Terms of Service

These Terms of Service (Terms) govern the supply and professional use of the app.legiscope.com software-as-a-service platform and related services. Legiscope means the app.legiscope.com platform operated by Legiscope UAB, company code 304581221, registered at Laisvės pr. 60-1107, LT-05120 Vilnius, Lithuania. Legiscope UAB is the provider and contracting party; a reference in these Terms to Legiscope performing, owing or enforcing an obligation means Legiscope UAB acting as operator of the platform. Customer means the business, public body or other organisation identified in the Order Form. Legiscope UAB and the Customer are each a Party and together the Parties.

The object of the Agreement is to provide the Customer a hosted, customer-controlled workspace for maintaining privacy and data-protection governance records, coordinating supported workflows, reviewing evidence, using enabled AI-assisted operations and exporting Customer records within the purchased Plan and Limits.

The Service is designed to support the Customer’s work; it does not assume the Customer’s legal responsibilities. The Agreement is exclusively for professional business use. It is not offered to consumers, and each signatory represents that they are authorised to bind the identified Party.

The Agreement consists only of: (a) the Order Form that defines the details of the Services purchased; (b) these current Terms, including the Plan Catalogue reproduced in them; and (c) the Data Processing Agreement (DPA) as published at www.legiscope.com/dpa.html.

The Parties first negotiate the commercial scope of the subscription — the Plan and options, quantities, term and price; these exchanges do not bind either Party. During the negotiation, Legiscope may provide a product demonstration in one of two forms. A standard demonstration is a presentation of the Service on screen by Legiscope personnel that displays the product features (the prospect submits no data and no account is created). An assisted demonstration is a hands-on session in a dedicated demonstration account, provided under the Assisted Demonstration Agreement published at www.legiscope.com/demo-agreement.html, accepted by the prospect — by email or through the demonstration booking flow — before the demonstration begins. Neither form of demonstration forms the Agreement described in these Terms; an assisted demonstration is governed exclusively by the Assisted Demonstration Agreement.

Once the commercial scope is agreed, Legiscope issues the final Order Form, which constitutes its offer. The Order Form may be issued as a standalone document or as an electronic quote issued through Legiscope’s billing provider. It states the selected Plan and options, the applicable prices and discounts, the quantities, allowances and term, and any separately priced service offered by Legiscope.

The Agreement is formed when the Customer accepts the Order Form through one of the following methods: (i) an agreed electronic signature; (ii) acceptance of an electronic quote through the billing provider’s hosted acceptance flow; (iii) payment of the initial payment stated in the Order Form; or (iv) clear written confirmation sent by email by an authorised representative of the Customer — in each case preserving the accepted terms.

The Agreement takes effect on the acceptance date (Effective Date) unless the Order Form states a different date. Legiscope activates access to the Service only after receipt of the initial payment stated in the Order Form.

Subject to payment and compliance with the Agreement, Legiscope grants the Customer a limited, non-exclusive, non-transferable right during the Subscription Term to permit its Authorised Users to access and use the Service for the Customer’s internal professional purposes within the selected Plan and Limits.

Legiscope supplies the Service online and remotely.

A preview, prototype, beta, evaluation feature or marketing reference is not a contractual commitment unless the Order Form expressly includes it. Legiscope may withdraw a non-contracted preview at any time.

The Service provides compliance-management workflows. Its current core covers privacy and data-protection governance — including records of processing activities, application inventories, processor relationships, personal-data-breach management, data-subject-rights handling, impact assessments, audits and evidence, and remediation planning. Legiscope may extend the Service to further compliance domains and workflows; a new capability is provided under the Agreement as stated in “Documented instructions and new services”.

The Service operates on the information and documents the Customer supplies, and helps the Customer structure, draft and review its compliance records. It does not verify the authenticity, completeness or sufficiency of Customer records, certify compliance, decide whether a legal obligation applies, or send notifications or responses to authorities or third parties in the Customer’s name. Conclusions, approvals and communications remain the Customer’s.

The Customer tenant is created after receipt of the initial payment. Within five Business Days after the later of the Agreement taking effect, receipt of the initial payment and receipt of the complete provisioning information reasonably required, Legiscope creates the Customer tenant and the initial Customer Administrator account identified in the Order Form and provides a secure activation method.

