Terms of Service

1. Provider and scope

These Terms govern access to www.unovox.com and the UNOVOX software-as-a-service platform, provided by MAINSYSTEMS, LDA., with a contact address at Av. da República, 50, 2nd floor, 1050-196 Lisbon, Portugal (“MAINSYSTEMS”, “UNOVOX”, “we”, “us” or “our”). They apply to organisations contracting the service, their representatives and authorised users (“Customer” or “you”).

These Terms, the applicable order or proposal, the Privacy Policy and, where personal data is processed on the Customer's behalf, the Data Processing Agreement form the contractual framework. Customer purchase terms apply only where expressly accepted in writing by MAINSYSTEMS.

2. Definitions

• Service: the hosted UNOVOX platform, including the reporting portal, case management area, configuration, updates and support included in the subscribed plan.
• Customer Data: content, reports, messages, files, configuration and other information submitted to or created in the Customer's environment.
• Authorised User: a person granted access to the restricted area by the Customer.
• Order: an online subscription, signed proposal, purchase order or other document accepted by the parties that identifies the Service contracted.
• Documentation: usage, security and technical information provided for the Service.

3. Acceptance and authority

By placing an Order, creating an administrative account or using the restricted Service, you confirm that you act for an organisation, have authority to bind it and accept these Terms. The Service is intended for professional, institutional and public-sector use, not primarily for individual consumers. If you do not accept the contractual framework, you must not access the restricted Service.

4. The Service

UNOVOX provides tools to configure a channel, receive anonymous or identified reports, communicate with reporting persons, classify and assign cases, manage deadlines, tasks, attachments and history, prepare reports and analyse operational information. Available features depend on the subscribed plan and Order.

The Customer remains responsible for designing and operating its whistleblowing process, appointing competent and impartial managers, deciding how to investigate and act on each case, meeting legal deadlines and providing appropriate notices. UNOVOX is a technology service and does not replace legal, compliance, employment or investigative advice.

5. Orders, pricing and payment

• Prices, billing cycle, included services and any implementation work are those shown during contracting or in the accepted Order. Unless stated otherwise, prices exclude VAT and other applicable taxes.
• The Customer must provide accurate billing details and pay invoices by the stated due date. The Customer is responsible for taxes other than those imposed on MAINSYSTEMS' net income.
• Monthly or annual subscriptions renew for an equivalent period unless cancelled under the Order before the renewal date. A fixed-term public contract renews only where its documents permit.
• A change to the list price does not alter the current paid period. Renewal pricing may be updated on prior notice, subject to any fixed-price commitment in the Order.
• Unless required by law or otherwise stated in the contracting terms or Order, amounts for periods already begun are not refundable merely because the Customer stops using the Service.

6. Accounts and users

The Customer may create the number of authorised users permitted by the plan. Where the plan specifies unlimited users or unlimited languages, no per-user or per-language licence fee applies; use must remain connected with the Customer's legitimate internal operations and does not permit resale or provision of the Service to independent third parties without written agreement.

The Customer controls roles and permissions and must promptly remove access that is no longer justified. Each user must use an individual account, keep credentials confidential, use available security controls and immediately report suspected unauthorised access. The Customer is responsible for actions performed through its accounts except to the extent caused by a breach attributable to MAINSYSTEMS.

7. Right to use

During the subscription, provided payments and the contractual framework are complied with, MAINSYSTEMS grants the Customer a limited, non-exclusive and non-transferable right to access and use the Service for its internal whistleblowing, compliance and case management activities. Ownership of the software is not transferred.

The Customer must not copy or commercially exploit the platform; reverse engineer or attempt to obtain source code except where mandatory law permits; bypass access, security or usage controls; conduct unauthorised vulnerability testing; interfere with availability; or use the Service to develop or publish comparative tests of a competing product without written authorisation.

8. Customer Data

The Customer retains its rights in Customer Data and grants MAINSYSTEMS the limited right to host, copy, transmit, display and process it only as necessary to provide, protect and support the Service, comply with documented instructions and meet legal obligations. MAINSYSTEMS does not acquire ownership of reports or case content.

The Customer is responsible for the lawfulness, accuracy and relevance of Customer Data; providing information and determining lawful bases; ensuring authorised users have a legitimate need for access; and avoiding submission of information manifestly unnecessary for the channel's purpose. MAINSYSTEMS is not required to assess the merits of reports or determine whether content is true.

