Terms and Conditions

TERMS AND CONDITIONS

As of: 31.10.2025

I. Introduction

The terms and conditions in this document govern the contractual terms for the use of the LegalTegrity whistleblower solution by the licensee and its group companies.
The solution is a „Software as a Service“ (SaaS) operated via a web-based interface that allows the licensee and the licensee's employees or business partners to communicate with each other via the solution, without using any software other than an internet browser on their computers to access the solution.

II. Definitions

„Admin Portal“ refers to the area of the solution where employees of the licensee can view or edit information and adapt the solution to the specific requirements of the company.
„Bedingungen“ means the terms and conditions contained in this document.
„Cyber attacks“ refers to intentional internal or external attempts, including computer-assisted ones, to impair the integrity, confidentiality or availability of the solution or otherwise gain manipulative access to the licensee's data.
„Settings“ refers to the section within the solution's administrator portal where the licensee can provide details about their current employee count and contact information.
„Updates“ refer to improvements and feature enhancements within a version and are installed as software updates. The numbering only changes in the trailing digits.
„LegalTegrity“ refers to the German company LegalTegrity GmbH, based in Frankfurt am Main.
„LegalTegrity-Portal“ refers to the web portal where the licensee submits the order for the solution and pays the license fee for the first license period.
„Licensee“ refers to the company that has acquired the rights to use the solution by paying the licence fee. For improved readability, the licensee companies should be subordinate to this term, as use of the solution by them is also possible.
„Royalty“ means the fee paid by the licensee for the right to use the Solution within a Licence Period.
„Licence Period“ is the period during which the licensee acquires the right to use the solution by paying the licence fee. Each licence period lasts for 12 months. At the end of each licence period, a new licence period automatically begins, unless this agreement has been terminated with one month's notice prior to the expiry of the licence period. The first licence period begins on the day the account is activated for the licensee.
„Solution“ is the LegalTegrity application, developed by LegalTegrity, to which the licensee is granted the rights to use the Solution under these terms.
„Solution Usage Right“ means the right of the licensee to use the solution in accordance with the terms and conditions.
„Usage Agreement“ is the agreement between LegalTegrity and the Licensee regarding the use of LegalTegrity.
„Party“ or „Parties“ refers to the contracting parties to this agreement, namely the licensee and LegalTegrity, who are subject to these terms and the rights and obligations described.
„Package“ refers to the subscription type. Packages vary according to the following parameters: maximum number of employees, maximum number of languages, and maximum number of users. The package is selected by the licensee when signing up for the solution and can be changed for the future during the subscription (an upgrade is always possible, a downgrade only after the licence period has expired).
„Leistungen“ refers to the section in the solution's administrator portal where the licensee can view their current valid package, change the package, book additional services, download invoices, and manage contact and billing information, etc.
„Services“ are theleistungen that LegalTegrity makes available to the licensee by providing solution usage rights.
„Contract Termination“ is the point in time from which LegalTegrity no longer makes the service available to the licensee.
„Additional Services“ are the services that LegalTegrity provides to licensees for a fee, beyond the packages, at the time of booking.
„Licensee Companies“ means all companies affiliated with, majority-owned by or belonging to the same group as the Licensee within the meaning of §§ 15 ff. AktG (German Stock Corporation Act). This includes all member companies of the Licensee consultant network.
„Licensee Employee Count“ means the number of employees in all Licensee companies for which the Licensee (including its own employees) uses the Solution.

III. General terms and conditions

A. Confidentiality

LegalTegrity is not authorised to disclose to third parties any information (whether oral or written) received from the licensee and marked as confidential.
The licensee is not permitted to disclose information received from LegalTegrity and marked as confidential (whether oral or written) to third parties (including information on how to use the solution). Licensee companies are not considered third parties for the purposes of this Agreement.
The licensee is not authorised to use the knowledge gained about the solution to design and/or create a similar solution, either oneself or through third parties.
LegalTegrity is permitted to publish, with prior express written consent on a case-by-case basis, for example in a reference list, that the licensee belongs to LegalTegrity's customer portfolio.

B. Information about licensees; notices

It is the licensee's responsibility to maintain information about their settings, e.g. information about the licensee's company, the number of licensee employees, contact details, and billing and payment information, in the „Services“ section of the administrator portal.
All notifications, communications, invoices, etc. will be sent to the email address stored in the Administrator Portal under „Settings“.

