Terms of Service

1. Provider and scope

These Terms govern access to www.unovox.com and to the UNOVOX platform, provided as software as a service by MAINSYSTEMS, LDA., with contact address at Av. da República, 50, 2.º andar, 1050-196 Lisbon, Portugal (“MAINSYSTEMS”, “UNOVOX”, “we” or “us”). They apply to the organisations that subscribe to the service, their representatives and their authorised users (“Customer” or “you”).

These Terms, the applicable Order, the Privacy Policy and, where personal data is processed on the Customer's behalf, the Data Processing Agreement form the contractual framework. Purchasing conditions of the Customer only apply where expressly accepted in writing by MAINSYSTEMS, even if they appear in purchase orders, supplier portals or later documents.

2. Definitions

• Service: the hosted UNOVOX platform, including the reporting portal, case management area, configuration, updates and the support included in the subscribed plan.
• Customer Data: content, reports, messages, files, configurations and other information submitted or created in the Customer's environment.
• Authorised User: a person to whom the Customer grants access to the restricted area.
• Partner: an entity authorised by written agreement with MAINSYSTEMS to resell, integrate or present the Service to its own customers.
• Order: an online subscription, signed proposal, purchase order or other document accepted by the parties that identifies the contracted Service.
• Documentation: the usage, security and technical information made available for the Service.
• DPA: the Data Processing Agreement concluded under Article 28 GDPR.
• Whistleblowing Law: Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law and the national transposition applicable to the Customer.
• Data Protection Law: Regulation (EU) 2016/679 (“GDPR”) and other applicable data protection legislation.

3. Acceptance and authority

By placing an Order, creating an administrative account or using the restricted Service, you confirm that you act on behalf of an organisation, have authority to bind it and accept these Terms. The Service is intended for professional, institutional and public sector use, not primarily for individual consumers. If you do not accept the contractual framework, do not access the restricted Service.

4. The Service

UNOVOX provides tools to configure a channel, receive anonymous or identified reports, communicate with reporting persons, classify and assign cases, manage deadlines, tasks, attachments and history, prepare reports and analyse operational information. Available features depend on the subscribed plan and the Order.

UNOVOX is a technology service. It does not provide legal, compliance, employment or investigation advice, does not manage reports on the Customer's behalf unless that service is expressly contracted, and making the platform available does not, by itself, guarantee the Customer's compliance with the Whistleblowing Law or any other legal obligation of the Customer.

5. Customer obligations as an obliged entity

Where the Customer uses the Service to comply with the Whistleblowing Law, the following remain the Customer's exclusive responsibility, among others:

• establishing and documenting its internal reporting channel and its operating rules;
• designating competent and impartial persons or services to follow up on reports;
• meeting the legal deadlines, including acknowledging receipt of a report within seven days and communicating the measures envisaged or taken within a maximum of three months;
• keeping the records of reports required by the transposition law applicable to the Customer, for the period it prescribes;
• protecting the confidentiality of reporting persons' identity and preventing retaliation;
• providing reporting persons with the legally required information, including the privacy notice for its channel;
• deciding how to investigate, which measures to adopt and how to respond to competent authorities.

MAINSYSTEMS does not assume or share these obligations, unless an additional service is expressly contracted in the Order.

6. Orders, price and payment

• Prices, billing cycle, included services and any implementation work are those presented at subscription or in the accepted Order. Unless stated otherwise, prices exclude VAT and other applicable taxes.
• The Customer must provide accurate billing information and pay invoices by the stated date. The Customer is responsible for taxes other than those on MAINSYSTEMS' net income.
• An invoice is deemed accepted if not disputed in writing, with reasons, within 15 days of issue. Undisputed amounts must be paid by the due date.
• In case of late payment, statutory commercial interest and reasonable collection costs may be due, without prejudice to the suspension right in section 21.
• Monthly or annual subscriptions renew for an equivalent period unless cancelled as set out in the Order before the renewal date. A fixed-term public contract only renews where its documents allow it.
• A change to list prices does not modify a current period already paid. Renewal prices may be updated with at least 30 days' notice, without prejudice to a fixed-price commitment in the Order.
• Unless the law, the subscription conditions or the Order provide otherwise, amounts for periods already started are not refundable merely because the Customer stopped using the Service.

7. Accounts and users

The Customer may create the number of authorised users allowed by the plan. Where a plan states unlimited users or unlimited languages, there is no per-user or per-language licence cost; usage must remain related to the Customer's legitimate internal operation and does not permit reselling or providing the Service to independent third parties without a written agreement.

