Terms of Service

These Terms of Service (Terms) govern the supply and professional use of the legiscope.com software-as-a-service platform and related services. Legiscope means the legiscope.com platform operated by Legiscope UAB, company code 304581221, registered at Laisvės pr. 60-1107, LT-05120 Vilnius, Lithuania. Legiscope UAB is the provider and contracting party; a reference in these Terms to Legiscope performing, owing or enforcing an obligation means Legiscope UAB acting as operator of the platform. Customer means the business, public body or other organisation identified in the Order Form. Legiscope UAB and the Customer are each a Party and together the Parties.

The object of the Agreement is to provide the Customer a hosted, customer-controlled workspace for maintaining privacy and data-protection governance records, coordinating supported workflows, reviewing evidence, using enabled AI-assisted operations and exporting Customer records within the purchased Plan and Limits.

The Service supports the Customer’s work; it does not assume the Customer’s legal responsibilities. The Agreement is exclusively for professional business use. It is not offered to consumers, and each signatory represents that they are authorised to bind the identified Party.

The Agreement consists only of: (a) the Order Form that defines the details of the Services puchased; (b) the version of these Terms identified in it, including the Plan Matrix contained in these Terms; and (c) the Data Processing Agreement (DPA) as published at www.legiscope.com/dpa.html at acceptance, where Legiscope processes Customer Personal Data.

Legiscope issues the final Order Form and the Parties form the Agreement when an authorised representative of each Party accepts it through an agreed electronic-signature, a verified Stripe-hosted order flow or another written method that preserves the accepted terms. The Agreement takes effect on the later acceptance date (Effective Date) unless the Order Form states a different date. Legiscope is not required to activate paid production access before formation.

The Order Form prevails over these Terms only for commercial scope or a provision that the Order Form expressly identifies as a negotiated deviation. The DPA prevails for processing Customer Personal Data and contains the controlling position for any restricted transfer in its scope. A purchase order is administrative only and does not amend the Agreement.

Legiscope retains the accepted Order Form, reproducible copies and SHA-256 hashes of the identified Terms and DPA, and available acceptance evidence. Each Party receives or can retain a complete copy. A Stripe quote, invoice, subscription record, payment request or receipt is billing or acceptance evidence only and does not become a fourth contractual document or amend the Agreement. An amendment must be accepted by authorised representatives; operational email, support correspondence and use of a later website version do not amend the Agreement.

• Affected Service means the purchased workflow, feature or professional service directly affected by the relevant event. A refund or credit uses the fee allocated to that Affected Service in the Order Form. Where the Order Form does not allocate a separate fee, the Parties will use the applicable standalone price or, if none exists, a reasonable allocation based on the scope and value of the Affected Service relative to the total annual subscription fee.
• Agreement means the three-document contract described in “Agreement, formation and precedence”.
• Authorised User means a named individual whom the Customer authorises to use the Service for the internal professional purposes of the Customer or an Authorised Affiliate.
• Business Contact Data means professional identity, authority, contact, billing, support-administration, service-security and proportionate operational information that Legiscope processes for its own contracting, relationship-management, legal-compliance, platform-security, engineering, maintenance and reliability purposes described in the independent-controller activity register in these Terms.
• Business Day means a day other than Saturday, Sunday or a Lithuanian public holiday.
• Contract Year means each consecutive 12-month period beginning on the Service Start Date or its anniversary.
• Authorised Affiliate means a Customer Affiliate expressly identified in the Order Form as permitted to participate in a Managed Programme. Customer Affiliate means a legal entity that controls, is controlled by or is under common control with the Customer.
• Customer Content means data, records, documents, files, prompts, instructions, configurations and other material submitted to or stored in the Service for the Customer, including Customer Personal Data.
• Customer Personal Data means personal data that Legiscope processes on the Customer’s behalf under the DPA. Business Contact Data is excluded only to the extent Legiscope determines its own distinct purposes and essential means for contracting, billing and commercial metering, relationship administration, platform-wide security, abuse prevention, platform engineering, maintenance, reliability or legal compliance as described in the independent-controller activity register in these Terms. That exclusion does not permit Customer Content to be repurposed as controller data.
• Limits means the applicable programme, AI funding amount, feature, integration, service and other entitlements stated in these Terms and the Order Form.
• Managed Programme means one independently administered controller or processor accountability boundary with its own authorised scope, permissions and exportable records.
• Order Form means the concise sales record accepted by the Parties that identifies the Customer, any Authorised Affiliates, Plan, Limits, enabled non-standard scope, annual price, total fixed-term commitment, Subscription Term, Service Start Date and the controlling Terms version.
• Output means a report, draft, structured record, analysis or other result generated for the Customer through the Service.
• Plan means Mini, Organisation, Group, Assurance, Enterprise or a successor plan expressly selected in the Order Form.
• Security Incident means an actual or reasonably suspected accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to Customer Content, or a material compromise of its availability. A personal data breach affecting Customer Personal Data is governed by the DPA and does not require confirmation before the DPA notification obligation begins.
• Service means the hosted Legiscope platform, documentation, support and any implementation or professional service expressly included in the Order Form.
• Subscription Term means the fixed 12-, 36- or 60-month initial term and each 12-month renewal term unless the Order Form expressly states another negotiated renewal period.
• AI Funds means the EUR-denominated amount made available in the Customer wallet for eligible AI-assisted operations. AI Funds are a contractual service-use entitlement, not a deposit, payment account, electronic money or redeemable stored-value product.