C. Liability

LegalTegrity shall be liable for damages in accordance with the general provisions of German law.
LegalTegrity is not obliged to compensate for indirect and consequential damages, such as loss of operation, loss of profit, loss of time, and expenses for legal advice and other consulting services.
The damage to be replaced by LegalTegrity for simple negligence may amount to a maximum of €500,000.00 in individual cases. This limitation of liability does not apply to the processing of personal data (see LegalTegrity's Data Processing Declaration).
The Licensee accepts that information received from LegalTegrity, whether oral or written, cannot be considered advice (including, but not limited to, legal advice). Therefore, the Licensee cannot sue LegalTegrity for errors in advice. Furthermore, the Licensee is not entitled to personally sue individuals employed by LegalTegrity in cases of slight or gross negligence.
LegalTegrity shall not be liable for circumstances beyond LegalTegrity’s control, such as general strikes, war, earthquakes, natural disasters, strikes, lockouts, and the like. LegalTegrity shall nevertheless be obliged to take the best possible measures, in accordance with the state of the art, to counter natural and technical events as well as cyber-attacks that could impair proper service delivery.
The aforementioned limitations of liability shall not apply to breaches of duty by the licensor or its vicarious agents in cases of gross negligence, wilful intent, as well as for damages arising from injury to life, body and health, nor for breaches of essential contractual obligations.

D. Term, termination

The contract term is one year from the activation of the account in the solution by LegalTegrity and is extended by a further contract year unless terminated in the system with one month's notice prior to the expiry of a contract year.
The service will be continuously provided to the licensee until the termination of the contract by LegalTegrity.
LegalTegrity is entitled at any time to terminate the Service immediately and without further notice if the Licensee's use of the Solution breaches the provisions in Section IV.A of these terms.
The licensee may terminate the Service at any time by opting out in the „Services“ section of the administrator portal. Termination shall take effect at the end of the last day of the current licence period. The opt-out may be withdrawn by the licensee at any time during the licence period. Data will not be deleted by the licensor until the expiry of the respective retention period and will be accessible to the licensee, provided the licensee does not instruct earlier deletion.
The right to terminate for good cause remains unaffected by this. License fees already paid for periods after the termination takes effect are to be reimbursed to the licensee if the licensee terminates for good cause.
If the licensee has not paid the license fee 30 days after the commencement of a license period and is in default of payment, LegalTegrity is entitled to suspend the Service until payment is received. During this period, external notifications may be received, but the licensee will not have access to these. If the licensee still does not pay the license fee within a further 15 days after a reminder, LegalTegrity is entitled to terminate the Service Portal (cf. Section IV.D.3). The licensee's data will be deleted by LegalTegrity unless the outstanding license fees are paid within 6 months. However, the termination will remain in effect in this case.
LegalTegrity is entitled to delete the licensee's solution and the data stored within the solution after service provision within the scope of the GDPR. The licensor will inform the licensee of the date of deletion at least 14 days in advance and will show them options for backing up the stored data.
So far as the terms provide that the agreement shall expire, terminate, etc., the parties agree that the provisions in Sections IV.A., IV.C., and V of these terms shall survive expiry.
It is possible for the licensee to export the data contained within the solution. Should the licensee wish to export data from the solution in the event of an impending contract termination, the licensee must carry out the data export no later than the last day of the licence period. If the licensee does not perform the data export in a timely manner, the data will be deleted after six months, and it will no longer be possible to export the data.

E. Breach of duty

Either party may claim a breach if the other party fails to adhere to its obligations under these terms. However, before being entitled to claim a breach, the party claiming the breach must provide the defaulting party with seven business days to remedy the breach. The notice must describe which obligations are considered breached.
If the breach is material, the aggrieved party may terminate this Agreement. In such event, the notice shall state that the aggrieved party intends to terminate the Service.
A breach of non-payment of the licence fee by the licensee is described under clause V.D.3.

IV. Licensee rights

A. Scope of use of the solution

The solution may only be used for reporting and case management of whistleblower notifications (internal and external) and complaints or similar matters under other laws (e.g. the German Supply Chain Due Diligence Act) and company internal regulations.
The licensee is only permitted to use the solution for its intended purpose, i.e., as a reporting platform for violations of laws or company internal regulations. The licensee may not use the solution for criminal purposes (e.g., drug trafficking, dissemination of pornography, etc.) or otherwise violate any applicable legal regulation.
In order to use the Service, the Licensee must observe the limits on the maximum number of employees specified in the package. The Licensee is obliged to record any change in the number of the Licensee’s employees, as defined in these terms and conditions, which is not merely temporary and exceeds 10 %, in the „Settings“ section of the solution’s administrator portal during the course of a licence period.
LegalTegrity is entitled to investigate whether the restrictions on the use of the solution are being complied with. LegalTegrity is entitled to terminate the service without notice in the event of non-compliance with the provisions in this section (see clause 3). This includes, for example, checking the number of reports received.

