Chapter 1 · ProjectVIEW ERP Master SaaS Framework Chapter 1 defines the 130+ terms used throughout the ProjectVIEW ERP Master SaaS Framework — from Authorised User and Availability to RPO, RTO, Champion and Escrow Agent — and sets the rules of interpretation and the order of precedence between the Commercial Contract and this Framework. It also lists the regulatory references the Framework relies on and the agreement-governance process. 130+defined terms GDPR · PDPLregulatory baseline ISO 27001 · 9001 · 20000-1standards referenced 1.1 Definitions In this Framework, unless the context otherwise requires, the following terms shall have the meanings set out below: Term Definition Acceptable Use Policy The set of rules and restrictions governing the Customer’s and its Authorised Users’ permitted use of the Platform/Applications/Portals of ProjectVIEW ERP and/or all associated Addons, including prohibitions on unlawful use, reverse-engineering, credential sharing, and automated scraping, as defined in Chapter 12. AI Agent (Software Quality) A custom AI Testing Agent configured with Customer-specific domain knowledge (module configuration, business rules, data schema, role taxonomy) that autonomously executes test scenarios against the Customer’s ProjectVIEW ERP instance via the Provider’s secure API integration layer, as defined in Chapter 5. Authorised User Any individual who is authorised by the Customer to access and use the Platform, each of whom shall be assigned a unique user identity. Availability The percentage of time during a calendar month that the Platform is operational and accessible to Authorised Users, calculated in accordance with Section 3 (SLA). Azure Microsoft Azure, the cloud computing platform operated by Microsoft Corporation on which the Platform is hosted, including Microsoft Entra ID (formerly Azure Active Directory) for identity and access management. ARR (Annual Recurring Revenue) The annualised value of the Customer’s subscription, comprising the aggregate of module subscription fees (per-user annual fees across all licensed modules within the applicable Volume Band), Addon/Connector/Portal subscription fees, and any recurring ancillary fees designated as ARR-contributing in the Commercial Contract. ARR excludes one-off implementation/services fees, bespoke customisation charges, Extended Support premiums, Escrow Agent fees, and accommodation costs. ARR is the basis for calculating SLA Non-Compliance Penalties (Chapter 3, §3.8) and is detailed in Chapter 11, §11.5. Annual Subscription Fee The annual fee payable by the Customer for access to the Platform based on the Universal/Concurrent User licensing model, as specified in the Commercial Contract. The fee is determined by the Volume Band applicable to the Customer’s total Concurrent User count and encompasses platform access, dedicated cloud infrastructure, support services, releases, major-version upgrades, COTS maintenance, Lifetime Software Warranty, BCDR, and compliance. See Chapter 11, §11.4.1. BCDR (Business Continuity & Disaster Recovery) The Provider’s integrated programme of business-continuity planning, backup management, data replication, and disaster-recovery procedures that ensure the Platform remains available and Customer Data remains recoverable within contracted RPO and RTO targets, as defined in Chapter 9. BCMS (Business Continuity Management System) The Provider’s management system aligned with ISO 22301:2019, encompassing the policies, procedures, governance, and continual-improvement mechanisms that establish and maintain business-continuity capability for the Platform, as defined in Chapter 9. BCP (Business Continuity Plan) The documented set of procedures, roles, communication protocols, resource inventories, and recovery workflows that the Provider maintains to restore or sustain Platform services during a disruption, as defined in Section 9.8.2. BIA (Business Impact Analysis) A structured assessment that identifies critical business processes supported by the Platform, maps their dependencies on Platform components, and quantifies the impact of service disruption to calibrate recovery objectives (RPO/RTO), as defined in Section 9.8.1. Billing Period A period of twelve (12) months starting on the date of the Framework (Contract) signing, representing one annual licensing subscription cycle. Each Billing Period includes Second Level Support (maintenance and support) and free Software Updates and Upgrades. See Chapter 11, §11.12.1. Binding Period The minimum subscription commitment binding the Customer to ProjectVIEW ERP enrolment, comprising the number of Billing Periods specified in the Commercial Contract. Neither Party may terminate for convenience during the Binding Period. See Chapter 11, §11.12.1. Business Day Any day other than a Friday, Saturday, or public holiday in the United Arab Emirates, unless otherwise agreed between the Parties. CAB (Change Advisory Board) The governance body responsible for reviewing, approving, or rejecting Normal and Emergency changes to the Platform, as detailed in Section 4.6. Cessation Plan The structured exit plan prepared by the Provider upon receipt of a Customer’s formal notification to cease the Subscription without transitioning to the successor version. The Cessation Plan covers data return, environment decommissioning, integration disconnection, and surviving-obligation management, as defined in Section 10.9. Change Request A formal request for modification to the Platform’s configuration, functionality, or integration, managed through the Change Management process defined in Section 4.6. Champion (DANAOS ProjectVIEW ERP) A Customer-designated senior power user who has completed the specialised Champions Training Programme and passed the formal Champion examination (§6.6.3). Each Customer must designate a minimum of two (2) Champions (Main and Deputy). Champions serve as the Customer’s Level 1 support contact for intranet (company) and extranet (portal) users, and as the primary communication channel with the Provider from Go-Live onwards (§6.6.4). CI/CD (Continuous Integration / Continuous Delivery) The Provider’s automated software delivery pipeline that builds, tests, and deploys code changes from the Git repository through to the Staging Environment, ensuring consistency and reducing manual deployment errors. CMT (Crisis Management Team) The Provider’s designated leadership team activated during DR-1 and DR-2 disaster-recovery events, comprising the CTO (Incident Commander), Cloud Operations Lead, DBA Lead, Customer Account Manager, and Communications Lead, as defined in Section 9.8.2. CSI (Continual Service Improvement) The ITIL-aligned programme operated by the Provider to drive ongoing improvements in service quality, operational efficiency, and Customer satisfaction, as defined in Section 4.10. CISO Chief Information Security Officer — the Provider’s designated executive responsible for the information-security programme, ISMS governance, and approval of security-related changes, as referenced in Chapter 8. Concurrent User An individual simultaneously logged in and actively using the Platform under the Universal/Concurrent User licensing model. The number of Concurrent Users at any point in time shall not exceed the Customer’s licensed Universal User count as specified in the Commercial Contract and governed by the applicable Volume Band. See Chapter 11, §11.3.2. Confidential Information All information disclosed by one Party to the other, whether orally, in writing, or by any other means, that is designated as confidential or that reasonably should be understood to be confidential given the nature of the information and the circumstances of disclosure. CSP (Content Security Policy) An HTTP security header enforced by the Platform to mitigate cross-site scripting (XSS) and data-injection attacks by specifying approved content sources, as defined in Section 8.4.4. CVSS (Common Vulnerability Scoring System) An industry-standard framework for rating the severity of software vulnerabilities on a 0.0–10.0 scale, used by the Provider to prioritise vulnerability remediation timelines, as defined in Section 8.7.2. Customer The entity identified in the Commercial Contract that has entered into this Framework for the provision of the Platform and related Services. Customer Data All data, information, documents, and materials uploaded to, generated within, or processed by the Platform by or on behalf of the Customer, including Personal Data. Data Controller As defined in Article 4(7) of the GDPR: the natural or legal person which, alone or jointly with others, determines the purposes and means of the processing of Personal Data. In respect of Customer Data, the Customer acts as Data Controller. Data-Integrity Report An automated report generated by AI agents at the conclusion of each test cycle, documenting the results of referential, computational, and temporal integrity assertions executed against the Customer’s data schema, as defined in Section 5.7.3. Data Processor As defined in Article 4(8) of the GDPR: the natural or legal person which processes Personal Data on behalf of the Data Controller. In respect of Customer Data, the Provider acts as Data Processor. Data Protection Laws The General Data Protection Regulation (EU) 2016/679 (GDPR), the UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection (PDPL), and any other applicable data protection and privacy legislation in the jurisdictions in which the Parties operate. Data Subject An identified or identifiable natural person whose Personal Data is processed under this Framework, as defined in Article 4(1) of the GDPR and Article 1 of the UAE PDPL. DIAC (Dubai International Arbitration Centre) The arbitration and mediation institution designated under this Framework for the resolution of disputes that cannot be settled through good-faith negotiation. Mediation and binding arbitration shall be conducted under DIAC’s applicable rules, with the seat in Dubai, UAE, as defined in Chapter 12, §12.10. Decommissioning Certificate A formal written confirmation issued by the Provider upon completion of all environment-decommissioning activities, certifying that all Customer Data has been permanently erased from production, staging, and backup infrastructure in accordance with NIST SP 800-88 media-sanitisation guidelines, as defined in Section 10.10. Platform Release Centre The Provider’s integrated release management module within the ProjectVIEW ERP Platform, used for release distribution, version tracking, and deployment history. Provides role-based access to release catalogues, release notes, and deployment records directly within each Customer’s Platform environment. DPA Data Processing Agreement, the terms governing the processing of Personal Data by the Provider on behalf of the Customer, as set out in Section 17. DPO Data Protection Officer, the individual appointed by the Provider in accordance with Articles 37–39 of the GDPR and Article 10 