Terms of Service — FortressPoint Compliance Suite

1. Acceptance of Terms

By creating an account, accessing, or using FortressPoint Compliance Suite (the "Service"), operated by FortressPoint Consulting Limited ("FortressPoint," "we," "us," or "our"), you agree to be bound by these Terms of Service ("Terms"). If you are using the Service on behalf of an organisation, you represent that you have authority to bind that organisation to these Terms, and "you" refers to both you individually and that organisation.

If you do not agree to these Terms, do not use the Service.

2. Description of the Service

The Service provides a self-assessment tool against Nigeria's Data Protection Act 2023 and the General Application and Implementation Directive (GAID) and other frameworks we support (including UK GDPR, the Cybercrimes Act, and ISO/IEC 27001), along with AI-assisted generation of supporting compliance documents (including but not limited to privacy policies and data registers), a compliance scoring dashboard, and related administrative features (team management, support ticketing).

The Service also includes: third-party/vendor due-diligence assessments (including sending assessment links to your vendors for them to complete directly); an Evidence Vault for storing supporting documentation; incident/breach response report generation; staff compliance training assignment and tracking; an AI Compliance Assistant that answers questions grounded in your own submitted evidence and audit data; AI-assisted drafting of answers to third-party security questionnaires you upload; an optional public Trust Page you may choose to publish, showing a summary of your compliance status to visitors you share it with; downloadable, sequentially-numbered invoices for your subscription and add-on purchases; and a dedicated channel for submitting product feedback and feature requests.

The Service does not constitute legal advice. Generated documents, scores, and recommendations are informational tools intended to help you understand and work toward compliance — they are not a substitute for advice from a qualified lawyer or licensed Data Protection Compliance Organisation (DPCO), and FortressPoint does not guarantee that use of the Service will result in legal compliance with any applicable law or regulation. You remain solely responsible for your organisation's actual compliance.

3. Account Registration

You must provide accurate, complete information when creating an account. You are responsible for maintaining the confidentiality of your account credentials and for all activity under your account. You must notify us promptly of any unauthorised use of your account.

Where your organisation uses a shared company account (the "Dashboard" tier), the individual who creates the account is designated as "Admin" and is responsible for managing team member access, including assigning roles (Admin, Editor, Viewer) to invited team members. FortressPoint is not responsible for disputes between members of the same organisation regarding account access or role assignment; where an organisation's sole Admin needs to transfer that role, this must be requested through FortressPoint support and is handled manually, not automatically.

4. Subscription Tiers and Payment

The Service is offered under multiple tiers, including a free tier, a one-time-purchase tier, and a recurring subscription tier, as described on our pricing page at the time of purchase. Optional add-ons may be purchased on top of a subscription. A negotiated Enterprise tier is also available for organisations with requirements beyond our standard tiers, under separately agreed contract terms. Pricing, included features, and any promotional discounts are as stated on the pricing page at the time of your purchase and may change for future purchases or renewals with notice.

Payments are processed by Paystack, a third-party payment processor. FortressPoint does not directly store your full payment card details.

Subscription changes you request: Upgrades to a higher tier take effect immediately. Downgrades, plan changes (e.g. monthly to annual), and cancellations of a recurring subscription that you request take effect at the end of your current billing period — you retain access through the period you have already paid for, and no partial refund is provided for the unused remainder of a cancelled period.

Automatic suspension on failed payment. This is different from the above: if a scheduled renewal payment fails, your subscription (or add-on) is automatically marked past due and your account's paid features are suspended immediately — you are not entitled to continue using paid features through the remainder of a period whose renewal payment did not succeed. See Privacy Policy Section 9 for how this automated process works and how to request a review if you believe it happened in error.

Launch/promotional discounts, where offered, are subject to availability and eligibility criteria stated at the time, and are not retroactively available once exhausted or expired.

