AcunaGRC Terms and Conditions

2.1 General

The Company shall provide the Customer with Services in accordance with this Agreement and with due care and accuracy.

The provision of Services include two phases: (i) the phase of configuration ("Configuration Phase"), during which the Company provides the Configuration Services as set out in the relevant Order Form; and (ii) the phase of service ("Subscription Phase"), during which the Company provides the Subscription Services and the Advisory Services (if applicable as per the relevant Order Form) as set out in the relevant Order Form.

Unless otherwise agreed in the relevant Order Form, both the Configuration Phase and the Subscription Phase begin on the Start Date set forth in the relevant Order Form.

2.2 Configuration Services

To the extent applicable under the Order Form, the Configuration Services include, but are not limited to, the migration of Customer to the Platform and related configuration.

The Company shall perform the Configuration Services with reasonable skill, care, and diligence. As the success of the Configuration Services is partly dependent on the Customer's cooperation and engagement, any outcomes described in an Order Form or any other correspondence represent the Parties' shared objectives and do not constitute a guarantee of a specific result.

Upon the end of the Configuration Phase, the Parties carry a formal handover documenting in text form the end of the provision of the Configuration Services. Each Party shall collaborate in this handover to the extent necessary.

2.3 Subscription Services

The Subscription Services are made available by the Company on https://acunagrc.com ("Platform").

The Subscription Services are made available through different subscription plans (each a "Subscription Plan") including different sets of features, functionalities and modules. A complete overview of the Subscription Services, Subscription Plans, related features, and pricing is available on the Platform. To the extent agreed in the respective Order Form, certain features of the Subscription Services may be governed by a separate schedule to these Terms. Upgrades and downgrades of Subscription Plans are possible at the conditions set forth in these Terms.

The Company shall provide the Subscription Services in the then-current version and according to the applicable Subscription Plan and this Agreement.

Depending on the features selected in the relevant Subscription Plan, Company may provide services related to third-party users ("Third-Party Users"), such as assessment, mapping, or evaluations. In such case, relevant Third-Party Users may be required to provide input to the Company via the Services. Customer hereby acknowledges that (i) Company assumes no liability regarding any such input of the Third-Party Users, and (ii) Company shall not be held responsible for delays or disruptions caused by such Third-Party Users, and such circumstances do not entitle Customer to any refund, compensation, or early termination.

2.4 Advisory Services

To the extent applicable under the Order Form, Company provides the Advisory Services to support Customers in managing third-party risks and strengthening their supplier relationship management practices.

The Advisory Services notably include:

• guidance on third-party risk management principles, processes and activities.
• support on legal and compliance requirements, security strategies, and best practices to enhance protection and operational efficiency.
• individual support (1-to-1 follow-up) tailored to the Customer's specific needs and objectives.

Advisory Services are provided to the extent agreed in the Order Form and are subject to the Advisory Fees, and are not included in the Subscription Services.

2.5 Access to Services

To access and use the Services, Customer shall agree to this Agreement by signing an Order Form, and shall have obtained an account (the "Account") on the Platform. The Services include access to a personal dashboard via which Customer may manage the Account, Subscription Plan, and related features.

Company provides access to the Platform to the Customer, who is responsible for designating the individuals authorized to use the Services on its behalf ("Authorized Users"). For the purposes of this Agreement, "Authorized User" means any employee or representative of the Customer expressly authorized to access and use the Services within the limits of the license granted and the user count allowed under the applicable Subscription Plan, or any other third-party expressly defined as such.

Customer must provide accurate, current, and complete information during registration and keep their Account information up to date. Customer is responsible for maintaining the confidentiality and security of their account credentials and may not disclose their credentials to any third party.

Customer is responsible and liable for activities conducted through their Account, including by Authorized Users, and must immediately notify Company if there is any suspicion that their credentials have been lost, stolen, or their account is otherwise compromised.

Company may, at any time, require the Customer to update or reset its password or other authentication means in connection with the security of the Services. The Customer must comply with such requests without undue delay. Failure to do so may result in temporary suspension of access to the Services.

