Customer Terms

1. About these terms

1.1 These Customer Terms apply when an organisation (the Customer) subscribes to the hosted Opencomplai service, on a paid plan, a pilot, a trial or the free plan. The service is provided by OpencomplAI Ltd, a company registered in England and Wales with company number 17546179, whose registered office is at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ (we, us).

1.2 The Agreement is made up of: (a) the Order Form signed by both parties, if any; (b) these Customer Terms; and (c) our Data Processing Agreement published at opencomplai.com/dpa (the DPA).

1.3 If there is a conflict, this order of precedence applies: (a) the DPA, for anything about the processing of personal data; (b) the Order Form; (c) these Customer Terms. Our website Terms & Conditions do not apply to the hosted service except where these Customer Terms say so.

1.4 The Agreement starts when the Order Form is signed or, for the free plan, when the Customer first accepts these Customer Terms in the service. The person accepting confirms that they are authorised to bind the Customer.

1.5 The hosted service is for businesses only. It is not offered to consumers.

2. Definitions

2.1 In these Customer Terms:

(a) Authorised Users means the Customer’s employees and contractors whom the Customer allows to use the Service.

(b) Customer Data means data the Customer or its Authorised Users submit to the Service, including evidence artifacts sent from the Customer’s CI pipelines.

(c) Documentation means our user documentation at docs.opencomplai.com, as updated from time to time.

(d) Fees means the fees set out in the Order Form.

(e) Open-Source Software means the Opencomplai CLI, SDK and rules engine licensed under the AGPL-3.0 License.

(f) Service means the hosted Opencomplai dashboard at app.opencomplai.com and its APIs, including the ingestion API, as described in the Order Form and the Documentation.

(g) Subscription Term means the period stated in the Order Form, as renewed under clause 8.

3. The Service

3.1 We will provide the Service to the Customer during the Subscription Term, materially in accordance with the Documentation and with reasonable skill and care.

3.2 The Customer may allow its Authorised Users to use the Service, up to any limits in the Order Form, for its internal business purposes only.

3.3 We may improve and change the Service. We will not make a change that materially reduces the core functionality of the Service the Customer has paid for during its current Subscription Term.

3.4 Features we label as beta, preview or early access are provided as is and may change or be withdrawn.

3.5 The Open-Source Software is licensed under the AGPL-3.0 License, not under these Customer Terms. The Service itself is proprietary software and is not licensed under the AGPL-3.0 License.

4. Free plan, trials and pilots

4.1 The free plan and free trials are provided as is and may be changed, suspended or withdrawn. We will give at least 30 days’ notice before withdrawing the free plan or ending a trial early, so the Customer can export its data.

4.2 A pilot is a paid subscription on the terms set out in its Order Form, which may include a pilot period, success criteria and conversion terms.

4.3 Our total liability for the free plan and free trials is limited as set out in clause 15.4.

5. Customer responsibilities

5.1 The Customer is responsible for: (a) its Authorised Users’ use of the Service and their compliance with the Agreement; (b) keeping API keys, signing keys and Authorised Users’ email accounts secure; (c) the accuracy and lawfulness of Customer Data; and (d) its own compliance decisions.

5.2 The Customer must not, and must ensure its Authorised Users do not:

(a) use the Service unlawfully or to infringe anyone’s rights;

(b) attempt to gain unauthorised access to the Service or other customers’ data, or circumvent its security or access controls;

(c) place unreasonable load on the Service, including by automated or bulk use inconsistent with the Documentation;

(d) resell or sublicense the Service, or use it to build or support a competing product or service;

(e) submit special category personal data or personal data relating to criminal convictions and offences; or

(f) introduce malicious code into the Service.

6. Fees and payment

6.1 The Customer will pay the Fees in the amounts and at the times set out in the Order Form. Unless the Order Form says otherwise, we will invoice annually in advance and invoices are payable within 30 days of the invoice date.

6.2 Fees are in pounds sterling and exclude VAT and other taxes, which the Customer will pay where they apply.

6.3 If an undisputed invoice is more than 14 days overdue, we may charge interest under the Late Payment of Commercial Debts (Interest) Act 1998 and, after giving 10 days’ written notice, suspend the Service until payment is made.

6.4 We may change the Fees with effect from a renewal by giving at least 60 days’ notice before the end of the current Subscription Term.

6.5 Fees are non-refundable except where these Customer Terms or the DPA expressly provide for a refund.

7. Suspension

7.1 We may suspend access to all or part of the Service if: (a) the Customer’s use breaches clause 5.2; (b) suspension is needed to protect the security or integrity of the Service or other customers; or (c) clause 6.3 applies.

7.2 We will give notice and, where practical, a chance to fix the issue before suspending, limit the suspension to what is reasonably needed, and restore access promptly once the cause is resolved.

8. Term, renewal and termination

8.1 Each paid Subscription Term renews automatically for a further period equal to the initial term, or 12 months if shorter, unless either party gives at least 30 days’ written notice before the end of the current term. A pilot does not renew automatically unless its Order Form says so.

8.2 Either party may terminate the Agreement immediately by written notice if the other: (a) commits a material breach that is not remedied within 30 days of written notice; or (b) becomes insolvent, enters administration or liquidation, or makes an arrangement with its creditors.

8.3 The Customer may terminate the free plan at any time by closing its organisation in the Service.

8.4 When the Agreement ends: (a) the Customer’s right to use the Service ends; (b) the Customer may export Customer Data for 30 days using the export feature or by asking us; and (c) we will then delete Customer Data in accordance with section 9 of the DPA.