Subject to payment and compliance with the Agreement, Legiscope grants the Customer a limited, non-exclusive, non-transferable right during the Subscription Term to permit its Authorised Users and those of each Authorised Affiliate to access and use the Service for their internal professional purposes within the selected Plan and Limits. The Customer remains responsible for every Authorised Affiliate and its users as for its own acts and omissions. An Authorised Affiliate receives no independent enforcement right unless the Order Form expressly makes it a Party.

Legiscope supplies the standard Service remotely. Implementation, migration, onboarding, SSO or API configuration, a security review, a contractual service level and any other professional service apply only to the extent fully described in the Order Form, including the deliverable, assumptions, Customer dependency, included effort and fee. Before professional services involving Customer Personal Data begin, the Order Form itself must include a processing-instructions schedule for that engagement. The schedule states the subject matter, duration, purpose, processing operations, data-subject and personal-data categories, access scope, deliverables, return or deletion rule and any additional subprocessor or transfer. Where an existing DPA activity card already fully describes the work, the Order Form may identify that card instead of restating those particulars.

A preview, prototype, beta, evaluation feature or marketing reference is not a contractual commitment unless the Order Form expressly includes it. Legiscope may withdraw a non-contracted preview at any time.

Within the purchased configuration, the core Service supports the following workflows:

• Records of processing activities (RoPA): maintain Customer-supplied Article 30 information, connect supported records, identify deterministically missing fields and export the authorised scope. Legiscope does not invent missing facts or certify the register.
• Applications: maintain an application inventory, connect applications to compatible activities, processor relationships and evidence, and use an enabled, explicit import workflow. Legiscope does not promise continuous discovery, complete coverage or security certification.
• Processor relationships: maintain and reference authorised relationship records. A relationship record is not a complete Article 28 assessment, DPA approval or independent legal conclusion.
• Personal data breaches: organise incident facts, assessments, actions and supported notification drafts and display the supported 72-hour signal where applicable. Legiscope does not decide whether notification is legally required or transmit a notice to an authority or data subject.
• Data-subject rights: maintain Customer-entered request facts, request type, status and a limited ordinary timing signal. The Service does not verify identity, classify the applicable right or exceptions, prepare the response or deliver it.
• Audits and evidence: maintain supported checklists, human conclusions, source documents and evidence provenance. Upload, completion or AI processing does not prove sufficiency, authenticity, remediation, compliance or certification.
• Roadmap: maintain a simple organisation-scoped list of Customer-created actions, priorities and open or completed status. It does not include unlisted project-management or autonomous-execution functions.

Eligible AI-assisted operations consume AI Funds in EUR. Before an operation begins, the Service displays or otherwise communicates its estimated EUR use and any applicable maximum. The amount shown when the Authorised User starts the operation governs that operation; actual use may be lower but cannot exceed the displayed maximum. A result unusable because of a Legiscope or provider failure, and an automatic system retry, does not consume AI Funds.

The Service maintains a customer-visible task-level usage record identifying the operation, time and EUR amount for Customer verification, account use, export and exit. Separately, Legiscope maintains the authoritative commercial AI-funding and usage ledger for wallet administration, reconciliation, invoicing, commercial-abuse prevention and dispute handling. Legiscope will provide an account statement on reasonable request. The Customer must raise a specific usage dispute within 30 days after the relevant statement is supplied; Legiscope will investigate and correct a verified error, but the Customer cannot instruct alteration of an accurate commercial or statutory record. Legiscope will not make a materially adverse change to the charging method during a committed Subscription Term without an accepted Order Form amendment.

The annual AI funding amount is credited for each Contract Year. Unused AI Funds, including separately purchased AI Funds unless the Order Form states otherwise, remain available in later Contract Years while the same subscription continues, including through a renewal. They do not expire solely because the Agreement ends. The unused balance becomes dormant when access ends and is reactivated and carried into a new Agreement if the same Customer later enters a new Legiscope subscription. AI Funds are not transferable to another customer and have no cash, refund or redemption value.

