General conditions

GENERAL TERMS AND CONDITIONS OF CONTRACT LICENCE OF USE

1 Definitions

The definitions that will govern these General Terms and Conditions of Contract are set out below:

• Contract: The Licence Agreement for the Use and Provision of Ancillary Services is considered to be the document formed by these General Conditions, as well as the Specific Conditions.
• Specific Conditions: For the purposes of the Contract, Specific Conditions will be considered those that establish the relationship between the Licensee and the Partner, and that will regulate detailed aspects of the Contract, such as the price, the type of accommodation, the Accessory Services or the contracted modalities of Risk4all.
• The Parties: It is the joint name of the Licensor and the Licensee.
• Licensor: The company that authorizes the use of Risk4all in accordance with the Agreement. This company is Risk4all, S.L., an entity registered in the Mercantile Registry of Madrid, with registered office at Calle de la Ribera del Loira, 38, Edificio 4, 28042 Madrid and NIF B88516257.
• Licensee: This is the natural or legal person who contracts the licence to use Risk4all. In the case of business groups or equivalent entities that jointly contract Risk4all, the term will apply to the entire group. The natural person acting in the name and on behalf of the Licensee at the time of contracting must have sufficient capacity to accept these Conditions.
• Partner: The natural or legal person authorised by the Licensor to distribute Risk4all to the Licensee.
• Risk4all: It is a Governance, Risk and Compliance (GRC) software, with the functionalities and limitations established in the Contract.
• Ancillary Services: These are services linked to Risk4all that the Licensee may contract as an accessory through the Specific Conditions.
• Users: These are the natural persons or automatic processes that make use of the Risk4all licenses acquired by the Licensee.

2 Object of the Contract

The purpose of the Agreement is to regulate the granting of licenses for the use of Risk4all by the Licensor, so that the Licensee can make use of Risk4all for its own organization, subject to the conditions and limitations established in these General Conditions, as well as in the Specific Conditions.

In no case may the Specific Conditions contradict these General Conditions without the express written consent of the Licensor.

Consequently, by accepting the Agreement, the Licensee is granted one or more licenses to use Risk4all that will be revocable, non-exclusive, temporary, non-sublicensable, non-transferable and onerous.

In no case shall the acceptance of these Conditions imply a sale or transfer of the ownership of Risk4all or of any intellectual property right or of any other nature over this tool that is not expressly regulated in the Agreement.

Likewise, the Contract will regulate the provision of the Accessory Services that, where applicable, the Licensee contracts through the Partner.

The Licensee undertakes to use Risk4all in accordance with the provisions of the Contract and applicable legislation, as well as in accordance with good faith, morality, good customs and public order.

3 Description of Risk4all and Ancillary Services

3.1 Modules, functionalities and contracting modalities

The functionalities available in each module are described below, as well as the conditions corresponding to each type of contract:

The Licensee may change the contracting method at any time, without prejudice to the costs, penalties and/or deadlines that this entails and which will be assessed by the Partner.

In the event that the change is to a lower price modality, such change will not entail a refund of the difference in the Price by the Licensor, without prejudice to what is established in the Specific Conditions agreed with the Partner.

3.2 Ancillary Services

Incidentally, the Licensee may request the Partner to provide certain Ancillary Services, which will be provided and invoiced in accordance with the provisions of the Specific Conditions.

The Accessory Services may be subcontracted, where appropriate, with companies specialized in the provision of such services, and certified in the product.

4 Subscription and support

Any Risk4all subscription includes:

• Access to new versions of the product, which are automatically deployed (a minimum of 3 per year). In on-premise mode, the application update procedure is established at the beginning.
• Updating standards and regulations when new versions are released
• New features
• Updated User Manual
• Corrective support, due to malfunctions or bugs in 8×5 mode, on weekdays (Madrid-Spain) at 8-17h and 8-15h in summer, through the support account: soporte@risk4all.com

CRITICAL incidents will be considered those that affect access to the platform or more than 75% of end users. Criticism is also considered to be those that prevent the full operation of the platform.

IMPORTANT incidents will be considered those that affect a volume of more than 50% of end users, or those that make it impossible to use one or more menu options

The REST of the incidents will be considered basic.

