Terms and Conditions

1. Introduction and Definitions

These terms and conditions of use ("Terms") govern access to and use of the software-as-a-service (SaaS) whistleblowing platform called "TrueSpeak" ("Platform" or "Service"), provided by True Solutions S.r.l., a company with registered office at Foro Buonaparte 59, 20121 Milan (MI), Italy, VAT number 14288140966, registered in the Companies Register of Milan (MI) n. 2772480 ("Provider", "we", "our"). TrueSpeak is a trade name of True Solutions S.r.l. Use of the Platform is subject to full and unreserved acceptance of these Terms. If the user does not accept these Terms, they may not access or use the Platform.

1.1 Definitions

For the purposes of these Terms, the following shall mean: (a) "User" or "Client": the natural or legal person who accesses and uses the Platform; (b) "Account": the user account created on the Platform to access services; (c) "Content": all data, information, documents, reports and materials uploaded or entered into the Platform by the User; (d) "Report": the communication of violations or unlawful acts made through the Platform in accordance with EU Directive 2019/1937; (e) "Service": the SaaS whistleblowing platform provided by the Provider; (f) "Data": all personal and non-personal information processed through the Platform.

2. Acceptance of Terms

Access to and use of the Platform implies full and unreserved acceptance of these Terms and the conditions contained therein. The User declares that they have read, understood and accepted these Terms before using the Platform. If the User does not accept these Terms, they must immediately cease using the Platform. Acceptance of these Terms constitutes a binding agreement between the User and the Provider. The User guarantees that they have the legal capacity necessary to accept these Terms and are authorized to represent the entity or organization on whose behalf they access the Platform, where applicable.

3. Service Description

TrueSpeak provides a software-as-a-service (SaaS) platform for managing whistleblowing reports, compliant with EU Directive 2019/1937 on the protection of persons who report breaches of Union law. The Platform allows Users to:

• Send reports of violations or unlawful acts in anonymous or identified form, in compliance with the provisions of EU Directive 2019/1937
• Manage the entire whistleblowing process, from receipt of reports to their management and follow-up
• Ensure protection of the reporter's identity and confidentiality of information, in compliance with applicable regulations
• Ensure regulatory compliance with EU Directive 2019/1937, GDPR and other applicable regulations on personal data protection
• Configure and customize the Platform according to the specific needs of the organization
• Access reporting, analysis and report management features through a secure web interface

4. Registration and Account

To use the Platform, the User must create an account by providing accurate, complete and up-to-date information. The User is responsible for: (a) maintaining the confidentiality of their access credentials (username and password); (b) all activities that occur under their account; (c) immediately notifying the Provider of any unauthorized use of their account or any other security breach; (d) ensuring that information provided during registration is truthful, accurate and complete. The Provider reserves the right to refuse registration or suspend/terminate the account of any User who violates these Terms or provides false or misleading information.

5. User Obligations

The User undertakes to use the Platform in compliance with these Terms, applicable regulations and best practices. In particular, the User undertakes to:

• Provide truthful, accurate, complete and up-to-date information during registration and use of the Platform
• Use the Platform exclusively for legitimate purposes and in compliance with EU Directive 2019/1937 and applicable regulations
• Respect the privacy, rights and dignity of all persons involved in the whistleblowing process
• Maintain the confidentiality of their access credentials and not share them with third parties
• Not attempt to access unauthorized accounts, systems or areas of the Platform
• Not interfere with the operation of the Platform or attempt to compromise its security
• Use the Platform in compliance with all applicable laws, regulations and standards
• Immediately notify the Provider of any security breaches or unauthorized uses

6. Prohibited Uses

It is expressly prohibited to use the Platform for:

• Sending false, slanderous, defamatory reports or reports made in bad faith, solely for the purpose of harming third parties
• Violating the privacy, intellectual property rights or other rights of third parties
• Spreading, uploading or transmitting viruses, malware, harmful code or other elements that may compromise Platform security
• Attempting unauthorized access to systems, networks or data of the Provider or other users
• Using the Platform for unauthorized commercial purposes, advertising, spam or unsolicited marketing communications
• Collecting or attempting to collect personal information of other users without their consent
• Using the Platform in a manner that violates any applicable law, regulation or standard
• Interfering with or disrupting the operation of the Platform or connected servers and networks

