recognition access or any other biometric processing through or alongside the Platform.

1. The Subscriber, and the management corporation or owner on whose behalf it acts, decide whether to enable biometric processing at a property and for what purpose. We do not enable it without that instruction.
2. Biometric data carries a higher risk of significant harm to the individual. The Subscriber must obtain the express, separate and informed consent of each individual before enrolment, must tell that individual what is collected, why, where it is held and for how long, and must offer a non-biometric alternative means of access. Consent to biometric enrolment must not be bundled with acceptance of these Terms or with any tenancy, employment or contractor engagement.
3. Facial recognition templates are held in encrypted form on the access device by the hardware vendor engaged under clause 11.5. We do not hold biometric templates on the Platform.
4. The Subscriber must ensure that a template is deleted on de-registration, on withdrawal of consent, and when the individual ceases to be an owner, occupier, employee or contractor at the property.
5. An individual may withdraw consent to biometric processing at any time. The Subscriber must give effect to that withdrawal and provide the alternative means of access.
6. Biometric data must not be used for any purpose other than access control and the security of the property, and must not be disclosed except as required by law.
7. The Subscriber indemnifies us under clause 15.1(c) in respect of any claim arising from biometric processing at a Managed Property where the requirements of this clause were not met.

12.1Each of us may receive information from the other that is non-public, confidential or proprietary, including technical, commercial, operational and financial information, source code, security information, pricing and the terms of your contract or subscription.

12.2Each of us must keep the other's confidential information confidential, use it only in connection with the Platform, and disclose it only to personnel, professional advisers and sub-processors who need to know it and are bound by equivalent obligations.

12.3These obligations do not apply to information that is or becomes public other than by breach, was lawfully known without restriction before disclosure, is independently developed without use of the confidential information, or must be disclosed by law, a court or a regulator. Where disclosure is compelled, the recipient must, where lawful and practicable, notify the discloser first and limit disclosure to what is required.

12.4These obligations continue for 3 years after termination, and indefinitely in respect of Personal Data, source code and trade secrets.

13.1All Intellectual Property Rights in the Platform, the Services, the Modules, the Qornerstone and QuickPay names and logos and all associated documentation are and remain the property of IBASE Technology Pte Ltd or its licensors. Where the Provider is Qornerstone Pte Ltd, it grants the rights in these Terms under licence from IBASE.

13.2You acquire no rights in the Platform other than the right to use it in accordance with these Terms.

13.3You may use the Qornerstone and QuickPay names and logos in communications to Authorised Users and End Users about the Platform, in accordance with our brand guidelines. All other use requires our prior written consent.

13.4If you give us feedback or suggestions about the Platform, we may use them without restriction or payment. This does not license your confidential information to us.

14.1Each of us warrants that it is validly incorporated, has the power to enter into these Terms, and that these Terms are binding on it.

14.2We warrant that we will provide the Services with reasonable skill and care, in compliance with applicable law, and that we will not knowingly introduce malicious code into the Platform.

14.3Except as expressly stated, and to the fullest extent permitted by law, all warranties, conditions and terms implied by statute or common law are excluded. We do not warrant that the Platform will be uninterrupted or error free, that it will meet requirements we have not agreed in writing, or that it will produce any particular commercial or financial outcome.

14.4The Platform integrates with services provided by third parties, including banks and payment processors, the InvoiceNow network, cloud infrastructure, communications carriers and hardware supplied by others. We are not responsible for the availability, accuracy or acts of those third parties. Where a third party service is withdrawn or materially changed, we will notify the Subscriber and use reasonable endeavours to provide a comparable alternative.

14.5The Platform is not a substitute for professional accounting, legal, engineering or valuation advice, and does not discharge any statutory duty of the Subscriber or of a management corporation.

14.6Card payments. Card payments are a separate solution and are not part of QuickPay. Card processing is performed by a card acquiring partner appointed by us from time to time (the "Card Partner"). Before card payments can be enabled for a property, the Subscriber, or the entity for whose account payments are collected, must enter into a separate merchant agreement directly with the Card Partner and complete that partner's onboarding and due diligence requirements.

14.7We are not the acquirer of card transactions and are not a party to that merchant agreement. Merchant discount rates, per-transaction charges, chargeback fees, reserves, settlement timing and card scheme rules are set by the Card Partner and the card schemes under that agreement and are billed by the Card Partner directly. As at the date of these Terms the Card Partner's rate is 2.45% of transaction value plus SGD 0.15 per transaction. That rate is set by the Card Partner and may change.

14.8Our platform fee for card transactions is set out in clause 9.8 and is charged in addition to the Card Partner's rate.