of the UAE PDPL to oversee data protection compliance. DR (Disaster Recovery) The set of policies, procedures, and technical mechanisms used to recover or continue the operation of the Platform following a significant disruption, including failover to secondary infrastructure, database restoration, and service verification, as defined in Section 9.7. DAST (Dynamic Application Security Testing) Automated runtime testing of the deployed Platform to detect security vulnerabilities (e.g., OWASP Top 10) in the Staging Environment before production deployment, as defined in Section 8.9. Embedded Ticketing System The native ITSM ticketing capability built into the ProjectVIEW ERP Platform, serving as the system of record for all support interactions including incident logging, service requests, ticket lifecycle tracking, SLA measurement, and reporting, as detailed in Section 4.2.1. EBCM (Enterprise Business Continuity Management) Microsoft’s Enterprise Business Continuity Management programme governing Azure platform resilience, availability-zone architecture, and geo-redundant infrastructure, upon which the Provider’s BCDR commitments are predicated, as referenced in Section 9.3. Enterprise License Agreement (ELA) The licensing instrument governing the Customer’s entitlement to use the ProjectVIEW ERP Platform under the Universal/Concurrent User model. The ELA specifies the Volume Band, Binding Period, Billing Period, licensed modules, Addon/Connector/Portal entitlements, and associated fee schedule. The ELA is appended to or incorporated within the Commercial Contract. See Chapter 11, §11.3.1. Evergreen Contract The auto-renewal mechanism whereby the Subscription Term renews automatically at the expiry of each Billing Period beyond the Binding Period, unless terminated by either Party in accordance with the notice provisions set out in Chapter 11, §11.12.2. EOE (End of Engineering) The date after which the Provider ceases all feature development, non-critical bug fixes, and enhancement work for a given major version. Critical-security and P1-severity patches continue until the End-of-Life (EOL) date. EOE is triggered thirty (30) days before EOL, as defined in Section 10.3. EOL (End of Life) The date after which a major version of the Platform is no longer supported, patched, or hosted by the Provider under standard Subscription terms. All Customers must have transitioned to the successor version or ceased their Subscription by the EOL date, as defined in Section 10.3. Escrow Agent The independent third-party custodian appointed by the Provider to hold the Platform’s source code, build scripts, database schemas, and deployment documentation under a Source Code Escrow arrangement. The Escrow Agent releases the deposit to the Customer upon the occurrence of specified release conditions (insolvency, cessation of business, material breach, or product discontinuation), as defined in Section 9.14. Extended Support An optional, time-limited support arrangement available for up to twelve (12) months post-EOL, providing P1/P2 incident response and critical-security patching only, at a premium of twenty percent (20%) of the prevailing ARR, as defined in Section 10.13. Executive Steering Committee The highest governance body comprising senior representatives from both Parties (minimum two per Party), convened semi-annually to review strategic alignment, approve material changes, resolve escalated disputes, and endorse improvement plans, as defined in Chapter 12, §12.1.2. Extranet User A User classified under the Intranet/Extranet licensing model who accesses the Platform exclusively through portal-based interfaces with limited functional scope. Extranet Users are typically external stakeholders (e.g., sub-contractors, blue-collar site personnel, external project managers) who require visibility into specific project data without full module access. See Chapter 11, §11.3.3. Flexible Subscription Model The usage-based mechanism enabling the Customer to add or remove Universal User Licences during the Subscription Term, subject to the Minimum Licence Commitment. Additions are invoiced pro-rata from the Activation Date. Removals take effect at the next Billing Period renewal. See Chapter 11, §11.3.6. Force Majeure Event Any event beyond the reasonable control of a Party, including acts of God, war, terrorism, pandemic, governmental action, fire, flood, earthquake, cyber-attack by state actors, or failure of third-party telecommunications or power supply. GA (General Availability) The date on which a new major version of the Platform is officially released for production deployment to all Customers, marking the commencement of full support, SLA coverage, and the standard version-lifecycle timeline, as defined in Section 10.3. GAP Analysis Document A consolidated report produced by the Provider at the conclusion of the implementation training phase (§6.4.6), categorising all qualms, configuration requirements, and change requests registered by attendees during training. The GAP Analysis Document is formally presented to the Customer for written approval and forms a binding addendum to the Implementation Plan. Go-Live The date on which the Production Environment is made available to all Authorised Users for live operational use, following successful completion of UAT and written Customer sign-off. Upon Go-Live, the Development/Sandbox environment transitions to become the Staging Environment. Governance Action Register The shared action log maintained by the Provider to track decisions, action items, and follow-ups arising from all governance meetings (Monthly Operations, QSR, and Executive Steering Committee). Actions not closed within two (2) consecutive review cycles are automatically escalated to the next governance tier, as defined in Chapter 12, §12.1.4. GOS (Grade of Service) The percentage of Incidents within each priority level that are resolved within the applicable MTTR target during the measurement period, as defined in Section 3.6. GRS (Geo-Redundant Storage) An Azure Storage replication option that maintains six copies of Customer Data — three in the primary Azure region and three in a geographically paired secondary region (hundreds of kilometres apart) — providing 16-nines durability with automatic cross-region failover, as defined in Section 9.6. GDPR Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data. Hypercare An intensified post-migration support period of thirty (30) days during which the Provider allocates dedicated resources for accelerated incident resolution, configuration fine-tuning, and user-adoption monitoring following a version transition, as defined in Section 10.5. IMAC/RD Install, Move, Add, Change, Remove, Dispose — the categories of service requests managed under this Framework, as detailed in Section 4.8. IRBC (ICT Readiness for Business Continuity) The extension of business-continuity management to information and communication technology services as defined in ISO 27031:2011, ensuring ICT systems can support the Provider’s business-continuity objectives within agreed RPO and RTO targets, as referenced in Section 9.3. ITIL Information Technology Infrastructure Library — the globally recognised framework of best practices for IT service management. The Provider aligns its support processes with ITIL 4 guidelines. ITSM (IT Service Management) The Provider’s IT Service Management capability, delivered through the Platform’s Embedded Ticketing System, used for recording, tracking, managing, and reporting all support tickets, incidents, service requests, problems, and change requests throughout their lifecycle. Incident An unplanned interruption to or reduction in the quality of the Platform or Services that requires remedial action by the Provider. Initial Term The initial period of the subscription commencing on the Subscription Start Date and continuing for the duration of the Binding Period as specified in the Commercial Contract and Enterprise License Agreement. The Initial Term comprises the minimum number of consecutive Billing Periods during which the Customer is contractually bound to the Platform. See Chapter 11, §11.12.1. Intranet User A User classified under the Intranet/Extranet licensing model who accesses the full Platform functionality through the internal corporate network or VPN. Intranet Users are typically white-collar office-based personnel (e.g., project managers, quantity surveyors, procurement officers, finance teams) with enhanced module access. See Chapter 11, §11.3.3. Intellectual Property Rights All patents, copyrights, trademarks, trade secrets, database rights, design rights, know-how, and all other intellectual property rights, whether registered or unregistered, and all applications for the same. LRS (Locally Redundant Storage) An Azure Storage replication option that maintains three copies of Customer Data within a single facility in a single Azure region, providing 11-nines durability. Used for non-critical temporary storage where cross-facility redundancy is not required, as defined in Section 9.6. Knowledge Base The Provider’s comprehensive repository of platform documentation, process guides, video tutorials, FAQ articles, and release notes, hosted on the the Platform’s integrated release management module and the per-Client Training Wiki (https://docs.projectview.wiki/[client]), accessible to all Authorised Users, as defined in Section 6.7. Minimum Licence Commitment The minimum number of Universal/Concurrent User Licences (not fewer than twenty (20)) that the Customer commits to maintain for the duration of the Binding Period as specified in the Commercial Contract and Enterprise License Agreement. Removals of User Licences via the Flexible Subscription Model shall not reduce the active licence count below this threshold. See Chapter 11, §11.5.4. Module Activation Amendment A formal amendment to the Commercial Contract executed by the Parties to activate additional ProjectVIEW ERP modules or Addons/Connectors/Portals mid-term. The amendment specifies the component(s), Activation Date, licensing metric, and pro-rata fees. See Chapter 11, §11.3.4. Named User A uniquely identified individual authorised to access specific Addons, Connectors, or Portals under a Named-User licensing model. Named-User licences apply to supplementary platform components where per-individual tracking is required and are non-transferable except via Seat Reassignment. Core Platform access is governed by the Universal/Concurrent User model. See Chapter 11, §11.3.4. Per-Client Training Wiki A dedicated, AI-enhanced documentation portal provisioned for each Customer at https://docs.projectview.wiki/[client], containing personalised training materials, recorded session libraries with AI-generated transcripts, role-specific manuals, training plans, and curated FAQ content unique to the Customer’s configuration and terminology, as defined in Section 6.7.1. Commercial Contract The document executed by the Parties specifying