9. Acceptable use

The Service must not be used to:

• commit, encourage or conceal unlawful acts, retaliation, harassment, discrimination or deliberately false accusations;
• upload malware, exploit vulnerabilities, disrupt systems or gain unauthorised access;
• violate privacy, confidentiality, intellectual property or other third-party rights;
• send unsolicited commercial communications or operate a public file-storage service;
• process data for a purpose incompatible with the contracted whistleblowing and case management context;
• present an automated output as a final human decision where human review is required.

A good-faith report that is not substantiated does not, by itself, constitute misuse. The Customer must protect reporting persons and other affected people in accordance with law and its policies.

10. Confidentiality

Each party must protect the other's non-public commercial, technical, security and contractual information with at least reasonable care and use it only to provide or receive the Service. Confidential information may be disclosed to employees, professional advisers and subprocessors who need it and are bound by confidentiality, or where legally required. Where permitted, the receiving party will give advance notice of a mandatory disclosure.

MAINSYSTEMS team access to cases is limited to authorised support, security, maintenance, incident-response or legal-compliance needs and is subject to access controls and confidentiality duties.

11. Data protection

Each party must comply with applicable data-protection law. For website, commercial and account-administration data, MAINSYSTEMS acts under the Privacy Policy. For Customer Data processed on the Customer's behalf, the Customer is normally the controller and MAINSYSTEMS the processor. The Data Processing Agreement, provided with contractual documentation or on request, governs that processing and prevails over these Terms on data-processing matters.

The Customer must not instruct MAINSYSTEMS to process data unlawfully and remains responsible for responding to data-subject requests, setting retention and assessing whether processing requires a data protection impact assessment. MAINSYSTEMS provides the assistance described in the Data Processing Agreement.

12. Security and incidents

MAINSYSTEMS maintains technical and organisational measures appropriate to the risks of the Service. The Customer acknowledges that security is shared: MAINSYSTEMS protects the hosted platform; the Customer must configure permissions, manage the user lifecycle, protect devices and credentials and use the Service in accordance with the Documentation.

Each party will notify the other without undue delay of a confirmed security incident relevant to the other's data or obligations and will reasonably cooperate in containment and legally required notifications. The Data Processing Agreement governs personal-data breaches involving Customer Data.

13. AI Agents

AI Agents are optional. When activated, the Customer determines the reporting categories and tasks within the configured scope. AI Agents may collect, organise, summarise, compare or propose investigative steps, but outputs may be incomplete, inaccurate or context-dependent. The Customer must ensure competent human oversight and final validation. Decisions producing legal, employment or similarly significant effects must not be based solely on an AI output unless applicable law permits and the required safeguards are in place.

The Customer is responsible for giving lawful instructions, reviewing outputs before relying on them and preventing the introduction of data unnecessary for the configured purpose. MAINSYSTEMS may apply technical limits or suspend an AI function where required for security, protection, provider restrictions or legal compliance while seeking to preserve the core Service. Case content is not used to train general-purpose models unless supported by a written agreement and valid lawful basis.

14. Third-party services

The Service may interoperate with hosting, email, identity, analytics, payment, security or AI providers. Providers engaged by MAINSYSTEMS are managed under appropriate agreements. A Customer-requested integration or external connection may be governed by the third party's terms, and MAINSYSTEMS is not responsible for an external service outside its control. Material subprocessor changes are handled under the Data Processing Agreement.

15. Availability, maintenance and support

MAINSYSTEMS seeks to keep the Service available and secure but does not promise uninterrupted operation unless the Order expressly defines a service level. Availability may be affected by planned maintenance, urgent security work, internet or provider failures, force majeure and Customer systems or configuration. We will seek to give reasonable advance notice of planned maintenance likely to have a material impact.

Support channels and response objectives are those published for the plan or specified in the Order. Support does not include legal advice, conducting Customer investigations or correcting Customer-controlled content unless separately contracted.

16. Changes to the Service

We may improve, update or replace features to maintain security, legal compliance, performance and product development. We will not materially reduce the essential functionality of a paid plan during a current prepaid period without a legitimate reason and reasonable mitigation. If a change has a material adverse effect that cannot reasonably be mitigated, the parties will seek an appropriate solution under the Order.