5 Limitations and Warranties of Use

The Licensee undertakes to make appropriate use of Risk4all by ensuring the following limitations:

• The Licensee will protect and safeguard access to Risk4all, not being able to transfer or assign to third parties in any way the rights acquired through the acceptance of the Agreement. Under no circumstances shall the Licensee permit the use of Risk4all by third parties outside of its organization.
• The use of Risk4all by the Licensee for the provision of direct or indirect services to entities other than the Licensee’s organization, as well as for purposes other than those set forth in the Agreement or any other purpose that has not been previously authorized by the Licensor, is prohibited.
• Any activity contrary to the internal use of Risk4all in accordance with the provisions of the Agreement is prohibited. By way of example and without limitation, it is forbidden to carry out the following actions with respect to Risk4all without the prior, express and written authorization of the Licensor: assignment, sale, sublicense, reverse engineering, decompilation, reproduction, translation, modification, versioning, marketing, duplication, transformation or transfer to any other entity or legal person of all or part of Risk4all,  removal of ownership or authorship marks, etc.
• In the same way, any rights not expressly mentioned in the Contract are fully reserved to the Licensor, and in no case may the clauses of these General Conditions be interpreted in such a way as to be detrimental to the Licensor or contrary to the legal exploitation of the license.

In accordance with the foregoing, the Licensor reserves the right to carry out any checks necessary to verify the proper use of Risk4all and full compliance with the clauses set forth in the Agreement.

6 Risk4all’s Responsibility, Requirements, and Maintenance

Taking into account the functionalities of Risk4all and the content of the Ancillary Services, the Licensor shall not assume any liability arising from any damages, direct or indirect, that the Licensee or other third parties may suffer for reasons such as, but not limited to: interruption of the service, breakdown, failure or loss of information.

Notwithstanding the foregoing, the Licensor undertakes to adopt the necessary means and solutions to correct or minimise the possible problems suffered by the Licensee, who in no case may claim any amount by way of compensation or any other concept for possible errors, response time or problems accessing Risk4all.

Without this implying an authorisation to assign any of the rights derived from the Contract, the Licensee will be responsible for any relationship that it formalises with third parties as a result of the use of Risk4all, these relationships being understood as carried out exclusively between the Licensee and the third party. Consequently, the Licensor shall not be liable for any damages caused to the Licensee or the third party by reason of the relations entered into between them as a result of the use of or through Risk4all.

The Licensee shall be solely responsible for its Users and shall hold the Licensor harmless from any liability in this regard. In this way, the Licensee must implement the necessary measures to prevent the unauthorized, fraudulent or irregular use of Risk4all by its Users.

Likewise, the Licensee shall be responsible for the Users’ compliance with the conditions governing Risk4all. By way of example and not limitation, the Licensee shall assume the responsibilities arising from:

• The non-diligent use of Risk4all by Users.
• The use of identification data that is not true, exact, complete and up-to-date, as well as the use of false identities or those of other Users.
• Lack of operability for reasons beyond the control of the Licensor.
• The dissemination, storage, publication or distribution of defamatory, violent, obscene, xenophobic or discriminatory information.
• The inclusion or use of any software, data, viruses, code or any other device, mechanism or routine likely to cause damage to Risk4all or to other equipment or systems of its own or third parties.
• The introduction, transmission or dissemination by Risk4all of any content that infringes the rights of third parties or is contrary to law.

On the other hand, for the proper functioning of Risk4all, the Licensor recommends compliance with the following technical requirements:

• Internet connection.
• Internet browser.
• Office suites (for reading reports extracted from Risk4all).

In accordance with the above requirements, the Licensee shall be solely responsible for ensuring the compatibility of Risk4all with its operating systems and computer equipment.

7 Economic conditions

7.1 Price and payment

The Licensee undertakes to pay for the Risk4all licenses and the Accessory Services contracted in accordance with the provisions of the Specific Conditions agreed with the Partner.

7.2 Non-payment

In the event of non-payment for a period of three (3) months, the Licensor reserves the right to suspend the licenses for use of Risk4all and to terminate the Agreement early without the right to compensation of any kind for the Partner and without prejudice to the claim for outstanding payment.