the Platform modules, number of Universal/Concurrent Users, applicable Volume Band, Binding Period, Billing Period, Addon/Connector/Portal entitlements, Named-User allocations (where applicable), currency, Minimum Licence Commitment, and any Customer-specific configurations. The Commercial Contract incorporates the Enterprise License Agreement and takes precedence over all other provisions per §1.3. See Chapter 11, §11.1. NSG (Network Security Group) An Azure-native stateful firewall applied to each virtual machine and subnet within the Customer’s sovereign environment, enforcing inbound and outbound traffic rules with a default deny-all policy, as defined in Section 8.5.1. Omnichannel Support Model The Provider’s unified support delivery approach integrating the Embedded Ticketing System, WhatsApp Business Channel, telephone, and email into a single traceable support workflow, as detailed in Section 4.2. Personal Data Any information relating to an identified or identifiable natural person, as defined in Article 4(1) of the GDPR and Article 1 of the UAE PDPL. PDCA (Plan-Do-Check-Act) The continuous-improvement methodology prescribed by ISO 22301:2019, applied by the Provider to its BCDR programme: Plan (BIA review and recovery-objective calibration), Do (backup and DR execution), Check (drill results and monitoring), Act (corrective actions and architecture improvements), as defined in Section 9.12. PIMS (Privacy Information Management System) The extension to the Provider’s Information Security Management System (ISMS) that establishes privacy-specific controls, procedures, and documentation in accordance with ISO/IEC 27701:2019, governing the processing of Personal Data by the Provider as Data Processor. PIR (Post-Incident Report) A formal report produced by the Provider within five (5) Business Days of resolving a DR-1 or DR-2 disaster-recovery event, containing root-cause analysis, timeline of actions, corrective measures, and BCDR plan updates, delivered to the Customer, as defined in Section 9.7.2. Platform The DANAOS ProjectVIEW ERP software application. When delivered as a Software-as-a-Service (SaaS) solution hosted on the DANAOS Cloud (Microsoft Azure), the terms of this Framework apply in full. The Platform includes all modules, updates, and enhancements provided under this Framework. Provider DANAOS Projects Software Solutions LLC, a company registered in the United Arab Emirates, with an EU entity registered in Greece, and its affiliated companies. Provider Service Desk (PSD) The primary point of contact operated by the Provider for recording and managing all technical support-related tickets via the Omnichannel Support Model (Embedded Ticketing System, WhatsApp Business, telephone, and email), accessible 24 hours per day, 7 days per week, 365 days per year. Process Optimisation Advisory A proactive service whereby the Provider analyses AI-agent test-execution data to identify workflow inefficiencies, configuration anomalies, and improvement opportunities within the Customer’s ProjectVIEW deployment, delivering recommendations during Quarterly Service Reviews, as defined in Section 5.9. RPO Recovery Point Objective — the maximum acceptable period of data loss measured in time. The Platform target RPO is fifteen (15) minutes. RBAC (Role-Based Access Control) The authorisation model implemented by the Platform’s Users & Roles Management module (STY), enforcing granular permissions at the module, function, field, and record level based on assigned roles, as defined in Section 8.4.2. RA-GRS (Read-Access Geo-Redundant Storage) An Azure Storage replication option that extends GRS by providing read-only access to Customer Data in the secondary region during a primary-region outage, enabling immediate data retrieval prior to full failover completion, as defined in Section 9.6. RTO Recovery Time Objective — the maximum acceptable duration for restoring the Platform following a significant disruption. The Platform target RTO is four (4) hours. Record of Processing Activities (RoPA) The documented record of all Personal Data processing activities maintained by the Provider as Data Processor in accordance with GDPR Article 30 and UAE PDPL, specifying the categories of processing, purposes, data subjects, recipients, transfer mechanisms, and retention periods, as described in Section 7.11. Release / Update An incremental software delivery within the current major version (e.g., v11.01, v11.02… v11.xx) addressing change requests, bug fixes, and minor enhancements specific to the Customer’s implementation. Delivered via Agile sprints as defined in Section 4.7.1. Renewal Term Each successive Billing Period following the expiry of the Binding Period during which the subscription automatically renews under the Evergreen Contract mechanism, unless either Party provides written non-renewal notice at least ninety (90) calendar days before the expiry of the then-current Billing Period. See Chapter 11, §11.12.2. SAST (Static Application Security Testing) Automated source-code analysis run on every code commit to detect security vulnerabilities before deployment, with Critical/High findings blocking the build, as defined in Section 8.9. SCA (Software Composition Analysis) Automated scanning of third-party libraries and dependencies for known vulnerabilities (CVEs) and licence compliance, integrated into the Provider’s CI/CD pipeline, as defined in Section 8.9. SCCs (Standard Contractual Clauses) The European Union Standard Contractual Clauses adopted under Commission Implementing Decision (EU) 2021/914 for the transfer of Personal Data to third countries not covered by an adequacy decision under GDPR Article 45, as referenced in Section 7.14. Seat Reassignment The transfer of a Named-User licence (for Addons, Connectors, or Portals) from a departing individual to a replacement individual who permanently assumes the departing user’s role. Seat Reassignment does not incur additional licence fees provided the total active Named-User count does not exceed the licensed count. Not applicable to Universal/Concurrent User Licences, which are floating. See Chapter 11, §11.3.4. Scheduled Downtime Any planned period of unavailability of the Platform for maintenance purposes, communicated to the Customer in advance in accordance with Section 3. Service Request A formal request from the Customer for something to be provided, changed, or actioned that is not an Incident — for example, new user creation, access permission changes, or report configuration. Simulation Scenario A parameterised, end-to-end test specification that defines a complete business-process transaction path (e.g., project initiation through to invoicing) executed by AI agents against the Customer’s Dev/Sandbox environment to validate data flows, business rules, and integration integrity, as defined in Section 5.5.2. SLA Non-Compliance Penalty A financial penalty payable by the Provider to the Customer, calculated as a percentage of the total ARR in accordance with Section 3.8, where the Provider fails to meet the applicable Service Level or GOS targets. Service Level The performance metrics and targets set out in Section 3 and Appendix A against which the Provider’s performance shall be measured. SLO Service Level Objective — the target availability for the Platform, being ninety-nine point nine nine percent (99.9%) uptime per calendar month, excluding Scheduled Downtime. Source Code Escrow The arrangement maintained by the Provider with an independent Escrow Agent for the custody of the Platform’s complete source code, build scripts, database schemas, dependency manifests, and deployment documentation. The escrow deposit is updated quarterly and upon each major version release, and is subject to annual verification. Release conditions and Customer rights are defined in Section 9.14. Sprint A short-cycle Agile development iteration averaging 3 Business Days, during which the Provider delivers a defined set of change requests, bug fixes, or configuration changes to the Customer’s Staging Environment, as detailed in Section 4.7.1. Staging Environment The non-production environment used post Go-Live for debugging, change requests, software updates, and Universal User Acceptance Testing (UAT) prior to deployment to the Production Environment. The Staging Environment is the post Go-Live continuation of the Development/Sandbox environment provisioned during implementation. Super User A Customer-designated employee who has completed the Provider’s Train-the-Trainer (T3) certification programme and is authorised to deliver first-line internal training, conduct new-user onboarding, and provide first-level troubleshooting support within the Customer’s organisation, as defined in Section 6.5. Sub-Processor Any third party engaged by the Provider to process Personal Data on behalf of the Customer, including Microsoft Corporation (as Azure cloud provider). Subscription Start Date The date on which the Customer’s subscription commences, being the date of Agreement signing as specified in the Commercial Contract. The Subscription Start Date triggers the Binding Period, the first Billing Period, and the Initial Term. See Chapter 11, §11.12.1. Subscription Term The aggregate period comprising the Initial Term (Binding Period) and any Renewal Terms under the Evergreen Contract mechanism during which the Customer is entitled to access and use the Platform, as specified in the Commercial Contract and Enterprise License Agreement. See Chapter 11, §11.12. Subscription Year Synonymous with Billing Period. Each consecutive twelve (12) month period within the Subscription Term, commencing on the date of Agreement signing or the anniversary thereof. Subscription Years / Billing Periods are the basis for billing cadence, ARR recalculation, price escalation, and licence-compliance auditing. See Chapter 11, §11.5. Supervisory Authority An independent public authority established by an EU Member State pursuant to GDPR Article 51, or the UAE Data Office under Federal Decree-Law No. 44 of 2021, responsible for monitoring the application of data-protection law within its jurisdiction. SIEM (Security Information and Event Management) The cloud-native security-monitoring platform (Microsoft Sentinel) that aggregates and correlates logs from all infrastructure, application, and database layers to detect threats and anomalous behaviour in real time, as defined in Section 8.8.1. TDE Transparent Data Encryption — the encryption technology applied to all data at rest within the Platform’s database layer using AES-256 encryption. SQT (Software Quality & Testing) The Provider’s AI-augmented software quality and testing framework encompassing automated data-flow simulation, user-interaction simulation, data-integrity validation, regression testing, and process-optimisation advisory services, as defined in Chapter 5. Test Evidence Repository The centralised, immutable store maintained by the Provider for each Customer containing test