WhistleHub Terms of Service

WhistleHub OÜ · Registry code 16567393 · Estonia

In plain English

Before the formal terms, here is what this agreement actually says:

• You pay one flat fee. It does not change if your organisation grows.
• Your price is locked for as long as your subscription continues. If we ever change our prices, you get six months’ notice and can leave before it applies to you.
• You get legal documentation validated by an independent law firm. You pay nothing to them.
• You keep those documents permanently, even if you cancel.
• If you cancel within 30 days of activating, we refund everything.
• After that, you can cancel any time and the service runs to the end of the period you paid for. We do not lock you in beyond that.
• You can export your data at any time, and for 90 days after you leave.
• We run the platform. You decide how reports are handled. We never see or manage your cases for you.
• We are a technology provider, not your lawyer.

1. Who we are, and who this is between

This agreement is between WhistleHub OÜ (registry code 16567393, Estonia) — “we”, “us”, “WhistleHub” — and the organisation named in the Order Form — “you”.

It consists of these Terms, your Order Form, and the Data Processing Addendum. If they conflict, the Order Form comes first, then the Data Processing Addendum, then these Terms.

By placing an Order you confirm you are authorised to enter into this agreement for your organisation.

2. What WhistleHub does

We provide a whistleblowing platform that lets people report concerns confidentially or anonymously, and lets your designated handlers receive, track and respond to those reports.

Depending on what you ordered, this includes:

• a secure reporting channel that runs outside your own IT systems;
• case management, follow-up communication and an audit trail;
• legal documentation validated by an independent law firm (see clause 4);
• with Trustline, an annual review and update of that documentation.

3. What WhistleHub does not do

We do not give legal advice. We do not investigate reports, assess them, or decide what should happen. We do not act as your reporting handler.

Those responsibilities stay with you, and the law places them there.

4. The Legal Sponsor

What it is. We engage an independent law firm — the Legal Sponsor — to validate the whistleblowing documentation supplied with your subscription. Where a Local Legal Sponsor is active for your market, that firm’s local-law validation applies. Otherwise the Global Legal Sponsor’s documentation applies.

What it costs you. Nothing beyond your subscription. You do not pay the Legal Sponsor, and you will not receive an invoice from them for the documentation supplied with the service.

Who they act for. The Legal Sponsor validates the documentation for use by subscribers. They are not your lawyer, and no lawyer-client relationship arises between you and them under this agreement. If you want advice on your specific situation, you can engage them — or any other firm — separately and on their own terms.

Independence. The Legal Sponsor exercises its own professional judgement and remains subject to its own professional rules. We do not direct their legal conclusions.

What you get. The documentation described in your Order Form. With Trustline, we also arrange an annual review and, where the law or good practice has changed, an updated version.

Who owns it. WhistleHub owns the documentation. The Legal Sponsor validates it against applicable law and does not acquire rights in it.

Your licence. You receive a permanent, irrevocable, royalty-free licence to use the documentation within your own organisation. This survives cancellation. You may not resell it, publish it as your own product, or supply it to organisations outside your group.

If the arrangement changes. If a Legal Sponsor relationship ends, we will appoint a replacement firm of comparable standing. If we cannot do so within 90 days, you may cancel and we will refund the unused part of your fee.

5. Your subscription and your price

Term. Subscriptions run for 12 months and renew automatically unless you cancel before the renewal date. Monthly billing is available where your Order Form says so.

Your price is flat. The fee in your Order Form does not depend on how many people you employ. We will not reprice your subscription because your organisation has grown.

Your price is locked. The fee in your Order Form applies for as long as your subscription continues without interruption. If we change our prices, we will tell you at least six months before it affects you. You may cancel before the change takes effect and we will refund the unused part of your fee.

No add-ons. Everything described in your Order Form is included. We will not charge separately for platform features within the service you bought.

Taxes. Fees are exclusive of VAT and other taxes, which are added where the law requires.

