Terms of Service

These Terms of Service (the “Terms”) govern access to and use of the Conclave virtual data room platform at app.conclave.work and related services (the “Service”), provided by Conclave S.r.l., Via Arnaldo Vassallo 3, 20125 Milano (MI), Italy, C.F. / P.IVA / Registro Imprese 14659250964, REA MI-2798612, PEC conclave@pec.it (“Conclave”, “we”, “us”).

The Service is offered only to businesses and professionals acting in the course of their trade or profession. It is not offered to consumers. By creating an account, opening a data room, or otherwise using the Service, you accept these Terms on behalf of the organisation you represent (the “Customer”) and confirm you have authority to bind it.

1. Definitions

• Authorised User: an individual the Customer, or a user it has authorised, invites to the Service, including members of the Customer’s team, advisers and invited counterparties such as bidders.
• Customer Data: documents, files, messages, questions, answers and any other content uploaded to or generated in the Customer’s data rooms by or for the Customer or its Authorised Users.
• AI Features: functions of the Service that use machine-learning models to index, analyse, summarise or draft content from Customer Data.
• Order: the plan, term and fees the Customer selects or accepts in writing (including by email or within the Service).

2. The Service and accounts

We grant the Customer, for the term of its Order, a non-exclusive, non-transferable right to use the Service, and to permit its Authorised Users to use it, for the Customer’s internal business purposes in accordance with these Terms.

The Customer is responsible for the acts and omissions of its Authorised Users, for setting access permissions within its data rooms, and for keeping account credentials confidential. The Customer must notify us without delay at security@conclave.work of any unauthorised access it becomes aware of.

Authorised Users invited by a Customer, including bidders, must comply with these Terms when using the Service. Their access is controlled by the Customer that invited them.

3. Acceptable use

The Customer and its Authorised Users must not:

• upload content they have no right to share, or that is unlawful;
• attempt to access data rooms, accounts or data they are not authorised to access, or probe, scan or test the vulnerability of the Service without our written consent;
• introduce malware, interfere with the integrity or performance of the Service, or circumvent its security or permission controls;
• reverse engineer the Service, except to the extent permitted by mandatory law, or use it to build a competing product;
• resell or make the Service available to third parties other than Authorised Users.

4. AI Features

AI Features produce suggestions, drafts and analyses that may be incomplete or inaccurate. Outputs cite their sources in the data room where available, and the Service requires a designated user to approve answers before they are released to counterparties. The Customer remains responsible for reviewing outputs and for any decision or communication based on them. Outputs do not constitute legal, financial, tax or other professional advice.

5. Customer Data

The Customer retains all rights in Customer Data. The Customer grants Conclave the rights needed to host, process and display Customer Data solely to provide, secure and support the Service.

To the extent Customer Data contains personal data, Conclave processes it as a processor on the Customer’s behalf under the Data Processing Terms in Annex A, which form part of these Terms. The Customer is the controller and is responsible for having a lawful basis to upload and share that personal data.

Personal data Conclave processes as a controller (for example, account and log-in data) is described in our Privacy Notice.

6. Confidentiality

Each party will keep confidential the non-public information it receives from the other in connection with the Service, use it only to perform or exercise its rights under these Terms, and disclose it only to personnel and advisers who need to know it and are bound by equivalent obligations, or where required by law. Customer Data is Customer’s confidential information.

7. Fees and payment

Fees are those set out in the Customer’s Order, or, if none is stated, in the prices published at conclave.work at the time of the Order. Fees are exclusive of VAT and other applicable taxes. Unless the Order states otherwise, fees are invoiced in advance for each billing period and are payable within 30 days of the invoice date. Fees already paid are non-refundable, except as stated in these Terms or required by law.

Late payments accrue interest under Italian Legislative Decree 231/2002. If an undisputed amount remains unpaid 15 days after written notice, we may suspend access to the Service until it is paid.

8. Term, renewal and termination

These Terms apply from first use of the Service until all Orders have ended. Monthly Orders renew automatically for successive monthly periods unless either party cancels before the end of the current period. Fixed-term packages (3, 6 or 12 months) and annual firm-wide licences end at the end of their term unless renewed in writing.

Either party may terminate these Terms by written notice if the other materially breaches them and fails to cure the breach within 30 days of notice. We may suspend access immediately where necessary to prevent a security incident or serious harm to the Service or other customers, and will restore access once the cause is resolved.

On expiry or termination, the Customer may export its Customer Data for 30 days. After that period we delete Customer Data as set out in Annex A, section 9.

9. Warranties and disclaimers

We will provide the Service with reasonable skill and care and in accordance with these Terms. Except as expressly stated in these Terms, and to the extent permitted by law, the Service is provided “as is” and we give no other warranties, including that the Service will be uninterrupted or error-free or that AI outputs will be accurate.

10. Limitation of liability

To the extent permitted by law, each party’s total liability arising out of or in connection with these Terms in any 12-month period is limited to the fees paid or payable by the Customer under these Terms in the 12 months preceding the event giving rise to the claim. Neither party is liable for loss of profits, revenue, business opportunity or goodwill, or for indirect or consequential loss.

These limits do not apply to liability that cannot be limited under Italian law, including for wilful misconduct or gross negligence (art. 1229 of the Italian Civil Code), to the Customer’s payment obligations, or to breaches of section 3 (Acceptable use).

11. Changes to these Terms

We may update these Terms. We will notify Customers of material changes by email or within the Service at least 30 days before they take effect. If the Customer objects, it may terminate before the change takes effect and receive a pro-rata refund of prepaid fees for the unused period. Continued use after the effective date constitutes acceptance.