plans, AI-agent execution logs, data-integrity reports, process-optimisation reports, UAT evidence packs, and regression-suite history, as defined in Section 5.10.1. TKT (Training & Knowledge Transfer) The Provider’s continuous enablement framework encompassing instructor-led training, self-paced digital learning, in-application AI guidance, train-the-trainer certification, and knowledge-base maintenance, as defined in Chapter 6. TNA (Training Needs Assessment) A structured assessment conducted by the Provider in collaboration with the Customer to identify activated modules, organisational roles, proficiency gaps, and training requirements prior to the design of a Training Plan, as defined in Section 6.4.1. TNRA (Training Needs Re-Assessment) A structured re-evaluation of the Customer’s training requirements conducted within sixty (60) days of an EOL Announcement, assessing the impact of successor-version changes on existing competencies, roles, and workflows to produce a Transition Training Plan, as defined in Section 10.7. Training Coordinator The Customer-designated single point of contact responsible for all training logistics, scheduling, attendee nomination, feedback collection, and internal distribution of Provider-supplied training materials, as defined in Section 6.9. Transition Training Plan A customised training programme developed following the TNRA to re-certify the Customer’s users, Champions, and Super Users on the successor version. Includes “What’s New” briefings, hands-on workshops, Champion re-certification, API/integration workshops, UAT guidance, Go-Live readiness checks, and post-migration clinics, as defined in Section 10.7. True-Up Notice A written notice issued by the Provider following a licence-compliance audit, specifying any excess usage of Universal/Concurrent Users, Named Users (for Addons/Portals), or modules beyond the licensed entitlements and the applicable fees for regularisation. See Chapter 11, §11.11.3. UAT (Universal User Acceptance Testing) The formal testing process in which the Customer validates that all software changes, patches, updates, and new features function correctly in the Staging Environment before deployment to Production. UAT requires written Customer sign-off prior to production release. Upgrade (Major Version) A product-wide new major version of the Platform (e.g., v11 → v12) encompassing significant functional enhancements, UI/UX redesigns, new APIs/SDKs, and major COTS version upgrades. Released approximately annually. Governed by the End-of-Life policy in Chapter 10. User Licence Amendment A formal amendment to the Commercial Contract executed by the Parties to add or remove Universal/Concurrent User Licences mid-term under the Flexible Subscription Model. Additions are invoiced pro-rata from the Activation Date, with the ARR recalculated based on the new Volume Band. Removals take effect at the next Billing Period renewal and are subject to the Minimum Licence Commitment. See Chapter 11, §11.3.6. UAE Data Office The national data privacy regulator of the United Arab Emirates, established under Federal Decree-Law No. 44 of 2021, responsible for regulating the application of the UAE PDPL. UAE PDPL Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, the first comprehensive federal data privacy law in the United Arab Emirates, effective 2 January 2022. Universal User A floating licence entitlement under the Universal/Concurrent User per Device licensing model that permits any authorised individual to access the Platform, provided the total number of simultaneously active sessions (Concurrent Users) does not exceed the licensed count specified in the Commercial Contract. Universal User Licences are not tied to specific named individuals. See Chapter 11, §11.3.2. Volume Band The tiered pricing bracket applicable to the Customer’s Annual Subscription Fee, determined by the total number of licensed Universal/Concurrent Users. Five Volume Bands are defined: Band 1 (Minimum–20 Users), Band 2 (21–30), Band 3 (31–50), Band 4 (51–100), and Band 5 (100+). Higher Volume Bands attract progressively reduced per-user rates. See Chapter 11, §11.4.1. WAF (Web Application Firewall) Azure Web Application Firewall deployed in front of the Platform’s application tier to protect against OWASP Top 10 web-application attacks including SQL injection, cross-site scripting, and request smuggling, as defined in Section 8.5.1. Warranty Period (Lifetime Warranty) The entire duration of the Customer’s active Subscription Term and any renewal thereof, during which the Provider warrants that the Platform shall perform materially in accordance with this Framework, remain free from material defects, receive continuous security patching, and maintain performance at or above the contracted SLO and recovery objectives. The warranty is co-extensive with the Subscription and does not expire, reduce in scope, or require separate renewal. Defined in Section 9.13. WhatsApp Business Channel A dedicated WhatsApp Business group established for each Customer, connecting the Customer’s key users with the Provider’s assigned consultants for expedient informal communication. Governed by the data protection and formalisation rules set out in Section 4.2.3. ZRS (Zone-Redundant Storage) An Azure Storage replication option that maintains three copies of Customer Data across two to three availability zones within a single Azure region, providing 12-nines durability and protection against single availability-zone failure, as defined in Section 9.6. 1.2 Interpretation In this document, unless the context otherwise requires: (a) References to Sections and Appendices are to sections of, and appendices to, this Framework. (b) Words importing the singular include the plural and vice versa, and words importing any gender include all genders. (c) References to any statute, regulation, or legislative provision include any modification, re-enactment, or extension thereof, including but not limited to the GDPR, the UAE PDPL,, and any successor legislation or implementing regulations (including any Executive Regulations issued by the UAE Data Office). (d) The headings in this document are for convenience only and shall not affect its interpretation. (e) The terms "include" and "including" shall be construed without limitation. (f) Where any obligation in this document requires compliance with a standard (including ISO 27001, ISO 9001, or ISO 20000-1), the reference shall be to the version current at the date of this document or, where the Provider has transitioned to a later version, that later version. (g) References to a Party include that Party’s successors and permitted assigns. (h) Any obligation on a Party not to do something includes an obligation not to allow, cause, or permit that thing to be done. 1.3 Order of Precedence In the event of any conflict or inconsistency between the provisions of this Framework, the following order of precedence shall apply (in descending order): (a) The Commercial Contract (including any Customer-specific terms agreed therein); (b) Part A (Commercial & Legal Framework) of this Framework; (c) Parts B through E (Technical & Operational Provisions) of this Framework; (d) The Appendices to this Framework. 1.4 Regulatory References This Framework references the following regulatory frameworks and standards. Where applicable, external links are provided for verification and further reading: GDPR — Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data https://eur-lex.europa.eu/eli/reg/2016/679/oj UAE PDPL — Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (United Arab Emirates). Effective 2 January 2022. Establishes comprehensive data protection obligations for entities processing personal data of natural persons in or from the UAE, including requirements for DPO appointment, data breach notification, Data Protection Impact Assessments (DPIAs), cross-border transfer safeguards, and a Record of Processing Activities (ROPA). Regulated by the UAE Data Office under Federal Decree-Law No. 44 of 2021. UAE Government Data Protection Laws: https://u.ae/en/about-the-uae/digital-uae/data/data-protection-laws Full text: https://uaelegislation.gov.ae/en/legislations/1972/download National Privacy Commission: ISO/IEC 27001:2022 — Information Security Management Systems ISO 9001:2015 — Quality Management Systems ISO/IEC 20000-1:2018 — IT Service Management DANAOS ISO Certifications: https://danaos-projects.com/iso-certifications/ Microsoft Azure Compliance — SOC 1/2/3, ISO 27001/27017/27018, FedRAMP, PCI DSS, CSA STAR Microsoft Service Trust Portal: https://servicetrust.microsoft.com/ Azure Trust Center: https://azure.microsoft.com/en-us/explore/trusted-cloud Note: The Provider maintains compliance with all applicable data protection regulations in each jurisdiction of operation. Given the Provider’s principal place of business in the United Arab Emirates, the UAE PDPL is of primary relevance alongside the GDPR. The Provider monitors the issuance of Executive Regulations by the UAE Data Office and will update its data protection practices accordingly within the compliance transition period prescribed by the UAE PDPL. 1.5 Process Register The following table summarises the governance processes established in this Chapter, including responsible roles, expected outcomes, and cross-references to related processes in other Chapters. Role Legend: P = Provider | C = Customer | SC = Steering Committee | DPO = Data Protection Officer | SDM = Service Delivery Manager 1.5.1 Process Registry Ref Process Trigger Handler Approver Expected Outcome Cross-Ref P-1.01 Agreement Amendment Either Party requests modification to terms Legal Counsel (P/C) Steering Committee Executed written amendment to Agreement § 7, § 1.3 P-1.02 Precedence Dispute Resolution Conflict identified between Agreement documents SDM / Customer IT Liaison Steering Committee Binding interpretation per § 1.3 hierarchy § 1.3, § 3.11 P-1.03 Regulatory Compliance Update New or amended Data Protection Law DPO / Legal Counsel Steering Committee Updated DPA, privacy notices, and processing records § 1.4, § 17 1.5.2 RACI Matrix Process (Ref) Provider Customer Steering Committee DPO P-1.01 Agreement Amendment C C A I P-1.02 Precedence Dispute R C A — P-1.03 Regulatory Update R I A R R = Responsible (executes) | A = Accountable (sign-off) | C = Consulted | I = Informed | — = Not Involved 1.5.3 Process Flow — Agreement Governance Lifecycle Stage Activity Role Output ① Initiation Amendment or dispute request raised Either Party Written request submitted ② Assessment Legal/regulatory impact analysis Provider + DPO Impact assessment report ③ Review Steering Committee review and decision Steering Committee Approval / rejection / deferral ④ Execution Signed amendment or updated DPA Both Parties Executed document → Agreement updated ← OverviewMaster SaaS FrameworkNext →Service Description & Scope See how ProjectVIEW ERP runs in a dedicated cloud environment for your projects. Book a Demo →
