These Terms of Service ("Terms") govern your access to and use of OSCAR, the online compliance platform provided by Illuminate Tech LTD (company number 15269594) ("the Provider", "we", "us" or "our"). By creating an account and accessing or using the Service, you ("the Customer", "you" or "your") agree to be bound by these Terms.
1. Definitions
- "AI Features" means any artificial intelligence, machine learning, or automated advice functionality that may be part of the Service, which generates outputs, recommendations, or advice based on data input by the Customer or its Authorised Users. AI Features are optional and only available to Customers who choose to enable and use them.
- "Affiliate" means any entity that directly or indirectly controls, is controlled by, or is under common control with a party, where "control" means ownership of at least fifty percent (50%) of the equity or beneficial interests of such entity or the right to vote for or appoint a majority of the board of directors or other governing body of such entity.
- "Authorised User" means any employee, contractor, or agent of the Customer who is authorised by the Customer to access and use the Service under the Customer's account.
- "Customer Data" means any data, content, or materials that the Customer or its Authorised Users upload, submit, or transmit to or through the Service.
- "Data Processing Agreement" or "DPA" means the data processing agreement set out in Schedule 1 to these Terms.
- "Documentation" means the user guides, manuals, and other materials relating to the Service that the Provider makes available to the Customer.
- "Fees" means the fees payable by the Customer for access to and use of the Service as set out in the Order Form or as otherwise agreed between the parties.
- "Order Form" means the ordering document executed by the parties specifying the subscription tier, number of Authorised Users, Fees, and other commercial terms.
- "Service" means OSCAR, the online compliance platform and related services provided by the Provider, accessible via login credentials, as described in the Documentation.
- "Subscription Term" means the period during which the Customer has access to the Service, as specified in the Order Form.
2. Service Access and Use
2.1. Subject to the Customer's compliance with these Terms and payment of applicable Fees, the Provider grants the Customer a non-exclusive, non-transferable, revocable right to access and use OSCAR during the Subscription Term solely for the Customer's internal compliance management purposes and trust and safety operations.
2.2. The Customer may permit its Authorised Users to access and use the Service on the Customer's behalf, provided that:
- the number of Authorised Users does not exceed the number specified in the Order Form;
- each Authorised User complies with these Terms;
- the Customer is responsible for all acts and omissions of its Authorised Users; and
- the Customer ensures that each Authorised User's access is terminated immediately upon such individual ceasing to be an employee, contractor, or agent of the Customer.
2.3. The Provider may carry out maintenance, updates, or modifications to the Service at any time, which may result in temporary unavailability of the Service. The Provider is not required to provide advance notice of such maintenance.
2.4. The Provider may update, modify, enhance, or upgrade the Service at any time, in its sole discretion. The Provider reserves the right to introduce new features, modify existing features, or discontinue features, provided that such changes do not materially reduce the core functionality of the Service as described in the Documentation.
2.5. Beta Features: From time to time, the Provider may make available features or functionality designated as beta, pilot, limited release, or similar designation ("Beta Features"). The Customer acknowledges and agrees that:
- Beta Features are provided on an "as is" and "as available" basis without any warranties of any kind;
- Beta Features may not be fully tested and may contain bugs or errors;
- Beta Features may be substantially modified or discontinued at any time without notice;
- the Provider makes no commitment to release a final or commercial version of any Beta Features; and
- the Customer's use of Beta Features is at its sole risk and the Provider shall have no liability for any issues arising from the use of Beta Features.
2.6. AI Features (Optional):
- The Service may include AI Features that provide automated outputs and recommendations based on information input by the Customer and its Authorised Users. Use of AI Features is entirely at the Customer's discretion.
- The following provisions in this clause 2.6 apply only to Customers who choose to enable the AI Features:
- AI Features use algorithms and machine learning models that may produce outputs that are inaccurate, incomplete, outdated, or inappropriate for the Customer's specific circumstances;
- AI-generated outputs are provided for informational purposes only and do not constitute legal advice, compliance advice, or professional services;
- the Customer must independently verify all AI-generated outputs before relying on them or taking any action based on them;
- the Provider makes no warranty regarding the accuracy, reliability, completeness, or suitability of any AI-generated output;
- the Customer is solely responsible for all decisions made and actions taken based on AI-generated outputs; and
- the Provider may use Customer Data (in aggregated and anonymised form) to train, improve, and enhance the AI Features, provided that such use does not identify the Customer or any individual.