7. Intellectual Property

All intellectual property rights in the Platform, including but not limited to software, source code, design, logos, trademarks, content and documentation, are the exclusive property of the Provider or its licensors. The User acknowledges that the Platform is protected by copyright, registered trademarks and other intellectual property laws. The User does not acquire any ownership rights in the Platform through use of the Service. The User may use the Platform exclusively for purposes permitted by these Terms. It is prohibited to copy, modify, distribute, sell, license or create derivative works from the Platform without the written consent of the Provider. Content uploaded by the User to the Platform remains the property of the User. The User grants the Provider a non-exclusive, royalty-free and non-transferable license to use the Content exclusively for purposes strictly necessary for service delivery, such as storage, display and transmission of Content to authorized users. This license does not extend to any commercial, promotional use or use other than service delivery and automatically terminates upon termination of the Contract. The license does not apply to content relating to whistleblowing reports, which are processed exclusively for report management purposes, in compliance with EU Directive 2019/1937 and GDPR.

8. Privacy and Personal Data Protection

The processing of personal data through the Platform is governed by the TrueSpeak Privacy Policy, available at /privacy-policy, and Regulation (EU) 2016/679 (GDPR). The User acknowledges that they have read and understood the Privacy Policy and the Cookie Policy, available at /cookie-policy, and accepts the processing of their personal data as described therein. For data processed in the context of whistleblowing reports, the client company is the Data Controller pursuant to Art. 4(7) GDPR. True Solutions S.r.l. acts as Data Processor pursuant to Art. 28 GDPR, according to the appointment available at /nomina-responsabile. The Client may request the signing of the data processor appointment contract pursuant to Art. 28 GDPR. The updated list of sub-processors is available at /subresponsabili. The Provider guarantees that the identity of the reporter, any persons involved and the content of the report are protected in accordance with EU Directive 2019/1937. Access is permitted exclusively to authorized subjects designated by the Client. The Provider never accesses the content of reports, except when strictly necessary for legal obligations or for technical reasons related to system security, and in any case only with prior authorization from the Client. Report retention is governed by the Report Management Procedure published at /procedura and varies according to the subscription plan (from 6 months to 5 years). Reports are automatically closed after 90 days from the last update by either party (reporter and recipient). The data retention period starts from the closure date, whether automatic or manual. Technical logs are retained for the period strictly necessary for security (max 24 months). The Platform provides tools to enable the Client to comply with legal obligations regarding confirmation within 7 days and response within 3 months in accordance with EU Directive 2019/1937. The User is responsible for ensuring that the processing of personal data through the Platform complies with applicable regulations and that all necessary consents have been obtained.

9. Limitation of Liability

The Provider provides the Platform "as is" and "as available", without warranties of any kind, express or implied. To the maximum extent permitted by applicable law, the Provider shall not be liable for:

• Direct, indirect, incidental, consequential or punitive damages arising from use or inability to use the Platform
• Loss of data, information or Content, even if the Provider has been advised of the possibility of such damages
• Temporary or permanent interruptions of the Service due to maintenance, updates, technical failures or force majeure
• Damages arising from improper use of the Platform by the User or violations of these Terms
• Damages arising from cyber attacks, viruses, malware or other security threats
• Damages arising from decisions or actions based on information or Content present on the Platform

The total liability of the Provider to the User, for any reason and in any form, shall not exceed the total amount paid by the User to the Provider in the twelve (12) months preceding the event that gave rise to the liability. The above limitations of liability do not apply in case of willful misconduct or gross negligence of the Provider, nor in case of violation of mandatory legal provisions.

10. Service Availability and Maintenance

The Provider undertakes to ensure maximum availability and reliability of the Platform, while reserving the right to make temporary interruptions for maintenance, updates, improvements or technical reasons. The Provider undertakes to: (a) notify Users in advance, when possible, of scheduled Service interruptions; (b) minimize the duration of interruptions; (c) ensure a Service availability level of at least 99.5% on a monthly basis (SLA). Availability is calculated as a percentage of actual uptime minutes versus total minutes in the reference month. Monitoring is carried out through the independent UptimeRobot service, whose data is publicly available at https://stats.uptimerobot.com/3QXvnmyadI. The following are excluded from the calculation: scheduled maintenance interruptions communicated at least 24 hours in advance, outages caused by third-party infrastructure providers (e.g. AWS, Cloudflare), and force majeure events. In the event the SLA is not met for two consecutive months, the User has the right to withdraw from the Contract without penalties, with a pro-rata refund for the unused period. The Provider guarantees adequate technical and organizational measures as described in the "Data Processor Appointment" document and the "Incident Management Procedure". These documents form an integral part of these Terms. The Provider has implemented daily backup and disaster recovery procedures, according to what is described in the DPIA and internal security measures. The Provider shall not be liable for interruptions or malfunctions due to force majeure, including but not limited to: natural disasters, wars, terrorist attacks, pandemics, strikes, interruptions of communications or electricity, or other events beyond the reasonable control of the Provider.

