Terms of Service

These Terms of Service (the "Terms") govern access to and use of the Nexa People platform, its APIs and related services (the "Service"), provided by Villaex Technologies ("we", "us"). By creating an account, signing in or using the Service you accept these Terms.

Almost every customer is an organization rather than a person. If you accept these Terms on behalf of an employer, you confirm you are authorised to bind it, and "you" means that organization. Its employees use the Service under its account, and it remains responsible for what they do there.

Where we have signed a separate written agreement, order form or data-processing agreement with you, that document governs to the extent it conflicts with these Terms.

Nexa People is a multi-tenant HR platform covering employee records and organisation structure, attendance and leave, payroll, recruitment, onboarding, performance, training, separation and final settlement, reporting, and the supporting administrative modules described in our documentation.

The Service is delivered over the internet. We may add, change or withdraw individual features as the product develops; if we withdraw a feature you materially rely on, section 18 explains what happens.

Each organization's data is isolated from every other organization's. Within your organization, what each person can see and do is governed by the role tiers and permission templates you configure — so granting someone HR or administrator access is your decision and your responsibility.

• Keep credentials, API keys and device tokens confidential. Activity under your account is treated as yours.
• Tell us promptly if you suspect an account, key or token has been compromised.
• Keep the leaver process current. Access that should have been withdrawn is the most common cause of unauthorised access we see.

We do not offer self-service password reset; resets are performed by an administrator inside your organization.

The HR data you put into the Service — employee records, attendance, leave, payroll, documents — remains yours. You grant us only the licence needed to host, process, back up and display it so we can provide the Service to you, and to support you when you ask.

For that data you are the controller and we are the processor: we act on your instructions. You are responsible for the accuracy and lawfulness of what you enter, for having a lawful basis to process it, and for giving your employees whatever notice or collecting whatever consent your local law requires. Our Privacy Policy sets out the detail, including sub-processors and international transfers.

We do not sell your data, and we do not use your HR data to train AI models.

This section matters more than any other in these Terms, because it is where money and statutory filings meet software.

What the platform calculates. Nexa People computes income tax from the tax slabs you configure, Provident Fund and Voluntary Pension Scheme contributions from the policies you configure, attendance-driven deductions and overtime from the rules you configure, and gratuity and final settlement at separation. Every one of those outputs is a function of your configuration. The platform does not know whether the slab values, rates, bases or policies you entered are the correct ones for the current tax year, and it does not maintain them for you.

What the platform does not calculate. EOBI, SESSI, PESSI and comparable social-security registrations are captured as fields on the employee record and can be deducted as payroll lines that you configure. The platform does not compute those contributions against their statutory rules, ceilings or rates on your behalf, and configuring such a deduction is not a substitute for your own statutory compliance.

We are not your tax or legal adviser. Nothing in the Service or its documentation is tax, legal, accounting or payroll advice. You are responsible for reviewing payroll, attendance and statutory outputs — and for verifying them against current law — before you pay anyone, file anything or rely on them for a statutory or financial decision. Where local regulations change, it is yours to update the configuration unless a written agreement says we will.

Some attendance features reach into where and how your employees work, and they are switched off until you turn them on. If you enable IP restrictions, geo-fencing or device binding, you are responsible for the notice and consent your local labour and data-protection law requires, and for using them proportionately.

Where you connect a biometric terminal, that hardware is yours and sits under your vendor's terms. Fingerprint and face templates stay on the device; the Service receives a punch code and a timestamp. You are responsible for lawfully enrolling your employees on that device.

The in-app assistant answers questions about using Nexa People and is powered by a third-party model provider. Your question, the recent turns of that chat and matching help documentation are sent to that provider; your HR records are not — the assistant has no access to them.

Do not paste employee, salary or other personal data into the chat. Its answers are generated, may be wrong, and are not advice; verify anything that matters against the product itself or your own professional advisers.

You may connect the Service to your own or third-party systems using API keys, webhooks and exports. When you do, you instruct us to send your data where you have pointed it, and what happens to it there is governed by that system's terms, not ours. We are not responsible for third-party systems, and an integration breaking because a third party changed is not a failure of the Service.

Use the API within any documented rate limits and do not use it to circumvent permissions or tenancy boundaries.

You agree not to:

• attempt to access another organization's data, or probe, scan or test the security of the Service without our written permission;
• reverse engineer, copy or resell the Service, or use it to build a competing product;
• upload malware, or content that is unlawful or that you have no right to process;
• use the Service to unlawfully monitor or surveil individuals, or in breach of applicable labour law;
• interfere with the Service's operation or place a deliberately unreasonable load on it.

