Terms of service

3. The Services

3.1. Civic shall provide the Services with reasonable skill and care.

3.2. The Services may include: (a) scanning Customer Websites for cookies and similar tracking technologies; (b) generating Reports; (c) assisting with production of Cookie Policies; (d) providing a cookie banner and consent management tool; (e) enabling website users to adjust consent permissions; (f) storing consent choices or consent records on an anonymous or anonymised basis where technically possible; (g) providing API connectivity between the Customer Website and the Platform; (h) making Software or Firmware available for configuration or connection purposes; and (i) providing dashboards, configuration tools and related Documentation.

3.3. The Customer acknowledges that the Services rely on information, configuration choices, URLs, sitemap data, website content, third-party scripts, tag managers, plugins, cookies, consent settings and other information supplied or controlled by the Customer or third parties. Civic is not responsible for inaccurate, incomplete, misleading, outdated or unlawful outputs caused by inaccurate, incomplete, misleading, outdated or unlawful inputs or configurations supplied by the Customer or third parties.

3.4. The Services are provided on a multi-tenant SaaS basis. The Customer has no right to a dedicated instance, dedicated infrastructure, source code access or bespoke hosting unless expressly agreed in writing.

3.5. Civic may update, modify, improve, patch, replace or discontinue parts of the Services from time to time, provided that this does not materially reduce the core functionality of the Services during a paid Subscription Term.

4. No guarantee of legal compliance

4.1. The Services are intended to assist the Customer with cookie, tracking technology, consent and privacy compliance processes. They are not a substitute for legal advice, regulatory advice, technical audit advice or professional compliance advice.

4.2. Civic does not warrant, represent or undertake that: (a) the Customer Website will be compliant with the Privacy Legislation; (b) the Customer’s use of cookies, pixels, tags, SDKs, scripts or tracking technologies will be lawful; (c) any Cookie Policy, banner wording, consent mechanism, Report or configuration will satisfy the requirements of any regulator, court, tribunal or Supervisory Authority; (d) the Services will identify every cookie, pixel, tag, SDK, script, tracker or similar technology; (e) the Services will detect every change to the Customer Website; (f) the Customer will avoid complaints, claims, regulatory action, fines, penalties or enforcement action; or (g) the Services will meet the Customer’s particular legal, regulatory, technical or commercial requirements.

4.3. The Customer is solely responsible for obtaining its own legal, privacy, regulatory and technical advice in relation to its website, cookies, tracking technologies, consent arrangements, privacy notices, direct marketing practices and compliance obligations.

4.4. The Customer acknowledges that the Privacy Legislation, regulatory guidance, browser technology, cookie technology, consent practices and enforcement expectations may change over time. Civic is not responsible for monitoring the Customer’s legal obligations or for advising the Customer of all changes affecting the Customer’s business.

5. Customer obligations

5.1. The Customer shall: (a) use the Services only in accordance with these Terms, the Documentation and Applicable Law; (b) provide accurate, complete and up-to-date information to Civic; (c) ensure that all URLs, sitemaps, domains and website data supplied to Civic are accurate and complete; (d) maintain and update its cookie configuration, consent settings, Cookie Policy, privacy information and website implementation; (e) check and validate all Reports, Cookie Policies, banner settings and outputs before relying on them or publishing them; (f) ensure that only Authorised Users access the Services; (g) keep API Credentials, passwords and Account access details secure and confidential; (h) promptly notify Civic of any unauthorised access, suspected security incident or misuse of the Services; (i) comply with all applicable Stripe terms and payment requirements; (j) ensure that its use of the Services does not infringe third-party rights or breach Applicable Law; and (k) be responsible for the acts and omissions of its Authorised Users.

5.2. The Customer shall not: (a) use the Services in respect of any website, URL, domain, subdomain, application or online property that it does not own, control or have express authority to scan, configure or manage; (b) scan, submit, crawl, process or analyse any third-party website without the third party’s express authority; (c) use the Services for unlawful, fraudulent, abusive, misleading or harmful purposes; (d) use the Services to monitor, profile, track or identify individuals unlawfully; (e) introduce malware, malicious code, worms, trojans, ransomware, spyware or other harmful material; (f) interfere with, disrupt, overload, scrape, reverse engineer or attempt to gain unauthorised access to the Platform; (g) copy, modify, adapt, translate, decompile, disassemble or reverse engineer the Software except to the extent permitted by law; (h) attempt to circumvent technical limitations, usage restrictions, security controls or access controls; (i) resell, sublicense, distribute or make the Services available to third parties except as expressly permitted in writing; (j) use the Services to develop a competing product or service; (k) remove proprietary notices from the Services, Software or Documentation; or (l) misrepresent the functionality, legal effect or compliance status of the Services.

5.3. The Customer acknowledges and agrees that the principle of “rubbish in, rubbish out” applies. Civic shall not be liable for any deficiency, error, omission, inaccuracy or non-compliance caused by incorrect, incomplete, misleading, unlawful or outdated Customer Data, Customer Website content, Customer configuration, URLs, sitemaps, third-party scripts, tag managers, plugins, integrations or other inputs.

6. Own URL and authority to scan

6.1. The Customer warrants and undertakes that each URL, sitemap, domain, subdomain, application, webpage or digital property submitted to the Services is owned, controlled or lawfully operated by the Customer, or that the Customer has obtained express authority from the relevant owner or operator to use the Services in respect of it.

6.2. The Customer must not use the Services to scan, interrogate, analyse, crawl or process third-party websites or systems without express written authority from the owner or lawful operator of those websites or systems.

6.3. The Customer shall indemnify Civic against all losses, liabilities, claims, complaints, damages, fines, penalties, costs and expenses arising out of or in connection with any breach of this clause 6.

7. Account registration and security

7.1. The Customer must ensure that all Account information is accurate and kept up to date.

7.2. Civic may refuse, suspend or cancel an Account where it reasonably believes that: (a) the Customer has breached these Terms; (b) the Account is being used unlawfully or fraudulently; (c) the Services are being misused; (d) the Customer has failed to pay Charges; (e) suspension is required for security, legal or regulatory reasons; or (f) the Customer’s use may harm Civic, the Platform, other customers or third parties.

7.3. The Customer is responsible for all activity under its Account unless caused by Civic’s breach of these Terms.

8. Subscriptions, Charges and payment

8.1. The Charges shall be as stated on the Website, in the checkout process, in the Order, or as otherwise agreed in writing.

8.2. Unless otherwise stated, Charges are exclusive of VAT and any other applicable taxes, which shall be payable by the Customer in addition.

8.3. Payment shall be made through Stripe or any other payment provider notified by Civic.

8.4. Civic does not store full card details. Payment information is processed and stored by Stripe or the relevant payment provider in accordance with its own terms and privacy notice.

8.5. Subscription Charges are payable in advance unless otherwise agreed in writing.

8.6. Where the Customer fails to pay any Charges when due, Civic may: (a) suspend access to the Services; (b) restrict functionality; (c) charge interest on overdue sums at the rate of 4% per annum above the Bank of England base rate from time to time; and (d) recover reasonable costs of collection.

8.7. Civic may increase Charges on renewal of a Subscription Term by giving reasonable notice to the Customer.

9. Free Trials

9.1. Civic may offer Free Trials at its discretion.

9.2. Civic may withdraw or modify any Free Trial at any time.

9.3. Free Trials are provided “as is” and without any warranty, representation or commitment as to availability, functionality, fitness for purpose, support or continuation.

9.4. At the end of a Free Trial, access may cease unless the Customer enters into a paid subscription.

10. Software, Firmware and API licence

10.1. Subject to payment of the Charges and compliance with these Terms, Civic grants to the Customer a limited, revocable, non-exclusive, non-transferable, non-sublicensable licence during the Subscription Term to: (a) access and use the Platform; (b) use the Software and Firmware solely for configuration, connection and operation of the Services; and (c) use the API solely to connect the Customer Website and authorised systems to the Platform.

10.2. The Customer shall use the API only in accordance with the Documentation and any technical, security, rate limit, authentication or usage requirements specified by Civic.

10.3. Civic may issue, rotate, suspend, revoke or replace API Credentials at any time where reasonably required for security, operational, legal or technical reasons.

10.4. The Customer must not: (a) disclose API Credentials to any unauthorised person; (b) embed API Credentials in publicly accessible code repositories or client-side code where this creates a security risk; (c) use the API to overload, disrupt, scrape, extract or misuse the Platform; (d) use the API to process unlawful data or third-party websites without authority; (e) bypass security, authentication, usage or rate restrictions; (f) use the API to create a competing service; or (g) permit any third party to use the API except as expressly authorised by Civic.

10.5. Civic may suspend API access immediately where it reasonably believes that the API is being misused, compromised, used unlawfully, used in breach of these Terms, or used in a way that may harm the Platform, Civic, other customers or third parties.

11. Customer Data and Reports

11.1. The Customer retains ownership of Customer Data.

11.2. Civic retains ownership of the Services, Platform, Software, API, Firmware, Documentation, templates, know-how, technical processes, algorithms, system architecture, product analytics, generic learnings and Civic Data.

11.3. The Customer grants Civic a non-exclusive, worldwide, royalty-free licence to use, host, copy, process, transmit, analyse and display Customer Data to the extent necessary to provide, secure, maintain, develop and improve the Services.

11.4. Civic may use anonymised and aggregated data derived from use of the Services for statistical research, benchmarking, analytics, product improvement, service development, security monitoring, training, quality assurance and commercial analysis, provided that such data does not identify the Customer, any Authorised User or any individual.

11.5. Reports are generated using automated and semi-automated tools and may be affected by website configuration, third-party scripts, browser settings, caching, geolocation, device type, consent settings, tag managers, access restrictions and changes to the Customer Website.

11.6. The Customer is responsible for reviewing, validating and approving all Reports, Cookie Policies, banner wording and configuration settings before relying on them or publishing them.

11.7. Civic may store Reports, scan history, last scanned URL, last scan time, consent configuration information and related records for the purpose of providing the Services, unless otherwise stated in the applicable subscription plan or Documentation.

12. Customer Website scanning

12.1. In order to provide the Services, Civic may temporarily load, access, retrieve, scan, analyse or process the Customer Website, URLs, sitemaps, pages, scripts, cookies, tags and related technical information.

12.2. Civic does not use Customer Website content for any purpose other than providing, maintaining, securing, analysing and improving the Services, unless otherwise agreed or permitted by these Terms.

12.3. The Customer is responsible for ensuring that the Customer Website can lawfully be scanned and processed by the Services.

12.4. Civic shall not be liable for failure to scan or analyse any Customer Website where that failure is caused by access restrictions, firewalls, bot controls, geoblocking, authentication, technical errors, outages, anti-scraping controls, third-party scripts, changes to the Customer Website or other matters outside Civic’s reasonable control.

13. Consent Data

13.1. The Services may store website users’ consent decisions anonymously or on an anonymised basis where technically possible.

13.2. Where any Consent Data, IP address, device identifier, browser identifier, online identifier, consent file, timestamp or related record constitutes Personal Data under the Privacy Legislation, the Customer is responsible for ensuring that there is a lawful basis for the Processing and that appropriate privacy information has been provided.

13.3. The Customer acknowledges that IP addresses and online identifiers may constitute Personal Data unless fully and irreversibly anonymised.

13.4. The Customer is responsible for determining appropriate retention periods for Consent Data and for responding to any Data Subject requests, complaints or regulatory enquiries relating to the Customer Website.

13.5. Where the Services allow website users or the Customer to download consent files, the Customer is responsible for the use, storage, protection and retention of those files after download.

14. Privacy, data protection and UK GDPR

14.1. Each party shall comply with the Privacy Legislation applicable to it.

14.2. The parties acknowledge that the Services are intended to minimise the Processing of Personal Data and that Civic does not require the Customer to upload website user content or unnecessary Personal Data to the Platform.

14.3. The Customer acknowledges that Civic may process limited Personal Data including company name, user name, business contact details, login details, Account records, payment status information, support communications, technical logs, IP addresses, online identifiers and usage data.

14.4. As between the parties: (a) the Customer is the Controller of Personal Data relating to the Customer Website, website users, cookie consent choices and Customer-controlled configuration; (b) Civic may act as Processor where it Processes Personal Data on behalf of the Customer for the purpose of providing the Services; and (c) Civic may act as Controller in respect of Account administration, billing administration, security monitoring, business communications, service analytics, product improvement, legal compliance and its own business records.

14.5. Where Civic acts as Processor for the Customer, Civic shall: (a) Process Personal Data only on documented instructions from the Customer, including these Terms; (b) ensure that persons authorised to Process Personal Data are subject to confidentiality obligations; (c) implement appropriate technical and organisational measures taking account of the nature, scope, context and purposes of Processing; (d) assist the Customer, taking account of the nature of the Processing, with the Customer’s obligations relating to Data Subject rights, security, Personal Data Breaches, data protection impact assessments and prior consultation, insofar as reasonably possible; (e) notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Personal Data Processed by Civic as Processor; (f) at the Customer’s choice, delete or return Personal Data Processed as Processor at the end of the Services, unless retention is required by Applicable Law; (g) make available information reasonably necessary to demonstrate compliance with this clause 14; and (h) permit and contribute to audits only where required by the Privacy Legislation, subject to reasonable notice, confidentiality, security requirements, and the Customer bearing Civic’s reasonable costs unless the audit reveals material breach by Civic.

14.6. For the avoidance of doubt, to the extent applicable, Civic will process Customer Personal Data in compliance with the CCPA, including by: (i) not selling or sharing Customer Personal Data (as those terms are defined under the CCPA); (ii) honouring any opt-out rights exercised by California residents in relation to such processing (where configured by the Customer); and (iii) providing the same level of privacy protection to Customer Personal Data as is required under the CCPA, regardless of the jurisdiction in which processing takes place.

14.7. Civic will not to use, process, analyse, or otherwise use any Customer Personal Data, or any aggregated, anonymised, or pseudonymised derivative thereof, for the purposes of developing, training, improving, or benchmarking any Civic product or service without the prior express written consent of the Customer.

14.8. The Customer gives Civic general authorisation to appoint sub-processors. Civic may use sub processors for hosting, infrastructure, communications, support, analytics, payment administration, security and service delivery. Civic shall remain responsible for the performance of its sub-processors where they Process Personal Data on behalf of the Customer.

14.9. Civic may transfer Personal Data outside the United Kingdom where appropriate safeguards are in place, including an adequacy decision, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful transfer mechanism.

14.10. In case of a Personal Data breach concerning the Personal Data processed by Civic under these Term, the data exporter shall notify the Customer without undue delay after becoming aware of it. "Without undue delay" shall mean no later than seventy-two (72) hours from when Civic becomes aware of, or reasonably suspects, that a Personal Data breach has occurred.

14.11. The Customer warrants and undertakes that: (a) all Personal Data on or collected through the Customer Website has been obtained, stored, used, disclosed and otherwise Processed in accordance with the Privacy Legislation; (b) the Customer has provided all required privacy notices and cookie notices; (c) the Customer has obtained all required consents or has another lawful basis for Processing; (d) the Customer has complied with all applicable rules relating to cookies, tracking technologies, direct marketing, analytics, pixels, advertising technologies and online identifiers; (e) the Customer has authority to provide Customer Data to Civic for Processing through the Services; and (f) the Customer’s use of the Services shall not cause Civic to breach the Privacy Legislation.

14.12. The Customer shall indemnify Civic against all losses, liabilities, claims, complaints, damages, fines, penalties, costs and expenses arising out of or in connection with: (a) the Customer’s breach of the Privacy Legislation; (b) unlawful Personal Data on or collected through the Customer Website; (c) the Customer’s failure to obtain required consents or provide required notices; (d) the Customer’s unlawful use of cookies, tracking technologies or direct marketing tools; (e) any claim by a website user, regulator or third party arising from the Customer Website; or (f) the Customer’s breach of clause 14.11.

15. Security

15.1. Civic shall implement reasonable technical and organisational measures designed to protect the Platform against unauthorised access, accidental loss, destruction or damage.

15.2. The Customer is responsible for: (a) securing its own systems, devices, websites, accounts and credentials; (b) applying updates and patches to its own website, systems and integrations; (c) configuring the Services correctly; (d) managing Authorised User access; (e) revoking access for former personnel; and (f) maintaining backups of Customer Data where required for its own business continuity.

15.3. Subject to the Uptime Commitment in clause 16, Civic does not warrant that the Services will be free from vulnerabilities, interruptions, errors or security incidents.

16. Availability, maintenance and support

16.1. Civic shall use reasonable endeavours to make the Services available during the Subscription Term.

16.2. The Services may be unavailable due to planned maintenance, emergency maintenance, updates, security work, hosting provider issues, third-party service failures, internet disruption, force majeure events or other matters outside Civic’s reasonable control.

16.3. Subject to the remainder of this clause 16, Civic shall ensure that the Hosted Services are available for at least 99.6% of each calendar month during the Subscription Term (the “Uptime Commitment”).

16.4. For the purposes of this clause 16, the Hosted Services shall be available where the Customer is able to access and use the material functionality of the Hosted Services substantially in accordance with the Documentation.

16.5. The calculation of availability for the purposes of the Uptime Commitment shall exclude any period during which the Hosted Services are unavailable or materially impaired as a result of:

(a) planned maintenance, provided that Civic gives the Customer reasonable prior notice where reasonably practicable;

(b) emergency maintenance, security updates, patches or other urgent remedial work;

(c) any act or omission of the Customer, an Authorised User or any person acting on the Customer’s behalf;

(d) any failure, defect or incompatibility in the Customer Website, the Customer’s systems, equipment, software, networks, internet connection, configuration, integrations or third-party services selected or controlled by the Customer;

(e) the failure or unavailability of any hosting provider, telecommunications provider, internet service provider, browser technology, third-party platform, API or other third-party service which is outside Civic’s reasonable control;

(f) the suspension of the Services in accordance with these Terms;

(g) the Customer’s breach of these Terms or failure to pay the Charges when due;

(h) a force majeure event; or

(i) any beta, trial, demonstration, evaluation or Free Trial service.

16.6. Civic shall use reasonable endeavours to schedule planned maintenance so as to minimise disruption to the Hosted Services and, where reasonably practicable, shall provide reasonable advance notice of any planned maintenance which is expected materially to affect availability.

16.7. Civic may provide support in accordance with the applicable subscription plan or as otherwise stated on the Website.

16.8. Unless expressly agreed in writing, Civic does not provide bespoke legal advice, bespoke regulatory advice, website development services, full compliance audits, penetration testing, data protection officer services or legal representation.

17. Third-party services

17.1. The Services may integrate with, rely on, interact with or contain links to third-party services, including Stripe, hosting providers, browser technologies, tag managers, analytics tools, advertising networks, website platforms, content management systems and third-party scripts.

17.2. Civic is not responsible for third-party services, third-party terms, third-party outages, third-party security, third-party processing, third-party scripts, third-party cookies or changes made by third parties.

17.3. The Customer is responsible for complying with all applicable third-party terms and licences.

18. Intellectual Property Rights

18.1. All Intellectual Property Rights in the Services, Platform, Software, Firmware, API, Documentation, templates, workflows, scanning tools, consent management tools, product design, know-how, business methods, technical methods and Civic Data are owned by or licensed to Civic.

18.2. Except for the limited licence expressly granted in these Terms, the Customer receives no right, title or interest in or to the Services or any Civic Intellectual Property Rights.

18.3. The Customer shall not challenge Civic’s ownership of the Services or any related Intellectual Property Rights.

18.4. The Customer grants Civic the right to use feedback, suggestions, improvement ideas, comments, bug reports and feature requests provided by the Customer without restriction or payment, provided that Civic does not disclose the Customer’s Confidential Information in doing so.

19. Confidentiality

19.1. Each party shall keep the other party’s Confidential Information confidential and shall not disclose it except as permitted by these Terms.

19.2. A party may disclose Confidential Information: (a) to its employees, officers, contractors, advisers, insurers, auditors, professional advisers and subcontractors who need to know it for the purposes of these Terms; (b) where required by Applicable Law, a court, a regulator or a competent authority; (c) with the other party’s prior written consent; or (d) to enforce its rights under these Terms but on condition in each case and where possible, such disclosure shall be on terms of confidentiality with the recipient of the information, no less onerous than these Terms.

19.3. Confidentiality obligations do not apply to information which: (a) is or becomes public other than through breach of these Terms; (b) was lawfully known to the receiving party before disclosure; (c) is lawfully received from a third party without restriction; or (d) is independently developed without use of the disclosing party’s Confidential Information.

19.4. This clause 19 shall continue for 5 years after termination of these Terms, except in respect of trade secrets, source code, security information and highly sensitive business or technical information, which shall remain confidential for so long as it remains non-public.

20. Warranties

20.1. Civic warrants that it shall provide the Services with reasonable skill and care.

20.2. Except as expressly stated in these Terms, all warranties, representations, conditions and terms implied by statute, common law or otherwise are excluded to the fullest extent permitted by law.

20.3. Civic does not warrant that: (a) subject to the Uptime Commitment in clause 16, the Services will be uninterrupted, error-free or secure; (b) all cookies or tracking technologies will be detected; (c) the Services will be compatible with all websites, browsers, devices, systems, scripts, tag managers or technologies; (d) any output will be legally accurate, complete or sufficient; (e) any Customer Website will become compliant through use of the Services; or (f) the Services will meet the Customer’s particular requirements or be fit for any particular purpose.

20.4. The Customer warrants and undertakes that: (a) it has authority to enter into these Terms; (b) it has authority to use the Services in respect of each Customer Website; (c) all Customer Data is accurate, lawful and complete; (d) it will comply with the Privacy Legislation and Applicable Law; (e) any Personal Data on or collected through the Customer Website has been obtained, stored and Processed in accordance with the Privacy Legislation; (f) its use of the Services will not infringe third-party rights; (g) it will not use the Services in respect of third-party websites without authority; and (h) it will not use the Services for unlawful, harmful or abusive purposes.

21. Customer indemnity

21.1. The Customer shall indemnify Civic against all losses, liabilities, claims, complaints, damages, fines, penalties, costs and expenses suffered or incurred by Civic arising out of or in connection with: (a) the Customer’s breach of these Terms; (b) the Customer’s breach of the Privacy Legislation or Applicable Law; (c) the Customer Website; (d) Customer Data; (e) unauthorised use of third-party websites, URLs, sitemaps, domains or systems; (f) infringement or alleged infringement of third-party rights by Customer Data or the Customer Website; (g) claims by website users, regulators, customers, consumers or third parties arising from the Customer Website or the Customer’s use of cookies or tracking technologies; (h) the Customer’s failure to obtain required consents or provide required notices; (i) the Customer’s misuse of the API, Software, Firmware or Platform; (j) any Personal Data uploaded, supplied, collected or processed unlawfully by or on behalf of the Customer; and (k) any claim that the Customer relied on the Services as legal advice or as a guarantee of compliance.

22. Limitation of liability

22.1. Nothing in these Terms shall limit or exclude liability for: (a) death or personal injury caused by negligence; (b) fraud or fraudulent misrepresentation, (c) breach of obligations which cannot lawfully be excluded or limited or (d) any other liability which cannot be excluded or limited by law.

22.2. Subject to clause 22.1, Civic shall not be liable for: (a) loss of profits; (b) loss of revenue; (c) loss of business; (d) loss of anticipated savings; (e) loss of goodwill; (f) loss of reputation; (g) loss of contracts; (h) loss of use; (i) loss or corruption of data; (j) business interruption; (k) regulatory fines, penalties or enforcement action, except to the extent caused directly by Civic’s breach of these Terms; (l) failure of the Customer Website to comply with the Privacy Legislation; (m) inaccurate, incomplete or outdated Customer Data; (n) third-party services, third-party cookies, third-party scripts or third-party technologies; or (o) indirect or consequential loss.

22.3. Subject to clause 22.1, Civic’s total aggregate liability arising out of or in connection with these Terms, the Services, any Order and any non-contractual obligations shall not exceed the greater of: (a) the Charges paid by the Customer to Civic in the 12 months immediately preceding the event giving rise to the claim; and (b) £1,000.

22.4. The limitations and exclusions in this clause 22 apply whether liability arises in contract, delict, breach of statutory duty, misrepresentation, restitution or otherwise.

22.5. The Customer acknowledges that the Charges are set on the basis of the limitations and exclusions in these Terms.

23. Suspension and termination

23.1. Either party may terminate a subscription at the end of the then-current Subscription Term by giving notice in accordance with the cancellation process stated on the Website.

23.2. Civic may suspend or terminate access to the Services immediately where: (a) the Customer fails to pay Charges; (b) the Customer breaches these Terms; (c) Civic reasonably suspects unlawful use, misuse, fraud or security compromise; (d) the Customer uses the Services in respect of third-party websites without authority; (e) suspension is required by law, regulator, payment provider or hosting provider; (f) the Customer’s use creates a security, legal, technical or operational risk; or (g) Civic is required to protect the Platform, Civic, other customers or third parties.

23.3. Either party may terminate these Terms immediately by written notice if the other party commits a material breach which is incapable of remedy or, if capable of remedy, fails to remedy it within 14 days after receiving written notice requiring remedy.

23.4. Civic may terminate these Terms if the Customer becomes insolvent, enters liquidation, administration, receivership, sequestration, makes an arrangement with creditors, ceases trading or suffers an equivalent event.

23.5. On termination: (a) the Customer’s right to access and use the Services shall cease; (b) the Customer shall stop using the Software, Firmware, API and Documentation; (c) all outstanding Charges shall become immediately payable; (d) Civic may delete or disable access to Customer Data in accordance with its retention practices; (e) clauses intended to survive termination shall continue in force.

24. Export, sanctions and restricted use

24.1. The Customer shall not use the Services in breach of applicable export control, sanctions, anti-bribery, anti-corruption, anti-money laundering or trade restrictions.

24.2. The Customer shall not use the Services in any country, territory or sector where such use would expose Civic to legal or regulatory risk.

25. Force majeure

25.1. Civic shall not be liable for delay or failure to perform caused by events outside its reasonable control, including internet failures, hosting failures, cloud provider outages, cyber-attacks, denial-of-service attacks, labour disputes, epidemics, pandemics (whether naturally occurring or man-made), war, terrorism, civil unrest, fire, flood, power failure, changes in law, regulatory action or failure of third-party services.

26. Changes to these terms

26.1. Civic may update these Terms from time to time.

26.2. Where changes are material, Civic shall take reasonable steps to notify Customers.

26.3. Continued use of the Services after updated Terms take effect shall constitute acceptance of the updated Terms.

26.4. Changes shall not materially reduce the Customer’s rights during a paid Subscription Term unless required by law, regulator, security reasons, payment provider requirements or technical necessity.

27. Notices

27.1. Notices under these Terms must be given in writing.

27.2. Civic may give notices by email, Account notification, Website notice or other electronic communication.

27.3. Notices to Civic must be sent to [email protected] or such other address notified by Civic.

28. Assignation and subcontracting

28.1. The Customer may not assign, transfer, charge, subcontract or deal in any other manner with its rights or obligations under these Terms without Civic’s prior written consent.

28.2. Civic may assign, transfer, subcontract or novate its rights and obligations under these Terms to an Affiliate, purchaser of its business or assets, successor, contractor or service provider, provided that this does not materially prejudice the Customer’s rights.

29. Entire agreement

29.1. These Terms and the applicable Order constitute the entire express agreement between the parties in relation to the Services.

29.2. The Customer acknowledges that it has not relied on any statement, representation, assurance or warranty not expressly set out in these Terms or the applicable Order.

29.3. Nothing in this clause limits or excludes liability for fraud or fraudulent misrepresentation.

30. Severability

30.1. If any provision of these Terms is invalid, unlawful or unenforceable, it shall be modified to the minimum extent necessary to make it valid, lawful and enforceable.

30.2. If modification is not possible, the relevant provision shall be deemed deleted and the remaining provisions shall continue in force.

31. Waiver

31.1. A failure or delay by either party to exercise any right or remedy shall not constitute a waiver of that right or remedy.

31.2. A waiver must be in writing and shall apply only to the specific circumstances for which it is given.

32. No partnership or agency

32.1. Nothing in these Terms creates a partnership, joint venture, employment relationship, agency relationship or fiduciary relationship between the parties.

32.2. The Customer has no authority to bind Civic.

33. Third-party rights

33.1. No person other than Civic and the Customer has any right to enforce these Terms.

34. Governing law and jurisdiction

34.1. These Terms, any Order and any dispute or claim arising out of or in connection with them, including non-contractual disputes or claims, shall be governed by Scots law.

34.2. The parties submit to the exclusive jurisdiction of the Scottish courts.

SECTION B - ACCEPTABLE USE TERMS

1. Acceptable Use

1.1. The Customer must not use the Services: (a) unlawfully; (b) fraudulently; (c) to infringe third-party rights; (d) to access or scan unauthorised websites; (e) to introduce malware or harmful code; (f) to overload or disrupt the Platform; (g) to test security without written permission; (h) to reverse engineer the Services; (i) to scrape, harvest or extract data unlawfully; (j) to identify individuals unlawfully; (k) to process Special Category Data without lawful basis and appropriate safeguards; (l) to send unlawful marketing communications; (m) to misrepresent compliance status; (n) to create or support a competing product; or (o) in any way that may damage Civic’s reputation, systems, customers or business.

1.2. Civic may investigate suspected breach of this clause 42 and may suspend access while doing so.

SECTION C - DATA PROCESSING PARTICULARS

1. Processing details

1.1. Where Civic acts as Processor for the Customer, the Processing details are as follows:

Subject matter of Processing: provision of cookie scanning, consent management, reporting, cookie banner, API connectivity and related SaaS services.

Duration of Processing: the Subscription Term and any period required for deletion, retention, legal compliance, backup management or dispute resolution.

Nature and purpose of Processing: hosting, storing, scanning, analysing, retrieving, transmitting and generating reports in relation to Customer Websites, consent choices and related technical information.

Types of Personal Data: business contact details, user names, login details, IP addresses, online identifiers, consent records, timestamps, website technical data, support communications, system logs and any Personal Data incidentally processed through the Customer Website.

Categories of Data Subjects: Customer personnel, Authorised Users, website users, support contacts and other individuals whose Personal Data is included in Customer Data.

Customer obligations: lawful basis, notices, consents, website compliance, accuracy of Customer Data, Data Subject requests, regulator engagement, retention instructions and compliance with the Privacy Legislation.

SECTION D - ORDER OF PRECEDENCE

1. Order of precedence

1.1. In the event of conflict, the following order of precedence shall apply: (a) any signed written agreement expressly varying these Terms; (b) the Order; (c) Section C, where Civic acts as Processor; (e) the rest of these Terms; (f) the Documentation.

SECTION E - CONTACT

1. Contact

1.1. Questions about these Terms should be sent to:
Civic Registered office address: 12 South Charlotte Street, Edinburgh, Scotland, EH2 4AX, UK.
Email: [email protected]
Website: cookiecontrol.com and civicuk.com