Terms of Service

In these terms: "Account" means the Provoxis tenant environment created when you register, including its assigned subdomain and region. "Administrator" means a user your Account grants administrative rights to; "Staff" means any other user your Administrators invite. "Customer Data" means all data your organisation and its users submit to or generate in the service, and includes "Report Content" — everything a reporter submits through your reporting channel and everything a case handler adds to a case. "Reporter" means a person who submits a report through your reporting channel. "Reporting Channel" means the internal whistleblowing reporting channel you operate using the service. "Documentation" means the product guidance Provoxis publishes for the service. "Subscription Term" means the period your subscription runs for, as selected at signup, together with any renewal period. "Trial" means a free evaluation period granted at signup. "DPA" means our Data Processing Agreement. "Acceptable Use Policy" or "AUP" means the Acceptable use section of these terms. "Directive" means Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law, and the national law implementing it that applies to your organisation. "Order Form" means a separately signed ordering document for the service; there is none unless the parties sign one, and if they do it prevails over these terms for the matters it covers.

You accept these terms electronically when you tick the acceptance box at registration. The individual who accepts warrants that they are authorised to bind the organisation they name. One acceptance records your organisation's agreement to the whole set — these terms, the Privacy Policy, and the Data Processing Agreement — and Provoxis records when acceptance was given and which revision of the set it applied to. These documents are the entire agreement between the parties about the service and replace any earlier understanding about it. The current version of each is always the one published on this website; Provoxis can provide an earlier version on request. Reporters, and people named in or affected by a report, are never asked to accept these terms and acquire no rights under them.

Provoxis is a hosted whistleblowing report-intake and case-management platform, provided on a subscription basis. The service is deployed as independent, region-specific stacks; a tenant's Report Content and staff-account data are processed only in the region assigned at registration. At launch the service runs one instance per live region: this guarantees regional data residency and isolation, but does not guarantee high availability, automatic failover, or a specific uptime commitment, and we do not warrant — and you should not represent to others — that the service carries an uptime SLA. Provoxis may modify, improve, or discontinue features of the service over time; where a change would materially and adversely affect a core feature you rely on, Provoxis will give your Administrators reasonable prior notice. These terms govern the service as made available from time to time, and not any feature that has been announced but not yet released; you should not make a purchasing decision in reliance on an unreleased feature.

A new subscription includes a free Trial — 30 days unless a different length is stated at signup. One Trial is available per organisation. A valid payment method is required to begin the Trial. Unless you cancel before the Trial ends, the subscription converts automatically to a paid subscription and your first payment is taken on the interval and in the currency you selected. Provoxis may change or withdraw the Trial offer for future signups, and may shorten or end a specific Trial where it is being abused or used other than to evaluate the service in good faith. If a Trial ends without converting, the Account and its data are handled under the "Effect of termination" section. Features made available during a Trial are provided "as is".

You must provide accurate registration information, including your organisation's name and a valid payment method, and keep your Account's login credentials confidential. You are responsible for all activity carried out through accounts your organisation controls, including Staff accounts your Administrators invite, and for your Administrators' management of roles, permissions, retention settings, and legal holds. Your Administrators may add and remove Staff and act for your organisation in relation to the Account. Your chosen subdomain and assigned region are fixed for the lifetime of the Account, barring a deliberate migration agreed with us in writing. It is your responsibility to keep your Administrator and billing contact details current so that the notices these terms provide for reach you.

Provoxis is billed at a flat rate per tenant — not per seat or per employee — via our payment processor, Stripe, on the interval and in the currency you selected at signup. Payment is by card; we do not invoice separately unless an Order Form says so. (a) Renewal. Your subscription renews automatically for successive periods equal to your initial Subscription Term unless you cancel before the renewal date. Renewal is at our then-current list price for your plan; we will give your Administrators reasonable prior notice of any price increase that would apply on renewal, and you may cancel before it takes effect. (b) Taxes. Fees are exclusive of VAT, sales, use, and similar taxes, which you are responsible for where they apply; where you are required to withhold tax, you will gross up the payment so that we receive the full amount due. (c) No refunds. Fees already paid are non-refundable, and we do not refund a partial period on a cancellation or on termination for convenience, except for the Trial cancellation right above and any refund we cannot lawfully exclude. (d) Failed payment. If a payment fails, we notify your Administrators and restrict access to case-management and administrative features immediately. Your public report-intake form and reporter portal stay available for a short grace period — 7 days unless a different length is stated — and are then suspended until payment is resolved, as described in the "Suspension" section. While they are suspended your organisation has no working internal reporting channel; meeting that obligation under the Directive or equivalent local law remains your organisation's responsibility, not ours. Resolving payment restores all access. (e) Chargebacks. Reversing a charge or raising a chargeback without first contacting us to resolve the issue is a breach of these terms and grounds for suspension.

