Terms of Service
O27

These terms govern the use of the platform operated under the O27 brand and the products it carries, in particular Paraphe (shared inbox) and Havre (platform for Belgian out-of-school care operators).

They apply to anyone who signs in to the service. They do not replace the contract between O27 and the customer organisation: that contract governs price, term, service levels and liability. The contract prevails in case of divergence.

O27 SRL is due to be incorporated in October 2026. The transfer of the service to that entity will be notified to customers in advance, and this page updated.

The service is multi-tenant: each customer organisation has its own space, and user accounts there are created by the organisation, not by O27.

• Credentials are personal. They are not to be shared.
• Multi-factor authentication is required.
• The customer organisation is responsible for the access it grants and for withdrawing it when a user leaves.
• Access found to be misused is suspended, and the organisation is informed.

Paraphe connects to the mailbox you designate, at your own provider. The connection is established through OAuth 2.0: you authenticate with your provider, never with us, and we neither receive nor store your password.

The permissions requested, their purpose and how to revoke them are set out in the privacy statement.

You remain a customer of your mail provider. That provider's terms continue to apply to your mailbox, and O27 does not answer for them.

You may not use the service to:

1. access data you are not entitled to, or attempt to circumvent the isolation between organisations;
2. send unsolicited mail, phishing or fraudulent content;
3. store or distribute unlawful content, or infringe the rights of a third party;
4. degrade the availability of the service, in particular through disproportionate automated load;
5. carry out penetration testing without O27's prior written authorisation;
6. resell access to the service without written agreement.

Programmatic access is permitted within the documented limits and without circumventing quotas.

The data you entrust to the service remains yours. O27 acquires no ownership right over it.

O27 processes it to provide the service, on the instructions of the customer organisation, as a processor within the meaning of the GDPR. It is not used to train models, nor sold, nor used for advertising purposes.

Processing is described in the privacy statement and, where a contract has been concluded, in its data processing annex.

The service is provided continuously, subject to interruptions required for maintenance and to incidents affecting our suppliers. Planned interruptions are announced in advance where their scale warrants it.

Quantified availability and recovery objectives are binding only where they appear in the contract. This page is not such an undertaking.

O27 may suspend an access, an account or a customer space where its use threatens the security of the service, that of other customers or that of third parties, or where the law requires it. Suspension is notified to the customer organisation and lasts no longer than the cause requires.

At the end of the contractual relationship, the customer organisation's data is returned and then erased in accordance with the contract.

A description of the security measures applied to the platform is provided to customers and prospects on request, at the contact address above.

Vulnerabilities are reported to that same address. We will not pursue anyone who reports one without accessing a third party's data, without degrading the availability of the service, and without disclosing it before it is fixed.

The service is provided as described in its documentation. O27 does not warrant that it meets a particular need not agreed in the contract.

Liability limitations and caps are those of the contract concluded with the customer organisation. Nothing on this page limits liability in the event of wilful misconduct, gross negligence, or harm to life or physical integrity.

O27 may amend these terms. Any substantial amendment is communicated to customer organisations before it takes effect. The date of last update and the corresponding commit appear in the document control block of this page.

Belgian law applies. The courts of the judicial district of Liège have exclusive jurisdiction, unless the contract provides otherwise or a mandatory consumer-protection rule applies.