When the AI Funds balance reaches zero, new funded AI-assisted operations pause. Authorised Users retain access to existing records and supported manual workflows, reports, exports, switching and deletion controls. There is no automatic top-up or automatic overage charge. Additional AI Funds require the Customer’s accepted Order Form amendment or renewal.

A suspension or the end of the Agreement prevents use of AI Funds while no active subscription exists but does not cancel the recorded unused balance. The balance may be used only after reactivation under a new Agreement with the same Customer.

The Service has no public self-registration flow. Within five Business Days after the Agreement takes effect and Legiscope receives the complete provisioning information reasonably required, Legiscope creates the Customer tenant and the initial Customer Administrator account identified in the Order Form and provides a secure activation method. An Authorised User cannot create an independent Customer subscription merely by accessing a sign-in page.

Additional accounts are provisioned by Legiscope on an authorised administrator’s instruction or by the Customer Administrator where the relevant administration function is enabled. Customer Administrators may give operational instructions for user access, roles, organisation scope and integrations on the Customer’s behalf. The Customer must keep the administrator contact current and promptly request removal or restriction when access is no longer authorised.

Each account is for one named individual. Credentials and authentication factors must not be shared. The Customer must maintain appropriate endpoint security and promptly notify Legiscope of suspected compromise. The Customer is responsible for activity through its accounts except to the extent caused by Legiscope’s breach of the Agreement.

For its independent contracting and platform-security purposes under APP-C01 and APP-C03, Legiscope may require reasonable identity, authority, domain or security verification before provisioning or changing privileged access. Legiscope may refuse an instruction where the requester’s authority cannot reasonably be established. The Customer’s underlying choice of its tenant users, roles, permissions and authentication configuration remains processor activity under APP-P01.

The Customer determines the purposes of its privacy programme and remains responsible for the lawfulness, accuracy, completeness and quality of Customer Content, its users’ instructions and its configuration. It must provide required notices and obtain the rights, authorisations and lawful bases needed for Customer Content, integrations and selected workflows. This allocation does not reduce Legiscope’s processor obligations under the DPA.

The Customer and its Authorised Users must not:

• use the Service unlawfully, infringe another person’s rights or submit content the Customer is not authorised to process;
• share accounts, bypass access or usage controls, or use the Service outside the purchased programme scope;
• upload malware or attempt unauthorised access, disruption, probing, extraction or circumvention, except for an audit or security test expressly permitted by the DPA or a specific written agreement with Legiscope;
• resell, sublicense, provide service-bureau access, reverse engineer or extract non-public software, models, system prompts, reusable prompt templates, security controls or platform components except where mandatory law permits;
• unlawfully scrape personal data or infringe database, confidentiality or intellectual-property rights;
• use the Service for deceptive, discriminatory or unlawful surveillance, a prohibited AI practice or an Annex III or other legally high-risk purpose unless the Order Form expressly identifies the intended purpose and the Parties have implemented every mandatory control applicable to their roles; written approval can never authorise a prohibited practice;
• submit special-category or criminal-conviction data without an applicable Article 9(2) or Article 10 condition and any required sector-specific authorisation, or outside a workflow and provider route permitted by the Order Form or documented configuration — the sensitive-data conditions in the DPA’s Annex II are conditions of use of the Service; or
• remove provenance, AI, safety, legal or rights notices supplied with an Output.

Where an identified workflow enables AI, an Authorised User may instruct Legiscope to send the minimum necessary Customer Content, task instructions and workflow context through a centrally controlled commercial AI route. Any authorised AI provider may be used for any AI-assisted operation; Legiscope determines provider and model selection according to feature, availability, security, location, capability, quality, cost and risk controls.

Customer Content must not be used to train, fine-tune or improve a general-purpose or cross-customer model or pooled into a cross-customer training dataset. Legiscope will use and configure authorised commercial AI providers under terms that prohibit that use. A provider route that cannot meet this restriction must not be enabled for Customer Content. Provider processing remains subject to the DPA, the authorised subprocessor position and applicable commercial service controls.

AI Output is probabilistic. It may be inaccurate, incomplete, inconsistent, fabricated, biased, outdated, non-unique or affected by an incomplete source, ambiguous instruction or model limitation. It may omit a legal issue or misstate a fact, citation, relationship, deadline or conclusion. Legiscope does not warrant that AI Output is protectable, exclusive or free from every third-party right.

AI Output is draft decision-support material. It is not legal advice, an official finding, a certification or a guarantee of compliance. The Customer must verify it against the original evidence, current authoritative sources and applicable law, correct material errors and obtain competent human approval before adopting or communicating a legally significant result.

The Customer must not use an AI Output as the sole or determinative basis for a decision producing legal or similarly significant effects on a person. As deployer of an enabled AI feature to the extent that role applies, the Customer must use it only for its stated purpose, apply proportionate human oversight, take appropriate measures to support the development of AI literacy among relevant personnel, give any deployer-side or public transparency required by applicable law, and avoid prohibited or unsupported high-risk uses. Legiscope may restrict an AI operation that appears inconsistent with these conditions.