The flat rate assumes normal use by a single organisation operating its own Reporting Channel. Provoxis may apply reasonable limits to storage, to the size and type of evidence attachments, to voice-recording minutes, and to the number of Administrators and channels on an Account, and will publish or make available the current limits on request. If your use is abnormal or materially exceeds what a single organisation would generate — for example automated bulk submission, or use that degrades the service for other tenants — Provoxis may contact you to agree a plan change or a reasonable additional fee, and may take action under the "Suspension" section if the use continues. You may not resell the service, provide it as a bureau service, or host a third party's reporting channel on your Account.

You are responsible for how your organisation uses the service. In particular, you: establish and operate your Reporting Channel lawfully, including under the Directive, the UK or EU GDPR, and any equivalent local law that applies to your organisation; act as the data controller of Report Content and reporter data, including giving reporters and, where required, the subjects of and witnesses to a report the information about the processing that Articles 13 and 14 of the UK and EU GDPR require, and complying with the prohibition on retaliation; designate competent persons to receive and handle reports and diligently follow up on them; do not use the platform, or ask Provoxis to use it, to identify a reporter who has chosen to remain anonymous; are responsible for the accuracy of the content and configuration your Staff enter, such as misconduct categories and retention settings; and manage your own internal access control, including promptly removing users who no longer need access. Provoxis provides the platform; it does not provide legal advice on how you should run your whistleblowing programme, and using the service does not by itself make your organisation compliant with the Directive or any other law.

You may not, and may not permit any user or third party to: use the service to store or transmit content that is unlawful, or that infringes or misappropriates a third party's intellectual-property or privacy rights; upload or transmit malicious code; attempt to gain unauthorised access to, or disrupt the integrity or performance of, the service or its underlying infrastructure; circumvent or attempt to circumvent the service's access controls, tenant isolation, or rate limiting; carry out load testing, vulnerability scanning, or penetration testing against the service without our prior written consent; access the service to build a competing product, or for benchmarking or competitive analysis; interfere with any other tenant's use of the service or attempt to access another tenant's data; or scrape or use automated means to extract data from the service other than through features we provide for that purpose. We may suspend or restrict access under the "Suspension" section if we reasonably believe this section has been breached, and will tell you why where we are able to.

Provoxis provides a neutral channel for your Reporting Channel. Provoxis does not monitor, review, verify, investigate, moderate, or act on Report Content, and has no obligation to do so. Provoxis makes no assessment of the merits, truth, or seriousness of any report, and decisions about how to handle, investigate, escalate, or close a report are solely yours as the controller and operator of the channel. Provoxis owes no duty of care to a reporter, or to a person named in or affected by a report, in respect of how your organisation operates its Reporting Channel or handles a report. Complaints from a reporter or an affected person about how a channel is run are a matter for your organisation as controller; Provoxis will refer any such complaint it receives to you.

If Provoxis receives a court order, subpoena, or a demand from a regulator or other public authority for Customer Data, it will act as set out in the Data Processing Agreement: unless legally prohibited, it will notify you without undue delay and, where possible, before disclosing, so that you can seek to limit or challenge the request; it will tell the authority that Provoxis is a processor and that the request should be directed to you; it will challenge a request that is unlawful or overbroad; and it will disclose only the minimum data actually required. Provoxis does not respond substantively to a request from a private third party for another party's Customer Data.

Provoxis processes Report Content and reporter data solely as your processor, under your instructions, as set out in our Privacy Policy and our Data Processing Agreement. The DPA is incorporated into and forms part of these terms; where it conflicts with the rest of these terms on a data-protection matter, the DPA prevails. Our Privacy Policy describes the separate, limited processing Provoxis carries out as an independent controller — your Administrators' account records, billing records, and website statistics. We disclose every sub-processor we use in our public sub-processor registry.

Each party may be given access to information of the other that is marked confidential or that a reasonable person would understand to be confidential ("Confidential Information") — including pricing and commercial terms, non-public information about the service and its security, and your configuration of the service. Report Content is not governed by this section; it is governed by the Data Processing Agreement. The receiving party will use the other's Confidential Information only to exercise its rights and perform its obligations under these terms, will protect it with at least reasonable care, and will not disclose it except to its personnel and advisers who need it and are under equivalent duties of confidence. This section does not apply to information that is or becomes public through no fault of the receiving party, was already known to it without a duty of confidence, is rightfully received from a third party, or is independently developed. A party may disclose the other's Confidential Information where required by law or a court, and will, where lawful, give reasonable prior notice so the other can seek protective treatment. These obligations continue for three years after disclosure, and for as long as the law protects it in the case of a trade secret.