2.6 Services Commitments

Access to the Platform and the functionalities included in the Subscription Plan are delivered as performance-based services, to the extent set forth in the Order Form or otherwise agreed by the Parties. Company undertakes to ensure that such functionalities are made available and operate in accordance with the specifications and service levels set out in these Terms. Where the Parties have agreed to a separate service level agreement ("SLA"), whether incorporated by reference in the Order Form or executed as a standalone document, the service levels and related commitments set forth in the SLA shall apply in addition to, and in the event of conflict shall prevail over, the provisions of this Section with respect to service levels only.

Services involving professional input, such as the Configuration Services and the Advisory Services, are provided under a duty of care. For such Services, Company commits to act diligently and to apply appropriate expertise and resources in the provision of the Services. Unless explicitly agreed otherwise, the Services are provided without any warranty of any kind, in accordance with these Terms.

The Services do not constitute outcome-based engagements and shall not be interpreted as a commitment to deliver a particular commercial, operational, or regulatory result.

2.7 Maintenance of the Services

Company may from time to time perform maintenance, updates, or improvements to the Services and related infrastructure. Such activities may temporarily impact the availability or performance of the Services.

Where maintenance is expected to substantially affect the Customer's access to or use of key functionalities of the Services, Company shall make reasonable efforts to:

• provide the Customer with a minimum of five (5) business days prior notice (via the Platform, email, or other agreed communication channels); and
• carry out the maintenance in a manner that minimizes disruption.

For the purpose of this clause, a substantial impact includes notably:

• planned downtime of the Platform exceeding four (4) consecutive hours during business days in Switzerland.
• updates that disable or suspend access to essential modules or workflows used by the Customer, at Company's reasonable discretion.
• changes that require Customer-side technical adaptations or reconfigurations.

In the event of emergency or unscheduled maintenance, Company shall use reasonable efforts to notify the Customer as soon as practicable and provide relevant information regarding the nature and expected duration of the interruption.

2.8 Modification of the Services

Customer acknowledges and agrees that Company may, from time to time, and at its sole discretion, without substantially changing or degrading the existing features, modify, enhance and/or expand the features and functionality of the Services.

Company may suppress access to the Platform and discontinue the Services or elements thereof, provided that Company will provide ninety days (90) prior notice to Customer if such changes materially and substantially degrade the existing features and functionality of the Services.

In such cases, the Customer may terminate its Subscription Plan by notifying Company within thirty (30) days following receipt of the notice. Termination shall take effect on the date on which the change is scheduled to occur ("Occurrence"), and Company shall reimburse the Customer for the portion of the Fees (as defined below) corresponding to the period between the Occurrence and the end of the Subscription Plan. Sections 5 and 7 applies to the post-termination and the recovery of the information on Customer's Account.

2.9 AI Disclaimer

Customer hereby acknowledges and agrees that using AI and machine learning tools such as some of the tools included in the Services or used by Company in the context of the Services can produce results influenced by data used for training the algorithm. Customer acknowledges that such outputs are generated by large language models and may contain inaccuracies, biases, or similarities to existing works. Although Company uses its best efforts to prevent the Services from producing biased output through technical and statistical support, Company does not warrant that the output will be entirely free of inaccuracies, biases, or similarities to existing works.

3.1 General Use and Compliance

Customer agrees to use the Services in compliance with these Terms and all legal and moral obligations applicable in the territory where they are located.

Customer is solely responsible for:

• all activities carried out through its Account, including by its personnel or any third party granted access by the Customer.
• maintaining the confidentiality and security of its login credentials.
• ensuring that its IT environment and systems meet the minimum technical requirements for accessing and using the Services, to the extent communicated from time to time by Company.

Company shall not be liable for any loss or damage resulting from unauthorized access, misuse of credentials, or failure by the Customer to secure its systems.

3.2 Cooperation

The Customer shall cooperate in good faith with Company in the performance of the Services, to the extent necessary, and free of charge.