14.9We are not liable for any act, omission, decision, charge, delay, suspension or termination by the Card Partner or a card scheme, including a decision to decline onboarding, to hold or reserve funds, or to reverse a transaction. Recourse in respect of card processing is against the Card Partner under the merchant agreement.

14.10We may change the Card Partner on notice. Where we do so, a merchant agreement must be entered into with the incoming partner for card payments to continue.

15.1Subscriber indemnity. The Subscriber indemnifies us and our related corporations, and our respective officers and employees, against all losses, liabilities, damages, fines, penalties and reasonable costs (including reasonable legal costs) arising out of or in connection with:

1. Data uploaded to the Platform by or for the Subscriber, including any claim that it is inaccurate, unlawful or infringes a third party's rights;
2. the Subscriber's breach of clause 5.5, including onboarding a Managed Property the Subscriber was not authorised to onboard;
3. the Subscriber's breach of section 11 or of the PDPA, including a failure to give a required notification or obtain a required consent;
4. any claim by an Authorised User, an End User, an owner, a management corporation or a council member arising from the Subscriber's own management activities, records or communications, other than to the extent caused by our breach of these Terms; and
5. fraud, wilful misconduct or dishonesty of the Subscriber's personnel.

15.2Provider indemnity. We indemnify the Subscriber and its officers and employees against all losses, liabilities, damages, fines, penalties and reasonable costs (including reasonable legal costs) arising out of or in connection with:

1. any claim that the Platform, used in accordance with these Terms, infringes a third party's Intellectual Property Rights, except where the claim arises from Data, from modification of the Platform by a person other than us, or from use in combination with anything not supplied or approved by us;
2. our breach of section 11 or of the PDPA in our capacity as data intermediary, including a claim by an individual or enforcement action by the Personal Data Protection Commission to the extent caused by that breach;
3. our breach of section 12; and
4. fraud, wilful misconduct or dishonesty of our personnel.

15.3If a claim under clause 15.2(a) is made or threatened, we may at our option and cost procure the right for the Subscriber to continue using the Platform, modify or replace it so that it is non-infringing while materially equivalent in function, or, if neither is achievable on commercially reasonable terms, terminate the affected licence on written notice and refund fees paid in advance for Services not provided. That is the Subscriber's sole remedy for infringement other than the indemnity itself.

15.4Conduct of claims. The indemnified party must notify the indemnifying party promptly and in any event within 10 Business Days of becoming aware of a claim, must not admit liability or settle without the indemnifying party's prior written consent (not to be unreasonably withheld), must allow the indemnifying party to conduct the defence and settlement provided no settlement imposes a non-indemnified obligation or admission on the indemnified party, and must give reasonable assistance at the indemnifying party's cost. Failure to comply reduces the indemnity to the extent the indemnifying party is prejudiced.

15.5Each party must take reasonable steps to mitigate its loss. No indemnity applies to the extent the loss is caused by the indemnified party's own breach, negligence or failure to mitigate.

16.1Nothing in these Terms excludes or limits liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any other liability that cannot lawfully be excluded.

16.2Subject to clause 16.1, neither of us is liable to the other, whether in contract, tort (including negligence), breach of statutory duty or otherwise, for indirect or consequential loss, or for any of the following whether direct or indirect: loss of profit, loss of revenue, loss of anticipated savings, loss of business or opportunity, loss of goodwill or reputation, business interruption, or loss or corruption of data beyond the reasonable cost of restoring it from the most recent backup.

16.3Subject to clause 16.1, we are not liable for:

1. any act, omission, delay, failure, error or insolvency of a bank, payment processor, payment scheme, the InvoiceNow network, a communications carrier or other third party;
2. loss arising from Data or instructions entered incorrectly by the Subscriber, an Authorised User or an End User;
3. loss arising from the Subscriber's failure to reconcile, review or verify Platform output;
4. failure or unavailability of internet, telecommunications or third party infrastructure outside our reasonable control; or
5. any period during which recurring fees are overdue, or use of a demonstration account.

16.4Eligibility for contractual remedies. The remedies and limits in clauses 16.4A to 16.4D apply only where the Subscriber's maintenance and support entitlement, and any other recurring fee applicable to the affected Service, was active, fully paid and current at the time the Incident occurred. Where it was not, clause 16.4E applies instead.

16.4AIncidents. An "Incident" means an event, defect, failure, act or omission, or a series of them arising from the same or a related originating cause. All claims arising from one Incident are treated as a single Incident and share a single limit collectively, however many residents, payers, transactions, units, Managed Properties, Subscribers or other claimants are affected, and however many separate claims are brought.