11. Modifications to Terms and Service

The Provider reserves the right to modify these Terms at any time, in particular to reflect changes in applicable legislation, Service features or for other legitimate reasons. Substantial changes to the Terms will be communicated to Users through appropriate channels (for example, by notice on the Platform or by email) at least thirty (30) days before they take effect. Continued use of the Platform after the changes take effect constitutes acceptance of the modified Terms. If the User does not accept the changes, they must cease using the Platform and may request termination of their account. The Provider also reserves the right to modify, suspend or discontinue any aspect of the Service, including but not limited to features, content or availability, at any time and without notice. The Provider reserves the right to modify the Service fee, notifying the User of the change with a minimum notice of 30 (thirty) days before the plan renewal date. The new fee will apply from the next renewal. Continued use of the Service after renewal constitutes acceptance of the new fee. If the User does not wish to accept the change, they may withdraw according to the procedures set out in Art. 13.

12. Technische ondersteuning

Voor elk verzoek om technische ondersteuning kan de Gebruiker contact opnemen met de Aanbieder door een e-mail te sturen naar [email protected]. De Aanbieder verbindt zich ertoe meldingen zo snel mogelijk in behandeling te nemen.

13. Beëindiging en opschorting

De Gebruiker kan het Contract bij afloop opzeggen door zijn voornemen mee te delen via PEC aan het adres [email protected] of via het gedeelte "Beheer uw abonnement" in het dashboard. De Aanbieder kan de toegang van de Gebruiker tot het Platform onmiddellijk en zonder voorafgaande kennisgeving opschorten of beëindigen in geval van: (a) schending van deze Voorwaarden; (b) frauduleus, illegaal of ongeoorloofd gebruik van het Platform; (c) verzoek van bevoegde autoriteiten; (d) sluiting of beëindiging van de activiteiten van de Gebruiker; (e) om elke andere gerechtvaardigde reden. Bij beëindiging verliest de Gebruiker de toegang tot zijn account en de daarin opgeslagen Inhoud, tenzij anders bepaald door de wet of specifieke overeenkomsten. De Aanbieder behoudt zich het recht voor gegevens te bewaren gedurende de door de wet vereiste perioden of voor nalevingsdoeleinden. Bepalingen van deze Voorwaarden die naar hun aard de beëindiging dienen te overleven, met inbegrip van maar niet beperkt tot intellectueel eigendom, beperking van aansprakelijkheid, privacy en toepasselijk recht, blijven van toepassing na beëindiging. De Gebruiker heeft het recht om binnen 30 (dertig) dagen na de datum van inschrijving het Contract te herroepen, zonder opgave van redenen. Bij uitoefening van dit recht zal de Aanbieder alle betaalde bedragen onmiddellijk terugbetalen. De herroeping moet worden meegedeeld via PEC aan het adres [email protected], per e-mail aan [email protected], of via het gedeelte "Beheer uw abonnement" in het dashboard.

14. Toepasselijk recht en bevoegde rechter

Deze Voorwaarden worden beheerst door en geïnterpreteerd in overeenstemming met het Italiaans recht. Elk geschil dat voortvloeit uit of verband houdt met deze Voorwaarden, met inbegrip van hun geldigheid, interpretatie, uitvoering of beëindiging, wordt onderworpen aan de exclusieve bevoegdheid van de Rechtbank van Milaan. Dit Contract wordt gesloten tussen professionals voor commerciële doeleinden. De partijen sluiten de toepasselijkheid van consumentenbeschermingsbepalingen of bepalingen ter bescherming van zwakkere contractpartijen uit. Voor alternatieve geschillenbeslechting kunnen de partijen gebruik maken van het ODR-platform van de Europese Commissie, beschikbaar op https://ec.europa.eu/consumers/odr/. De partijen verbinden zich ertoe geschillen minnelijk te trachten op te lossen alvorens gerechtelijke stappen te ondernemen.

15. Contact

For any questions, requests or reports relating to these Terms and Conditions or the use of the Platform, you can contact the Provider: