Terms of Service

These Terms of Service (Terms) govern the supply and professional use of the app.legiscope.com software-as-a-service platform and related services. Legiscope means the app.legiscope.com platform operated by Legiscope UAB, company code 304581221, registered at Laisvės pr. 60-1107, LT-05120 Vilnius, Lithuania. Legiscope UAB is the provider and contracting party; a reference in these Terms to Legiscope performing, owing or enforcing an obligation means Legiscope UAB acting as operator of the platform. Customer means the business, public body or other organisation identified in the Order Form. Legiscope UAB and the Customer are each a Party and together the Parties.

The object of the Agreement is to provide the Customer a hosted, customer-controlled workspace for maintaining privacy and data-protection governance records, coordinating supported workflows, reviewing evidence, using enabled AI-assisted operations and exporting Customer records within the purchased Plan and Limits.

The Service is designed to support the Customer’s work; it does not assume the Customer’s legal responsibilities. The Agreement is exclusively for professional business use. It is not offered to consumers, and each signatory represents that they are authorised to bind the identified Party.

The Agreement consists only of: (a) the Order Form that defines the details of the Services purchased; (b) these current Terms, including the Plan Catalogue reproduced in them; and (c) the Data Processing Agreement (DPA) as published at www.legiscope.com/dpa.html.

The Parties first negotiate the commercial scope of the subscription — the Plan and options, quantities, term and price; these exchanges do not bind either Party. During the negotiation, Legiscope may provide a product demonstration in one of two forms. A standard demonstration is a presentation of the Service on screen by Legiscope personnel that displays the product features (the prospect submits no data and no account is created). An assisted demonstration is a hands-on session in a dedicated demonstration account, provided under the Assisted Demonstration Agreement published at www.legiscope.com/demo-agreement.html, accepted by the prospect — by email or through the demonstration booking flow — before the demonstration begins. Neither form of demonstration forms the Agreement described in these Terms; an assisted demonstration is governed exclusively by the Assisted Demonstration Agreement.

Once the commercial scope is agreed, Legiscope issues the final Order Form, which constitutes its offer. The Order Form may be issued as a standalone document or as an electronic quote issued through Legiscope’s billing provider. It states the selected Plan and options, the applicable prices and discounts, the quantities, allowances and term, and any separately priced service offered by Legiscope.

The Agreement is formed when the Customer accepts the Order Form through one of the following methods: (i) an agreed electronic signature; (ii) acceptance of an electronic quote through the billing provider’s hosted acceptance flow; (iii) payment of the initial payment stated in the Order Form; or (iv) clear written confirmation sent by email by an authorised representative of the Customer — in each case preserving the accepted terms.

The Agreement takes effect on the acceptance date (Effective Date) unless the Order Form states a different date. Legiscope activates access to the Service only after receipt of the initial payment stated in the Order Form.

Subject to payment and compliance with the Agreement, Legiscope grants the Customer a limited, non-exclusive, non-transferable right during the Subscription Term to permit its Authorised Users to access and use the Service for the Customer’s internal professional purposes within the selected Plan and Limits.

Legiscope supplies the Service online and remotely.

A preview, prototype, beta, evaluation feature or marketing reference is not a contractual commitment unless the Order Form expressly includes it. Legiscope may withdraw a non-contracted preview at any time.

The Service provides compliance-management workflows. Its current core covers privacy and data-protection governance — including records of processing activities, application inventories, processor relationships, personal-data-breach management, data-subject-rights handling, impact assessments, audits and evidence, and remediation planning. Legiscope may extend the Service to further compliance domains and workflows; a new capability is provided under the Agreement as stated in “Documented instructions and new services”.

The Service operates on the information and documents the Customer supplies, and helps the Customer structure, draft and review its compliance records. It does not verify the authenticity, completeness or sufficiency of Customer records, certify compliance, decide whether a legal obligation applies, or send notifications or responses to authorities or third parties in the Customer’s name. Conclusions, approvals and communications remain the Customer’s.

The Customer tenant is created after receipt of the initial payment. Within five Business Days after the later of the Agreement taking effect, receipt of the initial payment and receipt of the complete provisioning information reasonably required, Legiscope creates the Customer tenant and the initial Customer Administrator account identified in the Order Form and provides a secure activation method.

