FortressSphere Terms of Service

1. Acceptance of Terms

These Terms govern commercial matters, including subscription, payment, intellectual property, acceptable use and liability unless expressly stated otherwise.

By creating an account, accessing or using FortressSphere (the "Service"), you agree to these Terms of Service ("Terms"). If you use the Service on behalf of an organisation, you agree that you have authority to bind that organisation, and "you" refers to both you individually and that organisation.

In these Terms, "FortressPoint" means FortressPoint Consulting Limited, a company incorporated in Nigeria, unless an order form, subscription agreement or other written agreement names a different FortressPoint entity as the contracting entity.

2. Description of the Service

FortressSphere is a SaaS compliance platform supporting self-assessment against the Nigeria Data Protection Act 2023, the General Application and Implementation Directive, the Cybercrimes Act, UK GDPR, ISO/IEC 27001 and AI governance requirements, together with other frameworks supported by the Service.

The Service may include AI-assisted generation of compliance documents, compliance scoring, an AI Compliance Assistant, third-party/vendor due-diligence assessments, vendor assessment links, an Evidence Vault, incident and breach-response report generation, staff compliance-training assignment and tracking with graded training quizzes, AI-assisted answers to uploaded security questionnaires, an optional public Trust Page, an AI System Register and DPIA workflow, implementation-roadmap/priority-gap tracking, compliance metric snapshots, automated compliance reminders, regulatory-update monitoring, invoicing and related administrative functionality.

Features may be added, modified or removed as the Service develops. The current feature set and applicable subscription tier are determined by the Service and the applicable order, pricing or subscription arrangement.

The Service does not constitute legal advice. Generated documents, scores, recommendations and AI outputs are informational tools. They are not a substitute for advice from a qualified lawyer, Data Protection Officer or licensed Data Protection Compliance Organisation where such advice is required. You remain responsible for your organisation's compliance decisions and implementation.

3. Account Registration and Organisation Access

You must provide accurate and complete information when creating an account and must keep account information reasonably up to date. You are responsible for maintaining the confidentiality of credentials and for activity carried out through your account.

Where an organisation account is used, the account creator or designated administrator may manage member access and roles, including Admin, Editor and Viewer. FortressPoint is not responsible for disputes within a customer organisation concerning allocation of roles or access. A transfer of sole administrator status may require intervention by FortressPoint support.

You must notify FortressPoint promptly if you become aware of unauthorised access or a security issue affecting your account.

4. Subscription Tiers and Payment

The Service may be offered under free, one-time-purchase, recurring subscription and Enterprise arrangements, together with optional add-ons. Pricing, included features and promotional terms are those stated at the time of purchase or otherwise agreed in the applicable customer contract.

Payments are processed by a third-party payment provider identified by FortressPoint. FortressPoint does not directly store full payment-card details.

Upgrades may take effect immediately. Unless otherwise stated in the applicable order or subscription terms, downgrades, plan changes and cancellations of recurring subscriptions take effect at the end of the current billing period, and no partial refund is provided for an unused remainder.

If a scheduled renewal payment fails, paid functionality may be suspended or the subscription may revert to the applicable free state. This is a mechanical consequence of payment status and is not an AI or profiling decision. If you believe a payment failure or resulting suspension occurred in error, contact FortressPoint for review.

5. Customer Responsibilities for Personal Data

You are responsible for the lawfulness, accuracy and adequacy of information you submit to FortressSphere and for ensuring that you have the necessary rights, notices, permissions and lawful bases to provide personal data to the Service.

This includes personal data relating to your employees, vendors, customers, contractors or other third parties. Where you submit such data, you generally determine the purposes for which it is processed and FortressPoint acts as your Processor under the FortressSphere Data Processing Agreement (the "DPA"), which is described in section 10.

You must not use the Service in a manner that breaches applicable data protection law or requires FortressPoint to process personal data contrary to your documented instructions or the DPA. You must not enter or upload special-category personal data (such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, genetic or biometric data, health data, or data about a person's sex life or sexual orientation) or data about criminal convictions and offences into the Service, including the Evidence Vault, free-text fields, chat and the AI-assisted features, unless FortressPoint has agreed to it in writing beforehand. The Service is not designed for health information regulated by the United States HIPAA and must not be used for it. The DPA sets out what happens if this data is submitted anyway.

If a third party whose data you have submitted seeks to exercise a data protection right, you remain responsible for responding as Controller where applicable. FortressPoint will provide the assistance required under the DPA.

6. Acceptable Use

You must not:

• use the Service for an unlawful purpose or in breach of applicable law;
• attempt to obtain unauthorised access to the Service, another user's account or FortressPoint's systems;
• submit personal data where you do not have an appropriate lawful basis, authority or instruction to do so;
• use the Service to process personal data on behalf of another party in a way that breaches applicable data protection law or the DPA;
• enter or upload special-category personal data in breach of section 5;
• reverse-engineer, decompile or attempt to extract the underlying logic, prompts or proprietary components of the Service for competitive redistribution, subject to any rights that cannot lawfully be restricted;
• share credentials with unauthorised individuals or circumvent subscription limits; or
• interfere with the security, availability or integrity of the Service.

7. Intellectual Property

FortressSphere, including its software, design, branding, question sets, templates and underlying proprietary materials, belongs to FortressPoint or its licensors and is protected by applicable intellectual property laws.

Subject to these Terms, FortressPoint grants you a limited, non-exclusive, non-transferable right to use the Service for your organisation's internal compliance purposes during the applicable subscription period.