This includes providing, in a timely and complete manner, all necessary information, documents, materials, access, software, data, as well as competent staff, and anything else reasonably required for the provision of Services.

This duty of cooperation applies in particular, but not limited to, Services involving professional input, such as Services requiring active interaction between the Parties. The Customer acknowledges that such Services cannot be effectively delivered without timely and adequate cooperation.

Failure to cooperate or to provide the necessary resources may adversely affect the performance or continuity of the Services. In such cases, no refund, credit, or right of termination shall be granted.

3.3 Prohibited uses

Customer shall not, directly or indirectly:

• access the Platform via unauthorized automated means, or take any action placing an unreasonable load on Company's infrastructure.
• use the Services for any unlawful or fraudulent purpose, including but not limited to storing or distributing content that is harassing, threatening, defamatory, obscene, or that infringes privacy or intellectual property rights.
• access the Platform or use the Services in connection with any unfair practice or conduct, including, without limitation, accessing the Platform for benchmarking or competitive purposes, monitoring their availability, performance or functionality, conducting competitive intelligence, scraping data, simulating user activity, or attempting to exploit the Services for purposes unrelated to legitimate use;
• make the Services available to anyone other than an Authorized User, or if agreed by the Parties in the Order Form, to an End User.
• sell, resell, rent, lease, offer any time-sharing arrangement, service bureau or any service based upon, the Services.
• interfere with or disrupt the integrity or performance of the Services or third-party data contained therein.
• attempt to gain unauthorized access to the Services or any associated systems or networks and circumvent or attempt to circumvent any security protection of the Services.
• modify, make derivative works of, disassemble, decompile or reverse engineer the Services or any component thereof including the source code.

Customer shall immediately inform Company of any circumstances within its sphere that might endanger or may be relevant to the provision of the Services and all misuses or suspicions of misuse of the Services.

Company reserves the right to suspend or terminate access to the Services in case of actual or suspected breach of this section.

4.1 General

The provision of the Services to Customer is subject to payment of the applicable fees as set out in the Order Form ("Fees"). Fees comprise (i) the Configuration Fees, as further set out in Section 4.2, (ii) the Subscription Fees, as further set out in Section 4.3, and (iii) the Advisory Fees, as further set out in Section 4.4. Except where prohibited by law, or otherwise specified in these Terms, Fees are non-refundable.

If not explicitly stated otherwise, all Fees are in CHF and excluding VAT and other applicable taxes. Late payments result in an interest rate of 5% p.a.

Any right to set off, retain, deduct, counterclaim and/or withhold any payments due under the Terms vis-a-vis Company is hereby expressly waived and excluded.

4.2 Configuration Fees

Where Configuration Services are set out in the Order Form, the Customer shall pay the Configuration Fees as specified therein.

Unless otherwise agreed in the Order Form, the Configuration Fees are invoiced upon completion of the Configuration Phase as set out in the Order Form.

Unless otherwise agreed in the Order Form, no Configuration Services will commence until the first instalment of the Configuration Fees has been validly paid.

The Configuration Fees are non-refundable once the Configuration Phase has commenced, except in the event of termination by Customer due to Company's material breach in accordance with Section 5.

4.3 Subscription Fees

Unless otherwise agreed in the Order Form, the Customer shall pay the Subscription Fees in advance upon subscription or renewal (as applicable).

No Subscription Services are provided until the valid payment of the Subscription Fees and Company may limit the features according to the applicable Subscription Plan until the valid payment of the Subscription Fees.

Company may change the Subscription Fees from time to time. Any price changes will apply to a respective Customer from the next renewal or new Subscription Plan period.

Upgrades of Subscription Plans are possible at any time. If Customer upgrades during an ongoing Subscription Plan, the surcharge must be paid proportionately in advance; the upgraded Subscription Plan is only available upon valid payment of the applicable surcharge.

Downgrades of Subscription Plans can only be carried out at the end of the termination period in accordance with Section 5, or as otherwise agreed at Company's sole discretion.