12. Governing law and jurisdiction

These Terms are governed by Italian law. The Courts of Milan, Italy have exclusive jurisdiction over any dispute arising out of or in connection with them.

13. General

Neither party is liable for failure to perform caused by events beyond its reasonable control. Neither party may assign these Terms without the other’s consent, except to a successor in a merger or sale of substantially all of its business. If any provision is held invalid, the rest remain in force. These Terms, together with any Order, are the entire agreement between the parties on their subject matter. Notices to Conclave must be sent to edoardo@conclave.work or conclave@pec.it.

14. Specific approval of clauses

Pursuant to articles 1341 and 1342 of the Italian Civil Code, the Customer specifically approves the following clauses: 3 (Acceptable use); 7 (suspension for non-payment); 8 (automatic renewal, suspension and termination); 9 (Warranties and disclaimers); 10 (Limitation of liability); 11 (Changes to these Terms); 12 (Governing law and exclusive jurisdiction).

Annex A — Data Processing Terms

This Annex applies where Conclave processes personal data contained in Customer Data on behalf of the Customer, and sets out the terms required by Article 28(3) of Regulation (EU) 2016/679 (“GDPR”). Terms defined in the GDPR have the same meaning here. If this Annex conflicts with the rest of the Terms, this Annex prevails.

1. Roles

The Customer is the controller (or a processor acting for its own client, in which case Conclave is its sub-processor). Conclave is the processor.

2. Instructions

Conclave processes personal data only on the Customer’s documented instructions, including regarding international transfers, unless required to do otherwise by EU or Member State law, in which case Conclave will inform the Customer of that requirement before processing unless the law prohibits it. These Terms and the Customer’s configuration and use of the Service are the Customer’s documented instructions. Conclave will immediately inform the Customer if, in its opinion, an instruction infringes the GDPR or other data protection law.

3. Confidentiality of personnel

Conclave ensures that persons authorised to process personal data have committed to confidentiality or are under an appropriate statutory obligation of confidentiality.

4. Security

Conclave implements the technical and organisational measures required by Article 32 GDPR, including those in Schedule 2.

5. Sub-processors

The Customer gives Conclave general authorisation to engage the sub-processors listed in Schedule 3. Conclave will inform the Customer by email at least 30 days before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, the Customer may terminate the affected Service and receive a pro-rata refund of prepaid fees. Conclave imposes on each sub-processor, by written contract, data protection obligations equivalent to those in this Annex, and remains fully liable to the Customer for each sub-processor’s performance.

6. International transfers

Customer Data is hosted in the European Union. Conclave will not transfer personal data outside the European Economic Area except in compliance with Chapter V GDPR. Where a sub-processor established outside the EEA may access personal data, the transfer is covered by the EU Standard Contractual Clauses or an adequacy decision, as stated in Schedule 3.

7. Assistance with data subject rights

Taking into account the nature of the processing, Conclave assists the Customer by appropriate technical and organisational measures, insofar as possible, to respond to requests from data subjects to exercise their rights under Chapter III GDPR. If Conclave receives such a request directly, it will forward it to the Customer without undue delay and will not respond except on the Customer’s instructions.

8. Other assistance and personal data breaches

Conclave assists the Customer in ensuring compliance with Articles 32 to 36 GDPR, taking into account the nature of processing and the information available to Conclave. Conclave notifies the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data, and provides the information the Customer reasonably needs to meet its obligations under Articles 33 and 34 GDPR.

9. Deletion or return

At the end of the Service, the Customer may export its Customer Data during the 30-day period in section 8 of the Terms. After that period Conclave deletes all personal data in Customer Data, unless EU or Member State law requires its storage. Copies in backups are deleted as backups expire in their normal rotation and remain protected under this Annex until then.

10. Information and audits

Conclave makes available to the Customer all information necessary to demonstrate compliance with Article 28 GDPR, and allows for and contributes to audits, including inspections, conducted by the Customer or an auditor it mandates. Audits require at least 30 days’ written notice, take place during business hours, are limited to once per 12 months unless required by a supervisory authority or following a personal data breach, are subject to confidentiality, and are at the Customer’s expense.

Schedule 1 — Details of processing

• Subject matter and nature: hosting, indexing, permissioned sharing and AI-assisted analysis of documents and communications in virtual data rooms.
• Purpose: providing the Service to the Customer.
• Duration: the term of the Terms plus the export and deletion periods in section 9.
• Categories of data subjects: Authorised Users; employees, directors, shareholders, customers, suppliers and other individuals named in documents the Customer uploads.
• Types of personal data: identification and contact data, professional data, user activity within data rooms, and any other personal data contained in uploaded documents, as determined by the Customer. This may include special categories of data or data relating to criminal convictions (for example, in employment or litigation records) where the Customer chooses to upload it.

Schedule 2 — Technical and organisational measures

• Hosting of Customer Data in EU data centres.
• Encryption of data in transit (TLS) and at rest.
• Permission-based access control in each data room, set by the Customer by counterparty group.
• Restriction of Conclave personnel access to production systems to those who need it, with authentication through managed company accounts.
• Logging of user activity and administrative access.
• Periodic penetration testing and remediation of findings.
• Backups and the ability to restore availability of data.
• Confidentiality obligations for all personnel.
• Written data processing agreements with all sub-processors.
• A documented incident response process.

Schedule 3 — Sub-processors