Documents and other outputs generated for you may be used by your organisation for its own purposes, subject to the terms of the Service and any third-party rights. You may not resell the Service or reproduce and redistribute its proprietary question sets or templates as a competing product.

Customer data and customer-uploaded materials remain subject to the customer's rights and the DPA. Nothing in these Terms transfers ownership of customer data to FortressPoint.

8. AI-Assisted Features and Outputs

The Service uses AI-assisted functionality, including features supported by third-party AI model providers. To produce a response, the content needed for that feature is sent to the relevant provider.

FortressPoint does not permit those providers to use content submitted through the Service to train their models and has not opted in to any provider programme that would allow it. The providers apply limited retention periods to content sent to them, which are described in the Privacy Policy.

The AI Compliance Assistant is intended to provide responses grounded in relevant customer-submitted evidence and platform content where configured. AI-generated responses and other outputs may be incomplete, inaccurate or unsuitable for a particular legal, regulatory or organisational context. You remain responsible for reviewing AI-generated outputs and for any decisions or actions taken in reliance on them.

9. Public Trust Page and External Recipients

The Service may allow you to create and publish a public Trust Page or share assessment links with vendors or other third parties. You are responsible for deciding what information to publish or disclose and for ensuring that doing so is lawful and appropriate.

Where the Service sends vendor-assessment or training communications to individuals who do not have a direct relationship with FortressPoint, those communications are generally made on your behalf and you remain responsible for the underlying processing as Controller.

10. Data Protection and Privacy

FortressPoint's own processing of personal data in connection with the Service is described in the FortressSphere Privacy Policy, which is incorporated into these Terms by reference.

Where FortressPoint processes personal data on your behalf as Processor, the DPA applies and forms part of these Terms. It applies automatically, without a separate signature, in the same way these Terms are accepted when an account is created. You can read it at /dpa, and FortressPoint will provide a separately countersigned copy on reasonable request to compliance@fortresspointconsulting.com. If the DPA conflicts with these Terms on the processing of personal data on your behalf, the DPA prevails. Some of FortressPoint's service providers also act as independent controllers for limited account or usage data about the people who use the Service. The Privacy Policy and the DPA identify them.

11. Data Retention, Deletion and Account Closure

You may request closure of your account in accordance with the Service's account-closure process. A 14-day grace period may apply before deletion proceeds.

Deletion of an individual member's account does not necessarily delete organisation-owned compliance work, records or other content belonging to the customer organisation. Individual personal data is deleted or anonymised as applicable, while non-identifying references may remain where necessary to preserve the integrity of surviving organisational records.

FortressSphere also operates automated account-lifecycle processes for abandoned or genuinely unused accounts. Verified sign-ups that are not completed may be deleted after approximately 90 days following warning communications. A content-free free solo account may be deleted after approximately 9 months of inactivity following staged warnings. An account containing real retained content is not automatically deleted through the re-engagement flow; closure requires affirmative action by the account holder through the applicable consent mechanism.

Customer-controlled data is subject to the retention and deletion arrangements in the DPA and applicable customer instructions. Certain data may be retained where required for legal, accounting, security or audit purposes.

12. Disclaimers

To the maximum extent permitted by applicable law, the Service is provided on an "as is" and "as available" basis. FortressPoint does not warrant that the Service will be uninterrupted, error-free, complete for every regulatory context or sufficient by itself to establish compliance with any law or standard.

Compliance requirements change over time. FortressPoint may update the Service's content, frameworks and functionality, but does not guarantee that every requirement applicable to a particular organisation, sector or jurisdiction is covered.

Nothing in these Terms excludes or limits liability that cannot lawfully be excluded or limited.

13. Limitation of Liability

FortressPoint's total liability for any claim arising out of or in connection with these Terms or your use of the Service shall not exceed the amount paid to FortressPoint for the Service in the 12 months preceding the event giving rise to the claim.

To the maximum extent permitted by applicable law, FortressPoint shall not be liable for indirect, incidental, special, consequential or punitive loss, or for loss of profits, revenue, business opportunity, goodwill or data, except to the extent such liability cannot lawfully be excluded or limited. Nothing in these Terms excludes or limits liability that cannot lawfully be excluded or limited.

14. Suspension and Termination

FortressPoint may suspend or terminate access where you materially breach these Terms, engage in fraudulent or abusive conduct, create a material security risk or fail to pay applicable fees, subject to any contractual notice or cure requirements.

You may cancel your account in accordance with the applicable subscription arrangement. On termination, access to the Service will cease subject to any agreed transition or export arrangements and the retention/deletion requirements in the Privacy Policy and DPA.

15. Changes to the Service and These Terms

FortressPoint may modify the Service as it develops, including adding, changing or retiring features. Material changes to these Terms will be notified through the Service, by email or by another appropriate means where required.

Continued use after a change takes effect may constitute acceptance where the change has been notified in accordance with the applicable contract and law. Where a separate signed customer agreement applies, its amendment provisions take precedence.

16. Governing Law and Jurisdiction

These Terms and any agreement entered into under them shall be governed by the law specified in the applicable Order Form, Subscription Agreement or other written agreement between FortressPoint and the Customer.

Where the applicable agreement does not specify the governing law, these Terms shall be governed by the laws of the jurisdiction in which the relevant FortressPoint contracting entity is established.

Nothing in these Terms shall exclude or limit any mandatory rights or protections that apply to the Customer under applicable law, including any mandatory consumer protection or data protection rights that cannot lawfully be excluded or varied by contractual agreement.

17. Contact

Questions about these Terms or the Service should be directed to compliance@fortresspointconsulting.com or through the in-Service support mechanism.