The Customer controls roles and permissions and must promptly remove access that is no longer justified. Each user must use an individual account, keep credentials confidential, use the available security controls and immediately report suspected unauthorised access. The Customer is responsible for actions taken through its accounts, except to the extent they result from a breach attributable to MAINSYSTEMS.

8. Right of use

During the subscription, and provided payments and the contractual framework are complied with, MAINSYSTEMS grants the Customer a limited, non-exclusive, non-transferable right to access and use the Service for its internal whistleblowing, compliance and case management activities. Ownership of the software is not transferred.

The Customer may not copy or commercially exploit the platform; reverse engineer it or attempt to obtain the source code, except where mandatory law allows it; circumvent access, security or usage controls; run unauthorised vulnerability tests; interfere with availability; use the Service to develop a competing product; or publish benchmarks without written authorisation.

9. Customer Data

The Customer retains its rights in Customer Data and grants MAINSYSTEMS a limited right to host, copy, transmit, display and process it only as needed to provide, protect and support the Service, comply with documented instructions and meet legal obligations. MAINSYSTEMS does not acquire ownership of reports or case content and does not use Customer Data for advertising.

The Customer is responsible for the lawfulness, accuracy and relevance of Customer Data; for providing information and establishing the legal bases; for ensuring authorised users have a legitimate need for access; and for avoiding the submission of information manifestly unnecessary for the purpose of the channel. MAINSYSTEMS has no duty to review the merits of reports or determine whether content is true.

The Service includes export functions in common formats. The Customer should export regularly the information it needs for its own records and legal retention obligations.

10. Acceptable use

The Service may not be used to:

• commit, encourage or conceal unlawful acts, retaliation, harassment, discrimination or deliberately false accusations;
• upload malicious software, exploit vulnerabilities, disrupt systems or gain unauthorised access;
• infringe privacy, confidentiality, intellectual property or other third-party rights;
• send unsolicited commercial communications or operate a public file storage service;
• process data for purposes incompatible with the contracted context of whistleblowing and case management;
• present an automated output as a final human decision where human review is required;
• identify or attempt to identify anonymous reporting persons outside legally permitted cases.

A good-faith report that is not ultimately confirmed is not, by itself, abusive use. The Customer must protect reporting persons and other affected persons as required by law and its policies.

11. Confidentiality

Each party must protect the other's non-public commercial, technical, security and contractual information with at least reasonable care and use it only to provide or receive the Service. Confidential information may be disclosed to employees, professional advisers and subcontractors who need it and are bound by confidentiality, or where legally required. Where permitted, the receiving party will give prior notice of a compelled disclosure.

Access by MAINSYSTEMS teams to cases is limited to authorised support, security, maintenance, incident response or legal compliance needs and is subject to access controls and confidentiality duties. Confidentiality obligations survive termination for as long as the information remains confidential.

12. Data protection

Each party must comply with Data Protection Law. For website, commercial and account administration data, MAINSYSTEMS acts as described in the Privacy Policy. For Customer Data processed on the Customer's behalf, the Customer is normally the controller and MAINSYSTEMS the processor. The Data Processing Agreement governs that processing and prevails over these Terms for personal data processing matters.

The Customer may not instruct MAINSYSTEMS to process data unlawfully and remains responsible for answering data subject requests, defining retention and assessing whether the processing requires a data protection impact assessment. MAINSYSTEMS provides the assistance described in the DPA.

13. Security and incidents

MAINSYSTEMS maintains technical and organisational measures appropriate to the risk of the Service, described in the Documentation and the DPA, including access controls, role-based permissions, encrypted password storage, access over HTTPS connections, activity logs and backups. The Customer acknowledges that security is shared: MAINSYSTEMS protects the hosted platform; the Customer must configure permissions, manage the user lifecycle, protect devices and credentials and use the Service in accordance with the Documentation.

Each party will notify the other, without undue delay, of a confirmed security incident relevant to the other's data or obligations and will reasonably cooperate on containment and legally required notifications. The DPA governs personal data breaches involving Customer Data.

14. AI Agents

AI Agents are an optional feature. When enabled, the Customer determines the report categories and tasks within the configured scope. AI Agents may collect, organise, summarise, compare or propose investigation steps, but outputs may be incomplete, inaccurate or context-dependent. The Customer must ensure competent human oversight and final validation. Decisions producing legal, employment or similarly significant effects must not be taken solely on the basis of an AI output, unless applicable law permits it and the required safeguards exist.

The Customer is responsible for giving lawful instructions, reviewing outputs before relying on them and preventing the entry of data unnecessary for the configured purpose. MAINSYSTEMS may apply technical limits or suspend an AI feature where necessary for security, safety, supplier restrictions or legal compliance, seeking to preserve the core Service. Case content is not used to train general-purpose models, except with written agreement and a valid legal basis.