To the extent the EU AI Act assigns those roles to the relevant operation, Legiscope is the provider of the application-level AI system, the Customer is its deployer, and the selected commercial model provider is an upstream general-purpose AI model provider rather than the provider of the Legiscope application. Role classification remains determined by applicable law and the facts of the operation.

Legiscope remains responsible for the provider, downstream-provider and Article 50 transparency obligations that applicable law assigns to its role. For a relevant feature, this includes informing a person that they are interacting with AI and making AI-generated or manipulated output identifiable or machine-readable where required, together with technical information and support for AI literacy. The prohibited-practice, AI-literacy and applicable transparency controls are current requirements; Legiscope does not support an Annex III or regulated-product high-risk deployment unless the Order Form identifies the intended purpose and the Parties separately establish every mandatory control when it becomes applicable to their respective roles.

Templates, checklists, suggested fields, examples, timing signals, articles and Output provide structured information for professional review. They are not tailored legal advice and do not establish an attorney-client, avocat-client or equivalent professional relationship.

Legiscope does not warrant that a template or workflow covers every rule, exception, fact or jurisdiction relevant to the Customer. The Customer remains responsible for selecting competent legal, DPO, security and other professional advice where appropriate and for every decision, filing, notification and communication made in its name.

Included onboarding is limited to the time and scope stated for the selected Plan and is delivered during the first 30 days after usable production access, unless Customer delay requires later coordination. Migration, bespoke configuration and additional assistance are chargeable only when included in an accepted Order Form or amendment. The Service Start Date cannot precede usable production access unless access is delayed by the Customer’s missing information, dependency or instruction.

Standard support is available by the published support channel on Business Days from 09:00 to 17:00 Europe/Vilnius time. The initial response target for the selected Plan is stated in the Plan Matrix. It is a response target, not a resolution guarantee, availability commitment or service-credit term.

Legiscope may maintain, improve and change the Service. During a committed Subscription Term it will not materially reduce the core functionality purchased by the Customer without reasonable advance notice. If a reduction causes material, continuing harm and Legiscope offers no reasonable alternative within 30 days after notice from the Customer, the Customer may terminate the Affected Service and receive a pro-rata refund of prepaid fees for the period after termination.

The Order Form states the annual fees, total fixed-term commitment, currency, billing contact, Service Start Date and any one-off fees. Subscription fees are invoiced annually in advance at the beginning of each Contract Year even where the fixed Subscription Term is longer than one year. Legiscope may issue and administer orders, subscriptions, invoices and payments through Stripe. An accepted Stripe quote or order may evidence formation; a Stripe subscription, invoice, payment request or receipt is administrative billing evidence only. No Stripe record changes the fixed term, price or scope stated in the accepted Order Form. Fees exclude VAT and other applicable taxes unless expressly stated otherwise.

An invoice is due on the date stated in the Order Form or, if none is stated, 14 calendar days after issue. The Customer must pay without set-off or deduction except where mandatory law permits. A good-faith invoice dispute must be notified promptly with reasonable detail; the Customer must pay the undisputed portion on time, and the Parties will address the disputed portion in good faith.

Legiscope may charge statutory late-payment interest, the fixed EUR 40 recovery compensation available without reminder under Lithuanian law and reasonable recovery costs exceeding that amount on an overdue undisputed amount. Persistent non-payment may result in proportionate suspension and, after the applicable cure period, termination.

Except for an express pro-rata remedy in the Agreement, fees are non-cancellable and non-refundable. A Plan upgrade or additional AI Funds purchase during a Subscription Term requires an accepted Order Form amendment. A downgrade takes effect only at renewal if agreed before the applicable non-renewal deadline.

The initial Subscription Term begins on the Service Start Date and is the fixed duration selected in the Order Form: 12 months, 36 months or 60 months. The 60-month option is a firm five-year commitment. It does not contain a year-three exit right or a shorter minimum commitment.

After the initial fixed term, the Subscription Term automatically renews for successive 12-month periods unless the Order Form expressly states another negotiated renewal period or either Party gives the other at least 90 days’ written notice of non-renewal before the current term ends. A notice of non-renewal does not terminate the current committed term.

The annual subscription price is fixed during the initial committed Subscription Term. Legiscope may propose a different price for a renewal only by giving at least 120 days’ written notice before the current term ends. If it gives no timely notice, the existing annual subscription price continues for the next 12-month renewal, excluding agreed scope changes and taxes.

As between the Parties, the Customer retains its rights in Customer Content. Customer-submitted prompts and instructions are Customer Content, and Legiscope claims no ownership of them. The Customer grants Legiscope and its authorised subprocessors a non-exclusive licence during the Agreement to host, copy, transmit, organise, analyse, transform, display, generate Output from, export, secure, support and delete Customer Content only as needed to perform the Agreement and documented Customer instructions.