4.4 Advisory Fees

Where Advisory Services are set out in the Order Form, the Customer shall pay the Advisory Fees as specified therein.

The Parties may agree on additional Advisory Services and an increase of the Advisory Fees at any time in text form.

Unless otherwise agreed in the Order Form, the Customer shall pay the Advisory Fees in advance on a monthly basis.

6.1 License to the Services

Company retains all right title and interest in and to the Services, including all intellectual property rights (the "Services IPR") therein and thereto, and Customer acquires no rights with respect to the Services, by implication or otherwise, except for those expressly granted in these Terms.

Company grants Customer a personal, non-transferable, non-assignable and non-exclusive license to the Services IPR to the extent required for the provision of the Services as per the Subscription Plan applicable to the Customer and solely for Customer's internal business purpose during the term of this Agreement ("License").

The License:

• includes the use of its functionalities, loading, accessing, using and displaying data generated from it.
• includes, to the extent permitted by the rightsholders, any use via interfaces already integrated in the Platform.
• is limited to the number of Authorized Users as specified in the applicable Subscription Plan.

6.2 Customer Data: ownership and license

Customer retains all rights and interests in data and information submitted, transmitted, generated or stored by Customer and/or Authorized Users and/or any Third-Party User in connection with use of the Services under these Terms ("Customer Data"), including all intellectual property rights therein and thereto, and Company acquires no rights with respect to Customer Data, except otherwise expressly granted in these Terms.

Customer hereby grants Company, a non-exclusive, worldwide, perpetual, irrevocable, royalty-free, right and license (including the right to authorize and grant sublicenses) to use, store, reproduce, distribute, and display Customer Data, for the purpose of providing the Services to the Customer and fulfilling Company's obligations under these Terms. This license also permits Company to process Customer Data to maintain, support and improve the Services (for example, to develop or enhance features and functionality), in each case in accordance with these Terms.

The processing of Customer Data as per the above-granted license includes both automated and manual (human) methods of processing. Company's automated methods often are related to and supported by manual methods.

6.3 Responsibility for Data Legality and Integrity

The Customer is solely responsible for the content, accuracy, and legality of all Customer Data submitted to the Services, whether by the Customer directly or by any third party acting on its behalf.

To the extent relevant, the Customer is solely responsible for ensuring that any data, information, or documentation submitted by a third-party on its behalf via the Platform, including potentially confidential, proprietary, or legally protected content (such as business secrets, intellectual property, or personal data), is collected, transmitted, and processed in compliance with applicable laws and contractual obligations.

The Customer shall, where required, obtain any necessary consent, authorization, or legal basis from such third-party prior to requesting or facilitating the submission of such data through the Services.

The Customer represents and warrants that:

• all Customer Data has been collected and submitted in full compliance with, these Terms, applicable laws, including data protection and intellectual property laws.
• it has obtained any required authorizations, consents, or legal bases (including under the FADP, GDPR or other applicable laws) to permit Company to process the Customer Data as set out in these Terms; and
• such Customer Data does not infringe or violate any third-party rights or legal obligations.

To the extent relevant, the Customer hereby acknowledges and understands that Company acts solely as a technical intermediary with respect to data or content submitted by any third-party and that Company is not responsible for its content, accuracy, legality, or authorization.

6.4 Data Protection and Privacy

The specific modalities under which personal data is collected and processed by Company including applicable legal bases, retention, data subject rights and international transfers, are described in Company's Privacy Policy available on Company's website.

To the extent that Customer Data includes personal data (as defined under FADP, GDPR or other applicable data protection law), the Parties acknowledge the following:

• For personal data processed by Company for its own business purposes, such as contract and account management, invoicing, and overall Customer relationship management, Company acts as an independent Data Controller, and processes such data in accordance with its Privacy Policy and applicable data protection laws.
• For personal data submitted to the Platform by or on behalf of the Customer (including data from third parties) for the purpose of using the Services, the Customer acts as the "Data Controller" (or equivalent term under applicable law) and Company acts as the "Data Processor" (or sub-contractor).