16.4BPer-Incident limit — Qornerstone software. Subject to clauses 16.1 to 16.3, our total aggregate liability for any one Incident affecting the Platform or any Module other than QuickPay is a single pool of SGD 10,000, whatever licence type the affected Subscribers hold. If the stated pool is held to be unenforceable, our liability to each claimant for that Incident is limited instead to the fees that claimant paid for the affected Service in the 12 months preceding the Incident, excluding the Enterprise licence fee and other one-time charges.

1. The pool is shared. The pool is our total liability for that Incident to all claimants taken together, however many Subscribers, Authorised Users, End Users, Managed Properties, management corporations or other persons are affected, and however many separate claims are brought. It is not increased by the number of claimants. Each claimant's share is the proportion that its proved loss bears to the total proved loss of all claimants. No claimant may recover more than the fees it paid for the affected Service in the 12 months preceding the Incident, excluding the Enterprise licence fee and other one-time charges.
2. Proof of loss. A claimant may recover only to the extent that it proves it has suffered actual, quantifiable financial loss and that the loss was caused directly by our breach of these Terms. We are not liable for loss that is not proved, for loss that would have been suffered in any event, for management or staff time, inconvenience or distress, or for any loss excluded by clause 16.2.
3. Assessment and distribution. Where we reasonably believe an Incident affects more than one claimant, we may defer payment for up to 90 days after notifying affected Subscribers of the Incident, so that claims can be assessed together and the pool distributed under paragraph (a). A claim notified after the pool has been distributed is limited to any undistributed balance.

16.4CPer-Incident limit — QuickPay. Subject to clauses 16.1 to 16.3, our total aggregate liability for any one Incident affecting QuickPay is limited to a maximum of either the amount of the transaction giving rise to the claim or SGD 100, whichever is the lower; and if that limit is held to be unenforceable, to the amount of the transaction. Where an Incident affects more than one transaction, that limit applies to each affected transaction, and clause 16.4D caps the total. Clause 16.4B(b) applies equally to a claim under this clause 16.4C, so a claimant may recover only to the extent it proves actual, quantifiable financial loss caused directly by our breach.

16.4DAnnual limit per Subscriber. Regardless of the number of Incidents, our total aggregate liability to any one Subscriber across all Incidents occurring in a calendar year is limited to SGD 10,000. The per-Incident limits in clauses 16.4B and 16.4C apply within that annual ceiling and are not additional to it. If the stated annual maximum is held to be unenforceable, our total aggregate liability to that Subscriber across all Incidents in that calendar year is limited instead to the fees paid by the Subscriber for the affected Service in that year, excluding the Enterprise licence fee and other one-time charges.

16.4EUnsupported operation. Where maintenance and support, or hosting, has lapsed or been terminated, we are not liable for any loss attributable to: (a) operation of the Platform without a current maintenance and support entitlement; (b) the absence of patches, security updates, new releases, support or hosting; (c) continued use of a version of the Platform that is no longer supported; or (d) the Subscriber's own hosting, infrastructure or administration of the Platform. This clause is subject to clause 16.1.

16.4FThe limits in clauses 16.4B, 16.4C and 16.4D are separate and are not aggregated with each other, save that all amounts paid under clauses 16.4B and 16.4C count toward the annual ceiling in clause 16.4D.

16.5The limits in clauses 16.4B, 16.4C and 16.4D do not apply to the Subscriber's obligation to pay fees properly due, or to either party's liability under clause 15.1(e) or 15.2(d).

16.6No claim may be brought more than 12 months after the claimant became aware, or ought reasonably to have become aware, of the facts giving rise to it.

16.7Acknowledgement. The parties acknowledge that the fees reflect the allocation of risk in this section 16 and would be materially higher if we bore uncapped liability; that the per-Incident and annual limits are a deliberate allocation of risk between parties who can each insure against it; that we supply software but do not control the underlying banking, communications or hardware infrastructure; that each party is a commercial entity able to take independent legal advice; and that if any provision of this section is found unreasonable, it is to be read down to the extent necessary to make it enforceable rather than struck out.

17.1We maintain an information security management system certified to ISO 27001 and audited by an independent third party auditor. We follow recognised good practice in data management and protection.

17.2Our controls include:

1. encryption of Data in transit over the internet using TLS with SHA-256, and encryption of Data at rest;
2. privileged access management, role-based access on a least-privilege basis, and multi-factor authentication where applicable;
3. logging and monitoring of access and administrative activity, with logs retained for the period stated in our security policy;
4. vulnerability management and patch management, including timely application of security patches;
5. secure development practices, including a maker, checker and reviewer protocol for source code changes, code review, and segregation of development, test and production environments;
6. periodic penetration testing by a qualified third party;
7. a documented incident response procedure covering detection, containment, assessment, notification and remediation;
8. secure backup and tested restoration; and
9. vendor and sub-processor controls, including security assessment before engagement and periodic review.