Responsible security research is welcome — write to us first at [email protected] and we will not pursue good-faith testing that follows what we agree.

We work to keep the Service available and will use commercially reasonable efforts to do so, but we do not commit to an uptime percentage in these Terms. If you need a contractual service level, ask us for one in writing — we would rather agree a real number than publish one we have not measured.

The Service may be unavailable during maintenance, and occasionally at short notice for urgent fixes. Support is provided through the channels and hours we publish or agree with you.

Fees, billing period and currency are those set out in your order form, quotation or written agreement. Unless stated otherwise, fees exclude taxes and duties, which you pay in addition where they apply.

Invoices are due by the date stated on them. If an undisputed invoice remains unpaid, we may suspend the Service after giving you reasonable notice and a chance to put it right. We will tell you before a renewal price changes.

These Terms apply for as long as you use the Service or your subscription runs, whichever is longer.

• You may stop using the Service at any time; ending a paid subscription follows your order form.
• We may suspend access where there is a genuine security risk, a legal requirement, or a material breach of these Terms — and, except in an emergency, we will tell you first and give you a chance to fix it.
• Either of us may terminate for material breach that is not remedied within 30 days of written notice.

Getting your data out. After termination we make your data available for export for 30 days, then delete it from production, with backups ageing out on their own cycle. Payroll and tax records often have to be retained for years — it is your responsibility to export what you are required to keep within that window.

We own the Service, its software, design and documentation, and nothing here transfers that to you. You get a non-exclusive, non-transferable right to use the Service for your own internal business during your subscription. You own your data, as section 4 sets out.

If you send us feedback or suggestions, we may use them to improve the Service without owing you anything for it.

Each of us may learn the other's confidential information. Each of us will use it only to perform this agreement, protect it with at least reasonable care, and not disclose it except to people who need it and are under similar obligations. This does not cover information that is public through no fault of the receiver, already known, independently developed, or that the law compels disclosure of — and if we are compelled to disclose your data, we will tell you unless we are prohibited from doing so.

Except as expressly stated in these Terms, and to the maximum extent permitted by law, the Service is provided "as is" and we disclaim all other warranties, express or implied, including merchantability, fitness for a particular purpose and non-infringement. We do not warrant that the Service will be uninterrupted or error-free, or that its calculations will meet a statutory obligation that depends on configuration you control — see section 5. Nothing in these Terms excludes liability that cannot lawfully be excluded.

To the maximum extent permitted by law, neither party is liable for indirect, incidental, special, consequential or punitive damages, or for loss of profits, revenue, goodwill or anticipated savings, even if advised such damages were possible.

To the maximum extent permitted by law, each party's total aggregate liability arising out of or related to these Terms is limited to the fees you paid or owed for the Service in the twelve months before the event giving rise to the claim.

These limits do not apply to your obligation to pay fees, to either party's breach of confidentiality, or to liability that cannot lawfully be limited.

You will defend and indemnify us against third-party claims arising from your data or your use of the Service in breach of these Terms or of applicable law — including claims by your own employees about data you chose to collect, or about attendance, location or biometric features you chose to enable without the notice or consent your law requires.

We may update these Terms as the product and the law change. The effective date at the top always reflects the current version. Where a change materially affects your rights — or where we withdraw a feature you materially rely on — we will give you at least 30 days' notice before it takes effect, and if the change is unacceptable to you, you may terminate before then. Continuing to use the Service after that means you accept the change.

These Terms and any dispute related to them are governed by the laws of the Islamic Republic of Pakistan, without regard to its conflict-of-laws provisions. Any legal action will be brought exclusively in the courts located in Lahore, Pakistan. Nothing here prevents either party from seeking urgent injunctive relief from any court of competent jurisdiction.

• Assignment— neither party may assign this agreement without the other's written consent, except to a successor of its business.
• Severability — if a provision is unenforceable, the rest stands.
• No waiver — not enforcing a right once does not waive it.
• Force majeure — neither party is liable for failures caused by events genuinely beyond its reasonable control.
• Notices — to us, by email to the address below; to you, by email to your account administrators or in the Service.
• Entire agreement — these Terms, with any order form and data-processing agreement, are the whole agreement between us on this subject.

Questions about these Terms go to [email protected].

Villaex Technologies · 22-D2, Johar Town, Lahore, Pakistan · 0323-9994066, 0324-4608194