The Customer administers its own accounts. Authorised User accounts are created and managed by the Customer through the Service’s administration functions; Legiscope does not intervene in the Customer’s account administration. Customer Administrators manage user access, roles, organisation scope and integrations on the Customer’s behalf. The Customer must keep its administrator contact current and must promptly remove or restrict access that is no longer authorised.

Each account is for one named individual. Credentials and authentication factors must not be shared. The Customer must maintain appropriate endpoint security and promptly notify Legiscope of suspected compromise. The Customer is responsible for activity through its accounts except to the extent caused by Legiscope’s breach of the Agreement.

Legiscope may suspend access to all or part of the Service, or to a specific account or function, where reasonably necessary: (i) to address a serious security threat; (ii) to stop unlawful use, or use in breach of the Agreement that causes harm to Legiscope, its customers or third parties; (iii) to comply with applicable law; or (iv) after notice, for persistent non-payment of an undisputed amount. A suspension is limited in scope and duration to what is proportionate to its cause.

Except where the urgency of the cause or a legal prohibition prevents it, Legiscope gives the Customer notice and an opportunity to remedy the cause before suspending. Legiscope restores the affected access promptly once the cause is resolved. Fees remain due during a suspension caused by the Customer.

The Order Form states the fees, the total commitment for the fixed term, the currency, the billing contact, the Service Start Date and any one-off fees. Subscription fees are invoiced in advance, either annually at the start of each Contract Year or as a single upfront payment for the Subscription Term, as agreed in the Order Form; if the Order Form is silent, fees are invoiced annually. Fees exclude VAT and other applicable taxes unless expressly stated otherwise. Legiscope administers quotes, orders, invoices and payments through an electronic billing provider; a billing-provider record is billing evidence only and does not modify the term, price or scope stated in the accepted Order Form. Subscription invoices are payable by wire transfer only. A purchase of additional Tokens is payable through the billing provider’s payment flow or by wire transfer.

The initial payment is the first annual subscription fee unless the Order Form states another amount or payment schedule. Unless the Order Form states otherwise, each later annual subscription fee is invoiced in advance at the start of the relevant Contract Year and payable under paragraph (c).

Invoices are payable within 14 calendar days of issue, unless the Order Form states a different due date. Payment is made without set-off or deduction, except where mandatory law provides otherwise.

On an overdue undisputed amount, Legiscope may charge statutory late-payment interest. The Customer additionally bears all documented recovery costs, including debt-collection charges, court costs and attorney fees. If an undisputed amount remains unpaid more than 90 days after its due date, the Customer owes a contractual penalty of 10% of the overdue amount, with a minimum of EUR 500, in addition to interest and recovery costs. Persistent non-payment may lead to suspension and, after the applicable cure period, termination.

Fees are non-cancellable and non-refundable except where the Agreement provides an express pro-rata remedy. A Plan upgrade during a Subscription Term requires an accepted Order Form amendment; the Customer may purchase additional Tokens at any time. A downgrade is not available during a running Subscription Term; it takes effect only at the end of the current term, for the renewal term, and only if agreed before the applicable non-renewal deadline.

Tokens are contractual units used to access AI-assisted operations in the Service. When such an operation is performed, Tokens are deducted from the Customer’s Token balance.

Legiscope credits the annual Token amount included in the Plan when it activates the Customer’s account after receipt of the initial payment. At the beginning of each later Contract Year, Legiscope credits the applicable annual Token amount after receiving all subscription fees then due. Additional Tokens purchased by the Customer are credited after Legiscope receives payment for them.

The Service shows the Customer’s current Token balance and aggregate summaries of Tokens credited and consumed. These summaries do not identify individual operations or disclose operation-level Token consumption, Legiscope’s internal allocation methods, processing costs or other internal commercial information. Legiscope maintains the authoritative Token ledger and will review and correct any verified error notified by the Customer.

Unused Tokens roll over between Contract Years while the subscription continues. When the balance reaches zero, operations that consume Tokens pause until Tokens are credited; other Service features remain available. Tokens are non-transferable and have no cash, refund or redemption value. Any Token balance unused when the Agreement ends lapses and is not carried into a later subscription.

The initial Subscription Term begins on the Service Start Date and runs for the fixed duration selected in the Order Form: 12, 36 or 60 months.