Chapter 1 · ProjectVIEW ERP Master SaaS Framework Chapter 1 defines the 130+ terms used throughout the ProjectVIEW ERP Master SaaS Framework — from Authorised User and Availability to RPO, RTO, Champion and Escrow Agent — and sets the rules of interpretation and the order of precedence between the Commercial Contract and this Framework. It also lists the regulatory references the Framework relies on and the agreement-governance process. 130+defined terms GDPR · PDPLregulatory baseline ISO 27001 · 9001 · 20000-1standards referenced 1.1 Definitions In this Framework, unless the context otherwise requires, the following terms shall have the meanings set out below: Term Definition Acceptable Use Policy The set of rules and restrictions governing the Customer’s and its Authorised Users’ permitted use of the Platform/Applications/Portals of ProjectVIEW ERP and/or all associated Addons, including prohibitions on unlawful use, reverse-engineering, credential sharing, and automated scraping, as defined in Chapter 12. AI Agent (Software Quality) A custom AI Testing Agent configured with Customer-specific domain knowledge (module configuration, business rules, data schema, role taxonomy) that autonomously executes test scenarios against the Customer’s ProjectVIEW ERP instance via the Provider’s secure API integration layer, as defined in Chapter 5. Authorised User Any individual who is authorised by the Customer to access and use the Platform, each of whom shall be assigned a unique user identity. Availability The percentage of time during a calendar month that the Platform is operational and accessible to Authorised Users, calculated in accordance with Section 3 (SLA). Azure Microsoft Azure, the cloud computing platform operated by Microsoft Corporation on which the Platform is hosted, including Microsoft Entra ID (formerly Azure Active Directory) for identity and access management. ARR (Annual Recurring Revenue) The annualised value of the Customer’s subscription, comprising the aggregate of module subscription fees (per-user annual fees across all licensed modules within the applicable Volume Band), Addon/Connector/Portal subscription fees, and any recurring ancillary fees designated as ARR-contributing in the Commercial Contract. ARR excludes one-off implementation/services fees, bespoke customisation charges, Extended Support premiums, Escrow Agent fees, and accommodation costs. ARR is the basis for calculating SLA Non-Compliance Penalties (Chapter 3, §3.8) and is detailed in Chapter 11, §11.5. Annual Subscription Fee The annual fee payable by the Customer for access to the Platform based on the Universal/Concurrent User licensing model, as specified in the Commercial Contract. The fee is determined by the Volume Band applicable to the Customer’s total Concurrent User count and encompasses platform access, dedicated cloud infrastructure, support services, releases, major-version upgrades, COTS maintenance, Lifetime Software Warranty, BCDR, and compliance. See Chapter 11, §11.4.1. BCDR (Business Continuity & Disaster Recovery) The Provider’s integrated programme of business-continuity planning, backup management, data replication, and disaster-recovery procedures that ensure the Platform remains available and Customer Data remains recoverable within contracted RPO and RTO targets, as defined in Chapter 9. BCMS (Business Continuity Management System) The Provider’s management system aligned with ISO 22301:2019, encompassing the policies, procedures, governance, and continual-improvement mechanisms that establish and maintain business-continuity capability for the Platform, as defined in Chapter 9. BCP (Business Continuity Plan) The documented set of procedures, roles, communication protocols, resource inventories, and recovery workflows that the Provider maintains to restore or sustain Platform services during a disruption, as defined in Section 9.8.2. BIA (Business Impact Analysis) A structured assessment that identifies critical business processes supported by the Platform, maps their dependencies on Platform components, and quantifies the impact of service disruption to calibrate recovery objectives (RPO/RTO), as defined in Section 9.8.1. Billing Period A period of twelve (12) months starting on the date of the Framework (Contract) signing, representing one annual licensing subscription cycle. Each Billing Period includes Second Level Support (maintenance and support) and free Software Updates and Upgrades. See Chapter 11, §11.12.1. Binding Period The minimum subscription commitment binding the Customer to ProjectVIEW ERP enrolment, comprising the number of Billing Periods specified in the Commercial Contract. Neither Party may terminate for convenience during the Binding Period. See Chapter 11, §11.12.1. Business Day Any day other than a Friday, Saturday, or public holiday in the United Arab Emirates, unless otherwise agreed between the Parties. CAB (Change Advisory Board) The governance body responsible for reviewing, approving, or rejecting Normal and Emergency changes to the Platform, as detailed in Section 4.6. Cessation Plan The structured exit plan prepared by the Provider upon receipt of a Customer’s formal notification to cease the Subscription without transitioning to the successor version. The Cessation Plan covers data return, environment decommissioning, integration disconnection, and surviving-obligation management, as defined in Section 10.9. Change Request A formal request for modification to the Platform’s configuration, functionality, or integration, managed through the Change Management process defined in Section 4.6. Champion (DANAOS ProjectVIEW ERP) A Customer-designated senior power user who has completed the specialised Champions Training Programme and passed the formal Champion examination (§6.6.3). Each Customer must designate a minimum of two (2) Champions (Main and Deputy). Champions serve as the Customer’s Level 1 support contact for intranet (company) and extranet (portal) users, and as the primary communication channel with the Provider from Go-Live onwards (§6.6.4). CI/CD (Continuous Integration / Continuous Delivery) The Provider’s automated software delivery pipeline that builds, tests, and deploys code changes from the Git repository through to the Staging Environment, ensuring consistency and reducing manual deployment errors. CMT (Crisis Management Team) The Provider’s designated leadership team activated during DR-1 and DR-2 disaster-recovery events, comprising the CTO (Incident Commander), Cloud Operations Lead, DBA Lead, Customer Account Manager, and Communications Lead, as defined in Section 9.8.2. CSI (Continual Service Improvement) The ITIL-aligned programme operated by the Provider to drive ongoing improvements in service quality, operational efficiency, and Customer satisfaction, as defined in Section 4.10. CISO Chief Information Security Officer — the Provider’s designated executive responsible for the information-security programme, ISMS governance, and approval of security-related changes, as referenced in Chapter 8. Concurrent User An individual simultaneously logged in and actively using the Platform under the Universal/Concurrent User licensing model. The number of Concurrent Users at any point in time shall not exceed the Customer’s licensed Universal User count as specified in the Commercial Contract and governed by the applicable Volume Band. See Chapter 11, §11.3.2. Confidential Information All information disclosed by one Party to the other, whether orally, in writing, or by any other means, that is designated as confidential or that reasonably should be understood to be confidential given the nature of the information and the circumstances of disclosure. CSP (Content Security Policy) An HTTP security header enforced by the Platform to mitigate cross-site scripting (XSS) and data-injection attacks by specifying approved content sources, as defined in Section 8.4.4. CVSS (Common Vulnerability Scoring System) An industry-standard framework for rating the severity of software vulnerabilities on a 0.0–10.0 scale, used by the Provider to prioritise vulnerability remediation timelines, as defined in Section 8.7.2. Customer The entity identified in the Commercial Contract that has entered into this Framework for the provision of the Platform and related Services. Customer Data All data, information, documents, and materials uploaded to, generated within, or processed by the Platform by or on behalf of the Customer, including Personal Data. Data Controller As defined in Article 4(7) of the GDPR: the natural or legal person which, alone or jointly with others, determines the purposes and means of the processing of Personal Data. In respect of Customer Data, the Customer acts as Data Controller. Data-Integrity Report An automated report generated by AI agents at the conclusion of each test cycle, documenting the results of referential, computational, and temporal integrity assertions executed against the Customer’s data schema, as defined in Section 5.7.3. Data Processor As defined in Article 4(8) of the GDPR: the natural or legal person which processes Personal Data on behalf of the Data Controller. In respect of Customer Data, the Provider acts as Data Processor. Data Protection Laws The General Data Protection Regulation (EU) 2016/679 (GDPR), the UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection (PDPL), and any other applicable data protection and privacy legislation in the jurisdictions in which the Parties operate. Data Subject An identified or identifiable natural person whose Personal Data is processed under this Framework, as defined in Article 4(1) of the GDPR and Article 1 of the UAE PDPL. DIAC (Dubai International Arbitration Centre) The arbitration and mediation institution designated under this Framework for the resolution of disputes that cannot be settled through good-faith negotiation. Mediation and binding arbitration shall be conducted under DIAC’s applicable rules, with the seat in Dubai, UAE, as defined in Chapter 12, §12.10. Decommissioning Certificate A formal written confirmation issued by the Provider upon completion of all environment-decommissioning activities, certifying that all Customer Data has been permanently erased from production, staging, and backup infrastructure in accordance with NIST SP 800-88 media-sanitisation guidelines, as defined in Section 10.10. Platform Release Centre The Provider’s integrated release management module within the ProjectVIEW ERP Platform, used for release distribution, version tracking, and deployment history. Provides role-based access to release catalogues, release notes, and deployment records directly within each Customer’s Platform environment. DPA Data Processing Agreement, the terms governing the processing of Personal Data by the Provider on behalf of the Customer, as set out in Section 17. DPO Data Protection Officer, the individual appointed by the Provider in accordance with Articles 37–39 of the GDPR and Article 10 