B. Licence

The usage agreement grants the licensee and the licensee's companies a non-exclusive licence to use the solution in accordance with the licence entitlement granted under I. The licence is subject to the restrictions and conditions set out in this agreement.
The intellectual property rights are the property of LegalTegrity and are not transferred to the licensee in any way.
LegalTegrity compensates the licensee for any third-party claims in the event of an infringement of their rights.

C. Data

All of the licensee’s data contained within the solution is the property of the licensee.
The data of incidents reported in the solution are encrypted. Only the licensee (not LegalTegrity) has access to the private key required to decrypt the data.
The licensee is responsible for maintaining and keeping up-to-date the editable texts in the solution.
Both the licensee and LegalTegrity are entitled to transfer rights and obligations under these terms in the event of a change in ownership structure. In this case, the licensee shall be granted a special right of termination. This must be exercised by the licensee within 14 days of notification by the licensor.
Provided the licensee expressly consents, LegalTegrity is entitled to send the licensee e-mail notifications about the solution, such as status information, alerts, newsletters, and information about new functionalities. The licensee can maintain the corresponding contact details within the solution. The licensee may object to this transmission in whole or in part at any time, with effect for the future.

D. Lfees, payments and invoices

Royalties will be invoiced to the licensee on a proper invoice and must be paid by the licensee within 7 days to the licensor's specified account free of charge and without deduction.
If the licensee fails to pay the recurring license fee and is in default, the licensee’s access to the administrator portal will be suspended 30 days after the start of the new licence period, following written notice. If the licensee has not paid the licence fee within a further 7 days, a second reminder email will be sent. If the licensee has not paid the licence fee 45 days after the start of a licence period, LegalTegrity is entitled to terminate the service. The licensee’s data will be deleted by LegalTegrity, unless there is payment of the outstanding licence fees within 6 months. The termination will, however, remain in effect.
The licence fees will be invoiced plus the respective statutory VAT.

E. Package change

It is not possible to downgrade the current package to another package with a lower licence fee.
When the licensee upgrades a package, the benefits of a package change take immediate effect. Only the difference in price between the new higher package price and the previous package fee will be invoiced.

F. Support

Every relevant page in the solution's administrator portal contains additional information on the use of the respective functionalities in the appropriate places (e.g. FAQ or a reference to the user manual).
Beyond that, there is free support available via email at the address
contact@legaltegrity.com requested. Telephone support is also available at the number provided to the licensee in the initialisation email during the specified times.

G. Usage and operation

The licence agreement comes into effect and the first licence period commences on the day the account is activated for the licensee. The solution cannot be used until the licensee has activated the solution.
The initialisation email contains information required to reset administrator user passwords should all administrator users forget their passwords and be consequently unable to log in to the solution's administrator portal. It is extremely important that the licensee retains the initialisation email in an appropriate manner to ensure that it is not lost or destroyed and is not disclosed to any unauthorised persons.
Where a supervisory authority lawfully demands access to the licensee's data in the solution pursuant to a mandatory provision, the licensor shall be obliged to cooperate to the best of its ability in the handover of the data to the authority and to grant the licensee and its supervisory authority the rights required by Article 274 of Commission Delegated Regulation (EU) 2015/35 of 10.10.2014.

H. Availability of the solution

The solution is updated and improved with approximately three to four version updates each year. The version updates take place at night (from 10 PM CET/CEST). The downtime for each major update depends on the content of the version update. Typically, the downtime will not exceed 60 minutes. All version updates are announced at least 7 days in advance of the release date to the administrator users of the LegalTegrity licensee stored in the solution. The licensor is obliged to operate the solution according to the state of the art and, in the event of legal changes relevant to such solutions, to update them free of charge with effect from the legal change.
Every year, a series of smaller updates/patches are released. The downtime for these individual smaller updates/patches is not noticeable to the licensee. The implementation of smaller updates/patches is not communicated in advance.
Upgrades and updates are included in the licence fee. The licensee will incur no further costs.
LegalTegrity ensures that availability is at least 99.8 %. The availability percentage is calculated on a calendar quarter basis. In the event of non-compliance with the above-mentioned availability, the licensee may reduce the remuneration due for the month in question by 10%. If the availability in any given month falls below 98%, no fee shall be invoiced for that month, or the equivalent amount shall be refunded to the licensee.