After the initial term, the Subscription Term renews automatically for successive 12-month periods unless either Party gives written notice of non-renewal before the current term ends. A notice of non-renewal does not terminate the current committed term.

Legiscope may change its list prices for new subscriptions at any time. The annual subscription price applicable to a Subscription Term is fixed until that term ends. A renewal takes place at the same annual price unless: (i) Legiscope publishes a different applicable price and its effective date on its website at least 90 days before that date, in which case the different price applies to renewals beginning on or after that date; or (ii) where no applicable public price exists, Legiscope communicates a different renewal price to the Customer in writing at least 120 days before the current term ends.

Legiscope owns the proprietary elements of the Service and retains all intellectual-property rights in them. These elements include all Legiscope-developed code, architecture, interfaces, workflows, functionality, UX/UI and visual design, documentation, methodologies, database structures, system and developer prompts, reusable prompt templates, model-routing and orchestration logic, evaluation methods and underlying technology.

Third-party libraries and components remain subject to the rights of their respective owners. Except for the rights expressly granted by the Agreement, no rights in the Service are transferred to the Customer.

Customer Content belongs to the Customer. Customer Content includes all data, records, documents, files, instructions, configurations and other materials that the Customer or an Authorised User uploads, imports, enters, creates, transmits or stores in the Service, including through an integration. It includes records maintained through supported workflows, such as RoPAs, DPIAs, processor relationships, incidents and breaches, data-subject requests, audits and supporting evidence. Legiscope acquires no ownership, intellectual-property right or other proprietary interest in Customer Content.

To provide the Service, the Customer grants Legiscope and its authorised subprocessors a limited, non-exclusive licence, for the duration of the Agreement, to host, copy, transmit, analyse, transform and otherwise process Customer Content only to perform the Agreement and follow the Customer’s documented instructions.

AI Output documents generated for the Customer in the ordinary course of using the Service through automated or AI processing, belongs to the Customer

Ownership of AI Output does not give the Customer any rights in the Legiscope technology used to generate it.

All Customer Content is confidential. This includes all data, records, documents, files and other information uploaded, imported, entered, created or stored in the Service by or for the Customer.

Legiscope will protect this information with reasonable care. It may process the information itself and through the authorised subprocessors listed at https://www.legiscope.com/subprocessors.html only to provide, secure and support the Service, comply with law, or follow the Customer’s documented instructions. This includes AI processing when the Customer uses or enables an AI-assisted feature.

Only personnel and authorised providers that need the information to perform their functions may access it, and they must be bound by confidentiality obligations. Legiscope remains responsible for the performance of the obligations it delegates to them. These duties continue for as long as Legiscope retains the information.

Each Party will comply with the data-protection law applicable to its role. Where Legiscope processes Customer Personal Data on the Customer’s documented instructions, the complete DPA as published at acceptance automatically forms part of the Agreement and controls that processing. No separate DPA signature is required.

The DPA remains the controlling and complete instrument for the subject matter, duration, nature, purpose, personal-data categories, data subjects, processor and subprocessor activities, security, subprocessors, international transfers, assistance, audit, personal data breach, return and deletion obligations applicable to Customer Personal Data.

Where support, troubleshooting, tenant security, incident response, restoration or Customer-directed transactional email requires processing Customer Personal Data to operate the Customer’s tenant or respond to its instruction, Legiscope acts as processor and the DPA applies. Legiscope acts as an independent controller only for the separately defined activities in the independent-controller register for which it determines its own purposes and essential means. The same technical event may produce distinct data elements processed in different roles. The Customer must make the controller information in these Terms available to its representatives and Authorised Users where required.

The Customer instructs Legiscope to process Customer Personal Data as necessary to provide the purchased Service and the features that the Customer or its Authorised Users enable, configure or use. The Agreement, Order Form, account configuration, authenticated user actions and documented support requests are the Customer’s documented instructions under the DPA.

A new feature enabled, configured or used by the Customer is covered by the same instructions and DPA. A separate Order Form is required only if the feature is separately priced. If the feature requires a new subprocessor, the DPA’s subprocessor-change process applies.

Legiscope decides the technical implementation of the Service, including its architecture, operations and routing among authorised subprocessors, provided it acts within the Customer’s documented instructions and the DPA.