Provoxis and its licensors retain all rights in the service itself, including its software, design, and branding. Subject to these terms and for the Subscription Term, Provoxis grants you a limited, worldwide, non-exclusive, non-transferable, non-sublicensable right to access and use the service and the Documentation for your organisation's internal business purposes. The restrictions in the "Acceptable use" section apply to that right. You retain all rights in Customer Data. You grant Provoxis only the rights needed to host, process, transmit, and display Customer Data in order to provide and support the service to you, and to create anonymous, aggregated statistics about the operation of the service that identify no person and no tenant.

If you or your users give Provoxis suggestions, ideas, or other feedback about the service, you grant Provoxis a perpetual, irrevocable, worldwide, royalty-free licence to use that feedback to operate and improve the service and its other products, without restriction and without any obligation to you. Provoxis is under no obligation to act on feedback, and feedback is not your Confidential Information.

Provoxis may make features available that are identified as beta, preview, early access, or evaluation. Those features are optional, are provided "as is" and "as available", are excluded from any service warranty and from any availability expectation in these terms, and may be changed, limited, or withdrawn at any time. Provoxis's liability in connection with a beta feature is limited to the fullest extent the law allows. The Data Processing Agreement continues to apply to any personal data a beta feature processes.

Provoxis will not use your name, marks, or logo, or otherwise identify your organisation as a Provoxis customer, in any marketing or public-facing material without your prior written consent. Either party may disclose the existence of the relationship on a confidential basis to its professional advisers and, where required, to a regulator or auditor.

Each party warrants that it has the authority to enter into these terms. Provoxis warrants that, during the Subscription Term, the service will perform materially in accordance with the Documentation; your exclusive remedy for a breach of this warranty is for Provoxis to correct the non-conformity or, if it cannot do so within a reasonable time, for either party to terminate the affected subscription and for Provoxis to refund the prepaid fees covering the period after termination. Except for that warranty, and to the fullest extent permitted by law, the service is provided on an "as is" and "as available" basis, and Provoxis disclaims all other warranties, express or implied, including the implied warranties of merchantability, satisfactory quality, fitness for a particular purpose, and non-infringement. Provoxis does not warrant that the service will be uninterrupted or error-free, or that using it will cause your organisation to be compliant with the Directive, the UK or EU GDPR, or any other law.

(a) By you. You will defend Provoxis against any third-party claim arising from or relating to your Customer Data or Report Content, your establishment or operation of your Reporting Channel, your breach of the Acceptable Use Policy or of applicable law, or a claim brought by a reporter, a person named in or affected by a report, an employee, or a regulator in connection with how your organisation operates its whistleblowing programme; and you will indemnify Provoxis against the damages, costs, and reasonable legal fees finally awarded against it or agreed in settlement in respect of such a claim. (b) By Provoxis. Provoxis will defend you against any third-party claim that the service, as provided by Provoxis and used in accordance with these terms, infringes that third party's intellectual-property rights, and will indemnify you against the damages, costs, and reasonable legal fees finally awarded or agreed in settlement; this does not apply to a claim arising from Customer Data, from your use of the service in breach of these terms, from a modification not made by Provoxis, or from a combination of the service with anything not provided by Provoxis. If the service becomes, or Provoxis believes it may become, the subject of such a claim, Provoxis may at its option procure the right for you to keep using the service, modify it to make it non-infringing, or terminate the affected subscription and refund the prepaid fees covering the period after termination. This section states each party's entire liability and the other party's exclusive remedy for a third-party intellectual-property claim. (c) Procedure. The party seeking indemnity must promptly notify the other of the claim, give the other sole control of its defence and settlement (except that a settlement imposing a non-monetary obligation or an admission of fault on the indemnified party needs that party's consent), and provide reasonable cooperation.

To the fullest extent permitted by law, neither party is liable for loss of profits, revenue, goodwill, anticipated savings, or data, or for any indirect or consequential loss, arising out of or relating to these terms or the service. To the fullest extent permitted by law, each party's total aggregate liability arising out of or relating to these terms and the DPA taken together is limited to the amount you paid Provoxis in the 12 months before the event giving rise to the liability. Nothing in these terms limits either party's liability that cannot lawfully be limited, including liability for death or personal injury caused by negligence, or for fraud; and nothing limits your obligation to pay fees due, or either party's liability under the "Indemnification" section. This section allocates risk between the parties and is reflected in the fees.

These terms apply for the Subscription Term and any renewal. (a) By you for convenience. You may cancel your subscription at any time; the cancellation takes effect at the end of your current billing period, access to administrative and case-management features ends then, and fees already paid are not refunded. (b) For cause. Either party may terminate for the other's material breach of these terms that is not cured within 30 days of written notice, or immediately if the other becomes insolvent, enters administration or liquidation, or ceases to carry on business. (c) For non-payment. Provoxis may terminate if a payment remains unresolved after the grace period and reasonable further notice. (d) Immediate. Provoxis may terminate immediately if your use of the service is unlawful, or creates a material legal risk for Provoxis or a material risk to the service or other tenants.