8.5 If the Customer terminates under clause 8.2, or under section 6.3 of the DPA, we will refund any prepaid Fees for the period after termination.

8.6 Clauses 6 (for unpaid Fees), 8.4, 8.5, 11 to 15 and 17 survive termination.

9. Reserved

10. Data protection and security

10.1 The DPA forms part of the Agreement and governs our processing of personal data in Customer Data.

10.2 We will maintain the technical and organisational measures described in Annex 2 of the DPA, and notify the Customer of a personal data breach as set out in section 8 of the DPA.

10.3 We will not use Customer Data to train artificial intelligence models, and will not sell Customer Data.

10.4 We may collect aggregated statistics about use of the Service that contain no Customer Data and do not identify the Customer or any individual, and use them to operate and improve the Service.

11. Intellectual property

11.1 We and our licensors own all rights in the Service, the Documentation and our brand. The Customer receives only the rights expressly granted in the Agreement.

11.2 The Customer owns Customer Data and the reports and evidence artifacts the Service generates from it. The Customer grants us a non-exclusive licence to host, process and display Customer Data only to provide and support the Service under the Agreement and the DPA.

11.3 If the Customer gives us feedback, we may use it without restriction or payment, provided we do not identify the Customer.

12. Confidentiality

12.1 Each party will keep the other party’s confidential information confidential, use it only to perform or receive the Service, and disclose it only to its employees, contractors and advisers who need to know it and are bound by equivalent duties.

12.2 Confidential information does not include information that is or becomes public through no breach, was already lawfully known to the recipient, is independently developed, or is received lawfully from a third party.

12.3 A party may disclose confidential information where required by law or a regulator, giving the other party prompt notice where the law allows.

13. Warranties and no legal advice

13.1 Each party warrants that it has full power and authority to enter into the Agreement.

13.2 The Service supports the Customer’s compliance work. Its classifications, gap reports, evidence artifacts and other outputs are heuristic, are not legal advice, and are not a conformity assessment or a declaration of conformity under the EU AI Act or any other law. The Customer remains responsible for its own compliance decisions.

13.3 Except as expressly set out in the Agreement, all warranties, conditions and terms implied by law are excluded to the extent permitted by law. We do not warrant that the Service will be uninterrupted or error-free.

14. Indemnities

14.1 We will defend the Customer against any third-party claim that the Service, used in accordance with the Agreement, infringes that third party’s UK intellectual property rights, and pay damages and costs finally awarded or agreed in settlement.

14.2 Clause 14.1 does not apply to claims arising from Customer Data, the Customer’s modification of the Service, its combination with anything we did not provide, the Open-Source Software, or the free plan or trials. If a claim is made or likely, we may modify or replace the Service so it is non-infringing, obtain a licence, or terminate the affected Service and refund prepaid Fees for the remaining term.

14.3 The Customer will defend us against any third-party claim arising from Customer Data or the Customer’s breach of clause 5.2, and pay damages and costs finally awarded or agreed in settlement.

14.4 The indemnified party must promptly notify the other of the claim, let it control the defence and settlement, and give reasonable cooperation at its cost.

15. Limitation of liability

15.1 Nothing in the Agreement limits or excludes liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, the Customer’s obligation to pay Fees, or any liability that cannot be limited or excluded by law.

15.2 Neither party is liable for any indirect or consequential loss, or for loss of profits, revenue, business, goodwill or anticipated savings, whether direct or indirect.

15.3 Subject to clauses 15.1 and 15.2, each party’s total liability arising out of or in connection with the Agreement in each 12-month period from the start of the Agreement is limited to the Fees paid and payable in that period.

15.4 For the free plan and free trials, our total liability is limited to £100.

16. Regulated customers

16.1 Where the Customer is a regulated financial entity, we will cooperate reasonably with the Customer’s competent authorities in connection with the Service and support the audit and information rights in section 10 of the DPA.

16.2 If the Customer is subject to Regulation (EU) 2022/2554 (DORA) or similar outsourcing rules, we will agree a regulated customer addendum on request. Where it applies, that addendum takes precedence over these Customer Terms.

17. General

17.1 Changes to these Customer Terms. We may update these Customer Terms by giving at least 30 days’ notice. A change that materially disadvantages the Customer does not apply to a paid plan during its current Subscription Term without its written agreement.

17.2 Assignment and subcontracting. Neither party may assign the Agreement without the other’s consent, not to be unreasonably withheld, except to a successor in a merger, acquisition or sale of substantially all of its relevant assets. We may use subcontractors and sub-processors, subject to the DPA, and remain responsible for them.

17.3 Force majeure. Neither party is liable for delay or failure caused by events beyond its reasonable control. If such an event prevents performance for more than 60 days, either party may terminate on written notice.

17.4 Notices. Notices must be in writing and sent by email to the notice contact in the Order Form or, for us, to legal@opencomplai.com. Notices of breach or termination must also be sent to the other party’s registered office.

17.5 Entire agreement. The Agreement is the entire agreement between the parties about its subject matter. Each party confirms it has not relied on any statement not set out in the Agreement.

17.6 Third parties. No one other than the parties has any right to enforce the Agreement under the Contracts (Rights of Third Parties) Act 1999.

17.7 Severance and waiver. If any provision is invalid, the rest remains in force. A failure or delay in exercising a right is not a waiver of it.

17.8 Publicity. Neither party may use the other’s name or logo in marketing without its prior written consent.

17.9 Governing law and jurisdiction. The Agreement and any dispute arising from it, including non-contractual disputes, are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.