Legiscope protects Customer Personal Data in accordance with Article 32 GDPR and implements the technical and organisational measures stated in the DPA. The Customer is responsible for determining whether its selected Service and configuration are suitable for the data it submits and for securing its endpoints, user permissions, downloaded exports and systems outside Legiscope’s control.

In case of a personal data breach affecting Customer Personal Data processed by Legiscope or its authorised subprocessors, Legiscope will notify the Customer and provide assistance in accordance with the DPA and applicable data-protection law.

The Service may include connectors that allow the Customer to import data from third-party services. The Customer controls each connector and decides which sources and data to import. By enabling or configuring a connector, the Customer instructs Legiscope to retrieve, import and automatically process the selected data within the functionality and Limits of the purchased Service.

Legiscope will use reasonable efforts to make the Core Service available at least 99.9% of each calendar month. The Core Service means the production web application functionality that allows Authorised Users to authenticate and access Customer records. It excludes AI processing, Customer-selected connectors, email delivery, preview or beta features and professional services.

Monthly Availability Percentage is the percentage of applicable minutes during the calendar month in which the Core Service is available. An Unavailable Minute occurs when the Customer’s Authorised Users cannot authenticate or access Customer records because of a failure within the Legiscope-managed Service. The calculation excludes: scheduled maintenance notified at least 48 hours in advance, up to four hours per month; emergency maintenance reasonably necessary to protect the Service; Customer systems, actions, configuration or credentials; Customer-selected services and connections; internet failures outside the Service boundary; force majeure events; and suspension permitted by the Agreement.

If Monthly Availability Percentage is below 99.9%, Legiscope will refund the pro rata portion of the applicable monthly subscription fee corresponding to the Unavailable Minutes. The monthly subscription fee is one-twelfth of the annual subscription fee and excludes Tokens, add-ons, professional services and taxes. The Customer must request the refund within 15 days after the affected month and identify the relevant dates and times. Legiscope will pay an approved refund or add a credit to the account of the same amount within 30 days. The refund cannot exceed the applicable monthly subscription fee.

Legiscope UAB acts as an independent controller when it processes personal data for its own contracting, billing, customer-relationship, platform-security, service-operation and legal-compliance purposes. Its privacy contact is contact@legiscope.com. These activities, their legal bases, retention periods, recipients and individual rights are described in the register below.

This processing is separate from Customer Personal Data processed on the Customer’s behalf under the DPA. It does not permit Legiscope to use Customer Content for its own purposes.

AI-assisted processing occurs when an Authorised User starts an AI operation or the Customer enables or configures an identified AI workflow. It forms part of the Customer-instructed Service purpose. Legiscope sends only the Customer Content, instructions and context needed for the operation to an authorised AI subprocessor listed on the Subprocessors page and may select or change the provider and model used.

Customer Content is not used by Legiscope to train, fine-tune models or pooled into a cross-customer training dataset.

Customer is warned that AI Output is probabilistic and may be inaccurate, incomplete, inconsistent, fabricated, biased, outdated or non-unique. It may omit legal significant issues or misstate facts, citations, relationships, deadlines or conclusions. Legiscope does not warrant that AI Output is protectable, exclusive or free from third-party rights.

AI Output is draft decision-support material. It is not legal advice, an official finding, a certification or a guarantee of compliance. Before using it for a legally significant purpose, the Customer must verify it against the original evidence, current authoritative sources and applicable law, correct material errors and obtain competent human approval. AI Output must not be the sole or determinative basis for a decision producing legal or similarly significant effects on a person.

The Service provides software tools and information for professional review, not legal advice, legal representation or a legal-document drafting service. Any document generated through the Service is a draft produced under the Customer’s control. Use of the Service does not create a lawyer-client relationship or, by itself, confer legal professional privilege; it does not affect any privilege or professional-secrecy protection that otherwise applies to Customer Content.

Templates, checklists, action lists and workflows may be simplified or limited to a specific purpose. They are not a complete statement of applicable law, a compliance determination or a substitute for assessing the Customer’s particular circumstances. Legiscope does not warrant that they are exhaustive or suitable for the Customer’s intended use, or that they address every applicable requirement, exception, fact, deadline or jurisdiction. The Customer must select, review, adapt, complete and approve them before relying on them for a legally significant purpose and remains responsible for obtaining professional advice where appropriate and for every decision, filing, notification and communication made in its name.