The Customer administers its own accounts. Authorised User accounts are created and managed by the Customer through the Service’s administration functions; Legiscope does not intervene in the Customer’s account administration. Customer Administrators manage user access, roles, organisation scope and integrations on the Customer’s behalf. The Customer must keep its administrator contact current and must promptly remove or restrict access that is no longer authorised.

Each account is for one named individual. Credentials and authentication factors must not be shared. The Customer must maintain appropriate endpoint security and promptly notify Legiscope of suspected compromise. The Customer is responsible for activity through its accounts except to the extent caused by Legiscope’s breach of the Agreement.

Legiscope may suspend access to all or part of the Service, or to a specific account or function, where reasonably necessary: (i) to address a serious security threat; (ii) to stop unlawful use, or use in breach of the Agreement that causes harm to Legiscope, its customers or third parties; (iii) to comply with applicable law; or (iv) after notice, for persistent non-payment of an undisputed amount. A suspension is limited in scope and duration to what is proportionate to its cause.

Except where the urgency of the cause or a legal prohibition prevents it, Legiscope gives the Customer notice and an opportunity to remedy the cause before suspending. Legiscope restores the affected access promptly once the cause is resolved. Fees remain due during a suspension caused by the Customer.

The Order Form states the fees, the total commitment for the fixed term, the currency, the billing contact, the Service Start Date and any one-off fees. Subscription fees are invoiced in advance, either annually at the start of each Contract Year or as a single upfront payment for the Subscription Term, as agreed in the Order Form; if the Order Form is silent, fees are invoiced annually. Fees exclude VAT and other applicable taxes unless expressly stated otherwise. Legiscope administers quotes, orders, invoices and payments through an electronic billing provider; a billing-provider record is billing evidence only and does not modify the term, price or scope stated in the accepted Order Form. Subscription invoices are payable by wire transfer only. A purchase of additional Tokens is payable through the billing provider’s payment flow or by wire transfer.

The initial payment is the first annual subscription fee, unless the Order Form states a different initial amount or payment schedule. Later payments are made annually in advance for each following Contract Year, in accordance with paragraph (c).

Invoices are payable within 14 calendar days of issue, unless the Order Form states a different due date. Payment is made without set-off or deduction, except where mandatory law provides otherwise.

On an overdue undisputed amount, Legiscope may charge statutory late-payment interest. The Customer additionally bears all documented recovery costs, including debt-collection charges, court costs and attorney fees. If an undisputed amount remains unpaid more than 90 days after its due date, the Customer owes a contractual penalty of 10% of the overdue amount, with a minimum of EUR 500, in addition to interest and recovery costs. Persistent non-payment may lead to suspension and, after the applicable cure period, termination.

Fees are non-cancellable and non-refundable except where the Agreement provides an express pro-rata remedy. A Plan upgrade during a Subscription Term requires an accepted Order Form amendment; the Customer may purchase additional Tokens at any time. A downgrade is not available during a running Subscription Term; it takes effect only at the end of the current term, for the renewal term, and only if agreed before the applicable non-renewal deadline.

Eligible AI-assisted operations consume Tokens. Token consumption depends on the operation and on the length, complexity and volume of the material processed; a published estimate is indicative planning guidance only and does not bind either Party.

The Service maintains a customer-visible, task-level usage record identifying each operation, its time and its Token amount. Legiscope separately maintains the authoritative commercial ledger of Token allocation and usage for wallet administration, reconciliation, invoicing, abuse prevention and dispute handling, and will provide an account statement on reasonable request. The Customer must raise a specific usage dispute within 30 days after the relevant statement is supplied; Legiscope will investigate and correct a verified error, but an accurate commercial or statutory record is not altered on instruction. Legiscope will not materially and adversely change the charging method during a committed Subscription Term without an accepted Order Form amendment.