3. User Accounts
3.1. The Customer must create an account with secure login credentials to access the Service. The Customer agrees to:
- provide accurate, current, and complete information during the registration process;
- maintain and promptly update account information to keep it accurate, current, and complete;
- maintain the security and confidentiality of all login credentials and account information;
- notify the Provider immediately of any unauthorised access to or use of the Customer's account or any breach of login credentials; and
- ensure that login credentials are not shared with any person who is not an Authorised User.
3.2. The Customer is responsible for all activities that occur under its account, regardless of whether such activities are authorised by the Customer.
3.3. The Provider reserves the right to suspend or terminate any account that violates these Terms or is inactive for a period exceeding twelve (12) months.
4. Acceptable Use
4.1. The Customer shall not, and shall ensure that its Authorised Users do not:
- use the Service in violation of any applicable law, regulation, or third-party right, including, without limitation, online safety regulations, including the UK Online Safety Act 2023 and the EU Digital Services Act, and any regulations made thereunder;
- upload, transmit, or distribute any Customer Data that is unlawful, harmful, threatening, abusive, harassing, defamatory, vulgar, obscene, or otherwise objectionable, or that violates any regulatory requirements;
- interfere with or disrupt the integrity or performance of the Service or any data contained therein;
- attempt to gain unauthorised access to the Service or its related systems or networks;
- reverse engineer, decompile, disassemble, or otherwise attempt to discover the source code or underlying algorithms of the Service;
- remove, alter, or obscure any proprietary notices on the Service;
- use the Service to transmit any viruses, malware, or other malicious code;
- share login credentials with unauthorised persons or permit unauthorised access to the Service;
- use the Service to infringe any intellectual property rights of any third party;
- use any automated means to access the Service except through the interfaces provided by the Provider;
- resell, sublicense, or otherwise make the Service available to any third party;
- use the Service for benchmarking purposes or to develop a competitive product or service;
- upload or process any special categories of personal data (as defined in Article 9 of the UK GDPR) without the Provider's prior written consent and without implementing additional safeguards as required by applicable data protection laws;
- if the Customer uses the AI Features, use the AI Features to generate content that violates any applicable law or regulation, or to circumvent any compliance obligations; or
- if the Customer uses the AI Features, attempt to manipulate, deceive, or exploit the AI Features to produce outputs that are misleading, harmful, or contrary to the intended purpose of the Service.
4.2. The Provider reserves the right to investigate and take appropriate action against anyone who, in the Provider's sole discretion, violates this clause 4, including removing or disabling access to Customer Data, suspending or terminating accounts, and reporting such activity to law enforcement authorities.
5. Fees and Payment
5.1. The Customer shall pay the Fees in accordance with the payment terms set out in the Order Form.
5.2. Unless otherwise specified in the Order Form:
- Fees are payable in advance on an annual or monthly basis, as selected by the Customer;
- all Fees are non-refundable except as expressly set forth in these Terms;
- Fees are exclusive of all taxes, duties, and similar assessments, which shall be the sole responsibility of the Customer; and
- the Provider may increase Fees upon not less than thirty (30) days' written notice, provided that any such increase shall not take effect until the next Subscription Term.
5.3. If the Customer fails to pay any Fees when due:
- the Provider may charge interest on the overdue amount at the rate of 2% per annum above the Bank of England base rate from time to time;
- the Provider may suspend the Customer's access to the Service until payment is received; and
- the Provider may terminate this Agreement in accordance with clause 11.2.
5.4. The Customer shall provide the Provider with valid and up-to-date payment information. The Customer authorises the Provider to charge all Fees to the payment method on file.
6. Intellectual Property Rights
6.1. The Provider and its licensors own all right, title, and interest in and to the Service and the Documentation, including all intellectual property rights therein. For the avoidance of doubt, the Provider retains exclusive ownership of:
- the Service platform, software, algorithms, code, and architecture;
- the Documentation, including all user guides, manuals, help materials, training materials, and any other documentation provided by the Provider in connection with the Service, whether in electronic or physical form;
- all other content, materials, and documentation provided by the Provider through or in connection with the Service;
- all improvements, modifications, enhancements, and derivative works relating to the Service or the Documentation;
- all data and analytics derived from the operation and use of the Service (excluding Customer Data);
- all AI-generated outputs, recommendations, reports, and content produced by the AI Features; and
- all improvements to the AI Features and underlying algorithms derived from use of the Service.