Each Party warrants that it has authority to enter into the Agreement. Legiscope warrants that it will provide the Service with reasonable skill and care and materially in accordance with these Terms and the Order Form.

If the Customer notifies Legiscope of a material non-conformity in sufficient detail, Legiscope will use reasonable efforts to correct it or re-perform the Affected Service. If Legiscope cannot do so within a reasonable period, the Customer may terminate the Affected Service and receive a pro-rata refund of prepaid subscription fees for the period after termination. Except for rights that cannot lawfully be limited, these are the Customer’s exclusive remedies for breach of the warranty in paragraph (a).

Legiscope uses reasonable efforts to provide a reliable Service. However, Legiscope does not warrant that every error, risk, deadline, legal issue or compliance gap will be detected, that every source is accurate or current, or that use of the Service makes the Customer compliant with law.

To the maximum extent permitted by law, Legiscope is not liable for indirect or consequential loss or for loss of profit, revenue, anticipated savings or goodwill.

Except where liability cannot lawfully be limited, Legiscope’s total liability for all claims arising in a Contract Year under or in connection with the Agreement, will not exceed the subscription fees payable under the affected Order Form for that Contract Year.

The Customer remains responsible for its legal and regulatory obligations and for decisions made using the Service. To the maximum extent permitted by law, the Customer bears any regulatory fine or penalty imposed on it and may not recover that amount from Legiscope. Nothing transfers a statutory responsibility or limits a public authority’s powers.

Nothing in this provision excludes or limits Legiscope’s liability for fraud, wilful misconduct, gross negligence, death or personal injury caused by negligence, or any liability that cannot lawfully be excluded or limited. Nothing limits the rights of a data subject under applicable law.

The Customer may give notice of non-renewal at any time. The Agreement, Service access and payment obligations continue until the end of the current Subscription Term and the Agreement then ends without renewal.

Legiscope may terminate the Agreement if the Customer fails to pay an undisputed amount when due, materially breaches the Agreement, uses the Service unlawfully, creates a material security risk, or if continued performance would be unlawful. Where the cause can reasonably be remedied, Legiscope will first give the Customer a reasonable opportunity to do so.

Fees paid for the current Subscription Term are non-refundable, and any remaining instalments remain payable according to the agreed payment schedule. Unused Tokens are not refundable when the Agreement ends.

Termination ends access to and the licence for the Service. Outstanding payment obligations and the ownership, confidentiality, liability and dispute provisions continue to apply.

The Customer is responsible for exporting any exportable data it wishes to retain before the Agreement ends or during the applicable retrieval period. Retention and deletion are governed by “Retention, deletion and backups” and the DPA.

The Customer may use the Service’s automated export tools at any time to download all exportable data and digital assets in a structured, commonly used and machine-readable format. The exhaustive exportable categories are all Customer Content, AI Output and customer-visible account, configuration, user, permission, usage and metadata records. Current formats, structures, interfaces and known limitations are listed at https://www.legiscope.com/portability-deletion.html.

The exhaustive exclusions are Legiscope or third-party intellectual property and trade secrets, including source code, platform components, reusable templates, system prompts, model weights, algorithms and routing logic; credentials, security logic, internal risk signals and provider-wide telemetry; irreversibly anonymised analytics; other customers’ data; and third-party material the Customer is not entitled to receive. These exclusions will not impede or delay switching.

The Customer initiates switching to another provider, porting to its own infrastructure or erasure through the Service’s automated exit tools. Starting the selected process constitutes notice, and no separate contact or manual coordination is required. Legiscope provides the required information and reasonable assistance through those tools and the published documentation. The Customer is responsible for operating the tools and importing the exported data at its destination. Switching and associated data egress are free.

Any switch that would not be completed immediately through the automated tools provided by Legiscope is governed by the mandatory timing, security, retrieval and termination rules in Article 25 of the Data Act.

The Customer may delete its account through the Service at any time, including during the Subscription Term. The Customer is responsible for exporting its data first.

If the Agreement ends before the Customer deletes its account, the DPA’s courtesy-retention and deletion periods apply to the account and all its contents.