The annual Token amount is credited for each Contract Year. Unused Tokens, including separately purchased Tokens unless the Order Form states otherwise, remain available in later Contract Years while the subscription continues, including through renewal, and do not expire solely because the Agreement ends. When access ends or is suspended, Tokens cannot be used, but the recorded unused balance is not cancelled; the balance becomes dormant and is reactivated if the same Customer enters a new Legiscope subscription. Tokens are not transferable and have no cash, refund or redemption value.

When the Token balance reaches zero, new AI-assisted operations that consume Tokens pause; records, supported manual workflows, reports, exports, switching and deletion controls remain available. There is no automatic top-up or overage charge; the Customer may purchase additional Tokens at any time.

The initial Subscription Term begins on the Service Start Date and runs for the fixed duration selected in the Order Form: 12, 36 or 60 months. The 60-month option is a firm five-year commitment, with no year-three exit right and no shorter minimum commitment.

After the initial term, the Subscription Term renews automatically for successive 12-month periods unless the Order Form states another negotiated renewal period or either Party gives at least 90 days’ written notice of non-renewal before the current term ends. A notice of non-renewal does not terminate the current committed term.

The annual subscription price is fixed for the initial committed Subscription Term. Legiscope may propose a different renewal price only by written notice given at least 120 days before the current term ends; absent timely notice, the existing price continues for the next 12-month renewal, apart from agreed scope changes and taxes.

As between the Parties, the Customer retains all rights in Customer Content; prompts and instructions submitted by the Customer are Customer Content. The Customer grants Legiscope and its authorised subprocessors a non-exclusive licence, for the duration of the Agreement, to host, copy, transmit, organise, analyse, transform, display, generate Output from, export, secure, support and delete Customer Content, only as needed to perform the Agreement and the Customer’s documented instructions.

Legiscope and its licensors retain all rights in the Service, its software, interfaces, documentation, reusable templates, methodology, model routing, system prompts, reusable prompt templates, designs and underlying technology. On payment of the applicable fees, Legiscope grants the Customer a perpetual, non-exclusive right to use, copy, modify and share Customer-specific Output for its business, governance and compliance purposes, including with its advisers, auditors, authorities and clients. A reusable Legiscope element embedded in an Output remains licensed, not assigned, and may not be extracted or commercialised separately.

AI Output may resemble output generated for another user, because models can produce similar results from similar inputs. Legiscope gives no ownership warranty for material that applicable law does not protect. The Customer remains responsible for verifying third-party rights before publication or commercial reuse.

Legiscope may use service metrics that are aggregated and irreversibly anonymised, identifying neither a person nor the Customer, solely to operate, secure, measure and improve the Service. Legiscope may use feedback to improve its services; feedback does not authorise disclosure of the Customer’s identity, Customer Content, personal data or other Confidential Information.

Confidential Information means non-public business, technical, security, commercial or personal information disclosed by or for a Party that is marked confidential or should reasonably be understood as confidential. Customer Content and the non-public Service architecture are Confidential Information. Confidential Information excludes information the recipient can demonstrate was lawfully known without restriction, becomes public without breach, is independently developed without use of it, or is lawfully received from a third party without a duty of confidence.

The recipient will use Confidential Information only to perform or exercise rights under the Agreement, protect it with at least reasonable care, and disclose it only to personnel, professional advisers and providers who need it and are bound by appropriate confidentiality duties. A legally required disclosure is permitted after advance notice where law allows and with reasonable cooperation to limit the disclosure.

On request or when the Agreement ends, the recipient will return or delete the other Party’s Confidential Information unless the Agreement or law permits retention. The confidentiality duty continues for five years after disclosure or termination, whichever is later; trade secrets remain protected while legally qualifying as trade secrets, and personal data remains protected for the period required by the DPA and applicable law.

Each Party will comply with the data-protection law applicable to its role. Where Legiscope processes Customer Personal Data on the Customer’s documented instructions, the complete DPA as published at acceptance automatically forms part of the Agreement and controls that processing. No separate DPA signature is required.

The DPA remains the controlling and complete instrument for the subject matter, duration, nature, purpose, personal-data categories, data subjects, processor and subprocessor activities, security, subprocessors, international transfers, assistance, audit, personal data breach, return and deletion obligations applicable to Customer Personal Data.