Provoxis may suspend or restrict all or part of your access to the service where: a payment has failed and remains unresolved (in which case case-management and administrative access is restricted immediately, and the report-intake form and reporter portal are suspended after the grace period in the "Subscription, fees, renewal and taxes" section); Provoxis reasonably believes the Acceptable Use Policy has been breached, or that there is a security risk to the service or other tenants; or a suspension is required to comply with the law or a binding order. Provoxis will give you notice, and where practicable an opportunity to cure, before suspending, unless the circumstances require immediate action. Provoxis will restore access promptly once the cause is resolved. Provoxis has no liability for a suspension carried out in good faith on these grounds, and a suspension does not extend your Subscription Term or entitle you to a refund.

On termination or expiry, your access to administrative and case-management features ends. Your Administrators may use the in-product case-file export to retrieve Report Content until the end of the Subscription Term or, where access has already ended, for 30 days afterwards. After that, Provoxis returns and deletes Report Content on the timetable and subject to the exceptions in the Data Processing Agreement, and applies the retention, legal-hold, and erasure rules in the Privacy Policy — so data is not deleted immediately or automatically, and any open legal or disciplinary matter, or any legal hold you have placed, suspends deletion so that it is not disrupted. Any fees accrued before termination remain payable. The "Definitions", "Confidentiality", "Intellectual property", "Feedback", "Indemnification", "Limitation of liability", and "Governing law and disputes" sections, and any accrued payment obligation, survive termination.

Neither party is liable for a delay in or failure of performance — other than an obligation to pay — caused by an event beyond its reasonable control, including an act of God, war, civil unrest, an act of a public authority, a network or utility failure not within its own systems, or a widespread internet or hosting-provider outage. The affected party will use reasonable efforts to mitigate the effect. If a force-majeure event continues for more than 30 days, either party may terminate the affected subscription on written notice.

Provoxis may update these terms from time to time. For a change that does not materially reduce your rights or materially increase your obligations, Provoxis updates the "last updated" date above. For a change that does, Provoxis notifies your Administrators with reasonable prior notice before it takes effect. Continuing to use the service after a change takes effect is acceptance of it. If you do not accept a material change, you may terminate your subscription before the change takes effect by notifying Provoxis, and Provoxis will refund any prepaid fees covering the period after termination. A change required by law takes effect on the date the law requires.

Each party will comply with the laws that apply to it in performing these terms. You warrant that your organisation is not established in, and will not access or use the service from, a territory subject to comprehensive UK or EU sanctions, and that neither your organisation nor any person who will use the service on its behalf is a person with whom dealing is restricted under UK or EU sanctions law. Each party will comply with applicable anti-bribery and anti-corruption law and will not offer or accept an improper payment in connection with these terms.

(a) Entire agreement and order of precedence. These terms, the Privacy Policy, and the Data Processing Agreement are the entire agreement between the parties about the service. If they conflict, the following order applies: a signed Order Form; then the DPA, for data-protection matters; then these terms; then the Privacy Policy; then the Documentation. (b) Assignment. Neither party may assign these terms without the other's prior written consent, except that Provoxis may assign them to an affiliate or to a successor in connection with a merger, acquisition, or sale of substantially all of its assets, on notice to you. (c) No third-party beneficiaries. These terms are between the parties only. A reporter, a person named in or affected by a report, and a Staff user acquire no rights under them, and the Contracts (Rights of Third Parties) Act 1999 is excluded. (d) Notices. Notices under these terms are given in writing. Provoxis gives notice to you by email to your Administrators, or through the product; you give notice to Provoxis at support@provoxis.com, and account and support matters may be raised at support@provoxis.com. A notice is treated as received on the day it is sent if that is a business day, and otherwise on the next business day. (e) Subcontractors. Provoxis may use subcontractors to help provide the service and remains responsible for their performance; sub-processors of personal data are governed by the DPA. (f) Waiver and severability. A failure to enforce a provision is not a waiver of it, and if a provision is found unenforceable it is modified to the minimum extent necessary and the rest of these terms continue in force. (g) Relationship of the parties. The parties are independent contractors; these terms create no partnership, agency, or joint venture.

These terms are governed by the laws of England and Wales, and the United Nations Convention on Contracts for the International Sale of Goods does not apply. Before starting court proceedings, the parties will first try in good faith to resolve the dispute through discussions between senior representatives, for a period of 30 days from written notice of the dispute — except that either party may seek urgent injunctive relief at any time. The courts of England and Wales have exclusive jurisdiction over any dispute arising from these terms. Nothing in this section deprives you of the protection of a mandatory consumer or data-protection right you have under the law of your own country.

Questions about these terms can be sent to support@provoxis.com.