5. Acceptable Use

You agree not to:

• Use the Service for any unlawful purpose or in violation of any applicable law or regulation;
• Attempt to gain unauthorised access to the Service, other users' accounts, or FortressPoint's systems;
• Use the Service to process personal data on behalf of a third party in a manner that would itself violate applicable data protection law;
• Reverse-engineer, decompile, or attempt to extract the underlying logic or prompts used by the Service's AI-assisted features for competitive or commercial redistribution purposes;
• Share your account credentials with unauthorised individuals, or circumvent team-seat limits associated with your subscription tier.

6. Intellectual Property

The Service, including its software, design, branding, and underlying question sets and document templates, is the property of FortressPoint Consulting Limited and is protected by applicable intellectual property laws. Subject to these Terms, we grant you a limited, non-exclusive, non-transferable licence to use the Service for your organisation's internal compliance purposes.

Documents generated for you through the Service (e.g. your privacy policy, data register) are yours to use for your own organisation's purposes. You may not resell or redistribute the Service itself, or the underlying question sets/templates, as a competing product.

7. Disclaimers

THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE," WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT.

Compliance and regulatory requirements change over time, and while we make reasonable efforts to keep the Service's content aligned with current Nigerian data protection law (including the NDPA 2023 and the GAID) and other referenced frameworks, we do not guarantee that the Service's content reflects the most current legal requirements at all times, or that it covers every requirement applicable to your specific organisation, sector, or circumstances. Sector-specific regulatory requirements (for example, additional obligations applicable to financial institutions or telecoms operators) may not be fully addressed by the Service.

8. Limitation of Liability

To the maximum extent permitted by applicable law, FortressPoint shall not be liable for any indirect, incidental, special, consequential, or punitive damages, or any loss of profits, revenue, data, or goodwill, arising from your use of or inability to use the Service, including any reliance on generated documents, scores, or recommendations, even if advised of the possibility of such damages.

FortressPoint's total liability for any claim arising from these Terms or your use of the Service shall not exceed the amount you paid to FortressPoint for the Service in the 12 months preceding the claim.

9. Data Protection and Privacy

Our collection and use of your personal data in connection with the Service is governed by our Privacy Policy, available at /privacy, which is incorporated into these Terms by reference.

*[Note for legal review — updated 2026-08-13 (data-mapping re-audit): our Privacy Policy (Section 1) is explicitly scoped to personal data belonging to users of the Service itself. It does not cover FortressPoint's processing of personal data ABOUT YOUR OWN third parties that you input into the Service as a customer — e.g. your vendors' contact details in Vendor Assessments, your staff members' names/emails for Training assignments, or any third-party personal data contained in files you upload to the Evidence Vault. In that relationship you are the data controller and FortressPoint is a processor acting on your instructions, which ordinarily calls for its own customer-facing Data Processing Addendum (a controller-processor agreement, distinct from this consumer-facing Privacy Policy).

This previously read "does not yet exist in any form" — that is now stale: a full draft DPA (`FortressPoint-Data-Processing-Agreement`) was prepared 2026-08-12, alongside a DPIA. Neither has been reviewed or signed off by qualified legal counsel or a DPO, and neither is yet published, incorporated into this Terms of Service by reference, or linked from the Service itself — so the underlying gap this note exists to flag (no operative DPA is currently in effect for any Customer) is NOT yet closed. Once the DPA is reviewed and finalized, this Section should incorporate it by reference the same way Section 9 above incorporates the Privacy Policy.]*

10. Termination

We may suspend or terminate your access to the Service if you breach these Terms, engage in fraudulent or abusive conduct, or fail to pay applicable fees. You may cancel your account at any time; see Section 4 regarding the effect of cancellation on subscription billing.

Upon termination, your right to access the Service ceases, though we may retain your data for a reasonable period as described in our Privacy Policy, or as required by applicable law.

11. Changes to These Terms

We may update these Terms from time to time. We will provide notice of material changes (e.g. via email or an in-Service notice) before they take effect. Continued use of the Service after changes take effect constitutes acceptance of the updated Terms.

12. Governing Law

These Terms are governed by the laws of the Federal Republic of Nigeria, without regard to conflict of law principles.

13. Contact

Questions about these Terms should be directed to: compliance@fortresspointconsulting.com