These Terms do not grant the Customer any rights in or to the Service or the Documentation except for the limited access rights expressly set forth in clause 2.1. The Customer acknowledges and agrees that all intellectual property rights in the Documentation are and shall remain the exclusive property of the Provider.
6.2. The Customer retains all right, title, and interest in and to the Customer Data, including all intellectual property rights therein.
6.3. The Customer grants the Provider a worldwide, non-exclusive, royalty-free licence to use, copy, store, transmit, and display Customer Data solely to the extent necessary to provide the Service to the Customer.
6.4. The Provider may collect and analyse aggregated and anonymised data derived from the Customer's use of the Service for purposes of improving and enhancing the Service, provided that such data does not identify the Customer or any individual. This includes using such data to train, test, and improve the AI Features.
6.5. The Customer grants the Provider a non-exclusive, royalty-free, worldwide licence to use the Customer's name and logo to identify the Customer as a customer of the Provider in the Provider's marketing materials, customer lists, and on the Provider's website, unless the Customer notifies the Provider in writing that it does not wish to be identified as a customer.
6.6. The Customer hereby assigns to the Provider all right, title, and interest (including all intellectual property rights) in and to any feedback, suggestions, ideas, comments, or other information or materials regarding the Service that the Customer or its Authorised Users provide to the Provider ("Feedback"). The Provider shall be free to use, disclose, reproduce, license, and otherwise distribute and exploit the Feedback as it sees fit, without obligation or restriction of any kind. The Customer represents and warrants that it has all rights necessary to provide such Feedback and to assign such rights to the Provider.
7. Data Protection and Security
7.1. Each party shall comply with all applicable data protection laws and regulations in connection with its performance under these Terms.
7.2. To the extent that the Provider processes personal data on behalf of the Customer in the provision of the Service, the parties agree to comply with the terms of the Data Processing Agreement set out in Schedule 1, which forms an integral part of these Terms.
7.3. The Provider's data processing practices are further described in the Provider's Privacy Policy, available at https://www.illuminatetech.co.uk/privacy-policy which is incorporated into these Terms by reference.
7.4. In the event of a security incident involving unauthorised access to or disclosure of Customer Data, the Provider shall:
- notify the Customer without undue delay after becoming aware of the incident;
- provide the Customer with sufficient information to allow the Customer to meet any data breach reporting obligations; and
- take reasonable steps to mitigate the effects and minimise any damage resulting from the incident.
7.5. The Customer is responsible for:
- ensuring that Customer Data, including any information uploaded to the Service, does not violate any applicable laws or third-party rights;
- maintaining appropriate security controls over Customer Data before it is uploaded to the Service;
- implementing appropriate backup procedures for Customer Data;
- ensuring that its use of the Service complies with any applicable data protection laws and regulatory requirements; and
- maintaining the security of login credentials and preventing unauthorised access to its account.
8. Confidentiality
8.1. Each party ("Receiving Party") agrees to hold in confidence and not disclose to any third party any confidential or proprietary information of the other party ("Disclosing Party") disclosed in connection with these Terms ("Confidential Information"), except:
- as required by law or court order, provided that the Receiving Party gives the Disclosing Party prompt written notice of such requirement and reasonable assistance in contesting or limiting the scope of disclosure;
- to its employees, contractors, and professional advisors who need to know such information and who are bound by confidentiality obligations at least as protective as those set forth in this clause 8; or
- with the prior written consent of the Disclosing Party.
8.2. Confidential Information does not include information that:
- is or becomes publicly available through no breach of these Terms by the Receiving Party;
- is rightfully received by the Receiving Party from a third party without breach of any confidentiality obligation;
- is independently developed by the Receiving Party without use of or reference to the Disclosing Party's Confidential Information; or
- was known to the Receiving Party prior to disclosure by the Disclosing Party.