15. Third-party services

The Service may interoperate with hosting, email, identity, analytics, payment, security or AI providers. Providers engaged by MAINSYSTEMS are managed under appropriate agreements. An integration requested by the Customer or an external link may be governed by the third party's terms, and MAINSYSTEMS is not liable for an external service outside its control. Material subprocessor changes are handled under the DPA.

16. Partners and resale

UNOVOX may be contracted directly with MAINSYSTEMS or through Partners who resell, integrate or present the Service to their own customers under a written partnership agreement with MAINSYSTEMS. Resale or intermediation without such an agreement is not permitted.

• Where the subscription is made through a Partner, the commercial and billing relationship between the Customer and the Partner is governed by their own arrangement; those conditions only bind MAINSYSTEMS to the extent they appear in an Order accepted by MAINSYSTEMS.
• Use of the Service always remains subject to these Terms and the DPA, which apply directly between the Customer and MAINSYSTEMS, whatever the contracting channel.
• No Partner has authority to amend these Terms, make commitments on behalf of MAINSYSTEMS or give additional warranties about the Service; any such commitment binds only the Partner.
• The Partner's own services, such as consulting, implementation, training, channel management or first-line support, are provided under the Partner's sole responsibility.
• If the agreement between MAINSYSTEMS and a Partner ends, MAINSYSTEMS will seek to ensure continuity of the Service for affected customers, and the relationship may become a direct subscription.

Organisations interested in reselling UNOVOX can visit the partners page or contact info@mainsystems.pt.

17. Availability, maintenance and support

MAINSYSTEMS seeks to keep the Service available and secure but does not promise uninterrupted operation unless the Order expressly defines a service level. Availability may be affected by planned maintenance, urgent security work, Internet or supplier failures, force majeure and the Customer's systems or configurations. We will seek to give reasonable advance notice of planned maintenance likely to have a material impact.

Support channels and response objectives are those published for the plan or stated in the Order. Support does not include legal advice, carrying out the Customer's investigations or correcting content controlled by the Customer, unless contracted separately. Restoring information from backups at the Customer's request, for causes not attributable to MAINSYSTEMS, is a reasonable-efforts service and may be charged as additional work.

18. Trials and beta features

We may make free evaluation access or features identified as beta, pilot or pre-release available. They are provided “as is”, may be changed or discontinued at any time, are not covered by service levels, and MAINSYSTEMS' liability for them is limited to the minimum legally permissible. Data uploaded to an evaluation environment may be deleted at the end of the period, with reasonable notice.

19. Changes to the Service

We may improve, update or replace features to maintain security, legal compliance, performance and product evolution. We will not materially reduce the core features of a paid plan during a current prepaid period without a legitimate reason and reasonable mitigation. If a change has a material adverse effect that cannot reasonably be mitigated, the parties will seek an appropriate solution under the Order.

20. Intellectual property and feedback

UNOVOX is original development by MAINSYSTEMS. MAINSYSTEMS and its licensors own the Service, software, interface, Documentation, trademarks and associated intellectual property rights. The Customer owns its names, logos, policies and Customer Data. If the Customer voluntarily provides product feedback, MAINSYSTEMS may use it without restriction or attribution, provided it does not disclose confidential information or Customer Data. Use of the Customer's name or logo as a commercial reference requires prior consent, revocable at any time.

21. Suspension

MAINSYSTEMS may suspend affected access where reasonably necessary to prevent an active security threat, unlawful use, material harm to the Service or to third parties, or where undisputed amounts remain overdue for more than 30 days after notice and an opportunity to remedy. Where feasible, suspension will be limited in scope and duration, and the Customer will be informed of the reason and the steps to restore access. Where possible, suspension will preserve the receipt of reports already in progress and the integrity of existing data.

22. Term, cancellation and termination

The contract starts when the Order takes effect and continues for the subscribed period. Either party may terminate for a material breach not cured within 30 days of written notice, or earlier where the breach cannot be cured, insolvency law permits termination or continuation would be unlawful. The Customer may cancel renewal by the method indicated in the Order or the account.

Upon termination, access ends and outstanding amounts become due. Subject to payment and legal restrictions, the Customer may export Customer Data using the available functions before termination or during the 30-day recovery period after termination, unless the Order or the DPA states a different period. After that period, MAINSYSTEMS deletes or returns Customer Data in accordance with the DPA, legal retention obligations and secure backup cycles. The Customer acknowledges that exporting and retaining the register of reports required by the Whistleblowing Law is its own responsibility.