Where support, troubleshooting, tenant security, incident response, restoration or Customer-directed transactional email requires processing Customer Personal Data to operate the Customer’s tenant or respond to its instruction, Legiscope acts as processor and the DPA applies. Legiscope acts as an independent controller only for the separately defined activities in the independent-controller register for which it determines its own purposes and essential means. The same technical event may produce distinct data elements processed in different roles. The Customer must make the controller information in these Terms available to its representatives and Authorised Users where required.

This provision defines the Customer’s documented instructions for the purposes of Article 28(3)(a) GDPR and Clause 7.1 of the DPA. The Agreement, the accepted Order Form, the Customer’s authorised configuration, the authenticated actions of its Authorised Users in the Service and the Customer’s documented support requests constitute the Customer’s documented instructions.

Legiscope continuously develops the Service and may introduce new services, modules, features, workflows and processing capabilities. A new capability that the Customer enables, configures or uses is processed under the same documented instructions and under the DPA, without any new agreement, signature or amendment; an Order Form is required only where the capability is separately priced or the Agreement expressly requires it. This instruction framework applies to every current and future capability of the Service. A new capability that requires a new sub-processor follows the DPA’s sub-processor change process.

Within the Customer’s documented instructions, Legiscope determines the non-essential technical and organisational means of providing the Service — including its internal implementation, architecture, provider routing among authorised sub-processors and operational choices.

Legiscope will maintain appropriate technical and organisational measures for all Customer Content, including the measures stated in the DPA, taking account of the state of the art, implementation cost, processing context and risks. The Customer remains responsible for endpoint security, user permissions, lawful configuration, downloaded exports and systems outside Legiscope’s control.

After becoming aware of a Security Incident, Legiscope will notify the Customer without undue delay and, where feasible, within 48 hours. Legiscope will not delay an initial notice until the incident is confirmed or the investigation is complete. It will describe the information then known about the nature and likely consequences, state the containment or remediation taken, provide available information needed for the Customer’s response and give material updates in phases. The DPA exclusively controls notification and assistance where Customer Personal Data is involved.

Unless the Order Form contains an express availability commitment, Legiscope does not warrant uninterrupted or error-free operation. Legiscope may perform maintenance and will give reasonable notice of planned material disruption where practicable.

The Customer may instruct the Service to exchange data with a Customer-selected third-party service. The Customer authorises the necessary exchange and is responsible for its rights, credentials and configuration. A Customer-selected destination is not a Legiscope subprocessor merely because the Customer connects it. Third-party services are governed by their own terms and may change or become unavailable.

Where Legiscope processes Customer Personal Data on documented instructions, it acts as processor or subprocessor, as applicable. The DPA exclusively describes the processor and subprocessor activities, their activation, processing particulars, authorised subprocessors, transfers, security, assistance, audits, personal data breaches, return, restorability and deletion. Those activities are not repeated as a second register in these Terms.

Only DPA activities applicable to the purchased Plan, enabled configuration, Order Form and Authorised User instructions are performed. Customer-directed transactional email is not a current standard activity and is not included unless the capability is implemented and contractually activated under the DPA.

An AI-assisted operation may form part of any supported workflow made available in the Customer’s purchased configuration. AI-assisted processing is a means of performing the applicable Customer-instructed Service purpose and does not create an independent purpose. It occurs where an Authorised User initiates the operation or an authorised administrator enables or configures a workflow that identifies the AI processing, and sends only the minimum necessary Customer Content, task instructions and workflow context through a centrally controlled commercial AI route. Any authorised AI provider may be used for any AI-assisted operation; Legiscope determines provider and model selection according to feature, availability, security, location, capability, quality, cost and risk controls.

Customer Content must not be used to train, fine-tune or improve a general-purpose or cross-customer model or pooled into a cross-customer training dataset. Legiscope will use and configure authorised commercial AI providers under terms that prohibit that use. A provider route that cannot meet this restriction must not be enabled for Customer Content. Provider processing remains subject to the DPA, the authorised subprocessor position and applicable commercial service controls.