17.3We will provide our current ISO 27001 certificate, a summary of our most recent independent security assessment, and responses to a reasonable written security questionnaire, on request once in any 12-month period.

17.4We keep these measures under review and may change them, provided the overall level of protection is not materially reduced.

17.5The Subscriber is responsible for security within its own control, including the provisioning and removal of Authorised Users, the strength and confidentiality of credentials, the security of its own devices and networks, and prompt notification to us under clause 5.3.

18.1Scope. The Platform includes, and may in future include, features that use artificial intelligence, machine learning, optical character recognition and similar techniques, including automated document reading and data extraction, automated summaries, categorisation, drafting assistance, anomaly detection and recommendations (together, "AI Features").

18.2Output is assistive. AI Features produce output that is probabilistic and may be incomplete, inaccurate or unsuitable for a particular purpose. Output is provided to assist the Subscriber, not to replace its judgement. The Subscriber is responsible for reviewing output before relying on it or acting on it, and in particular before using it in a financial statement, a notice to owners or occupiers, a statutory filing, a contract, or a decision affecting an individual.

18.3No automated decisions about individuals. We do not use AI Features to make a decision producing legal effects or similarly significant effects for an individual without human review. Where an AI Feature supports such a decision, a person at the Subscriber makes the decision.

18.4Third party providers. We may use third party providers to deliver AI Features. We will engage them on terms that prohibit them from using Data to train their own models except as permitted by clause 18.6, and we remain responsible to the Subscriber for their processing of Data on our behalf.

18.5Use of Data to develop and improve AI Features. The Subscriber grants us the right to use Data to develop, train, test, evaluate and improve the Platform and its AI Features, and to provide those features to the Subscriber. That right is limited to the purposes in this clause and is subject to clauses 18.6 and 18.7.

18.6Personal Data is excluded from general-purpose training. We will not use Personal Data contained in Data to train general-purpose or foundation models, whether ours or a third party's, and we will not permit a third party provider to do so, unless the Subscriber expressly agrees in writing. Nothing in this section 18 varies section 11, and where we process Personal Data for AI Features we do so as the Subscriber's data intermediary on its instructions.

18.7Aggregated and anonymised data. We may use anonymised and aggregated data derived from Data for the purposes in clause 10.4, including to develop and improve AI Features. Such data must not identify the Subscriber, any Managed Property, any Authorised User or any End User.

18.8No warranty. Except as stated in clause 14.2, AI Features are provided without warranty as to the accuracy, completeness or fitness of their output, and clause 16 applies to any claim arising from their use.

19.1Self-service export during the term. A Super Admin user may at any time export from the Platform: (a) structured data in CSV format through the Control Panel; and (b) system-generated reports, PDF documents and images. Reports, PDFs and images are downloaded as individual files; the Platform does not provide a bulk download of those file types.

19.2Export window on termination. The Subscriber may continue to export under clause 19.1 during the notice period and until the end of the retention period in clause 11.9. The notice period is one month for a Subscription Licence and three months for an Enterprise Licence.

19.3Assisted export and migration. Bulk extraction of reports, PDFs or images, data transformation, migration to another system, and any other assistance beyond clause 19.1 is chargeable at SGD 1,100 per man-day, or at such other rate as we notify from time to time, and is subject to our resource availability. We will provide a written estimate before starting and will not begin until the Subscriber approves it in writing.

19.4Fees must be current. We are not obliged to provide export or migration assistance while any fee properly due remains unpaid.

19.5After the retention period in clause 11.9 ends, Data is deleted or anonymised and cannot be recovered.

20.1We may suspend access, in whole or in part, where fees remain unpaid 14 days after written notice, where we reasonably suspect fraud or unauthorised access, where suspension is necessary to address a material security risk, where a regulator or law enforcement authority requires it, or where continued provision would breach applicable law. We will give as much notice as is reasonably practicable and will restore access promptly once the cause is resolved.

20.2A Subscription Licence continues monthly until either party terminates on at least one month's written notice.

20.3An Enterprise Licence continues in accordance with your contract or subscription. Recurring maintenance, support and hosting renew annually unless either party gives at least 60 days' written notice before the renewal date.

20.4Either of us may terminate immediately by written notice if the other commits a material breach that is not remediable, or is remediable and is not remedied within 14 days of written notice, or suffers an insolvency event.