Legiscope and its licensors retain all rights in the Service, software, interfaces, documentation, reusable templates, methodology, model routing, system prompts, reusable prompt templates, designs and underlying technology. After payment of the applicable fees, Legiscope grants the Customer a perpetual, non-exclusive right to use, copy, modify and share Customer-specific Output for the business, governance and compliance purposes of the Customer and its Authorised Affiliates, including with their advisers, auditors, authorities and clients. Any embedded reusable Legiscope element remains licensed, not assigned, and may not be extracted or commercialised separately.

AI Output may resemble material produced for another user because models can generate similar results from similar inputs. No ownership warranty is given for material that applicable law does not protect. The Customer remains responsible for reviewing third-party rights before publication or commercial reuse.

Legiscope may use service metrics that are aggregated and irreversibly anonymised so that they identify neither a person nor the Customer, solely to operate, secure, measure and improve the Service. Legiscope may use feedback to improve its services, but feedback does not authorise disclosure of the Customer’s identity, Customer Content, personal data or other Confidential Information.

Confidential Information means non-public business, technical, security, commercial or personal information disclosed by or for a Party that is marked confidential or should reasonably be understood as confidential. Customer Content and the non-public Service architecture are Confidential Information. Confidential Information excludes information the recipient can demonstrate was lawfully known without restriction, becomes public without breach, is independently developed without use of it, or is lawfully received from a third party without a duty of confidence.

The recipient will use Confidential Information only to perform or exercise rights under the Agreement, protect it with at least reasonable care, and disclose it only to personnel, professional advisers and providers who need it and are bound by appropriate confidentiality duties. A legally required disclosure is permitted after advance notice where law allows and with reasonable cooperation to limit the disclosure.

On request or when the Agreement ends, the recipient will return or delete the other Party’s Confidential Information unless the Agreement or law permits retention. The confidentiality duty continues for five years after disclosure or termination, whichever is later; trade secrets remain protected while legally qualifying as trade secrets, and personal data remains protected for the period required by the DPA and applicable law.

Where Legiscope processes Customer Personal Data on documented instructions, it acts as processor or subprocessor, as applicable. The DPA exclusively describes the processor and subprocessor activities, their activation, processing particulars, authorised subprocessors, transfers, security, assistance, audits, personal data breaches, return, restorability and deletion. Those activities are not repeated as a second register in these Terms.

Only DPA activities applicable to the purchased Plan, enabled configuration, Order Form and Authorised User instructions are performed. Customer-directed transactional email is not a current standard activity and is not included unless the capability is implemented and contractually activated under the DPA.

For the activities in this register, Legiscope UAB, company code 304581221, Laisvės pr. 60-1107, LT-05120 Vilnius, Lithuania acts as an independent controller. Privacy contact: contact@legiscope.com. The register provides the activity-specific information required by Articles 13 and 14 GDPR, including the source where information is not obtained directly from the individual.

This register is limited to independent-controller activities connected with the Legiscope application, platform operations and customer relationship. Independent-controller activities concerning visitors to the public website are described separately in the Privacy Notice at https://www.legiscope.com/privacy.html and do not form part of this application register.

An individual may request access, rectification, erasure, restriction or portability where applicable and may object to processing based on legitimate interests. The individual may complain to the Lithuanian State Data Protection Inspectorate or the supervisory authority for the place of habitual residence, work or alleged infringement. These rights remain subject to the limits stated for each activity and applicable law.

The independent-controller activities are separated by purpose from Customer Personal Data processing. The same technical event may generate a tenant record processed for the Customer and a distinct, proportionate security or contract record processed by Legiscope for its own stated purpose; that does not convert Customer Content into Legiscope controller data.

The customer-visible task-level EUR usage record is processed for Customer verification, use, export and exit. The separate authoritative commercial AI-funding and usage ledger is controlled by Legiscope for wallet administration, reconciliation, invoicing, commercial-abuse prevention and dispute handling. A verified error will be corrected, but a Customer instruction cannot require alteration of an accurate commercial or statutory record.

Platform engineering and platform-wide security records include proportionate operational diagnostics, deployment and change evidence, vulnerability and threat information, privileged-access verification, infrastructure events, backup-job health, restoration tests and continuity records processed for Legiscope’s own platform purposes. Those controller records are not Customer Personal Data and do not become subject to Customer instructions, return or deletion merely because they concern operation of the Service. This separation does not reduce Legiscope’s duty under the DPA to provide information necessary to demonstrate compliance or to notify and assist the Customer where Customer Personal Data is affected.