AI Output is probabilistic. It may be inaccurate, incomplete, inconsistent, fabricated, biased, outdated, non-unique or affected by an incomplete source, ambiguous instruction or model limitation. It may omit a legal issue or misstate a fact, citation, relationship, deadline or conclusion. Legiscope does not warrant that AI Output is protectable, exclusive or free from every third-party right.

AI Output is draft decision-support material. It is not legal advice, an official finding, a certification or a guarantee of compliance. The Customer must verify it against the original evidence, current authoritative sources and applicable law, correct material errors and obtain competent human approval before adopting or communicating a legally significant result.

The Customer must not use an AI Output as the sole or determinative basis for a decision producing legal or similarly significant effects on a person. To the extent the Customer is deployer of an enabled AI feature, it must use the feature only for its stated purpose, apply proportionate human oversight, support AI literacy among relevant personnel, give the transparency required of it by applicable law, and avoid prohibited or unsupported high-risk uses. Legiscope may restrict an AI operation that appears inconsistent with these conditions.

To the extent the EU AI Act assigns those roles to the relevant operation, Legiscope is the provider of the application-level AI system, the Customer is its deployer, and the selected commercial model provider is an upstream general-purpose AI model provider rather than the provider of the Legiscope application. Role classification remains determined by applicable law and the facts of the operation.

Legiscope remains responsible for the provider and transparency obligations that applicable law assigns to its role, including, for a relevant feature, informing a person that they are interacting with AI, making AI-generated or manipulated output identifiable where required, and providing the technical information and AI-literacy support required of a provider. Legiscope does not support a high-risk deployment under the EU AI Act unless the Order Form identifies the intended purpose and the Parties establish the mandatory controls applicable to their respective roles.

Templates, checklists, suggested fields, examples, timing signals, articles and Output provide structured information for professional review. They are not tailored legal advice and do not establish an attorney-client, avocat-client or equivalent professional relationship.

Legiscope does not warrant that a template or workflow covers every rule, exception, fact or jurisdiction relevant to the Customer. The Customer remains responsible for selecting competent legal, DPO, security and other professional advice where appropriate and for every decision, filing, notification and communication made in its name.

Each Party warrants that it has authority to enter into the Agreement. Legiscope warrants that it provides the Service with reasonable professional skill and care and materially in accordance with these Terms and the Order Form. After notice describing a non-conformity in sufficient detail, Legiscope will use reasonable efforts to correct a verified material non-conformity or re-perform the Affected Service.

If Legiscope cannot remedy a material non-conformity within a reasonable period, the Customer may terminate the Affected Service and receive a pro-rata refund of prepaid subscription fees for the period after termination. This remedy does not exclude a right that cannot lawfully be limited.

Except for the express warranties and to the maximum extent permitted by law, the Service is supplied on an as-available basis. Legiscope does not warrant that every error, risk, deadline, legal issue or compliance gap will be detected, that every source is accurate or current, or that use of the Service makes the Customer compliant with law.

Legiscope will defend the Customer against a third-party claim that authorised use of the paid Service infringes that third party’s intellectual-property rights, and will pay reasonable external defence costs, damages finally awarded and settlement amounts Legiscope approves. Legiscope may procure the right to continue use, modify or replace the affected element, or terminate the Affected Service and refund prepaid fees for the period after termination. This indemnity does not apply to the extent the claim arises from: (i) Customer Content or Customer specifications; (ii) an unlawful Customer instruction not required for authorised standard use; (iii) an unauthorised modification or combination; (iv) use outside the Agreement; or (v) continued use after Legiscope provides a non-infringing replacement or notice to stop.

The Customer will defend Legiscope against a third-party claim to the extent it arises from: (i) Customer Content; (ii) an unlawful Customer instruction; (iii) the Customer’s legally significant use of an Output without the human review required by the Agreement; or (iv) the Customer’s material breach of the acceptable-use conditions — and will pay damages finally awarded and settlement amounts the Customer approves. This indemnity does not apply to the extent the claim arises from a defect in the Service, Legiscope’s breach of the Agreement or an act for which Legiscope is responsible.