20.5Effect of termination. On termination, the right to access the Platform ends and the Subscriber must cease using it. Where a Subscriber holds an Enterprise Licence, the licence in clause 4.2(a) terminates at the same time and the Subscriber has no continuing right to use, copy or retain any part of the Platform. We will refund fees paid in advance for Services not performed. Section 19 governs export and clause 11.9 governs Data. Sections 10, 11, 12, 13, 15, 16, 17, 18.6, 19 and 22 survive, together with any provision that by its nature is intended to survive.

21.1We may update these Terms to reflect changes to the Platform, to our sub-processors, or to law or regulatory requirements. The current version is published at qornerstone.com/terms-of-use with its effective date.

21.2Material commercial changes. We will give at least 30 days' notice before a change that materially and adversely affects a Subscriber's commercial position takes effect, including a change to fees, to the scope of a Module, to the service levels in section 8, or to the limits in section 16. A Subscriber that does not accept such a change may terminate on 30 days' written notice given within 30 days of the notice of change, and we will refund fees paid in advance for Services not provided.

21.2ARegulatory and security changes. A change required by law, by a regulator, by a payment partner or card scheme, or to address a security vulnerability or threat, may take effect immediately or on shorter notice. We will notify the Subscriber as soon as reasonably practicable and will limit the change to what is necessary. Clause 21.2 does not apply to a change of this kind, and it does not give rise to a right to terminate, but we will discuss alternatives with the Subscriber in good faith where the change materially affects it.

21.3Continued use of the Platform after the effective date of a change constitutes acceptance of it.

22.1Notices. Formal notices under these Terms, including notices of breach, suspension and termination, must be in writing and sent to the designated notice address of the recipient. Our designated notice address is finance@qornerstone.com. The Subscriber's designated notice address is the email address stated for that purpose in your contract or subscription, or as notified to us in writing. A notice sent by email to a designated notice address is deemed received at the time of transmission if sent on a Business Day before 5.00pm Singapore time, and otherwise at 9.00am on the next Business Day, provided the sender has not received an automated delivery failure. A notice delivered by hand is deemed received on delivery, and one sent by prepaid registered post within Singapore on the second Business Day after posting. Operational notices may be given through the Platform.

22.2Assignment. You may not assign or transfer your rights without our prior written consent, not to be unreasonably withheld. We may assign or novate to a related corporation, or in connection with a sale or reorganisation of our business, on written notice.

22.3Subcontracting. We may subcontract performance but remain responsible for our subcontractors.

22.4Precedence. If there is a conflict, your contract or subscription prevails over these Terms, and these Terms prevail over any other document, except that the QuickPay Terms of Use prevail over these Terms in respect of QuickPay transactions.

22.5Entire agreement. Your contract or subscription and these Terms are the entire agreement between us in relation to the Platform and supersede prior discussions. Neither of us has relied on any statement not set out in them. This does not limit liability for fraudulent misrepresentation.

22.6Third party rights. A person who is not a party has no right under the Contracts (Rights of Third Parties) Act 2001 to enforce these Terms, except that IBASE Technology Pte Ltd and our related corporations may enforce sections 12, 13, 15 and 16.

22.7Force majeure. Neither of us is in breach for a failure caused by an event beyond its reasonable control, including act of God, fire, flood, epidemic, war, terrorism, industrial action, act of government or regulator, failure of the banking system or national payment infrastructure, failure of telecommunications or internet services, and cyber attack not resulting from that party's own failure to perform its security obligations. Payment obligations for amounts already due are not suspended. If the event continues for more than 60 consecutive days, either of us may terminate on 30 days' written notice.

22.8Waiver and severance. A failure or delay in exercising a right is not a waiver of it. If a provision is invalid or unenforceable, it is modified to the minimum extent necessary to make it enforceable, or if that is not possible, severed, and the remainder continues in force.

22.9No partnership. Nothing in these Terms creates a partnership, joint venture, agency or employment relationship.

23.1These Terms are governed by the laws of Singapore.

23.2If a dispute arises, either party may give written notice, and senior representatives must meet within 14 days to attempt resolution in good faith. If unresolved within 30 days, the parties will refer the dispute to mediation administered by the Singapore Mediation Centre.

23.3If unresolved by mediation within 60 days of referral, the dispute is to be referred to and finally resolved by arbitration administered by the Singapore International Arbitration Centre under the SIAC Rules in force at the time, before a single arbitrator, seated in Singapore, in English.

23.4Nothing in this section prevents a party from applying for urgent interim or injunctive relief.

This Schedule is a summary and a signpost. It does not vary the QuickPay Terms of Use, which govern QuickPay, or the merchant agreement between the collecting entity and the card partner, which governs card payments.