GENERAL TERMS AND CONDITIONS

State: 24 April 2022

I. Introduction

1. The Conditions in this document govern the contractual terms and conditions for the Licensee’s use of the LegalTegrity Whistleblowing Solution.
2. The Solution is a “Software as a Service” (SaaS), which is operated via a web-based interface and enables the Licensee and the Licensee’s employees or business partners to communicate with a whistleblower via the Solution without using any software other than an Internet browser on the computers to access the Solution.

II. Definitions

1. “Additional services” are the services that LegalTegrity provides to Licensees in addition to the Packages against payment with the booking.
2. “Administrator portal” means the area of the Solution where Licensee’s employees can view or edit notices and adapt the Solution to the specific requirements of the Company.
3. “Conditions” means the conditions contained in this document.
4. “LegalTegrity” refers to the German company LegalTegrity GmbH with its registered office in Frankfurt am Main.
5. “LegalTegrity portal” means the web portal on which the Licensee sends the order for the Solution and pays the License fee for the first License period.
6. “Licence fee” means the fee paid by the Licensee for the Solution usage right during a Licence period.
7. “Licence period” means the period during which the Licensee acquires the Solution usage right by paying the Licence fee. Each Licence period runs for 12 months. At the end of each Licence period a new Licence period shall automatically commence unless this agreement has been terminated in accordance with Section III.D. The first License period starts on the day the Licensee has paid the first License fee in the LegalTegrity portal.
8. “Licensee” means the company that has acquired the Solution usage right by paying the Licence fee.
9. “Package” means the type of subscription. Packages vary according to the following parameters: maximum number of employees, maximum number of languages and maximum number of users. The Package is selected by the Licensee when he/she registers for the Solution and can be changed for the future during the subscription period (an upgrade is always possible, a downgrade only after the License period has expired).
10. “Party” or “Parties” means the parties to this agreement, namely Licensee and LegalTegrity, who are subject to these Conditions and the rights and obligations described herein.
11. “Service” are the services that LegalTegrity provides to the Licensee by providing Solution usage rights.
12. “Services” means the section of the Solution’s Administrator portal where Licensee can view its currently valid Package, change the Package, book Additional services, download invoices and maintain contact and billing information, etc.
13. “Settings” means the section in the Administrator portal of the Solution where the Licensee can enter information about his current number of employees and contact details.
14. “Solution” means the LegalTegrity application developed by LegalTegrity and for which Solution usage rights are granted to Licensee under these Conditions.
15. “Solution usage right” means the right of the Licensee to use the Solution in accordance with the Conditions.
16. “Termination of agreement” is the time from which LegalTegrity ceases to provide the Service to the Licensee.
17. “Update” refers to improvements and functional enhancements within a version and is installed as software updates. The numbering changes only at the rear positions.
18. “Usage Agreement” is the agreement between LegalTegrity and the Licensee regarding the use of the Solution.

III. General conditions

A. Confidentiality

1. LegalTegrity is not entitled to pass on confidential information received from the Licensee (both orally and in writing) to third parties.
2. The Licensee may not disclose any confidential information (whether oral or written) received from LegalTegrity to any third party (including information regarding the use of the Solution).
3. The licensee is not entitled to use the knowledge obtained about the Solution to design and/or create a similar solution himself or through third parties.
4. LegalTegrity is entitled to publish, e.g. in a reference list, that the Licensee belongs to the customer portfolio of LegalTegrity.

B. Information on Licensees; notifications

1. It is the Licensee’s responsibility to maintain the information about his settings, e.g. information about the company, number of employees, contact information, billing and payment information, in the “Services” section of the Administrator portal.
2. All notifications, messages, invoices, etc. are sent to the e-mail address registered in the “Settings” section of the Administrator portal.

C. Liability

1. LegalTegrity is liable for damages according to the general rules of German law.
2. LegalTegrity is not obligated to compensate indirect damages and consequential damages, such as business interruptions, loss of profits, loss of time and expenses for legal assistance and other consulting services.
3. The maximum amount of damages to be compensated by LegalTegrity is ten times the amount of a one-year License period. This limitation of liability does not apply to the processing of personal data (see the Privacy Policy of LegalTegrity).
4. The Licensee accepts that information received from LegalTegrity, whether oral or written, cannot be considered advice (including but not limited to legal advice). Therefore, the Licensee may not sue LegalTegrity for errors in advice. Furthermore, the Licensee is not entitled to personally sue persons employed by LegalTegrity in cases of slight and gross negligence.
5. LegalTegrity is not liable for conditions beyond the control of LegalTegrity, such as general strike, war, earthquake, natural disasters, strike, lockout and the like.

D. Termination

1. The Service will be provided continuously to the Licensee until the Termination of agreement by LegalTegrity. LegalTegrity is entitled to terminate the Service with a notice period of 12 months to the end of a calendar month.
2. In addition, LegalTegrity may terminate the Service immediately and without further notice at any time if Licensee’s use of the Solution violates the provisions of Section IV.A of these Conditions.
3. The Licensee may terminate the Service at any time by logging out in the “Services” section of the Administrator Portal. The Termination of the agreement becomes effective at the end of the last day of the current License Period. Logging out may be completed by the Licensee at any time within the Licence Period with one month’s notice to the end of the License Period. Data will not be deleted by the Licensor until the end of the retention periods.
4. If the Licensee has not paid the Licence fee 30 days after the start of a Licence period, LegalTegrity is entitled to pause the Service until payment is received. During this time, notices from outside may be received, but the Licensee has no access to these receipts. If the Licensee does not pay the Licence fee within further 15 days even after a reminder, LegalTegrity is entitled to cancel the Service and delete all data on the LegalTegrity portal (see Section IV.D.7).
5. A prepaid Licence fee is not refundable to the Licensee.
6. LegalTegrity is entitled to delete the Licensee’s Solution and the data stored in the Solution after the Service has been provided within the scope of the GDPR.
7. To the extent that the Conditions state that the agreement shall expire, end, etc., the Parties agree that the provisions in Sections III.A. III.A., III.C., and V. of these Conditions shall continue to apply after the expiry of the term.
8. It is possible for the Licensee to export the data contained in the Solution. If the Licensee wishes to export data from the Solution in case of an imminent Termination of agreement, the Licensee must perform the data export at the latest on the last day of the Licence period. If the Licensee does not carry out the data export in time, the data will be deleted after 6 months at the latest and the export of the data is no longer possible.

E. Breach of duty

1. Either Party may invoke a breach if the other Party fails to fulfil its obligations under these Conditions. However, before being entitled to invoke an infringement, the Party invoking the infringement must give the defaulting Party a period of 7 working days to remedy the infringement. The notification must describe which obligations are considered to have been breached.
2. If the infringement is substantial, the Party invoking it may terminate this agreement. In this case, the notice must state that the Party invoking it intends to terminate the Service.
3. A breach of payment of the Licence fee by the Licensee is described in Section III.D.4.

IV. Rights of the Licensee

A. Scope of use of the Solution

1. The Solution can only be used for reporting and case management of whistleblower reports and complaints or similar under other laws.
2. The Licensee is only entitled to use the Solution in the intended sense, i.e. as a reporting platform for whistleblowing cases. The Licensee may not use the Solution for criminal purposes (e.g. drug trafficking, distribution of pornography, etc.) or otherwise violate any applicable legal regulation.
3. In order for the Licensee to use the Service, the Licensee must observe the limits of the maximum number of employees provided for in the Package, which the Licensee has indicated in the “Settings” section of the Administrator portal as being employed by him/her at the time of registration (headcount of employees, not full-time equivalent). The Licensee is obliged to record any change in the number of employees within the meaning of these Conditions that is not only temporary by more than 10% during the course of a Licence period in the “Settings” section of the Solution Administrator portal.
4. LegalTegrity has the right to investigate whether the restrictions on the use of the Solution are respected. LegalTegrity is entitled to terminate the Service without notice in the event of non-compliance with the provisions in this Section (see Section III.D.2.).

B. License

1. The Usage Agreement grants the Licensee a non-exclusive licence to use the Solution. The licence is subject to the restrictions and Conditions set out in this agreement.
2. The intellectual property rights are the property of LegalTegrity and are not transferred to the Licensee in any way.
3. LegalTegrity compensates the Licensee for any claims of third parties in case of violation of their rights.