6. Cancelling, and refunds

First 30 days. If you cancel within 30 days of first activating the service, we refund your fee in full.

After that. You can cancel at any time. The service continues until the end of the period you have paid for, and we do not charge you again. Fees already paid for the current period are not refunded, except where these Terms say otherwise.

If we breach. If we materially breach this agreement and do not fix it within 30 days of your written notice, you may cancel immediately and we will refund the unused part of your fee.

If you breach. We may suspend or cancel if you materially breach this agreement and do not fix it within 30 days of our written notice, or immediately if the law requires it.

7. What you are responsible for

You are responsible for:

• appointing suitable people to receive and handle reports, and keeping that list current;
• meeting the whistleblowing obligations that apply to your organisation;
• handling reports lawfully and fairly, including the rights of anyone named in a report;
• publishing your reporting channel so that the people who need it can find it;
• keeping your organisational details accurate;
• your own record-retention obligations.

Adapting the supplied documentation to your organisation, and adopting it, is your decision.

8. Security

We protect your data with technical and organisational measures appropriate to the sensitivity of whistleblowing information. Our current measures are described in our Security Documentation, which forms part of this agreement.

We will not materially reduce the level of protection described there during your subscription. If we change how we protect your data, the Security Documentation will say so.

9. Personal data

Where we handle personal data on your behalf, we do so as your processor and our Data Processing Addendum applies. It forms part of this agreement.

10. Your data and your rights in it

Your data stays yours. You keep all rights in the reports, case records, documents and other content in your account. We claim no ownership of it and we will not use it to train models, build products, or for any purpose other than providing the service to you and meeting our legal obligations.

Our platform stays ours. We keep all rights in the WhistleHub software, brand and the documentation described in clause 4, subject to the licence granted there.

Getting your data out. You can export your data at any time during your subscription, and for 90 days after it ends. After that we delete it in line with the Data Processing Addendum. If you need a longer window, tell us before your subscription ends and we will agree one.

11. Availability and support

Availability. We commit to 99.5% monthly availability for the platform, excluding planned maintenance announced in advance. If we fall below that in two consecutive months, you may cancel and we will refund the unused part of your fee.

Support. We answer support requests within one business day. Where your Order Form states a different service level, that applies.

12. Liability

What is not limited. Nothing in this agreement limits liability for death or personal injury, fraud, wilful misconduct, gross negligence, or anything that cannot be limited by law.

General cap. Otherwise, each party’s total liability under this agreement is limited to the greater of the fees you paid in the 12 months before the claim, or €5,000.

Data protection and confidentiality. For breaches of clause 8, clause 9 or the Data Processing Addendum, our liability is limited to the greater of three times the fees you paid in the 12 months before the claim, or €25,000.

Indirect loss. Neither party is liable for indirect or consequential loss, or for loss of profit, revenue or anticipated savings.

What caps cannot do. These limits apply between you and us. They do not affect either party’s obligations to data subjects or regulators under data protection law.

13. Changes to these terms

We may update these Terms. We will give you at least 30 days’ notice of any change, and at least six months’ notice of any price change.

If a change materially disadvantages you, you may cancel before it takes effect and we will refund the unused part of your fee.

14. Governing law and disputes

Estonian law applies. Disputes go to Harju County Court, Estonia.

Before starting proceedings, both of us will try in good faith to resolve the matter directly for at least 30 days.

15. General

Confidentiality. Each of us keeps the other’s confidential information confidential, and uses it only for this agreement.

Assignment. Neither of us may assign this agreement without the other’s consent, except to a successor of the whole business, where notice is enough.

Notices. Notices may be sent by email to the addresses on the Order Form.

Entire agreement. These Terms, the Order Form and the Data Processing Addendum are the whole agreement between us on this subject.

Language. These Terms and the Data Processing Addendum are published in several languages so that you can read them in your own. If a translation and the English version differ, the English version applies.

Severability. If any part is unenforceable, the rest still applies.

Acceptance. Accepting electronically is valid and binding.