of the UAE PDPL to oversee data protection compliance. DR (Disaster Recovery) The set of policies, procedures, and technical mechanisms used to recover or continue the operation of the Platform following a significant disruption, including failover to secondary infrastructure, database restoration, and service verification, as defined in Section 9.7. DAST (Dynamic Application Security Testing) Automated runtime testing of the deployed Platform to detect security vulnerabilities (e.g., OWASP Top 10) in the Staging Environment before production deployment, as defined in Section 8.9. Embedded Ticketing System The native ITSM ticketing capability built into the ProjectVIEW ERP Platform, serving as the system of record for all support interactions including incident logging, service requests, ticket lifecycle tracking, SLA measurement, and reporting, as detailed in Section 4.2.1. EBCM (Enterprise Business Continuity Management) Microsoft’s Enterprise Business Continuity Management programme governing Azure platform resilience, availability-zone architecture, and geo-redundant infrastructure, upon which the Provider’s BCDR commitments are predicated, as referenced in Section 9.3. Enterprise License Agreement (ELA) The licensing instrument governing the Customer’s entitlement to use the ProjectVIEW ERP Platform under the Universal/Concurrent User model. The ELA specifies the Volume Band, Binding Period, Billing Period, licensed modules, Addon/Connector/Portal entitlements, and associated fee schedule. The ELA is appended to or incorporated within the Commercial Contract. See Chapter 11, §11.3.1. Evergreen Contract The auto-renewal mechanism whereby the Subscription Term renews automatically at the expiry of each Billing Period beyond the Binding Period, unless terminated by either Party in accordance with the notice provisions set out in Chapter 11, §11.12.2. EOE (End of Engineering) The date after which the Provider ceases all feature development, non-critical bug fixes, and enhancement work for a given major version. Critical-security and P1-severity patches continue until the End-of-Life (EOL) date. EOE is triggered thirty (30) days before EOL, as defined in Section 10.3. EOL (End of Life) The date after which a major version of the Platform is no longer supported, patched, or hosted by the Provider under standard Subscription terms. All Customers must have transitioned to the successor version or ceased their Subscription by the EOL date, as defined in Section 10.3. Escrow Agent The independent third-party custodian appointed by the Provider to hold the Platform’s source code, build scripts, database schemas, and deployment documentation under a Source Code Escrow arrangement. The Escrow Agent releases the deposit to the Customer upon the occurrence of specified release conditions (insolvency, cessation of business, material breach, or product discontinuation), as defined in Section 9.14. Extended Support An optional, time-limited support arrangement available for up to twelve (12) months post-EOL, providing P1/P2 incident response and critical-security patching only, at a premium of twenty percent (20%) of the prevailing ARR, as defined in Section 10.13. Executive Steering Committee The highest governance body comprising senior representatives from both Parties (minimum two per Party), convened semi-annually to review strategic alignment, approve material changes, resolve escalated disputes, and endorse improvement plans, as defined in Chapter 12, §12.1.2. Extranet User A User classified under the Intranet/Extranet licensing model who accesses the Platform exclusively through portal-based interfaces with limited functional scope. Extranet Users are typically external stakeholders (e.g., sub-contractors, blue-collar site personnel, external project managers) who require visibility into specific project data without full module access. See Chapter 11, §11.3.3. Flexible Subscription Model The usage-based mechanism enabling the Customer to add or remove Universal User Licences during the Subscription Term, subject to the Minimum Licence Commitment. Additions are invoiced pro-rata from the Activation Date. Removals take effect at the next Billing Period renewal. See Chapter 11, §11.3.6. Force Majeure Event Any event beyond the reasonable control of a Party, including acts of God, war, terrorism, pandemic, governmental action, fire, flood, earthquake, cyber-attack by state actors, or failure of third-party telecommunications or power supply. GA (General Availability) The date on which a new major version of the Platform is officially released for production deployment to all Customers, marking the commencement of full support, SLA coverage, and the standard version-lifecycle timeline, as defined in Section 10.3. GAP Analysis Document A consolidated report produced by the Provider at the conclusion of the implementation training phase (§6.4.6), categorising all qualms, configuration requirements, and change requests registered by attendees during training. The GAP Analysis Document is formally presented to the Customer for written approval and forms a binding addendum to the Implementation Plan. Go-Live The date on which the Production Environment is made available to all Authorised Users for live operational use, following successful completion of UAT and written Customer sign-off. Upon Go-Live, the Development/Sandbox environment transitions to become the Staging Environment. Governance Action Register The shared action log maintained by the Provider to track decisions, action items, and follow-ups arising from all governance meetings (Monthly Operations, QSR, and Executive Steering Committee). Actions not closed within two (2) consecutive review cycles are automatically escalated to the next governance tier, as defined in Chapter 12, §12.1.4. GOS (Grade of Service) The percentage of Incidents within each priority level that are resolved within the applicable MTTR target during the measurement period, as defined in Section 3.6. GRS (Geo-Redundant Storage) An Azure Storage replication option that maintains six copies of Customer Data — three in the primary Azure region and three in a geographically paired secondary region (hundreds of kilometres apart) — providing 16-nines durability with automatic cross-region failover, as defined in Section 9.6. GDPR Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data. Hypercare An intensified post-migration support period of thirty (30) days during which the Provider allocates dedicated resources for accelerated incident resolution, configuration fine-tuning, and user-adoption monitoring following a version transition, as defined in Section 10.5. IMAC/RD Install, Move, Add, Change, Remove, Dispose — the categories of service requests managed under this Framework, as detailed in Section 4.8. IRBC (ICT Readiness for Business Continuity) The extension of business-continuity management to information and communication technology services as defined in ISO 27031:2011, ensuring ICT systems can support the Provider’s business-continuity objectives within agreed RPO and RTO targets, as referenced in Section 9.3. ITIL Information Technology Infrastructure Library — the globally recognised framework of best practices for IT service management. The Provider aligns its support processes with ITIL 4 guidelines. ITSM (IT Service Management) The Provider’s IT Service Management capability, delivered through the Platform’s Embedded Ticketing System, used for recording, tracking, managing, and reporting all support tickets, incidents, service requests, problems, and change requests throughout their lifecycle. Incident An unplanned interruption to or reduction in the quality of the Platform or Services that requires remedial action by the Provider. Initial Term The initial period of the subscription commencing on the Subscription Start Date and continuing for the duration of the Binding Period as specified in the Commercial Contract and Enterprise License Agreement. The Initial Term comprises the minimum number of consecutive Billing Periods during which the Customer is contractually bound to the Platform. See Chapter 11, §11.12.1. Intranet User A User classified under the Intranet/Extranet licensing model who accesses the full Platform functionality through the internal corporate network or VPN. Intranet Users are typically white-collar office-based personnel (e.g., project managers, quantity surveyors, procurement officers, finance teams) with enhanced module access. See Chapter 11, §11.3.3. Intellectual Property Rights All patents, copyrights, trademarks, trade secrets, database rights, design rights, know-how, and all other intellectual property rights, whether registered or unregistered, and all applications for the same. LRS (Locally Redundant Storage) An Azure Storage replication option that maintains three copies of Customer Data within a single facility in a single Azure region, providing 11-nines durability. Used for non-critical temporary storage where cross-facility redundancy is not required, as defined in Section 9.6. Knowledge Base The Provider’s comprehensive repository of platform documentation, process guides, video tutorials, FAQ articles, and release notes, hosted on the the Platform’s integrated release management module and the per-Client Training Wiki (https://docs.projectview.wiki/[client]), accessible to all Authorised Users, as defined in Section 6.7. Minimum Licence Commitment The minimum number of Universal/Concurrent User Licences (not fewer than twenty (20)) that the Customer commits to maintain for the duration of the Binding Period as specified in the Commercial Contract and Enterprise License Agreement. Removals of User Licences via the Flexible Subscription Model shall not reduce the active licence count below this threshold. See Chapter 11, §11.5.4. Module Activation Amendment A formal amendment to the Commercial Contract executed by the Parties to activate additional ProjectVIEW ERP modules or Addons/Connectors/Portals mid-term. The amendment specifies the component(s), Activation Date, licensing metric, and pro-rata fees. See Chapter 11, §11.3.4. Named User A uniquely identified individual authorised to access specific Addons, Connectors, or Portals under a Named-User licensing model. Named-User licences apply to supplementary platform components where per-individual tracking is required and are non-transferable except via Seat Reassignment. Core Platform access is governed by the Universal/Concurrent User model. See Chapter 11, §11.3.4. Per-Client Training Wiki A dedicated, AI-enhanced documentation portal provisioned for each Customer at https://docs.projectview.wiki/[client], containing personalised training materials, recorded session libraries with AI-generated transcripts, role-specific manuals, training plans, and curated FAQ content unique to the Customer’s configuration and terminology, as defined in Section 6.7.1. Commercial Contract The document executed by the Parties specifying