C. Data

1. All data of the Licensee contained in the Solution is the property of the Licensee.
2. The data of the incidents reported in the Solution are encrypted. Only the Licensee (not LegalTegrity) has access to the private key required to decrypt the data.
3. The Licensee is responsible for maintaining and updating the editable texts in the Solution.
4. Both the Licensee and LegalTegrity are entitled to transfer rights and obligations under these Conditions if the reason is a change in ownership structure.
5. LegalTegrity is entitled to send e-mail notifications about the Solution to the Licensee, e.g. status information, notifications, newsletters and information about new functionalities.

D. Licence fee, payments and invoices

1. The Licensee pays LegalTegrity a Licence fee for the use of the Solution.
2. Payments are made online with a major credit card, SEPA direct debiting or services such as PayPal, etc.
3. The Licensee accepts that the payment is created as a recurring payment with the payment provider.
4. The payment will be made in euros.
5. The Licensee understands and accepts that the invoices and payment information will be stored with the payment provider Payone GmbH, based in Frankfurt am Main.
6. LegalTegrity is entitled to change the prices at its own discretion. The Licensee is to be informed of a price change. Price changes become effective from the first License period after notification.
7. If the Licensee does not pay the recurring License fee, the Licensee’s access to the Administrator portal will be blocked after a written reminder 30 days after the start of the new License period. If the Licensee has not paid the Licence fee within further 7 days, a second reminder e-mail will be sent. If the Licensee has not paid the Licence fee 45 days after the start of a Licence period, LegalTegrity is entitled to cancel the Service and delete the data stored in the Solution.
8. The Licence fees are always invoiced plus the applicable statutory VAT.

E. Package change

1. It is not possible to reduce the current Package to another Package with a lower Licence fee.
2. The Licensee may update the Package to another Package with a higher License fee at any time in the “Services” section of the Administrator portal.
3. When the Licensee upgrades a Package, the benefits of a Package change take effect immediately. Only the difference between the new higher Package price and the previous Package fee will be invoiced.

F. Support

1. Each relevant page in the Administrator portal of the Solution contains additional information on the use of the respective functionalities at the appropriate places.

2. In addition, there is a free support service which can be requested by e-mail at service@legaltegrity.com. Telephone support is also available at the telephone number given to the Licensee with the initialisation e-mail at the times specified.

G. Use and operation

1. Immediately after payment of the first License fee, the Licensee will receive an initialization e-mail to activate the Solution. The Solution can only be used after the Licensee has activated the Solution.
2. The initialization e-mail contains information required to reset the passwords of an administrator user when all administrator users have forgotten their passwords and therefore cannot log in to the Administrator portal of the Solution. It is very important that the Licensee keeps the initialisation e-mail in an appropriate manner to ensure that it is not lost or destroyed and is not disclosed to unauthorised persons.
3. If a supervisory authority – in accordance with a statutory provision – lawfully requests access to the Licensee’s data in the Solution, the Licensee is obliged to cooperate to the best of his ability in the transfer of the data to the authority.

H. Availability of the Solution

1. The solution is updated and improved every year with about three to four version updates. The most important version updates are carried out during the night (from 22.00 CET/CEST). The downtime of each major update depends on the content of the version update. Usually the downtime is not more than 60 minutes. All major version updates are announced at least 7 days before the release date to the administrator users of the Licensee of LegalTegrity who are stored in the Solution.

2. Every year a number of smaller Updates/patches are released. The downtime of these individual minor Updates/patches is not noticeable to the Licensee. The implementation of minor Updates/patches is not communicated in advance.