Shared infrastructure does not determine the legal role. Customer Personal Data contained in a multi-tenant backup remains processor data protected by APP-P13 and the DPA. The Customer retains access to its Customer data through the supported Service, restoration, retrieval and export routes and may give the return and deletion instructions allowed by the Agreement. Within the agreed recovery purpose and 90-day final-purge limit, it does not administer the shared backup system or determine its technical architecture, operational timing and orchestration, encryption, replication, immutability, testing or restoration procedure; Legiscope determines those non-essential technical means as processor. Legiscope acts as controller only for distinct system-level job-health, capacity, recovery-assurance and continuity records used for its own platform operations, and it will not use backed-up Customer Content for platform development, analytics or another independent purpose.

Each Party will comply with the data-protection law applicable to its role. Where Legiscope processes Customer Personal Data on the Customer’s documented instructions, the complete DPA as published at acceptance automatically forms part of the Agreement and controls that processing. No separate DPA signature is required.

The DPA remains the controlling and complete instrument for the subject matter, duration, nature, purpose, personal-data categories, data subjects, processor and subprocessor activities, security, subprocessors, international transfers, assistance, audit, personal data breach, return and deletion obligations applicable to Customer Personal Data.

Where support, troubleshooting, tenant security, incident response, restoration or Customer-directed transactional email requires processing Customer Personal Data to operate the Customer’s tenant or respond to its instruction, Legiscope acts as processor and the DPA applies. Legiscope acts as an independent controller only for the separately defined activities in the independent-controller register for which it determines its own purposes and essential means. The same technical event may produce distinct data elements processed in different roles. The Customer must make the controller information in these Terms available to its representatives and Authorised Users where required.

Legiscope will maintain appropriate technical and organisational measures for all Customer Content, including the measures stated in the DPA, taking account of the state of the art, implementation cost, processing context and risks. The Customer remains responsible for endpoint security, user permissions, lawful configuration, downloaded exports and systems outside Legiscope’s control.

After becoming aware of a Security Incident, Legiscope will notify the Customer without undue delay and, where feasible, within 48 hours. Legiscope will not delay an initial notice until the incident is confirmed or the investigation is complete. It will describe the information then known about the nature and likely consequences, state the containment or remediation taken, provide available information needed for the Customer’s response and give material updates in phases. The DPA exclusively controls notification and assistance where Customer Personal Data is involved.

Unless the Order Form contains an express availability commitment, Legiscope does not warrant uninterrupted or error-free operation. Legiscope may perform maintenance and will give reasonable notice of planned material disruption where practicable.

The Customer may instruct the Service to exchange data with a Customer-selected third-party service. The Customer authorises the necessary exchange and is responsible for its rights, credentials and configuration. A Customer-selected destination is not a Legiscope subprocessor merely because the Customer connects it. Third-party services are governed by their own terms and may change or become unavailable.

Legiscope may suspend the affected account, function or processing when reasonably necessary to contain a material security threat, prevent unlawful use or harm, comply with law, protect another customer, or address persistent non-payment of an undisputed amount, and may require the Customer to delete data submitted in breach of the sensitive-data conditions. Legiscope will limit suspension to what is proportionate.

Where practicable, Legiscope will give advance notice, reasons and an opportunity to cure. Emergency action may be taken without advance notice where delay would create material risk or notice is legally prohibited. Legiscope will restore the affected access promptly after the cause is resolved. Fees continue during a suspension caused by the Customer’s breach or risk. The Customer receives a pro-rata credit for a suspension lasting more than five consecutive Business Days to the extent caused solely by Legiscope’s material breach.

Each Party warrants that it has authority to enter the Agreement. Legiscope warrants that it will provide the Service with reasonable professional skill and care and will materially provide the purchased workflows and services described in these Terms and the Order Form. After notice with sufficient detail, Legiscope will use reasonable efforts to correct a verified material non-conformity or re-perform the Affected Service.

If Legiscope cannot remedy a material non-conformity within a reasonable period, the Customer may terminate the Affected Service and receive a pro-rata refund of prepaid subscription fees for the period after termination. This remedy does not exclude a right that cannot lawfully be limited.

Except for the express warranties and to the maximum extent permitted by law, the Service is supplied on an as-available basis. Legiscope does not warrant that every error, risk, deadline, legal issue or compliance gap will be detected, that every source is accurate or current, or that use of the Service makes the Customer compliant with law.

Legiscope will defend the Customer against a third-party claim that authorised use of the paid Service infringes that third party’s intellectual-property right and will pay reasonable external defence costs, damages finally awarded and amounts included in a settlement Legiscope approves. Legiscope may obtain the right to continue use, modify or replace the affected element, or terminate the Affected Service and refund prepaid fees for the period after termination. An exclusion applies only to the extent the claim is caused by Customer Content or specifications, an unlawful Customer instruction not required for authorised standard use, an unauthorised change or combination, use outside the Agreement, or continued use after Legiscope provides a non-infringing replacement or notice to stop.