23. Warranties and disclaimers

MAINSYSTEMS warrants that the Service will substantially conform to the Documentation and will be provided with reasonable professional skill. If a reproducible material non-conformity is reported, the primary remedy is its correction or a reasonable alternative. If neither is reasonably possible, the affected Service may be terminated with a refund of prepaid amounts for the affected unused period.

To the maximum extent permitted by law, no warranty is given that the Service will be error-free or uninterrupted, that it will by itself ensure the Customer's legal or regulatory compliance, or that it will guarantee the detection, truthfulness or successful investigation of a report. The Customer's decisions remain its own responsibility.

24. Customer responsibility for its activity

The Customer is solely responsible for the operation of its whistleblowing channel, for the content and processing of Customer Data, for the decisions taken in its cases and for complying with its own legal obligations, including those under the Whistleblowing Law and under Data Protection Law as controller.

If MAINSYSTEMS is subject to claims, judicial or administrative proceedings, fines, penalties or any costs, including lawyers' fees and court costs, due to an act attributable to the Customer, its users or its operation of the channel, the Customer will fully reimburse and compensate MAINSYSTEMS for all such amounts and damages, including the time and resources reasonably spent responding. This obligation is not subject to the limit in section 25 and does not apply only to the extent the matter demonstrably results from a breach attributable to MAINSYSTEMS.

MAINSYSTEMS will inform the Customer of the claim or proceeding with reasonable promptness and will conduct its own defence. The Customer will provide, on request, the necessary information and cooperation. Neither party will enter into a settlement imposing obligations on the other without its consent.

25. Liability

Neither party is liable for indirect or consequential damages, loss of profits, revenue, anticipated savings or reputation, nor for losses caused by the other party's unlawful instructions, configuration or failure to follow the Documentation, except where such exclusion is prohibited by law. MAINSYSTEMS is not liable for fines, penalties or measures imposed on the Customer by authorities as a result of the Customer's failure to comply with its own legal obligations.

To the maximum extent permitted by law, MAINSYSTEMS' total liability arising from the Service is limited to the amounts actually paid by the Customer for the Service in the twelve months preceding the event giving rise to liability, except in cases of wilful misconduct or in matters where the law does not allow limitation. The Customer's liability towards MAINSYSTEMS, including payment obligations, the reimbursement and compensation obligations in section 24, infringement of MAINSYSTEMS' intellectual property rights and breach of confidentiality, is not subject to any contractual limit.

26. Force majeure

Neither party is liable for delay or failure caused by events beyond its reasonable control, including widespread network or cloud failure, power outage, natural disaster, war, civil unrest, epidemic, act of authority or labour dispute, provided the affected party seeks to mitigate the effect and resumes performance when possible. Payment obligations already due are not excused.

27. Changes to these Terms

We may update these Terms for legal, security or Service changes. Updates apply to website use when published. For an existing paid subscription, a materially unfavourable change applies from the next renewal, unless earlier application is required by law or necessary to address an urgent security risk. Where appropriate, we will give prior notice. Continued use after the applicable date constitutes acceptance; if the Customer does not accept a renewal change, it may cancel the renewal.

28. General provisions

• Notices: contractual notices may be sent to the account's administrative email; notices to MAINSYSTEMS may be sent to info@mainsystems.pt. A notice is deemed received on the first business day after sending, unless proven otherwise.
• Assignment: neither party may assign the contract without the other's consent, not to be unreasonably withheld, except to an affiliate or in a merger, reorganisation or sale of substantially all relevant assets, with obligations maintained.
• Severability: if a provision is unenforceable, it will be adjusted to the minimum extent necessary and the remainder stays in force.
• No waiver: failure to exercise a right is not a waiver.
• Independence: the parties are independent contractors; the contract creates no agency, partnership or employment relationship.
• Survival: sections on payment of amounts due, confidentiality, data protection, intellectual property, liability and reimbursement, governing law and any provisions that by their nature should survive, survive termination.
• Entire agreement: the contractual framework described in section 1 supersedes prior discussions on the same subject.
• Language: versions in other languages are provided for convenience. In case of divergence, the Portuguese version prevails, unless the Order states otherwise.

29. Governing law and jurisdiction

The contract is governed by Portuguese law. The courts of Lisbon, Portugal, have jurisdiction, without prejudice to any mandatory forum or dispute mechanism that cannot legally be excluded. Before starting proceedings, the parties will seek to resolve the dispute in good faith through their designated representatives, within 30 days of written notice of the dispute.

30. Contact

MAINSYSTEMS, LDA. (UNOVOX)
Av. da República, 50, 2.º andar, 1050-196 Lisbon, Portugal
Email: info@mainsystems.pt
Privacy: dpo@mainsystems.pt
Phone: +351 211 245 202