The indemnified Party must give prompt notice and reasonable cooperation and must allow the indemnifying Party to control the defence with competent counsel, provided that delay reduces the obligation only to the extent it materially prejudices the defence. The indemnified Party may participate at its own cost. No settlement may admit fault by or impose a non-monetary obligation on the indemnified Party without its prior consent, not to be unreasonably withheld.

To the maximum extent permitted by law, neither Party is liable for indirect or consequential loss or for loss of profit, revenue, anticipated savings or goodwill. This exclusion does not remove liability for amounts payable under a covered third-party claim or reasonable direct costs of restoring Customer Content and responding to a confidentiality, security or data-protection breach to the extent caused by the liable Party.

Subject to the enhanced cap and uncapped matters stated in this Liability provision, each Party’s total aggregate liability for all claims first arising in a Contract Year is limited to the subscription fees paid or payable under the affected Order Form for that Contract Year. A claim arising on or after the Effective Date but before the first Service Start Date is treated as arising in the first Contract Year. Claims arising from the same or related events are treated as one claim arising when the first such event occurred.

For breach of confidentiality, breach of the DPA, breach of the contractual security obligations and Legiscope’s intellectual-property indemnity, the liable Party’s aggregate cap is the greater of: (a) two times the amount used to calculate the general cap; and (b) EUR 50,000. This enhanced cap is not additional to the general cap; the higher applicable cap replaces it for those claims.

A regulatory fine or penalty is recoverable between the Parties only to the extent applicable law permits that allocation and only to the extent caused by the other Party’s breach of the Agreement or applicable law. Nothing in the Agreement transfers a statutory responsibility that cannot lawfully be transferred.

No exclusion or cap applies to agreed fees, the Early Termination Charge stated in “Data Act switching and exit”, fraud or fraudulent misrepresentation, wilful misconduct, gross negligence, death or personal injury caused by negligence, or liability that cannot lawfully be excluded or limited. Nothing limits a data subject’s rights or a supervisory authority’s statutory powers.

Either Party may terminate the Agreement for the other Party’s material breach not cured within 30 days after written notice describing it. The notice may state that termination takes effect automatically on expiry of the cure period; otherwise a final termination notice is required. Termination may be immediate where the breach cannot be cured, continued performance is unlawful or applicable law expressly permits it. An insolvency or restructuring termination right applies only to the extent mandatory law permits.

The Customer has no contractual right to terminate for convenience before the fixed Subscription Term ends. The selected 12-, 36- or 60-month initial term remains binding, subject only to the express fault-based remedies in the Agreement and rights that mandatory law does not permit the Parties to exclude.

If the Customer terminates for Legiscope’s uncured material breach, Legiscope will refund prepaid subscription fees for the period after termination and no future annual instalment becomes due. If Legiscope terminates for the Customer’s breach, accrued unpaid fees and Legiscope’s documented direct loss caused by the early ending remain recoverable, reduced by demonstrably avoided costs and reasonable mitigation and capped, excluding already issued annual invoices, at one annual subscription fee. There is no double recovery.

Termination does not affect accrued rights. The licence and account access end, subject to the Data Act transition, retrieval and DPA restorability processes. Payment, confidentiality, ownership, liability, dispute and exit provisions survive for their intended duration. Unused Tokens become dormant and remain eligible for reactivation under a later Agreement with the same Customer.

The Customer may send a switching, on-premises porting or erasure notice to contact@legiscope.com; that notice satisfies the notice requirements of these Terms. Legiscope will initiate the selected process without undue delay after receiving the information reasonably required to perform it. The maximum notice period will not exceed two months.

On request, Legiscope will allow the Customer to switch to a data processing service of the same service type or port all exportable data and digital assets to on-premises infrastructure. The mandatory maximum transitional period of 30 calendar days begins after the notice period. The Agreement remains applicable during the transition, and Legiscope will support the Customer’s exit strategy with relevant available information and reasonable assistance, maintain continuity, data integrity and security, and inform the Customer of known continuity risks.

If the 30-day transition is technically unfeasible, Legiscope will notify the Customer within 14 working days after the request, explain why and specify an alternative transition not exceeding seven months while maintaining continuity. The Customer may extend the transition once for a period it considers appropriate.