The Customer will defend Legiscope against a third-party claim to the extent caused by Customer Content, an unlawful Customer instruction, the Customer’s legally significant use of an Output without the human review expressly required by the Agreement, or the Customer’s material breach of the acceptable-use conditions, and will pay damages finally awarded or included in a settlement the Customer approves. This indemnity does not apply to the extent the claim is caused by a defect in the Service, Legiscope’s breach of the Agreement or an act for which Legiscope is responsible.

The indemnified Party must give prompt notice and reasonable cooperation and must allow the indemnifying Party to control the defence with competent counsel, provided that delay reduces the obligation only to the extent it materially prejudices the defence. The indemnified Party may participate at its own cost. No settlement may admit fault by or impose a non-monetary obligation on the indemnified Party without its prior consent, not to be unreasonably withheld.

To the maximum extent permitted by law, neither Party is liable for indirect or consequential loss or for loss of profit, revenue, anticipated savings or goodwill. This exclusion does not remove liability for amounts payable under a covered third-party claim or reasonable direct costs of restoring Customer Content and responding to a confidentiality, security or data-protection breach to the extent caused by the liable Party.

Subject to the enhanced cap and uncapped matters stated in this Liability provision, each Party’s total aggregate liability for all claims first arising in a Contract Year is limited to the subscription fees paid or payable under the affected Order Form for that Contract Year. A claim arising on or after the Effective Date but before the first Service Start Date is treated as arising in the first Contract Year. Claims arising from the same or related events are treated as one claim arising when the first such event occurred.

For breach of confidentiality, breach of the DPA, breach of the contractual security obligations and Legiscope’s intellectual-property indemnity, the liable Party’s aggregate cap is the greater of: (a) two times the amount used to calculate the general cap; and (b) EUR 50,000. This enhanced cap is not additional to the general cap; the higher applicable cap replaces it for those claims.

A regulatory fine or penalty is recoverable between the Parties only to the extent applicable law permits that allocation and only to the extent caused by the other Party’s breach of the Agreement or applicable law. Nothing in the Agreement transfers a statutory responsibility that cannot lawfully be transferred.

No exclusion or cap applies to agreed fees, the Early Termination Charge stated in “Data Act switching and exit”, fraud or fraudulent misrepresentation, wilful misconduct, gross negligence, death or personal injury caused by negligence, or liability that cannot lawfully be excluded or limited. Nothing limits a data subject’s rights or a supervisory authority’s statutory powers.

Either Party may terminate the Agreement for the other Party’s material breach if the breach is not cured within 30 days after written notice describing it. The notice may state that termination takes effect automatically when the cure period expires; otherwise a final termination notice is required. Termination may be immediate where a material breach cannot be cured, continued performance is unlawful, or applicable law expressly permits immediate termination. An insolvency or restructuring termination right applies only to the extent permitted by mandatory law.

The Customer has no contractual right to terminate for convenience before the fixed Subscription Term ends. The selected 12-, 36- or 60-month initial term remains binding, subject only to the express fault-based remedies in the Agreement and rights that mandatory law does not permit the Parties to exclude.

If the Customer terminates for Legiscope’s uncured material breach, Legiscope will refund prepaid subscription fees for the period after termination and no future annual instalment becomes due. If Legiscope terminates for the Customer’s breach, accrued unpaid fees and Legiscope’s documented direct loss caused by the early ending remain recoverable, reduced by demonstrably avoided costs and reasonable mitigation and capped, excluding already issued annual invoices, at one annual subscription fee. There is no double recovery.

Termination does not affect accrued rights. The licence and account access end, subject to the Data Act transition, retrieval and DPA restorability processes. Payment, confidentiality, ownership, liability, dispute and exit provisions survive for their intended duration. Unused AI Funds become dormant and remain eligible for reactivation under a later Agreement with the same Customer.

The Customer may send a switching, on-premises porting or erasure notice to contact@legiscope.com. That transmission also constitutes the contractual notice required under the General terms. Legiscope will initiate the selected process without undue delay after receiving the information reasonably required to perform it. The maximum notice period will not exceed two months.

On request, Legiscope will allow the Customer to switch to a data processing service of the same service type or port all exportable data and digital assets to on-premises infrastructure. The mandatory maximum transitional period of 30 calendar days begins after the notice period. The Agreement remains applicable during the transition, and Legiscope will support the Customer’s exit strategy with relevant available information and reasonable assistance, maintain continuity, data integrity and security, and inform the Customer of known continuity risks.

If the 30-day transition is technically unfeasible, Legiscope will notify the Customer within 14 working days after the request, explain why and specify an alternative transition not exceeding seven months while maintaining continuity. The Customer may extend the transition once for a period it considers appropriate.