17. Intellectual property and feedback

MAINSYSTEMS and its licensors own the Service, software, interface, Documentation, marks and associated intellectual property rights. The Customer owns its names, logos, policies and Customer Data. If the Customer voluntarily provides product feedback, MAINSYSTEMS may use it without restriction or identifying the Customer, provided that it does not disclose confidential information or Customer Data.

18. Suspension

MAINSYSTEMS may suspend affected access where reasonably necessary to prevent an active security threat, unlawful use, material harm to the Service or third parties, or where undisputed amounts remain overdue after notice and an opportunity to cure. Where feasible, suspension will be limited in scope and duration, and the Customer will be informed of the reason and steps required to restore access.

19. Term, cancellation and termination

The contract begins when the Order takes effect and continues for the subscribed period. Either party may terminate for a material breach not cured within 30 days after written notice, or earlier where the breach cannot be cured, insolvency law permits termination or continued performance would be unlawful. The Customer may cancel renewal by the method indicated in the Order or account.

On termination, access ends and outstanding amounts become due. Subject to payment and legal restrictions, the Customer may request an export of Customer Data through available functions before termination or during the recovery period stated in the Order or Data Processing Agreement. MAINSYSTEMS deletes or returns Customer Data under that agreement, legal retention obligations and secure backup cycles.

20. Warranties and disclaimers

MAINSYSTEMS warrants that the Service will materially conform to the Documentation and will be provided with reasonable professional care. If a reproducible material non-conformity is reported, the primary remedy is correction or a reasonable workaround. If neither is reasonably possible, the affected Service may be terminated with a refund of prepaid amounts corresponding to the unused affected period.

To the maximum extent permitted by law, the Service is not warranted to be error-free or uninterrupted, to ensure legal compliance by itself, or to guarantee detection, truthfulness or successful investigation of a report. Customer decisions remain the Customer's responsibility.

21. Liability

Neither party is liable for indirect or consequential losses, loss of profit, revenue, anticipated savings or reputation, or losses caused by the other party's unlawful instructions, configuration or breach of the Documentation, except where exclusion is prohibited by law.

To the maximum extent permitted by law, each party's total liability arising from the Service in any 12-month period is limited to the amounts paid or payable for the Service in the 12 months preceding the event giving rise to liability. The limit does not apply to fraud or wilful misconduct, payment obligations, infringement of the other party's intellectual-property rights, breach of confidentiality or data-protection liability to the extent it cannot lawfully be limited, or death or personal injury caused by negligence.

22. Force majeure

Neither party is liable for delay or failure caused by events beyond its reasonable control, including widespread network or cloud failure, power interruption, natural disaster, war, civil unrest, epidemic, government action or labour dispute, provided the affected party seeks to mitigate the effect and resumes performance when possible. Payment obligations already due are not excused.

23. Changes to these Terms

We may update these Terms for legal, security or Service changes. Updates apply to website use when published. For an existing paid subscription, a materially adverse change applies from the next renewal unless earlier application is required by law or necessary to address an urgent security risk. Where appropriate, we will give advance notice. Continued use after the applicable date constitutes acceptance; if the Customer does not accept a renewal change, it may cancel renewal.

24. General provisions

• Notices: contractual notices may be sent to the account's administrative email; notices to MAINSYSTEMS may be sent to info@mainsystems.pt.
• Assignment: neither party may assign the contract without the other's consent, not to be unreasonably withheld, except to an affiliate or in connection with a merger, reorganisation or sale of substantially all relevant assets, with obligations continuing.
• Severability: if a provision is unenforceable, it will be adjusted only as far as necessary and the remainder will continue.
• No waiver: failure to exercise a right does not waive it.
• Entire agreement: the contractual framework described in section 1 replaces prior discussions about the same subject matter.
• Language: Portuguese and English versions are provided for convenience. In the event of inconsistency, the Portuguese version prevails unless the Order states otherwise.

25. Governing law and jurisdiction

The contract is governed by Portuguese law. The courts of Lisbon, Portugal have jurisdiction, without prejudice to any mandatory forum or dispute-resolution mechanism that cannot lawfully be excluded. Before commencing proceedings, the parties will seek in good faith to resolve the dispute through their designated representatives.

26. Contact

MAINSYSTEMS, LDA. — UNOVOX
Av. da República, 50, 2nd floor, 1050-196 Lisbon, Portugal
Email: info@mainsystems.pt
Privacy: dpo@mainsystems.pt
Telephone: +351 211 245 202