When the Customer deletes its account, the account, Customer Content and AI Output are deleted from active systems without undue delay. Residual copies remain for 90 days in access-restricted, immutable disaster-recovery backups and are then automatically deleted. The DPA governs the deletion of Customer Personal Data.

Legiscope determines how the Service is designed, developed and operated and may add, modify, replace, rebuild or discontinue features, workflows, interfaces, models, providers and technical components. This includes changes made because functionality does not perform as expected or to improve, secure, maintain or operate the Service for its customers as a whole. Legiscope will exercise this right reasonably, taking into account the functionality and continuity of the Customer’s purchased Plan and the interests of its customers as a whole.

Legiscope determines the pricing of the Service and may set or change prices for new subscriptions, renewal terms and new or optional features, modules and services. New or modified functionality may be included in an existing Plan or offered separately at Legiscope’s discretion. The price and financial commitment for the current Subscription Term remain fixed, and renewal pricing is governed by “Fixed term, renewal and price protection.”

Legiscope may update these Terms or the DPA to reflect changes to the Service, applicable law, security requirements or provider arrangements, or to clarify the Agreement. Corrections of typographical or formatting errors, clarifications and other changes that do not materially affect the Parties’ rights or obligations may take effect upon publication without prior notice. Material updates are governed by paragraphs (b) and (c).

For a material update, Legiscope will notify the Customer’s contract contact by email and publish the revised document at least 30 days before the effective date. An update will not amend the Commission Clauses, reduce the protection of Customer Personal Data required by the DPA or applicable law, or change the amount payable or total financial commitment for the current Subscription Term. A change to the Service permitted under “Service development and pricing” does not by itself change that price or financial commitment. Legiscope may apply an update immediately when required by law or reasonably necessary to address an urgent material security risk and will notify the Customer as soon as reasonably practicable.

The Customer may object in writing to a material update before its effective date. The Parties will seek a reasonable solution in good faith. If no solution is agreed before that date, either Party may terminate the affected Service or the Agreement when the update takes effect, and Legiscope will refund prepaid fees for the period after termination. If the Customer does not object and continues using the Service after the effective date, the update is accepted.

Neither Party may transfer the Agreement without the other Party’s prior consent, except to an affiliate or in connection with a merger, reorganisation or sale of the relevant business or assets, provided that the new party assumes the Agreement. Legiscope may use subcontractors while remaining responsible for its obligations under the Agreement and DPA.

Neither Party is liable for delay or failure to perform caused by an event beyond its reasonable control that it could not reasonably prevent or overcome. This does not excuse the Customer’s payment obligations.

The Customer grants Legiscope a non-exclusive, royalty-free licence during the Agreement to use its name and unmodified logo solely to identify it as a Legiscope customer on Legiscope’s website, in newsletters, on social media and in other marketing and communications materials. The Customer may withdraw this permission prospectively by written notice. Legiscope will not imply endorsement or publish a testimonial or case study without the Customer’s prior written approval.

Notices under the Agreement must be sent by email to contact@legiscope.com for Legiscope and to the notice email in the Order Form for the Customer. Either Party may change its notice email by written notice. Mandatory rules governing court or authority documents continue to apply.

The Agreement constitutes the entire agreement between the Parties concerning its subject matter and supersedes all prior proposals, discussions and understandings. No person other than a Party may enforce the Agreement, except as expressly provided by the DPA or mandatory law. A failure or delay in exercising a right does not waive that right. If any provision is unenforceable, it will be limited to the minimum extent necessary and the remainder of the Agreement will continue in effect.

The Order Form controls the Customer-specific commercial terms and any non-standard scope expressly permitted by these Terms. It does not otherwise amend these Terms. The DPA governs the processing of Customer Personal Data, and its Commission Clauses prevail over any conflicting provision. These Terms govern all other matters. A purchase order or other Customer document is administrative only and does not form part of or amend the Agreement.

The Agreement and any non-contractual obligations arising from or connected with it are governed by Lithuanian law, excluding its conflict-of-law rules. Subject to mandatory law, the courts of Vilnius, Lithuania have exclusive jurisdiction over any dispute arising from or connected with the Agreement. The English version prevails unless the signed Order Form expressly designates another controlling language.