Legiscope will notify the Customer when switching is complete. A retrieval period of at least 30 calendar days begins after the agreed transition. Throughout transfer and retrieval, Legiscope will maintain continuity, data integrity and security to the extent applicable to the relevant process. Retrieval may use in-service exports and, where needed, a secure final package or interface; it does not require ordinary application access after termination. The Agreement terminates when switching completes or, for an erasure election, at the end of the applicable notice period, unless the Customer expressly requests that the subscription continue.

The charge for operations necessary to perform switching and associated data egress is EUR 0. Ordinary subscription fees remain payable while the Agreement applies. A separately requested service that is not necessary for switching is chargeable only if agreed in the Order Form. Where mandatory law causes the Agreement to end before the fixed Subscription Term expires and Legiscope is not in uncured material breach, the Customer pays accrued fees plus an Early Termination Charge equal to Legiscope’s documented unrecovered customer-specific implementation or commercial incentives and non-cancellable third-party commitments identified in the Order Form, reduced by demonstrably avoided costs and reasonable mitigation and capped at one annual subscription fee. The Early Termination Charge is a consequence of ending the fixed term early, not a charge for the switching process or data egress.

Exportable data and digital assets mean the input and output data, including relevant metadata, and Customer-specific digital materials generated directly or indirectly by the Customer’s use of the Service, excluding provider or third-party intellectual property and trade secrets. Legiscope will make applicable open interfaces available free of charge to the Customer and its authorised destination provider and provide exportable data in a structured, commonly used and machine-readable format.

The exhaustive exportable data and digital-asset categories, to the extent present in the Customer account, are: Customer organisation and programme configuration; Authorised User, role and permission records; applications; processor relationships; processing activities and RoPA records; rights-request records; incident and breach records; audits, evidence and evidence-activity records; roadmap tasks; uploaded source files and attachments; Customer-specific reports, assessments and AI-assisted Output; the current Token balance and customer-visible task-level usage history; and the customer-visible relationships, comments, decisions, approvals, identifiers, statuses, timestamps, history and other metadata associated with those records. The export does not make the Customer the controller of Legiscope’s separate authoritative commercial, accounting or legal ledger.

Structured records are supplied through available CSV or JSON exports or an equivalent documented machine-readable package. Human-readable records may also be supplied in a supported PDF or DOCX format, and uploaded files in their original or a commonly readable format. The up-to-date online register of available methods, data structures, formats, schemas, limitations, relevant standards and open interoperability specifications is maintained at https://www.legiscope.com/portability-deletion.html.

The exhaustive provider-internal categories excluded from portability are: Legiscope source code, executables, reusable templates and platform components; model weights, system instructions, proprietary algorithms, routing rules, security-detection logic and internal risk signals; credentials, cryptographic keys and other secrets; raw infrastructure telemetry, provider-wide performance information and internal security records whose disclosure would create a security risk or reveal a trade secret; irreversibly anonymised provider analytics; other customers’ data; and third-party material the Customer is not entitled to receive. An exclusion will not be used to impede or delay switching, and customer-visible metadata remains exportable.

The public infrastructure-jurisdiction and non-personal-data governmental-access information required by Regulation (EU) 2023/2854 is maintained at https://www.legiscope.com/hosting-residency-transfers.html and https://www.legiscope.com/security.html. Those pages are transparency information and do not add a fourth document to the Agreement.

The DPA controls the return, retention for restorability and deletion of Customer Personal Data. When the Agreement expires or terminates without a completed switch or an election to return or erase the data, the DPA’s retention-for-restorability position applies as the Customer’s standing instruction: the account and Customer Content remain access-disabled and restorable for up to 12 months without additional charge. The Customer may request return or instruct active-system erasure at any time during that period.

The same election and timing apply to exportable data and digital assets that are not Customer Personal Data. Legiscope may end the courtesy restorability service and delete the dormant account after the applicable retrieval period and will do so no later than 12 months after the Agreement ends. Following a return or erasure instruction, Legiscope deletes the applicable material from active systems without undue delay. Separate application-controller records described in these Terms follow their stated purposes and retention criteria rather than Customer instructions under the DPA.