8 Intellectual Property

The Licensor is the legitimate owner or licensee of all intellectual and industrial property rights inherent to Risk4all, as well as its contents (including, but not limited to, databases, images, photographs, drawings, graphics, icons, operations and text, audio, video and code files), as well as trademarks, logos, trade names or any distinctive sign,  who are or have been part of Risk4all at some point. All these materials are protected by Spanish intellectual and industrial property laws.

Any improvements, changes or further developments of Risk4all shall be the property of the Licensor, including functionalities developed at the request of the Licensee.

Pursuant to the Agreement, Licensor only grants one or more non-exclusive licenses of use to Licensee. In no case does this document grant the Licensee intellectual or industrial property rights over Risk4all beyond those that are strictly necessary for its correct use and operation, nor does it imply a waiver of such rights by the Licensor.

Except where the Licensor expressly states in writing that it is acceptable to do so, you may not reproduce, modify, excerpt, adapt, publish, transmit, copy, make available or distribute or otherwise use all or any part of the Risk4all content without the prior written permission of the Licensor. Any use of such content may constitute a violation of the Licensor’s intellectual property rights, and appropriate legal action is reserved.

The Licensee may not sell, resell, distribute or otherwise make available to a third party the Risk4all content or fragments or other information derived from it in any way or by any means without the express, prior written permission of the Licensor. Under no circumstances may Risk4all or any of its contents be downloaded or executed in a manner or on a medium other than that specified in the Contract.

The Licensor reserves the right to modify and make updates to Risk4all. The Licensor does not warrant or certify that the content on Risk4all is accurate, complete, up-to-date, or free from errors or omissions.

8.1 Notice of License and Attribution

Risk4all includes the Secure Control Framework (SCF) checklist. Such resource is subject to the following license:

License: Attribution-NoDerivatives 4.0 International –

https://creativecommons.org/licenses/by-nd/4.0/

Original Source:Secure Control Framework

Attribution:

The controls have been developed by the Secure Control Framework (SCF) and are used under the terms of the CC ND 4.0 license, which allows content to be shared and adapted, provided that proper attribution is provided.

Summary of rights and obligations under CC BY-ND 4.0:

• Permitted Use: You may copy and redistribute the material in any format, including for commercial purposes.
• Attribution requirement: You must acknowledge the original authorship and provide a link to the license.
• No modifications allowed: You may not alter, transform, or create derivative works based on this content.
• No additional restrictions: You may not apply legal terms or technological measures that restrict the use of the material beyond what is permitted by the license.

9 Confidentiality

The Parties undertake to maintain the utmost confidentiality and secrecy regarding the information classified as confidential, whether relating to technical, commercial, industrial or any other nature, provided by the other party in connection with the provision of services subject to the Contract or the negotiation, execution or execution thereof. Confidential information may not be disclosed, communicated or provided to third parties without the prior, express and written authorization of the party disclosing such information.

Confidential information shall be considered to be any information to which a party has access under the Contract, in particular the information and personal data for which the other party has accessed or accesses during the performance of the Agreement. Such information, as well as its copies and/or reproductions, shall be considered confidential information for the purposes of the Contract.

All information and data that were in the public domain or that were in the possession of the Parties prior to the start of the negotiation of the Contract and have been obtained by lawful means in accordance with the applicable legislation will not be considered confidential.

The confidentiality obligation set out in the Contract will be indefinite, remaining in force after the termination, for any reason, of the relationship between the Parties.

Each of the Parties shall be responsible for ensuring that its staff, collaborators, managers and, in general, all persons under its responsibility who have access to the confidential information and personal data under the responsibility of the other Party, respect the confidentiality of the information, as well as the obligations relating to the processing of personal data,  even after the end of the Contract. Therefore, the Parties shall issue as many warnings and as many documents as may be necessary with such persons, in order to ensure compliance with such obligations.

Each of the Parties shall make available to the other the documentation accrediting compliance with the obligation established in the previous paragraph.

10 Data protection

10.1 Personal Data of Licensee’s Representatives and Contacts

The Partner and/or the Licensee shall communicate to the Licensor the personal, identification and contact details of the Licensee’s representatives and professional contacts for the successful completion of the Contract.

The Licensor hereby informs such data subjects that their personal data will be processed for the purpose of perfecting, executing, controlling and maintaining the Agreement.