3. LegalTegrity ensures that the uptime is at least 95%. The availability percentage is calculated per calendar quarter.

I. Further development and correction of errors

1. LegalTegrity is continuously developing the Solution and adding new functionalities. LegalTegrity is inspired to develop new functionalities through a continuous general dialogue with the users of the Solution. LegalTegrity prioritises to what extent and in what order new functionalities are implemented.
2. The correction of significant errors begins within 12 normal working hours (CET/CEST) after the error has occurred at LegalTegrity. Troubleshooting will continue without undue delay until the error is corrected.
3. Licensee may not invoke the violation of a serious error while LegalTegrity is correcting the error, provided that LegalTegrity corrects the error within 72 hours from the time the error is reported to LegalTegrity.
4. Insignificant errors will be corrected in a small update/patch as quickly as possible, taking into account the extent to which the error affects the Solution. The Licensee may not invoke a breach of performance for minor errors.
5. The distinction between serious and insignificant errors is made exclusively by LegalTegrity. However, the following errors are always considered serious errors:
   • errors that result in the entire Solution not being available;
   • errors that result in reports not being able to be submitted in the Solution’s report portal;
   • errors that result in a user of the Licensee not being able to log on to the Administrator portal of the Solution, and
   • errors that result in the impossibility for a user of the Licensee and a whistleblower to communicate via the Solution.
6. LegalTegrity is not responsible for errors in the Solution caused by misuse or abuse of the Solution by the Licensee or third parties.
7. The Licensee is responsible for the correct configuration of the Solution for use by his organisation.

J. Security

1. LegalTegrity guarantees that the security of the Solution corresponds to the state of the art in the hosting of internet based applications. The Privacy Policy of LegalTegrity contains a list of the technical and organisational measures taken to ensure a high level of information security. The hosting provider Deutsche Telekom is ISO 27001 certified with the Open Telekom Cloud.
2. LegalTegrity is not liable for the consequences of hostile attacks on the Solution.
3. The Licensee is obliged to comply with the generally accepted safety guidelines, including (but not limited to):
   • No sharing of passwords for the Solution’s Administrator portal.
   • Login to the Administrator portal of the Solution only via secure computers with the latest antivirus/antimalware software installed.
   • Regular checking of the administrators’ accounts and blocking or updating the administrators’ accounts in case of separation from an employee or change of position of an employee.
   • In the “Download reports/processing log” section, the Licensee can download lists of activities carried out in his LegalTegrity application. This should be done on a regular basis in order to detect irregularities at an early stage.
4. A daily backup of the Solution is made and this backup is stored for 30 days and then automatically deleted. A monthly backup is created at the end of each month. This monthly backup is kept for three years and then deleted.
5. If the Licensee requests LegalTegrity to back up his data, this request must be made in writing to LegalTegrity. The costs for this are to be paid separately and amount to 300 euros plus the respective statutory VAT for the separate backup of the data, insofar as the cause of the data backup is not attributable to LegalTegrity.

K. Processing of personal data

1. The processing of personal data is regulated by the Privacy Policy of LegalTegrity.
2. The Solution is configured to comply with the requirements of EU legislation on the processing of personal data (GDPR). Passwords (to the Administrator portal and to the whistleblower’s mailbox) must be at least 8 characters long, contain a mixture capital and small letters and contain at least one digit. Access to the Solution will be suspended for 5 minutes after 10 consecutive unsuccessful login attempts.
3. The Licensee is obliged to ensure the secrecy of passwords and user names.

V. Final provisions

1. The Conditions apply automatically from the moment the Licensee places an order for the Service on the LegalTegrity portal.
2. Amendments and supplements to this agreement must be in writing to be effective and must be accepted by all Parties. This also applies to the amendment of this provision. Section 305b of the German Civil Code (Bürgerliches Gesetzbuch – BGB) remains unaffected.
3. The Conditions may be changed by LegalTegrity at any time at its sole discretion with effect from the next License period.
4. The Licensee will be notified of significant changes to the Conditions by e-mail to the e-mail address provided by the Licensee in the “Services” section of the Administrator portal.
5. The updated Conditions can be downloaded at any time from https://legaltegrity.com/legal. LegalTegrity’s Privacy Policy can be downloaded at https://legaltegrity.com/datenschutz.
6. Exclusive place of jurisdiction for all disputes arising from or in connection with this agreement is Frankfurt am Main.
7. Should individual provisions of this agreement be subject to interpretation or supplementation in whole or in part, the interpretation or supplementation shall be made in such a way that the spirit, content and purpose of this agreement is best served. The provisions which the Parties would reasonably have agreed upon if they had considered the need for interpretation or supplementation of the relevant provision when concluding this agreement shall apply. Should this agreement contain a gap in the provisions, the above Section V.7. shall apply accordingly.
8. Each Party shall bear its own costs, unless otherwise provided for in this agreement.
9. This agreement and its interpretation are subject exclusively to German law.