8.3. Upon termination or expiration of these Terms, the Receiving Party shall, at the Disclosing Party's option, either return or destroy all Confidential Information in its possession or control.
9. Warranties and Disclaimers
9.1. The Provider warrants that:
- it has the right to grant the rights granted to the Customer under these Terms; and
- it will perform its obligations under these Terms in a professional and workmanlike manner consistent with industry standards.
9.2. The Customer's sole remedy for breach of the warranties in clause 9.1 shall be for the Provider to use commercially reasonable efforts to correct the non-conforming Service or, if the Provider is unable to correct the non-conforming Service within thirty (30) days of receiving written notice from the Customer, the Customer may terminate the affected Order Form and receive a pro-rata refund of prepaid Fees for the terminated portion of the Subscription Term.
9.3. Except as expressly set forth in clause 9.1, the Service is provided "as is" and "as available" without warranties of any kind, whether express, implied, statutory, or otherwise. Provider specifically disclaims all implied warranties of merchantability, fitness for a particular purpose, title, and non-infringement, and all warranties arising from course of dealing, usage, or trade practice. Provider does not warrant that the Service will be uninterrupted, error-free, or completely secure.
9.4. The Customer acknowledges and agrees that:
- the Service provides tools, resources, and functionality to assist with compliance management but does not guarantee compliance with online safety regulations, including, without limitation, the UK Online Safety Act 2023 and the EU Digital Services Act, or any other applicable laws or regulations;
- the Provider makes no warranty, representation, or guarantee regarding the accuracy, completeness, reliability, or suitability of any compliance assessments, reports, analyses, recommendations, or other outputs generated by or through the Service;
- the Service is a tool to support the Customer's compliance efforts and should not be relied upon as the sole means of achieving or maintaining regulatory compliance; and
- the Customer remains solely responsible for ensuring its compliance with all applicable laws and regulations, including conducting its own independent assessments and seeking professional advice where necessary.
9.5. AI Features Disclaimer (Applicable Only If the Customer Uses AI Features): If the Customer chooses to enable AI Features, the Customer acknowledges and agrees that:
- AI-generated outputs, recommendations, and advice are produced by automated algorithms and machine learning models and may contain errors, inaccuracies, or omissions;
- AI Features are not a substitute for professional legal or compliance advice and should not be relied upon as such;
- the Provider makes no warranty that AI-generated outputs will be accurate, complete, current, or suitable for the Customer's specific circumstances or compliance obligations;
- the Customer must independently verify all AI-generated outputs before relying on them or taking any action based on them;
- the Provider shall have no liability for any decisions made, actions taken, or compliance failures resulting from the Customer's reliance on AI-generated outputs; and
- the accuracy and reliability of AI-generated outputs depends on the quality, accuracy, and completeness of the data and information provided by the Customer.
9.6. The Customer warrants that:
- it has the right to upload and use the Customer Data in connection with the Service;
- the Customer Data does not and will not infringe any third-party intellectual property rights or violate any applicable law;
- it will comply with all applicable laws in its use of the Service; and
- it will not rely solely on the Service for regulatory compliance and will implement appropriate additional compliance measures as necessary.
10. Limitation of Liability
10.1. To the maximum extent permitted by law, in no event shall either party be liable to the other party for any indirect, incidental, special, consequential, or punitive damages, or any loss of profits, revenue, data, or data use, arising out of or relating to these Terms, even if such party has been advised of the possibility of such damages.
10.2. Provider's total aggregate liability arising out of or relating to these Terms shall not exceed the total amount of Fees paid or payable by Customer to Provider in the twelve (12) months immediately preceding the event giving rise to the liability.
10.3. The limitations in clauses 10.1 and 10.2 shall not apply to:
- the Customer's indemnification obligations under clause 12.5;
- the Customer's payment obligations;
- either party's breach of clause 8 (Confidentiality);
- the Customer's breach of clauses 2 (Service Access and Use) or 4 (Acceptable Use) to the extent such breach involves unauthorised access or use of the Service or violation of the Provider's intellectual property rights; or
- liability that cannot be excluded or limited under applicable law.
11. Term and Termination
11.1. These Terms commence on the date the Customer first accesses the Service and continue until all Order Forms have expired or been terminated.
11.2. The Provider may terminate these Terms or any Order Form for convenience upon not less than thirty (30) days' written notice to the Customer, provided that the Customer shall remain liable for all Fees for the remainder of the then-current Subscription Term.
11.3. Either party may terminate these Terms or any Order Form:
- immediately upon written notice if the other party materially breaches these Terms and fails to cure such breach within thirty (30) days after receiving written notice thereof; or
- immediately upon written notice if the other party becomes insolvent, makes an assignment for the benefit of creditors, or becomes subject to any bankruptcy or insolvency proceeding.
11.4. The Provider may suspend the Customer's access to the Service immediately upon written notice if:
- the Customer fails to pay any Fees when due and fails to cure such failure within ten (10) days of receiving written notice thereof;
- the Provider reasonably believes that the Customer's use of the Service poses a security risk to the Service or any third party; or
- the Customer breaches clause 4 (Acceptable Use).
11.5. Upon termination or expiration of these Terms:
- the Customer's right to access and use the Service shall immediately cease;
- the Customer shall pay all outstanding Fees;
- the Provider shall make Customer Data available to the Customer for download for a period of thirty (30) days, after which the Provider may delete all Customer Data; and
- each party shall return or destroy all Confidential Information of the other party in accordance with clause 8.3.
11.6. Clauses 1 (Definitions), 6 (Intellectual Property Rights), 7 (Data Protection and Security), 8 (Confidentiality), 9.3 (Disclaimers), 10 (Limitation of Liability), 11.5 (Effect of Termination), 12 (Indemnification), 13 (General Provisions), and Schedule 1 (Data Processing Agreement) shall survive any termination or expiration of these Terms.
12. Indemnification
12.1. The Provider shall defend, indemnify, and hold harmless the Customer from and against any claims, damages, losses, liabilities, costs, and expenses (including reasonable solicitors' fees) arising out of any third-party claim that the Service, when used in accordance with these Terms, infringes any patent, copyright, trade mark, or other intellectual property right of such third party, provided that the Customer:
- promptly notifies the Provider in writing of the claim;
- grants the Provider sole control of the defence and settlement of the claim; and
- provides the Provider with reasonable co-operation and assistance in the defence of the claim.
12.2. The Provider's indemnification obligations under clause 12.1 shall not apply to the extent that the claim arises from:
- the Customer's modification of the Service;
- the Customer's combination of the Service with any product, service, or data not provided by the Provider;
- the Customer's continued use of the Service after being notified of allegedly infringing activity; or
- Customer Data.
12.3. If the Service becomes, or in the Provider's opinion is likely to become, the subject of an infringement claim, the Provider may, at its option and expense:
- procure for the Customer the right to continue using the Service;
- replace or modify the Service to make it non-infringing; or
- if options (a) and (b) are not commercially reasonable, terminate the affected Order Form and refund to the Customer any prepaid Fees for the terminated portion of the Subscription Term.
12.4. This clause 12 states Provider's entire liability and Customer's exclusive remedy for any infringement claims.
12.5. The Customer shall defend, indemnify, and hold harmless the Provider from and against any claims, damages, losses, liabilities, costs, and expenses (including reasonable solicitors' fees) arising out of:
- any claim that the Customer Data infringes any third-party intellectual property right or violates any applicable law;
- the Customer's use of the Service in violation of these Terms; or
- any claim by an Authorised User relating to the Customer's termination of such Authorised User's access to the Service.
13. General Provisions
13.1. Governing Law: These Terms shall be governed by and construed in accordance with the laws of England and Wales.
13.2. Dispute Resolution: Any dispute arising out of or relating to these Terms shall be subject to the exclusive jurisdiction of the courts of England and Wales.
13.3. Assignment: Neither party may assign or transfer these Terms or any rights or obligations hereunder without the prior written consent of the other party, except that either party may assign these Terms in connection with a merger, acquisition, or sale of all or substantially all of its assets, provided that the assignee agrees to be bound by these Terms.
13.4. Force Majeure: Neither party shall be liable for any delay or failure to perform its obligations under these Terms (other than payment obligations) to the extent such delay or failure is caused by circumstances beyond its reasonable control, including acts of God, natural disasters, war, terrorism, labour disputes, or governmental actions.
13.5. Notices: All notices under these Terms shall be in writing and delivered by email to the email addresses provided by the parties, with a copy sent by registered mail or courier. Notices shall be deemed given upon receipt or, if sent by email, upon confirmation of delivery.
13.6. Entire Agreement: These Terms, together with any Order Forms, the Privacy Policy, and the Data Processing Agreement set out in Schedule 1, constitute the entire agreement between the parties regarding the subject matter hereof and supersede all prior or contemporaneous agreements, understandings, and communications, whether written or oral.
13.7. Amendments: The Provider may modify these Terms from time to time by posting the modified Terms on its website or by providing notice to the Customer. The Customer's continued use of the Service after such notice constitutes acceptance of the modified Terms. If the Customer does not agree to the modified Terms, the Customer's sole remedy is to terminate these Terms in accordance with clause 11.3.
13.8. Waiver: No waiver of any provision of these Terms shall be effective unless in writing and signed by the party against whom the waiver is sought to be enforced. No failure or delay by either party in exercising any right or remedy under these Terms shall operate as a waiver thereof.
13.9. Severability: If any provision of these Terms is held to be invalid, illegal, or unenforceable, the remaining provisions shall continue in full force and effect.
13.10. No Legal or Compliance Advice: The Customer acknowledges and agrees that:
- the Service is provided as an online compliance management platform and technology tool for assisting with compliance and does not constitute legal advice, compliance advice, regulatory advice, or the provision of legal or professional services;
- the Provider is not acting as the Customer's solicitor or legal advisor in relation to the Service and does not owe the Customer any fiduciary duty. To the extent the Provider offers separate consulting or professional advisory services to the Customer, such services shall be governed by a separate written agreement and are not part of the Service provided under these Terms;
- the Customer should seek independent legal and compliance advice from qualified professionals before relying on any output, content, or information provided by or through the Service;
- the Provider makes no representations or warranties regarding the accuracy, completeness, currency, suitability, or compliance of any output or content generated by or available through the Service for any particular purpose, regulatory regime, or the Customer's obligations under online safety regulations, including, without limitation, the UK Online Safety Act 2023 and the EU Digital Services Act;
- the Customer is solely responsible for ensuring that its compliance practices and any actions taken based on the Service meet all applicable legal and regulatory requirements, including all obligations under online safety regulations, including, without limitation, the UK Online Safety Act 2023 and the EU Digital Services Act; and
- the Provider shall have no liability whatsoever (whether in contract, tort, negligence, or otherwise) for any claims, losses, damages, costs, or liabilities arising from or in connection with:
- the Customer's reliance on any output, content, information, or guidance provided by or through the Service;
- any regulatory action, investigation, examination, or enforcement proceedings brought against the Customer by any regulator, governmental authority, or other third party;
- any fines, penalties, sanctions, enforcement actions, or other remedies imposed on the Customer by any regulator, governmental authority, or court;
- the Customer's failure to comply with any applicable laws, regulations, regulatory requirements, or professional standards;
- any compliance failures, breaches, or deficiencies in the Customer's compliance programme or practices; or
- any decisions made or actions taken by the Customer based on information or functionality provided by the Service, including any AI-generated outputs, recommendations, or advice.
13.11. Contact: If you need to contact us regarding these Terms or the Service, please email us at hello@illuminatetech.co.uk.
13.12. Regulatory Changes: The Customer acknowledges and agrees that:
- online safety regulations, including, without limitation, the UK Online Safety Act 2023 and the EU Digital Services Act, and related regulatory requirements are subject to change, amendment, or repeal;
- regulatory guidance, codes of practice, and enforcement approaches may evolve over time;
- the Provider may update the Service from time to time to reflect changes in applicable regulations, but the Provider is under no obligation to do so;
- the Provider makes no representation or warranty that the Service will be updated to reflect all regulatory changes or that such updates will be made in a timely manner;
- the Customer is responsible for monitoring changes to applicable regulations and ensuring that its use of the Service and its compliance practices remain appropriate in light of such changes; and
- the Provider shall have no liability for any failure by the Customer to comply with regulatory requirements due to changes in applicable laws or regulations.
Illuminate Tech LTD
Company Number: 15269594
86-90 Paul Street, London, England, United Kingdom, EC2A 4NE
Email: hello@illuminatetech.co.uk
Schedule 1 — Data Processing Agreement
This Data Processing Agreement ("DPA") forms part of the Terms of Service between Illuminate Tech LTD ("the Provider" or "Processor") and the Customer ("the Customer" or "Controller") and applies to the extent that the Provider processes personal data on behalf of the Customer in the provision of the Service.
1. Definitions and Interpretation
1.1. In this DPA, the following terms shall have the meanings set out below:
- "Data Protection Laws" means all applicable laws and regulations relating to the processing of personal data, including the UK GDPR and the Data Protection Act 2018;
- "UK GDPR" means the UK General Data Protection Regulation (Regulation (EU) 2016/679 as it forms part of the law of England and Wales, Scotland, and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018);
- "Controller", "Processor", "Data Subject", "Personal Data", "Personal Data Breach", "Processing" (and "Process"), and "Supervisory Authority" shall have the meanings given to them in the UK GDPR; and
- "Sub-processor" means any Processor engaged by the Provider to Process Personal Data on behalf of the Customer in connection with the Service.
1.2. The terms "Controller" and "Processor" as used in this DPA shall be interpreted in accordance with the Data Protection Laws, and the parties acknowledge that:
- the Customer is the Controller of Personal Data processed through the Service; and
- the Provider is the Processor of such Personal Data.
1.3. References to clauses are to clauses of this DPA unless otherwise stated.
2. Scope and Details of Processing
2.1. Subject Matter: The subject matter of the Processing is the provision of the Service (OSCAR online compliance platform) to the Customer in accordance with the Terms of Service.
2.2. Duration: The duration of the Processing is the period during which the Provider provides the Service to the Customer under the Terms of Service, and for such additional period as may be required to delete or return Personal Data in accordance with clause 8.
2.3. Nature and Purpose: The nature and purpose of the Processing is to enable the Customer to use the Service for compliance management in relation to online safety regulations, including, without limitation, the UK Online Safety Act 2023 and the EU Digital Services Act.
2.4. Types of Personal Data: The types of Personal Data processed may include names and contact details, user account information, user-generated content, IP addresses and device identifiers, complaint and incident records, moderation decisions, and such other Personal Data as the Customer may upload to the Service.
2.5. Categories of Data Subjects: The categories of Data Subjects may include the Customer's employees and contractors, end users of the Customer's services, complainants, and individuals whose data is processed for compliance purposes.
2.6. Special Categories of Data: The Customer shall not upload special categories of Personal Data (as defined in Article 9 of the UK GDPR) or Personal Data relating to criminal convictions and offences (as defined in Article 10 of the UK GDPR) to the Service without the Provider's prior written consent.
3. Obligations of the Processor
3.1. The Provider shall:
- Process Personal Data only in accordance with documented instructions from the Customer, which shall include these Terms, any Order Form, and the Customer's use and configuration of the Service. The Provider may also process Personal Data as reasonably necessary to provide the Service, maintain security, and comply with applicable law;
- ensure that persons authorised to Process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
- implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk;
- respect the conditions for engaging Sub-processors as set out in clause 4;
- taking into account the nature of the Processing and the information available to the Provider, provide reasonable assistance to the Customer to enable the Customer to respond to requests for exercising Data Subject rights under Data Protection Laws;
- taking into account the nature of Processing and the information available to the Provider, provide reasonable assistance to the Customer in ensuring compliance with the Customer's obligations under Articles 32 to 36 of the UK GDPR;
- at the Customer's choice, delete or return all Personal Data to the Customer after the end of the provision of the Service, and delete existing copies unless applicable law requires storage of the Personal Data;
- make available to the Customer information reasonably necessary to demonstrate compliance with the obligations laid down in Article 28 of the UK GDPR and allow for and contribute to audits in accordance with clause 7; and
- inform the Customer if, in the Provider's opinion, an instruction from the Customer infringes Data Protection Laws.
4. Sub-processors
4.1. The Customer provides general authorisation for the Provider to engage Sub-processors to Process Personal Data on the Customer's behalf.
4.2. The Provider shall maintain a list of Sub-processors, which shall be made available to the Customer upon request.
4.3. The Provider shall provide the Customer with at least thirty (30) days' prior written notice of the addition or replacement of any Sub-processor.