The legal basis that legitimizes the processing of the data of the interested parties is the necessity for the conclusion and execution of the Contract.

The data will be kept for the duration of the Contract and, subsequently, for the legally necessary period in order to meet any possible liabilities arising from the contractual relationship.

Likewise, the Licensor will use the contact details of the interested parties to send, by any means of contact provided, (i) functional information on the use, incidents or updates of Risk4all, as well as (ii) commercial information on products, services, promotions, news or events of the Licensor, related to the field of information security, privacy,  software, technology and other related sectors. When these communications are sent by email, the tool used to send communications will include tiny, transparent links and images that will be associated with the recipient’s email address. In this way, when one of these images is downloaded or the links contained in the email are accessed, the recipient can know for statistical purposes if the email has been opened or if any link has been accessed from the email. The recipient may reject these uses by configuring their email manager or program to prevent the automated downloading of images, as well as by not accessing the links included in the emails they receive. Likewise, in each commercial communication, the Licensee may object to receiving this type of information through the contact means indicated to process its cancellation. The legal basis that legitimises this processing is the legitimate interest of the Licensor, as well as the existence of a previous legal relationship being commercial communications about products or services similar to those originally contracted by the Licensee. Your data will be processed for this purpose indefinitely until you object to it or request the deletion of your data.

In any case, the affected parties may exercise their rights of access, rectification, deletion, opposition, limitation and portability before the Licensor through written communication to the registered office listed at the beginning of this document or through the email dpo@risk4all.com, sufficiently proving their identity, identifying themselves as a party or interested party to this Agreement and indicating the right to be exercised. Likewise, if they consider that their right to personal data protection has been violated, they may file a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the Licensor’s Data Protection Officer (dpo@risk4all.es).

10.2 Processing

For the maintenance of the Agreement, the Licensor may process personal identification and contact data that are the responsibility of the Licensee or whose processing has been entrusted to it by third parties. For the purposes of the Agreement, the Licensee shall be considered the data controller and the Licensor shall be considered the processor in accordance with the provisions of Articles 28 and 29 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter, GDPR).

By virtue of the position assumed, each of the Parties undertakes to comply with their respective obligations in terms of data protection.

10.2.1. Obligations assumed by the Licensee

If, for the maintenance of the Agreement, the Licensee makes available to the Licensor personal identification and contact data for which it is responsible, the Licensee guarantees and states for the appropriate purposes that:

1. In the event that the processing includes the collection of personal data in the name and on behalf of the Licensee, it will establish the procedures corresponding to the collection of the data, especially with regard to the duty of information and, where appropriate, the obtaining of the consent of the affected parties, guaranteeing that these instructions comply with all the legal and regulatory requirements required by current regulations on data protection.
2. In the event that the processing does not include the collection of personal data in the name and on behalf of the Licensee, the Licensee guarantees that the personal data to which the Licensor will have access under this Agreement have been obtained and processed in compliance with all legal and regulatory requirements required by the current regulations on data protection.
3. You comply with all your data protection obligations as a data controller and are aware that the terms of this Agreement do not alter or replace the obligations and responsibilities that are attributable to the Licensee as a data controller.
4. Supervise the processing and compliance with data protection regulations by the Licensor.

10.2.2. Obligations assumed by the Licensor

Accordingly, the Licensor assumes the following obligations:

• Access to personal data under the responsibility of the Licensee only when it is essential for the proper development of the services for which it has been contracted, for example, for support or maintenance work, or, where appropriate, for the hosting of Risk4all.
• To process the data in accordance with the documented instructions received from the Licensee.
• Immediately inform the Licensee if the Licensor detects that any of the Licensee’s instructions violate the current data protection regulations.
• Not to use, apply or use the personal data under the responsibility of the Licensee for any purpose other than that indicated in the Agreement or in any other way that involves a breach of the Licensee’s instructions.
• Not to disclose, transfer, assign or otherwise communicate the personal data for which the Licensee is responsible, either verbally or in writing, by electronic means, paper or by computer access, not even for its conservation, to any third party, unless there is prior authorization or instruction from the Licensee.
• Except for the auxiliary services of the Licensor’s activity, in the event that it needs to subcontract all or part of the services contracted by the Licensee in which the processing of personal data is involved, it must notify the Licensee in advance in writing at least 1 month in advance, indicating the processing that is intended to be subcontracted and clearly and unequivocally identifying the subcontractor company and its contact details. Subcontracting may be carried out if the Licensee does not express its opposition within the established period. The subcontractor, who will also have the status of processor, is also obliged to comply with the obligations established in this document for the processor and the instructions issued by the controller. The Licensor shall remain fully liable to the Licensee for the performance of the obligations. In relation to the above, the Licensee authorises the Licensor from the outset and in a general way to subcontract, where appropriate, the hosting of Risk4all, and the development and maintenance work with companies or entities located within the European Union. At any time, the Licensee may request information from the Licensor about the services and companies or entities subcontracted.
• To notify the Licensee as soon as possible, and within a maximum period of two (2) business days, of any request to exercise the right of access, rectification, deletion, opposition, limitation of processing, portability of data and not to be subject to automated individualized decisions, made by a data subject whose data have been processed by the Licensor for the purpose of fulfilling the object of the Contract,  so that it is resolved within the deadlines established by the regulations in force.
• Make available to Licensee all information necessary to demonstrate compliance with its obligations, as well as for the performance of audits or inspections carried out by Licensee or another auditor authorized by Licensee.
• In the event that the Licensor is required to transfer or allow access to personal data under the Licensee’s responsibility to a third party under the law of the Union or of the Member States applicable to it, it shall inform the Licensee of this legal requirement in advance, unless prohibited for reasons of public interest.
• Once the contractual relationship agreed between the Licensee and the Licensor has been fulfilled or terminated, the Licensee must provide the Licensor with precise instructions on the destination of the data, and may choose between its return, referral to another service provider or complete destruction, provided that there is no legal provision requiring the retention of the data,  in which case it may not be destroyed.
• Adopt and apply the appropriate technical and organisational measures to guarantee a level of security that prevents their alteration, loss, processing or unauthorised access, taking into account the state of technology, the nature of the data stored and the risks to which they are exposed, in accordance with the provisions of Article 32 of the GDPR. The Annex to this license includes the details of the security measures applied to the system when the data is hosted by the Licensor’s suppliers.

• In the event of a breach of the security of personal data in the information systems used by the Licensor for the provision of the services covered by the Agreement, the Licensor shall notify the Licensee, without undue delay, and in any event within a maximum period of 72 hours, of any breaches of the security of the personal data for which it is aware,  together with all the relevant information for the documentation and communication of the incident in accordance with the provisions of article 33.3 of the GDPR.

11 Duration and termination of the Contract

11.1 Entry into force and validity of the Agreement

The Licensor will confirm the entry into force of the Use License by email.

Unless otherwise specifically agreed in the particular conditions, the Licence of Use will be valid for one (1) year from the date of entry into force.

11.2 Early termination of the Contract

Either Party may suspend or definitively terminate the Contract when the other Party seriously and/or repeatedly breaches any of the clauses established in the Contract. In this sense, the following shall be understood:

• Serious breach: A breach that causes direct damage or harm to the other party, or that without causing direct damage or harm is not remedied within three (3) months.
• Repeated non-compliance: That which occurs more than 3 times within one (1) year.

Early termination of the Contract for any of the causes set forth in this Clause does not relieve the Parties from performing their outstanding obligations under the Contract. Early termination of the Contract will not in any case result in the refund of the payment of the Price or the proportional part thereof.

12 Assignment of the Contract

Neither Party may assign, encumber, transfer or otherwise dispose of the Agreement or any rights or obligations contained herein without the prior written knowledge of the other Party.

In such a situation, the party who intends to assign the Contract must inform the other party one (1) month in advance, during which such party may proceed to the early termination of the Contract.