the Platform modules, number of Universal/Concurrent Users, applicable Volume Band, Binding Period, Billing Period, Addon/Connector/Portal entitlements, Named-User allocations (where applicable), currency, Minimum Licence Commitment, and any Customer-specific configurations. The Commercial Contract incorporates the Enterprise License Agreement and takes precedence over all other provisions per §1.3. See Chapter 11, §11.1. NSG (Network Security Group) An Azure-native stateful firewall applied to each virtual machine and subnet within the Customer’s sovereign environment, enforcing inbound and outbound traffic rules with a default deny-all policy, as defined in Section 8.5.1. Omnichannel Support Model The Provider’s unified support delivery approach integrating the Embedded Ticketing System, WhatsApp Business Channel, telephone, and email into a single traceable support workflow, as detailed in Section 4.2. Personal Data Any information relating to an identified or identifiable natural person, as defined in Article 4(1) of the GDPR and Article 1 of the UAE PDPL. PDCA (Plan-Do-Check-Act) The continuous-improvement methodology prescribed by ISO 22301:2019, applied by the Provider to its BCDR programme: Plan (BIA review and recovery-objective calibration), Do (backup and DR execution), Check (drill results and monitoring), Act (corrective actions and architecture improvements), as defined in Section 9.12. PIMS (Privacy Information Management System) The extension to the Provider’s Information Security Management System (ISMS) that establishes privacy-specific controls, procedures, and documentation in accordance with ISO/IEC 27701:2019, governing the processing of Personal Data by the Provider as Data Processor. PIR (Post-Incident Report) A formal report produced by the Provider within five (5) Business Days of resolving a DR-1 or DR-2 disaster-recovery event, containing root-cause analysis, timeline of actions, corrective measures, and BCDR plan updates, delivered to the Customer, as defined in Section 9.7.2. Platform The DANAOS ProjectVIEW ERP software application. When delivered as a Software-as-a-Service (SaaS) solution hosted on the DANAOS Cloud (Microsoft Azure), the terms of this Framework apply in full. The Platform includes all modules, updates, and enhancements provided under this Framework. Provider DANAOS Projects Software Solutions LLC, a company registered in the United Arab Emirates, with an EU entity registered in Greece, and its affiliated companies. Provider Service Desk (PSD) The primary point of contact operated by the Provider for recording and managing all technical support-related tickets via the Omnichannel Support Model (Embedded Ticketing System, WhatsApp Business, telephone, and email), accessible 24 hours per day, 7 days per week, 365 days per year. Process Optimisation Advisory A proactive service whereby the Provider analyses AI-agent test-execution data to identify workflow inefficiencies, configuration anomalies, and improvement opportunities within the Customer’s ProjectVIEW deployment, delivering recommendations during Quarterly Service Reviews, as defined in Section 5.9. RPO Recovery Point Objective — the maximum acceptable period of data loss measured in time. The Platform target RPO is fifteen (15) minutes. RBAC (Role-Based Access Control) The authorisation model implemented by the Platform’s Users & Roles Management module (STY), enforcing granular permissions at the module, function, field, and record level based on assigned roles, as defined in Section 8.4.2. RA-GRS (Read-Access Geo-Redundant Storage) An Azure Storage replication option that extends GRS by providing read-only access to Customer Data in the secondary region during a primary-region outage, enabling immediate data retrieval prior to full failover completion, as defined in Section 9.6. RTO Recovery Time Objective — the maximum acceptable duration for restoring the Platform following a significant disruption. The Platform target RTO is four (4) hours. Record of Processing Activities (RoPA) The documented record of all Personal Data processing activities maintained by the Provider as Data Processor in accordance with GDPR Article 30 and UAE PDPL, specifying the categories of processing, purposes, data subjects, recipients, transfer mechanisms, and retention periods, as described in Section 7.11. Release / Update An incremental software delivery within the current major version (e.g., v11.01, v11.02… v11.xx) addressing change requests, bug fixes, and minor enhancements specific to the Customer’s implementation. Delivered via Agile sprints as defined in Section 4.7.1. Renewal Term Each successive Billing Period following the expiry of the Binding Period during which the subscription automatically renews under the Evergreen Contract mechanism, unless either Party provides written non-renewal notice at least ninety (90) calendar days before the expiry of the then-current Billing Period. See Chapter 11, §11.12.2. SAST (Static Application Security Testing) Automated source-code analysis run on every code commit to detect security vulnerabilities before deployment, with Critical/High findings blocking the build, as defined in Section 8.9. SCA (Software Composition Analysis) Automated scanning of third-party libraries and dependencies for known vulnerabilities (CVEs) and licence compliance, integrated into the Provider’s CI/CD pipeline, as defined in Section 8.9. SCCs (Standard Contractual Clauses) The European Union Standard Contractual Clauses adopted under Commission Implementing Decision (EU) 2021/914 for the transfer of Personal Data to third countries not covered by an adequacy decision under GDPR Article 45, as referenced in Section 7.14. Seat Reassignment The transfer of a Named-User licence (for Addons, Connectors, or Portals) from a departing individual to a replacement individual who permanently assumes the departing user’s role. Seat Reassignment does not incur additional licence fees provided the total active Named-User count does not exceed the licensed count. Not applicable to Universal/Concurrent User Licences, which are floating. See Chapter 11, §11.3.4. Scheduled Downtime Any planned period of unavailability of the Platform for maintenance purposes, communicated to the Customer in advance in accordance with Section 3. Service Request A formal request from the Customer for something to be provided, changed, or actioned that is not an Incident — for example, new user creation, access permission changes, or report configuration. Simulation Scenario A parameterised, end-to-end test specification that defines a complete business-process transaction path (e.g., project initiation through to invoicing) executed by AI agents against the Customer’s Dev/Sandbox environment to validate data flows, business rules, and integration integrity, as defined in Section 5.5.2. SLA Non-Compliance Penalty A financial penalty payable by the Provider to the Customer, calculated as a percentage of the total ARR in accordance with Section 3.8, where the Provider fails to meet the applicable Service Level or GOS targets. Service Level The performance metrics and targets set out in Section 3 and Appendix A against which the Provider’s performance shall be measured. SLO Service Level Objective — the target availability for the Platform, being ninety-nine point nine nine percent (99.9%) uptime per calendar month, excluding Scheduled Downtime. Source Code Escrow The arrangement maintained by the Provider with an independent Escrow Agent for the custody of the Platform’s complete source code, build scripts, database schemas, dependency manifests, and deployment documentation. The escrow deposit is updated quarterly and upon each major version release, and is subject to annual verification. Release conditions and Customer rights are defined in Section 9.14. Sprint A short-cycle Agile development iteration averaging 3 Business Days, during which the Provider delivers a defined set of change requests, bug fixes, or configuration changes to the Customer’s Staging Environment, as detailed in Section 4.7.1. Staging Environment The non-production environment used post Go-Live for debugging, change requests, software updates, and Universal User Acceptance Testing (UAT) prior to deployment to the Production Environment. The Staging Environment is the post Go-Live continuation of the Development/Sandbox environment provisioned during implementation. Super User A Customer-designated employee who has completed the Provider’s Train-the-Trainer (T3) certification programme and is authorised to deliver first-line internal training, conduct new-user onboarding, and provide first-level troubleshooting support within the Customer’s organisation, as defined in Section 6.5. Sub-Processor Any third party engaged by the Provider to process Personal Data on behalf of the Customer, including Microsoft Corporation (as Azure cloud provider). Subscription Start Date The date on which the Customer’s subscription commences, being the date of Agreement signing as specified in the Commercial Contract. The Subscription Start Date triggers the Binding Period, the first Billing Period, and the Initial Term. See Chapter 11, §11.12.1. Subscription Term The aggregate period comprising the Initial Term (Binding Period) and any Renewal Terms under the Evergreen Contract mechanism during which the Customer is entitled to access and use the Platform, as specified in the Commercial Contract and Enterprise License Agreement. See Chapter 11, §11.12. Subscription Year Synonymous with Billing Period. Each consecutive twelve (12) month period within the Subscription Term, commencing on the date of Agreement signing or the anniversary thereof. Subscription Years / Billing Periods are the basis for billing cadence, ARR recalculation, price escalation, and licence-compliance auditing. See Chapter 11, §11.5. Supervisory Authority An independent public authority established by an EU Member State pursuant to GDPR Article 51, or the UAE Data Office under Federal Decree-Law No. 44 of 2021, responsible for monitoring the application of data-protection law within its jurisdiction. SIEM (Security Information and Event Management) The cloud-native security-monitoring platform (Microsoft Sentinel) that aggregates and correlates logs from all infrastructure, application, and database layers to detect threats and anomalous behaviour in real time, as defined in Section 8.8.1. TDE Transparent Data Encryption — the encryption technology applied to all data at rest within the Platform’s database layer using AES-256 encryption. SQT (Software Quality & Testing) The Provider’s AI-augmented software quality and testing framework encompassing automated data-flow simulation, user-interaction simulation, data-integrity validation, regression testing, and process-optimisation advisory services, as defined in Chapter 5. Test Evidence Repository The centralised, immutable store maintained by the Provider for each Customer containing test