4.4. If the Customer objects to the appointment of a new Sub-processor on reasonable data protection grounds, the Customer shall notify the Provider in writing within fourteen (14) days of receiving notice. The parties shall discuss the Customer's concerns in good faith. If no resolution can be achieved, the Customer may terminate the affected Order Form by giving written notice to the Provider.
4.5. The Provider shall ensure that Sub-processors are bound by written contracts imposing data protection obligations substantially equivalent to those set out in this DPA.
5. Data Subject Rights
5.1. Taking into account the nature of the Processing and the information available to the Provider, the Provider shall provide reasonable assistance to the Customer to enable the Customer to respond to requests from Data Subjects exercising their rights under Data Protection Laws.
5.2. If the Provider receives a request from a Data Subject to exercise their rights, the Provider shall promptly notify the Customer and shall not respond to such request except on the Customer's documented instructions or as required by applicable law.
6. Personal Data Breaches
6.1. The Provider shall notify the Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Personal Data Breach affecting Personal Data processed under this DPA.
6.2. Such notification shall include, to the extent reasonably available to the Provider:
- a description of the nature of the Personal Data Breach;
- the contact details of the Provider's data protection officer or other contact point;
- a description of the likely consequences of the Personal Data Breach; and
- a description of the measures taken or proposed to be taken by the Provider to address the Personal Data Breach.
6.3. The Provider shall provide reasonable assistance to the Customer to enable the Customer to comply with its obligations under Data Protection Laws in relation to the Personal Data Breach.
7. Audits and Inspections
7.1. The Provider shall make available to the Customer information reasonably necessary to demonstrate the Provider's compliance with its obligations under this DPA.
7.2. The Customer may conduct an audit of the Provider's compliance with this DPA no more than once per calendar year, subject to the following conditions:
- the Customer shall give the Provider at least sixty (60) days' prior written notice of any audit;
- audits shall be conducted during normal business hours and shall not unreasonably interfere with the Provider's business operations;
- the Customer shall ensure that any auditor is bound by appropriate confidentiality obligations and is not a competitor of the Provider;
- audits shall be limited in scope to matters directly relevant to the Provider's compliance with this DPA; and
- the Customer shall be responsible for all costs associated with such audits.
7.3. The audit frequency limitation in clause 7.2 shall not apply where an audit is required by a Supervisory Authority or in response to a Personal Data Breach.
8. Return and Deletion of Personal Data
8.1. Upon termination or expiration of the Terms of Service, the Provider shall, at the Customer's choice, either return all Personal Data to the Customer in a commonly used electronic format or securely delete all Personal Data.
8.2. The Provider shall complete the return or deletion of Personal Data within thirty (30) days of the termination or expiration of the Terms of Service.
8.3. The Provider may retain Personal Data to the extent required by applicable law, provided that the Provider ensures the Personal Data is held securely and only Processed as necessary to comply with the legal requirement.
9. International Transfers
9.1. The Provider shall not transfer Personal Data outside the EEA without the Customer's prior written consent.
9.2. If the Customer consents to an international transfer of Personal Data, the Provider shall ensure that such transfer is made in compliance with Data Protection Laws, including by implementing appropriate safeguards such as Standard Contractual Clauses, Binding Corporate Rules, or reliance on an adequacy decision.
10. Liability
10.1. The Provider's liability arising out of or related to this DPA shall be subject to the limitations and exclusions of liability set out in clause 10 of the Terms of Service.
10.2. Nothing in this DPA shall limit either party's liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, or any other liability that cannot be excluded or limited under applicable law.
11. General Provisions
11.1. This DPA shall be governed by and construed in accordance with the laws of England and Wales.
11.2. Any dispute arising out of or in connection with this DPA shall be subject to the exclusive jurisdiction of the courts of England and Wales.
11.3. This DPA may only be amended or modified by written agreement of both parties.
11.4. If any provision of this DPA is held to be invalid, illegal, or unenforceable, the remaining provisions shall continue in full force and effect.
11.5. This DPA shall remain in effect for so long as the Provider Processes Personal Data on behalf of the Customer.
11.6. In the event of any conflict between the provisions of this DPA and the Terms of Service, the provisions of this DPA shall prevail to the extent of the conflict with respect to the Processing of Personal Data.