I. Further development and bug fixing

LegalTegrity is continuously developing the solution and adding new functionalities. LegalTegrity is inspired to develop new functionalities through ongoing general dialogue with users of the solution. LegalTegrity prioritises to what extent and in what order new functionalities are implemented.
LegalTegrity ensures that the solution always complies with local legal requirements in EU member states. Any clarifications made through judicial or administrative decisions that clarify legal requirements will be implemented immediately.
The resolution of critical errors will commence within 12 normal business hours (CET/CEST) after the error occurs or is reported by the licensee to LegalTegrity. Work to resolve the error will continue without interruption until the error is resolved.
The licensee may not rely on the unavailability of the Solution during the period in which LegalTegrity is rectifying a Critical Error, provided that LegalTegrity rectifies the Critical Error within 24 hours of being notified of the Critical Error and provided that the number of Critical Errors does not exceed 3 per calendar year.
Minor defects will be resolved in a small update/patch as quickly as possible, taking into account the impact of the defect on the solution. The licensee shall not be entitled to rely on a breach of performance for minor defects.
The following errors are always considered serious, without this list being exhaustive:
- Failures that render the entire solution or substantial parts of the solution unavailable;
- Errors that prevent reports from being submitted in the solution's report portal;
- Errors that prevent a licensee user from logging into the solution's administrator portal and
- Errors that prevent a licensee user and a whistleblower from communicating about the solution.
LegalTegrity shall not be liable for errors in the solution caused by incorrect use or misuse of the solution by the licensee or any third party.
The licensee is responsible for correctly configuring the solution for use by their company.
In the event of an error that impairs the accessibility of the solution for potential whistleblowers to the extent that no tips can be received, LegalTegrity is obliged to notify the licensee immediately and to provide immediate information within the solution, informing potential whistleblowers of the malfunction and its expected duration.

J. Security

LegalTegrity guarantees that the security of the solution complies with the state of the art in the hosting of internet-based applications. LegalTegrity's data processing terms and conditions contain a list of the technical and organisational measures taken to ensure a high level of information security. The licensor's solution is operated on the systems of the hosting provider Deutsche Telekom, using the Open Telekom Cloud, which is certified according to ISO 27001. The licensor is only permitted to change the hosting provider if it 1. notifies the licensee at least 6 months prior to the change, 2. the new hosting provider has its location within the EU, 3. no data is transferred to third countries, and 4. the new hosting provider can provide appropriate certifications, similar to the current one. In any case, the licensee has a special right of termination if a change of hosting provider is to be made. Relocating the server location for the licensor's solution outside the EU is not permitted and entitles the licensee to an extraordinary right of termination and establishes unlimited liability of LegalTegrity towards the licensee companies.
LegalTegrity shall not be liable for the consequences of hostile attacks on the solution, provided that the solution is at the state of the art.
The licensee is obliged to comply with the following safety guidelines:
- Do not share passwords for the solution's administrator portal.
- Log in to the Solution's administrator portal only from secure computers with up-to-date antivirus/antimalware software installed.
- Regular review of administrator accounts and locking or updating administrator accounts in the event of staff departure or a change in staff position.
- In the „Reports/Download Audit Log“ section, the licensee can download lists of activities that have taken place within their LegalTegrity application. This should be done regularly to identify any irregularities early on.
Telekom provides two redundant data centres for OTC with daily backups. These backups are deleted after one week. LegalTegrity creates an additional 14-day backup. If the licensee of LegalTegrity requires a separate delivery of their backup on a data carrier, this request must be made in writing to LegalTegrity. The costs for this are to be paid separately and amount to €300.00 plus the respective statutory VAT for the separate backup of the data, provided that the reason for the data backup is not attributable to LegalTegrity.

K. Processing of personal data

The processing of personal data is governed by LegalTegrity's data processing conditions.
The solution is configured to comply with the EU legislation requirements for processing personal data (GDPR). Passwords (for the administrator portal and for the whistleblower mail) must be at least 8 characters long, contain a mix of upper- and lower-case letters, and include at least one digit. Access to the solution is suspended for 5 minutes after 6 consecutive unsuccessful login attempts. The lockout period is progressively increased for repeated incorrect entries up to 11 days.
The licensee is obliged to ensure the confidentiality of passwords and usernames.

V. Final provisions

The conditions apply automatically from the time the licensee places the order for the service in the LegalTegrity portal.
Any changes or additions to this contract, including any changes to this provision, must be made in writing and agreed to by all parties to be effective. Section 305b of the German Civil Code (BGB) shall remain unaffected.
The updated terms and conditions can be downloaded at any time here: https://legaltegrity.com/legal. LegalTegrity's data processing terms and conditions can be downloaded at https://legaltegrity.com/datenschutz.
The exclusive place of jurisdiction for all disputes arising out of or in connection with this contract is Frankfurt am Main.
Should a provision of this contract be or become wholly or partially invalid or unenforceable, this shall not affect the validity of the remaining provisions of the contract. In place of the invalid or unenforceable provision, the parties agree on a regulation that comes closest to the economic purpose of the invalid or unenforceable provision. The same applies in the event of a gap.
Each party shall bear its own costs, unless this Agreement provides otherwise.
This contract and its interpretation are exclusively subject to German law.