13 Miscellaneous

• In the event that any of the clauses of the Contract is declared invalid or null and void, it will be modified to the extent possible, in order to comply with the will of the Parties. In any case, all other clauses of the Agreement will be considered valid and enforceable in their entirety.
• At any time, the Licensee may request information about other Partners, as well as, where appropriate, the assignment of a new Partner.
• The Licensee may request a license to test or demonstrate the operation of Risk4all. Such testing or demonstration will be conducted in test environments that do not guarantee the confidentiality, security, or persistence of the information. Therefore, the Licensee shall not use actual or confidential data during the trial period.
• The Parties declare themselves independent entities without the provisions of the Agreement implying in any way an agency, collaboration or joint-venture relationship.
• The signing of the Contract shall not imply any waiver of the rights that each of the Parties may hold in accordance with the applicable legislation at any given time.
• The Parties declare that both the General Conditions and the Particular Conditions, as well as any annex or addendum subsequent to them, will constitute the only valid agreement and main instrument of the relationship between them, any previous provision contrary to what is established herein being invalid, being null and void unless expressly agreed in writing between the Parties.
• The Parties may add amendments, modifications and annexes to the Agreement, which shall be binding on them from the effective date, provided that such amendments, modifications and annexes are in writing, signed or accepted by a representative authorized by the Parties and incorporated into the Agreement.
• The Agreement shall be accepted by the means provided by the Partner, or by the means mutually agreed between the Licensee and the Partner.
• The Contract was originally drafted in Spanish. In the event of a contradiction between the Spanish version and its translation into any other language, the provisions of the Spanish version will apply.
• By accepting the Contract, the Licensee undertakes to fully and unreservedly adhere to all the clauses set forth at the time of contracting and guarantees:
  • That they have read, understand and accept these General Conditions, as well as the Specific Conditions.
  • That the person who has made the acceptance of the Contract has sufficient capacity of representation to bind the Licensee with what is agreed in the Agreement.
• The Licensee will always have access to these General Terms and Conditions prior to the start of the contracting procedure, which may be stored and/or reproduced on a durable medium.
• By accepting the Agreement and without prejudice to the provisions of the confidentiality conditions, the Licensee authorises the Licensor to use its logo and its trademark or company name for the purpose of promoting the use of Risk4all on its website, in promotional or informative emails, as well as in any commercial material of the Licensor,  whether online or on paper; all free of charge, and without territorial or temporal limitation. In online materials, the logo or trademark may act as a link to the Licensee’s website. The Licensee’s representative in the acceptance of the Contract guarantees that he or she has sufficient capacity to enter into this authorization. This authorization does not confer on the Licensor any other rights in the logo, trademark or company name of the Licensee. The Licensee may revoke this authorization at any time by written communication to the Licensor.

14 Governing Law and Jurisdiction

The Contract shall be governed by and construed in accordance with Spanish Law.

For any issues that may arise from the interpretation and execution of the Clauses of the Contract, both Parties, expressly waiving any other jurisdiction that may correspond to them by law, submit to the jurisdiction and competence of the Courts and Tribunals of Madrid Capital (Spain).

Annex – Technical and Organizational Security Measures

The Risk4all tool has an Information Security Management System (ISMS) and ensures compliance with the ENS at Medium level.

A security policy has also been developed and approved, which you can consult through your contact at Risk4all or through your Partner.

In summary, the following technical and organizational measures have been implemented to ensure the security of the information (confidentiality, integrity, availability, traceability, authenticity), as well as of the personal data under the responsibility of the Licensee, applicable to all modalities hosted by the Licensor:

• Information Security Policy
• Regulations for users
• Roles and Responsibilities for Security
• Risk assessment at planned intervals, or when there are relevant changes
• System Architecture Documentation
• Capacity management for key components (CPU, disk, memory, and network)
• Access Control Policy
• Access management by unique identifiers and passwords, and MFA.
• Access management based on security roles/groups
• Segregation of duties and tasks, through the separation of independent environments and users
• Asset Inventory
• Security base configurations for each element of the architecture
• Regular vulnerability analysis and annual penetration testing
• Regular patching and updates
• Incident management procedure
• Logging of user and administrator activities
• Daily system and data backups
• Data Processing Center located in Madrid (Spain).
  • Availability 99.99%
  • Connectivity availability 99.5%
  • Hardware availability 99%
  • ISO/IEC 27001 – ISO 22301 certified suppliers
• Firewall and IDS
• WAF
• Security awareness and training of personnel
• Safe Development Training
• Separate environments for development, testing, and production
• Simulated test data, but the same safety measures are guaranteed

If you would like more information on the details of these security measures, you can request it at any time from Risk4all via the contact form on the website or through your contact at Risk4all or your Partner.