Legiscope will notify the Customer when switching is complete. A retrieval period of at least 30 calendar days begins after the agreed transition. Throughout transfer and retrieval, Legiscope will maintain continuity, data integrity and security to the extent applicable to the relevant process. Retrieval may use in-service exports and, where needed, a secure final package or interface; it does not require ordinary application access after termination. The Agreement terminates when switching completes or, for an erasure election, at the end of the applicable notice period, unless the Customer expressly requests that the subscription continue.

The charge for operations necessary to perform switching and associated data egress is EUR 0. Ordinary subscription fees remain payable while the Agreement applies. A separately requested service that is not necessary for switching is chargeable only if agreed in the Order Form. Where mandatory law causes the Agreement to end before the fixed Subscription Term expires and Legiscope is not in uncured material breach, the Customer pays accrued fees plus an Early Termination Charge equal to Legiscope’s documented unrecovered customer-specific implementation or commercial incentives and non-cancellable third-party commitments identified in the Order Form, reduced by demonstrably avoided costs and reasonable mitigation and capped at one annual subscription fee. The Early Termination Charge is a consequence of ending the fixed term early, not a charge for the switching process or data egress.

Exportable data and digital assets mean the input and output data, including relevant metadata, and Customer-specific digital materials generated directly or indirectly by the Customer’s use of the Service, excluding provider or third-party intellectual property and trade secrets. Legiscope will make applicable open interfaces available free of charge to the Customer and its authorised destination provider and provide exportable data in a structured, commonly used and machine-readable format.

The exhaustive exportable data and digital-asset categories, to the extent present in the Customer account, are: Customer organisation and programme configuration; Authorised User, role and permission records; applications; processor relationships; processing activities and RoPA records; rights-request records; incident and breach records; audits, evidence and evidence-activity records; roadmap tasks; uploaded source files and attachments; Customer-specific reports, assessments and AI-assisted Output; the current AI Funds balance and customer-visible task-level EUR usage history; and the customer-visible relationships, comments, decisions, approvals, identifiers, statuses, timestamps, history and other metadata associated with those records. The export does not make the Customer the controller of Legiscope’s separate authoritative commercial, accounting or legal ledger.

Structured records are supplied through available CSV or JSON exports or an equivalent documented machine-readable package. Human-readable records may also be supplied in a supported PDF or DOCX format, and uploaded files in their original or a commonly readable format. The up-to-date online register of available methods, data structures, formats, schemas, limitations, relevant standards and open interoperability specifications is maintained at https://www.legiscope.com/portability-deletion.html.

The exhaustive provider-internal categories excluded from portability are: Legiscope source code, executables, reusable templates and platform components; model weights, system instructions, proprietary algorithms, routing rules, security-detection logic and internal risk signals; credentials, cryptographic keys and other secrets; raw infrastructure telemetry, provider-wide performance information and internal security records whose disclosure would create a security risk or reveal a trade secret; irreversibly anonymised provider analytics; other customers’ data; and third-party material the Customer is not entitled to receive. An exclusion will not be used to impede or delay switching, and customer-visible metadata remains exportable.

The public infrastructure-jurisdiction and non-personal-data governmental-access information required by Regulation (EU) 2023/2854 is maintained at https://www.legiscope.com/hosting-residency-transfers.html and https://www.legiscope.com/security.html. Those pages are transparency information and do not add a fourth document to the Agreement.

The DPA controls the return, retention for restorability and deletion of Customer Personal Data. When the Agreement expires or terminates without a completed switch or an election to return or erase the data, the DPA’s retention-for-restorability position applies as the Customer’s standing instruction: the account and Customer Content remain access-disabled and restorable for up to 12 months without additional charge. The Customer may request return or instruct active-system erasure at any time during that period.

The same election and timing apply to exportable data and digital assets that are not Customer Personal Data. Legiscope may end the courtesy restorability service and delete the dormant account after the applicable retrieval period and will do so no later than 12 months after the Agreement ends. Following a return or erasure instruction, Legiscope deletes the applicable material from active systems without undue delay. Separate application-controller records described in these Terms follow their stated purposes and retention criteria rather than Customer instructions under the DPA.

Residual exportable data or digital assets may remain only in encrypted, access-restricted and technically immutable rolling backups used solely for disaster recovery. Those residual copies cannot be selectively altered during the protected cycle, are put beyond ordinary operation and are automatically purged no later than 90 days after active-system deletion. The Parties agree to that bounded cycle as the alternative later erasure period for a completed switch where Regulation (EU) 2023/2854 permits it.

Legiscope records the deletion instruction. If a protected backup is restored, Legiscope re-applies the recorded deletion instruction before the deleted exportable data or digital assets return to ordinary operation. The backup period does not permit analytics, model training, product development or another secondary use. Legiscope will confirm completion of the applicable deletion process on request.