Residual exportable data or digital assets may remain only in encrypted, access-restricted and technically immutable rolling backups used solely for disaster recovery. Those residual copies cannot be selectively altered during the protected cycle, are put beyond ordinary operation and are automatically purged no later than 90 days after active-system deletion. The Parties agree to that bounded cycle as the alternative later erasure period for a completed switch where Regulation (EU) 2023/2854 permits it.

Legiscope records the deletion instruction. If a protected backup is restored, Legiscope re-applies the recorded deletion instruction before the deleted exportable data or digital assets return to ordinary operation. The backup period does not permit analytics, model training, product development or another secondary use. Legiscope will confirm completion of the applicable deletion process on request.

The Service is a continuously developed platform: Legiscope owns all rights in the Service, its software, interfaces and documentation, and evolves them for the benefit of its customers. Legiscope may therefore update these Terms and the DPA from time to time, including to support new services, modules and capabilities, to reflect legal, security or provider changes, or to clarify existing provisions.

Legiscope announces an update by email to the Customer’s contract contact and by publishing the updated document with its effective date, at least 30 days in advance for a material change; publication alone does not create acceptance of a material change. An update that does not materially reduce the Customer’s rights, protections or purchased functionality applies from its effective date. An update may not modify the Commission Clauses of the DPA, reduce the protection of Customer Personal Data, or change the price of the Customer’s current committed Subscription Term; pricing changes for a current subscription take effect only through the renewal process in these Terms, and new services and capabilities may be priced freely. An update does not expand the Customer’s financial commitment for the current committed Subscription Term without agreement. Legiscope may make an operational change required by law or urgently necessary to address a material security risk with immediate effect, giving notice as soon as reasonably practicable.

If the Customer objects in writing to a material update within 30 days of the announcement, the Parties will discuss a reasonable solution in good faith. If none is found, each Party may terminate the affected Service or the Agreement with effect from the update’s effective date, and Legiscope will refund prepaid fees for the period after termination. Absent a timely objection, continued use of the Service after the effective date constitutes acceptance of the update.

Neither Party may assign the Agreement without the other’s prior consent, not to be unreasonably withheld, except to an affiliate or in connection with a merger, reorganisation or sale of substantially all relevant assets if the assignee assumes the Agreement and the assignment does not materially reduce the other Party’s protections. Legiscope may use subcontractors subject to its obligations under the Agreement and DPA.

Neither Party is liable for delay caused by an event beyond its reasonable control that it could not reasonably prevent, excluding payment obligations. The affected Party will notify the other and use reasonable efforts to mitigate. If a force-majeure event prevents an Affected Service for more than 60 consecutive days, either Party may terminate that Affected Service; Legiscope will refund prepaid fees for the period after termination and no future instalment for that Affected Service becomes due.

A legal notice to Legiscope must be sent to contact@legiscope.com and a legal notice to the Customer must be sent to the notice email in the Order Form. A Party may change its address by notice through the same method. A notice transmitted before 17:00 Europe/Vilnius time on a Business Day is effective on the next Business Day; a later transmission is effective on the second following Business Day, unless the sender receives a delivery failure. A termination notice must identify the Agreement and effective date. This contractual method does not displace mandatory procedural rules for court or authority documents.

The Agreement is the entire agreement on its subject. No person other than a Party has contractual enforcement rights except as the DPA or mandatory law expressly provides. Failure to enforce a right is not a waiver. If a provision is unenforceable, it will be limited to the minimum necessary and the remainder continues.

The Order Form may improve a quantitative entitlement of the selected Plan, but does not add to, remove from or otherwise modify the Service or these Terms. The DPA governs the processing of Customer Personal Data; in case of contradiction with its Commission Clauses, the Commission Clauses prevail. These Terms govern everything else, including the description of the Service and the processing registers. A purchase order or other Customer document is administrative only and does not amend the Agreement.

The Agreement is governed by Lithuanian law, without regard to conflict-of-law rules. The competent courts located in Vilnius, Lithuania have exclusive jurisdiction, subject to mandatory law. Electronic signatures and counterparts are valid and may be retained in a durable electronic record. The English version controls unless the signed Order Form expressly designates another controlling language.