Unless otherwise agreed (see section below), when processing Customer Data as a Data Processor, Company shall process such personal data only on the documented instructions of the Customer and strictly for the purposes of providing the Services, in accordance with this Terms. Company will comply with all obligations applicable to it as a data processor under FADP, GDPR, and any other relevant data protection laws.

In particular, Company will implement and maintain all measures required by law to protect personal data, ensure that any personnel authorized to process the personal data are bound by confidentiality obligations, and provide reasonable assistance to the Customer in fulfilling the Customer's obligations under data protection laws.

If required by applicable law or upon the Customer's reasonable request, the Parties shall in good faith execute a separate Data Processing Agreement (DPA) in which case the provisions of the data processing agreement prevail.

Upon termination or expiration of the Terms, Company shall, at the choice of the Customer, delete or return all personal data that constitutes Customer Data which Company processes as a Data Processor, in accordance with Section 7, except to the extent that applicable law requires or permits Company to retain such data (in which case Company will continue to protect the data in accordance with these Terms and applicable law).

6.5 Confidentiality and Security related to the Customer Data

Company acknowledges that Customer Data may include sensitive or confidential information of the Customer. Section 12 applies to Customer's Confidential Information.

Further security information are provided in the Trust Center.

6.6 Security Breach Notification

Company shall take appropriate measures to contain and remediate any security breach including those resulting in the loss, alteration, erasure, destruction, disclosure of, or unauthorized access to Customer's Data and shall take steps to mitigate any potential adverse effects.

Company shall notify the Customer of any confirmed security breach within 48 hours of becoming aware of such breach. Such notice shall include, to the extent reasonably available at the time, a description of the nature of the breach, the affected data, the likely consequences, and the measures taken or proposed to address and mitigate its impact.

Company shall cooperate with the Customer in investigating and remediating the breach, including by providing all reasonably necessary information and support required for the Customer to comply with its own legal obligations (such as notification to supervisory authorities or affected data subjects, where applicable). Unless otherwise required by law, Company shall not communicate externally about any breach involving Customer Data without the Customer's prior approval.

6.7 Permitted Use

The Customer authorizes Company to use Customer Data for its own purposes, as an independent data controller, limited to improving, maintaining, or developing the Services, including internal analytics and services diagnostics. Such processing may include the use of Customer Data in aggregated or anonymized form for analytics, diagnostics, enhancement of existing features, and the development of new functionalities related to the Services.

Company shall not use Customer Data for any unrelated commercial purposes, nor shall it disclose identifiable Customer or third party information to any third party without the Customer's prior consent. Any processing conducted under this clause shall remain subject to the confidentiality, security, and data protection obligations set forth in these Terms.

6.8 Use of Sub processors

The Customer expressly authorizes Company to engage sub processors for the purpose of delivering the Services and fulfilling its obligations under these Terms. Company shall ensure that any such sub processors are subject to written agreements that impose data protection and confidentiality obligations at least equivalent to those set forth in these Terms.

A current list of sub processors is available on Company's website and may be updated from time to time. Company shall notify the Customer of any intended addition or replacement of sub processors by updating the list and providing prior notice via the Platform or another appropriate communication channel.

If the Customer raises a reasonable and specific objection to a newly added sub processor based on data protection concerns, the Parties shall discuss in good faith to assess whether an appropriate solution can be found. In the absence of such a solution, the Parties may mutually agree on appropriate technical or contractual adjustments. Only where no reasonable alternative exists, and where the objection materially affects the Customer's ability to use the Services, termination of the affected Services may be considered as a last resort.

Some sub processes may be located in countries outside Switzerland or the European Economic Area. In such cases, Company will ensure that appropriate safeguards are implemented in accordance with applicable data protection laws, including through adequacy decisions, standard contractual clauses, or other legally recognized mechanisms. Further details on international data transfers are provided in Company's Privacy Policy.