Terms and conditions of sale and use

Template to be reviewed by a lawyer. This document is a draft of general terms. It must be reviewed and adapted by legal counsel before any contractual use. In case of discrepancy, the French version prevails.

These general terms and conditions (the “Terms”) govern access to and use of the OK-GRC platform. They are entered into between ESERENIT, a SAS with a share capital of 1 000 €, whose registered office is at 16 rue Cuvier, 69006 Lyon, France, registered with the RCS Lyon 909 937 948 (“ESERENIT”), and any legal entity or individual acting for professional purposes who subscribes to the Service (the “Customer”).

1. Purpose and scope

1.1. OK-GRC is an online software platform (SaaS) that helps organisations run their compliance: frameworks and controls, Statement of Applicability, risks, documents, evidence, tasks, GDPR records, incidents, vendors, audits, training and an artificial intelligence assistant (the “Service”).

1.2. The Service is reserved for professionals. By accepting the Terms, the Customer declares that it acts in the course of its business. Consumer protection provisions do not apply.

1.3. The Terms apply to the exclusion of any general purchasing conditions of the Customer. They are accepted at sign-up (tick box); the applicable version is the one in force on the date of subscription or renewal. An Enterprise offer may be subject to special terms, which prevail over the Terms in case of conflict.

2. Definitions

• Account: an organisation’s workspace in the Service, opened by the Customer.
• User: any individual authorised by the Customer to access its Account.
• Billed user: a User with a role allowing them to edit data (owner, administrator, CISO, DPO, quality manager, contributor). The viewer and external auditor roles, and the consultants of a partner firm accessing the Account, are not billed, within the limits of the plan.
• Customer Data: all data and files put into the Service by the Customer or its Users.
• Plan: the chosen subscription plan (Starter, Pro, Enterprise) and its billing period (monthly or annual).

3. Access to the Service and Account

3.1. The Customer creates its Account online, providing accurate and up-to-date information. It designates at least one Account owner.

3.2. Credentials are personal and confidential. The Customer ensures that its Users protect them and, where relevant, turns on the mandatory two-factor authentication offered by the Service. Any action performed with a User’s credentials is deemed performed by that User.

3.3. The Customer is responsible for the rights it grants to its Users and to the partners (consultants, auditors) it gives access to its Account. It can revoke such access at any time.

4. Free trial

4.1. A 14-day free trial is offered on the first subscription. During the trial, the Customer gets the features of the Pro plan, with a quota of 200 artificial intelligence credits.

4.2. A valid payment method is requested at sign-up. Nothing is charged before the end of the trial. The Customer can cancel at any time during the trial from the Billing page of the application; nothing is then owed.

4.3. Unless cancelled before the end of the trial, the subscription to the chosen Plan starts automatically and the first payment is collected. A reminder is sent to the Customer before the end of the trial.

5. Plans and prices

5.1. The Plans and their prices are described on the Pricing page. Prices are in euros excluding taxes; VAT and other applicable taxes are added according to the Customer’s country and tax status.

5.2. Each Plan includes a base price covering a number of Billed users; each additional Billed user incurs a supplement prorated over the current period. Every framework of the catalogue is included in every Plan.

5.3. ESERENIT may change its prices. Any increase is notified to the Customer at least thirty (30) days in advance and only applies from the next renewal; the Customer may cancel before that date.

6. Invoicing and payment

6.1. Subscriptions are payable in advance, by card or any other method offered by our payment provider Stripe. Invoices are available in the application. For the Enterprise plan, payment by bank transfer on invoice may be agreed.

6.2. In the event of non-payment, ESERENIT sends reminders to the Customer. Without settlement, access to the Account may be limited to read-only fourteen (14) days after the unpaid due date, and the subscription terminated thirty (30) days after it. The Customer keeps access to the Billing page and to the export of its data during the suspension.

6.3. In accordance with Article L. 441-10 of the French Commercial Code, any amount unpaid when due bears interest at three times the legal interest rate and gives rise to a fixed recovery fee of €40.

7. Term and renewal

7.1. The subscription is entered into for one month or one year depending on the Plan chosen. It is automatically renewed for the same period, unless cancelled under Article 8.

7.2. The Customer can change Plan or billing period at any time from the application; the difference is prorated.

8. Termination

8.1. The Customer can cancel its subscription at any time from the application. Cancellation takes effect at the end of the current period; amounts paid for the current period are not refunded, unless otherwise provided in special terms.

8.2. In the event of a serious breach by either party, not remedied within fifteen (15) days of formal notice, the other party may terminate the subscription by operation of law, without prejudice to damages.

8.3. ESERENIT may suspend without notice the access of a User whose use threatens the security of the Service or of other customers, informing the Customer as soon as possible.

9. Reversibility and Customer Data

9.1. The Customer can export its Data at any time from the application, in open formats (XLSX, CSV, PDF and original files).