plans, AI-agent execution logs, data-integrity reports, process-optimisation reports, UAT evidence packs, and regression-suite history, as defined in Section 5.10.1. TKT (Training & Knowledge Transfer) The Provider’s continuous enablement framework encompassing instructor-led training, self-paced digital learning, in-application AI guidance, train-the-trainer certification, and knowledge-base maintenance, as defined in Chapter 6. TNA (Training Needs Assessment) A structured assessment conducted by the Provider in collaboration with the Customer to identify activated modules, organisational roles, proficiency gaps, and training requirements prior to the design of a Training Plan, as defined in Section 6.4.1. TNRA (Training Needs Re-Assessment) A structured re-evaluation of the Customer’s training requirements conducted within sixty (60) days of an EOL Announcement, assessing the impact of successor-version changes on existing competencies, roles, and workflows to produce a Transition Training Plan, as defined in Section 10.7. Training Coordinator The Customer-designated single point of contact responsible for all training logistics, scheduling, attendee nomination, feedback collection, and internal distribution of Provider-supplied training materials, as defined in Section 6.9. Transition Training Plan A customised training programme developed following the TNRA to re-certify the Customer’s users, Champions, and Super Users on the successor version. Includes “What’s New” briefings, hands-on workshops, Champion re-certification, API/integration workshops, UAT guidance, Go-Live readiness checks, and post-migration clinics, as defined in Section 10.7. True-Up Notice A written notice issued by the Provider following a licence-compliance audit, specifying any excess usage of Universal/Concurrent Users, Named Users (for Addons/Portals), or modules beyond the licensed entitlements and the applicable fees for regularisation. See Chapter 11, §11.11.3. UAT (Universal User Acceptance Testing) The formal testing process in which the Customer validates that all software changes, patches, updates, and new features function correctly in the Staging Environment before deployment to Production. UAT requires written Customer sign-off prior to production release. Upgrade (Major Version) A product-wide new major version of the Platform (e.g., v11 → v12) encompassing significant functional enhancements, UI/UX redesigns, new APIs/SDKs, and major COTS version upgrades. Released approximately annually. Governed by the End-of-Life policy in Chapter 10. User Licence Amendment A formal amendment to the Commercial Contract executed by the Parties to add or remove Universal/Concurrent User Licences mid-term under the Flexible Subscription Model. Additions are invoiced pro-rata from the Activation Date, with the ARR recalculated based on the new Volume Band. Removals take effect at the next Billing Period renewal and are subject to the Minimum Licence Commitment. See Chapter 11, §11.3.6. UAE Data Office The national data privacy regulator of the United Arab Emirates, established under Federal Decree-Law No. 44 of 2021, responsible for regulating the application of the UAE PDPL. UAE PDPL Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, the first comprehensive federal data privacy law in the United Arab Emirates, effective 2 January 2022. Universal User A floating licence entitlement under the Universal/Concurrent User per Device licensing model that permits any authorised individual to access the Platform, provided the total number of simultaneously active sessions (Concurrent Users) does not exceed the licensed count specified in the Commercial Contract. Universal User Licences are not tied to specific named individuals. See Chapter 11, §11.3.2. Volume Band The tiered pricing bracket applicable to the Customer’s Annual Subscription Fee, determined by the total number of licensed Universal/Concurrent Users. Five Volume Bands are defined: Band 1 (Minimum–20 Users), Band 2 (21–30), Band 3 (31–50), Band 4 (51–100), and Band 5 (100+). Higher Volume Bands attract progressively reduced per-user rates. See Chapter 11, §11.4.1. WAF (Web Application Firewall) Azure Web Application Firewall deployed in front of the Platform’s application tier to protect against OWASP Top 10 web-application attacks including SQL injection, cross-site scripting, and request smuggling, as defined in Section 8.5.1. Warranty Period (Lifetime Warranty) The entire duration of the Customer’s active Subscription Term and any renewal thereof, during which the Provider warrants that the Platform shall perform materially in accordance with this Framework, remain free from material defects, receive continuous security patching, and maintain performance at or above the contracted SLO and recovery objectives. The warranty is co-extensive with the Subscription and does not expire, reduce in scope, or require separate renewal. Defined in Section 9.13. WhatsApp Business Channel A dedicated WhatsApp Business group established for each Customer, connecting the Customer’s key users with the Provider’s assigned consultants for expedient informal communication. Governed by the data protection and formalisation rules set out in Section 4.2.3. ZRS (Zone-Redundant Storage) An Azure Storage replication option that maintains three copies of Customer Data across two to three availability zones within a single Azure region, providing 12-nines durability and protection against single availability-zone failure, as defined in Section 9.6. 1.2 Interpretation In this document, unless the context otherwise requires: (a) References to Sections and Appendices are to sections of, and appendices to, this Framework. (b) Words importing the singular include the plural and vice versa, and words importing any gender include all genders. (c) References to any statute, regulation, or legislative provision include any modification, re-enactment, or extension thereof, including but not limited to the GDPR, the UAE PDPL,, and any successor legislation or implementing regulations (including any Executive Regulations issued by the UAE Data Office). (d) The headings in this document are for convenience only and shall not affect its interpretation. (e) The terms "include" and "including" shall be construed without limitation. (f) Where any obligation in this document requires compliance with a standard (including ISO 27001, ISO 9001, or ISO 20000-1), the reference shall be to the version current at the date of this document or, where the Provider has transitioned to a later version, that later version. (g) References to a Party include that Party’s successors and permitted assigns. (h) Any obligation on a Party not to do something includes an obligation not to allow, cause, or permit that thing to be done. 1.3 Order of Precedence In the event of any conflict or inconsistency between the provisions of this Framework, the following order of precedence shall apply (in descending order): (a) The Commercial Contract (including any Customer-specific terms agreed therein); (b) Part A (Commercial & Legal Framework) of this Framework; (c) Parts B through E (Technical & Operational Provisions) of this Framework; (d) The Appendices to this Framework. 1.4 Regulatory References This Framework references the following regulatory frameworks and standards. Where applicable, external links are provided for verification and further reading: GDPR — Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data https://eur-lex.europa.eu/eli/reg/2016/679/oj UAE PDPL — Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (United Arab Emirates). Effective 2 January 2022. Establishes comprehensive data protection obligations for entities processing personal data of natural persons in or from the UAE, including requirements for DPO appointment, data breach notification, Data Protection Impact Assessments (DPIAs), cross-border transfer safeguards, and a Record of Processing Activities (ROPA). Regulated by the UAE Data Office under Federal Decree-Law No. 44 of 2021. UAE Government Data Protection Laws: https://u.ae/en/about-the-uae/digital-uae/data/data-protection-laws Full text: https://uaelegislation.gov.ae/en/legislations/1972/download National Privacy Commission: ISO/IEC 27001:2022 — Information Security Management Systems ISO 9001:2015 — Quality Management Systems ISO/IEC 20000-1:2018 — IT Service Management DANAOS ISO Certifications: https://danaos-projects.com/iso-certifications/ Microsoft Azure Compliance — SOC 1/2/3, ISO 27001/27017/27018, FedRAMP, PCI DSS, CSA STAR Microsoft Service Trust Portal: https://servicetrust.microsoft.com/ Azure Trust Center: https://azure.microsoft.com/en-us/explore/trusted-cloud Note: The Provider maintains compliance with all applicable data protection regulations in each jurisdiction of operation. Given the Provider’s principal place of business in the United Arab Emirates, the UAE PDPL is of primary relevance alongside the GDPR. The Provider monitors the issuance of Executive Regulations by the UAE Data Office and will update its data protection practices accordingly within the compliance transition period prescribed by the UAE PDPL. 1.5 Process Register The following table summarises the governance processes established in this Chapter, including responsible roles, expected outcomes, and cross-references to related processes in other Chapters. Role Legend: P = Provider | C = Customer | SC = Steering Committee | DPO = Data Protection Officer | SDM = Service Delivery Manager 1.5.1 Process Registry Ref Process Trigger Handler Approver Expected Outcome Cross-Ref P-1.01 Agreement Amendment Either Party requests modification to terms Legal Counsel (P/C) Steering Committee Executed written amendment to Agreement § 7, § 1.3 P-1.02 Precedence Dispute Resolution Conflict identified between Agreement documents SDM / Customer IT Liaison Steering Committee Binding interpretation per § 1.3 hierarchy § 1.3, § 3.11 P-1.03 Regulatory Compliance Update New or amended Data Protection Law DPO / Legal Counsel Steering Committee Updated DPA, privacy notices, and processing records § 1.4, § 17 1.5.2 RACI Matrix Process (Ref) Provider Customer Steering Committee DPO P-1.01 Agreement Amendment C C A I P-1.02 Precedence Dispute R C A — P-1.03 Regulatory Update R I A R R = Responsible (executes) | A = Accountable (sign-off) | C = Consulted | I = Informed | — = Not Involved 1.5.3 Process Flow — Agreement Governance Lifecycle Stage Activity Role Output ① Initiation Amendment or dispute request raised Either Party Written request submitted ② Assessment Legal/regulatory impact analysis Provider + DPO Impact assessment report ③ Review Steering Committee review and decision Steering Committee Approval / rejection / deferral ④ Execution Signed amendment or updated DPA Both Parties Executed document → Agreement updated ← OverviewMaster SaaS FrameworkNext →Service Description & Scope See how ProjectVIEW ERP runs in a dedicated cloud environment for your projects. Book a Demo →