Terms and Conditions

1. General

These Terms and Conditions ("Terms") govern the use of the services provided by The GRC Company AB ("the Company"). By using Noru ("the Service"), the Customer agrees to be bound by these Terms.

2. Scope of Service

The Company provides a technical platform that connects to and analyzes the Customer's IT infrastructure for the purpose of assessing regulatory compliance, governance, risk, and related controls. The Service is provided "as is" without any guarantee that analyses are complete, up-to-date, or sufficient to meet specific legal or regulatory obligations.

3. Responsibility for Uploaded Data

• The Customer is solely responsible for ensuring that all data uploaded to the Service is correct, complete, lawful, and relevant.
• Data uploads are performed at the Customer's own risk.
• The Company shall not be liable for errors, omissions, or incomplete analyses caused by inaccurate, insufficient, or unlawful data provided by the Customer.
• The Customer warrants that all data provided can lawfully be shared with The Company and will indemnify The Company against any claims from third parties related to such data.

4. Data Ownership and Usage

• The Customer retains all rights to the data uploaded into the Service.
• The Company retains all rights to the Service, including intellectual property.
• The Company may use aggregated and anonymized data for purposes such as service improvement, statistical analysis, and benchmarking, provided that no individual or Customer is identifiable.

5. Data Protection and Security

The Company implements appropriate technical and organizational measures to safeguard Customer Data. However, the Customer is responsible for ensuring that no unlawful, sensitive, or unauthorized data is uploaded.

6. Service Levels and Availability

• The Service may be unavailable from time to time due to maintenance, updates, or circumstances beyond The Company's reasonable control.
• The Company does not guarantee uninterrupted availability and disclaims any liability for downtime unless otherwise agreed in a separate Service Level Agreement (SLA).

7. Limitation of Liability

• To the maximum extent permitted by law, The Company's total liability for all claims arising out of or in connection with the Service shall not exceed the fees paid by the Customer to The Company in the twelve (12) months preceding the event giving rise to the claim.
• The Company shall not be liable for indirect, incidental, or consequential damages, including but not limited to loss of profit, business, or data.
• Nothing in these Terms excludes liability for fraud, gross negligence, or willful misconduct.

8. Force Majeure

The Company shall not be liable for any delay or failure to perform due to circumstances beyond its reasonable control, including but not limited to acts of God, cyberattacks, regulatory changes, or third-party service provider outages.

9. Payment and Suspension

The Company may suspend access to the Service in case of late payment, misuse, or breach of these Terms.

10. Termination and Data Return

Upon termination, the Customer is responsible for disconnecting from the Service platform. Once the Customer disconnects, the Customer regains control of its data. After disconnection, The Company may permanently delete residual data unless retention is required by law.

11. Amendments

The Company reserves the right to amend these Terms. Customers will be notified in advance of any material changes.

12. Governing Law and Disputes

These Terms shall be governed by Swedish law. Any disputes shall be settled by Swedish courts, with Stockholm District Court as the court of first instance.