9.2. At the end of the subscription, Customer Data is kept for ninety (90) days so the Customer can retrieve it, then permanently deleted, subject to backups, which are overwritten according to their rotation cycle, and to legal retention obligations (invoices in particular).

9.3. On request, ESERENIT can assist with data migration under a service quoted in advance.

10. Customer obligations

The Customer undertakes to:

• use the Service in accordance with its purpose, the Terms and the law;
• only upload lawful content for which it holds the necessary rights;
• not upload personal health data (the Service is not an HDS-certified host) or payment card data;
• not attempt to access other customers’ data, circumvent security measures or perform penetration tests without ESERENIT’s prior written consent;
• not resell or make the Service available to third parties outside the cases provided for (partner and auditor access).

11. Availability, maintenance and support

11.1. ESERENIT uses reasonable efforts to keep the Service available 24/7, excluding maintenance. Service level commitment: [[To complete: guaranteed monthly availability, measurement method and any service credits, in particular for the Enterprise plan]].

11.2. Planned maintenance is, as far as possible, carried out outside business hours and announced in advance.

11.3. Support is provided by email according to the Plan subscribed.

12. Artificial intelligence

12.1. The Service offers an artificial intelligence assistant that produces suggestions (drafts): policies, analyses, justifications, answers. These suggestions are provided as an aid; they may be incomplete or inaccurate. The Customer reviews them and decides how to use them; no suggestion is saved without the Customer’s action.

12.2. The Customer chooses the AI provider used (Anthropic’s Claude model or a model hosted by ESERENIT; the Customer’s own endpoint on the Enterprise plan) and can turn the AI off for its organisation. Usage is counted in credits according to the Plan.

12.3. The Customer shall not use the assistant for purposes contrary to the law or to the AI providers’ usage policies.

13. Personal data

13.1. For Customer Data, ESERENIT acts as a processor under Article 28 of the GDPR, under the terms of the data processing agreement, which forms an integral part of the Terms.

13.2. For managing the business relationship (accounts, billing, support), ESERENIT acts as controller, as described in the privacy policy.

14. Security

ESERENIT implements appropriate technical and organisational measures to protect the Service and Customer Data, described on the Security and trust page and in the annex of the data processing agreement. The Customer remains responsible for the security of its own equipment, access and credentials.

15. Intellectual property

15.1. The Service, its software, its library of controls, its templates and its documentation are and remain the property of ESERENIT. ESERENIT grants the Customer, for the term of the subscription, a personal, non-exclusive and non-transferable right to use the Service for the internal needs of its organisation.

15.2. Documents the Customer creates from the templates provided belong to the Customer; it may keep and use them after the end of the subscription for its internal needs.

15.3. The Customer remains the owner of Customer Data. It grants ESERENIT the right to process it solely to provide the Service.

15.4. The Service does not provide the texts of ISO/IEC standards, which must be purchased from their publishers; it offers summaries written by ESERENIT.

16. Confidentiality

Each party undertakes to keep confidential the information of the other party it learns while performing the Terms, during their term and for five (5) years afterwards, except public information or disclosure required by law.

17. Liability

17.1. ESERENIT is bound by an obligation of means (best efforts). The Service is a support tool: it guarantees neither the Customer’s compliance with a regulation or a standard nor obtaining a certification, which depend on the measures actually implemented by the Customer and on the assessment of authorities or certification bodies.

17.2. ESERENIT shall not be liable for indirect damage such as loss of revenue, customers, data attributable to the Customer, or reputational harm.

17.3. In any event, ESERENIT’s total liability under the Terms, for all causes combined, is capped at the amount excluding taxes actually paid by the Customer during the twelve (12) months preceding the event giving rise to liability. This cap does not apply in case of gross negligence or wilful misconduct, or to personal injury.

18. Force majeure

Neither party is liable for a failure resulting from force majeure within the meaning of Article 1218 of the French Civil Code. If the impediment lasts more than thirty (30) days, either party may terminate the subscription without compensation.

19. Partners and subcontracting

ESERENIT may use subcontractors to provide the Service; the list of sub-processors processing personal data is published on the Sub-processors page. Consultants and partner firms the Customer gives access to act under the sole responsibility of the Customer and of those partners.

20. Changes to the Terms

ESERENIT may change the Terms. Material changes are notified to the Customer at least thirty (30) days before they take effect; a Customer refusing them may cancel its subscription before that date.

21. General provisions

If any provision of the Terms is held invalid, the other provisions remain in force. A party’s failure to enforce a breach is not a waiver. The Terms are written in French; in case of translation, the French version prevails.

22. Governing law and jurisdiction

The Terms are governed by French law. The parties will try to settle any dispute amicably. Failing agreement within thirty (30) days, any dispute relating to their formation, interpretation or performance shall be submitted to the exclusive jurisdiction of the Commercial Court of Lyon (tribunal de commerce de Lyon), including in case of multiple defendants or third-party claims.