Legal
Términos y condiciones
These terms govern access to and use of the RiskOnyx website, platform, and related services.
Ownership of the Website and Contact
The Website and the Service are operated by ASMAK AI SOLUTIONS S.L., a company incorporated
in Spain with registered office at Calle Ali Bei 25 Atico 1, 08010 Barcelona, Spain and
NIF/CIF B88913959. For the purposes of these Terms, references to “RiskOnyx”, “Owner”, “we”,
“us”, or “our” mean ASMAK AI SOLUTIONS S.L. operating the RiskOnyx platform.
You may contact us at info@riskonyx.com for matters relating to the Website, the Service,
billing, legal notices, privacy, or account administration.
These Terms govern access to and use of the RiskOnyx website, platform, and related
services. Nothing in these Terms creates an employment, agency, partnership, fiduciary, or
similar relationship between the parties.
The Privacy Policy and, where applicable, the Data Processing Agreement form an integral
part of these Terms.
Service
RiskOnyx helps organisations create, structure, manage, and evidence their AI governance and
compliance activities more clearly. It does not replace legal advice, regulatory advice, or
other specialised professional review.
RiskOnyx is an AI governance and compliance technology platform that allows organisations to
register AI systems, organise documentation and evidence, structure governance workflows,
track obligations, and maintain a clearer view of their AI compliance position through more
accessible, structured, and operationally usable formats. The Service may include, among
other features, AI system inventories, risk and governance classification support,
documentation and evidence management, workflow coordination, status tracking, reporting,
dashboards, and structured records intended to improve visibility and usability.
Unless expressly agreed otherwise in writing, RiskOnyx acts as a supporting technology tool
and does not provide legal advice, regulatory advice, or any other form of individualised
professional advice. Use of the Platform does not create a lawyer-client, adviser-client,
consultant-client, fiduciary, or similar professional relationship between RiskOnyx and the
User.
The User is responsible for providing truthful, complete, and up-to-date information,
selecting the options appropriate to its business and activities, reviewing the outputs and
records generated or maintained through the Platform, and verifying that any resulting
documentation, classifications, workflows, reports, or other content are suitable for its
specific use case, industry, risk profile, and applicable legal or regulatory requirements.
RiskOnyx may offer additional services such as onboarding, support, customisation, training,
implementation support, or access to specialist assistance where expressly contracted. In
such cases, the specific scope of the service shall be the one set out in the applicable
proposal, order, quotation, statement of work, or other written agreement.
Users acknowledge that, due to the complexity, evolution, and context-specific nature of
AI-related laws, regulations, standards, and governance expectations, information, records,
classifications, workflows, documentation, or other outputs generated, stored, or presented
through RiskOnyx may require additional review, adaptation, validation, or professional
assessment before being relied on in a specific operational, contractual, regulatory, or
legal context.
Eligibility and Account Requirements
You must be at least 18 years old and legally capable of entering into a binding contract in
order to use the Service.
You are responsible for ensuring that you have the hardware, software, internet connection,
and technical environment reasonably necessary to access and use the Service. We may update
technical requirements from time to time.
You must provide accurate billing, account, and contact information and keep it up to date.
Once an invoice has been issued, information used for billing may not be editable for
accounting or legal reasons.
Automated, bot-created, or otherwise non-human accounts are not permitted unless expressly
authorised by RiskOnyx in writing.
You are responsible for safeguarding your account credentials and for all activity carried
out through your account, except to the extent caused by our own failure to maintain
reasonable account security controls.
You may cancel your account at any time, subject to any active subscription terms, minimum
commitment periods, or payment obligations that may still apply.
Conduct and Acceptable Use
You must use the Website and the Service lawfully, in good faith, and in a way that does not
interfere with the rights of others, the security of the platform, or the proper operation
of the Service.
You must not impersonate another person, misrepresent your identity, or act on behalf of
another person or entity without authority.
You must not upload, submit, publish, or transmit content that is unlawful, defamatory,
infringing, fraudulent, abusive, threatening, hateful, discriminatory, or otherwise harmful.
You must not introduce malware, attempt to disable or bypass security measures, probe
vulnerabilities, overload systems, scrape data using automated means without prior written
permission, or otherwise interfere with the integrity, availability, or security of the
Website or Service.
You must use only the official interfaces, workflows, and technical functionalities made
available by RiskOnyx. Unauthorised integration methods, reverse engineering, or attempts to
circumvent product restrictions are prohibited.
We may suspend or terminate access where we reasonably believe a User has breached these
Terms, created security risk, exposed us or others to legal or operational harm, or used the
Service in a manner materially inconsistent with its intended purpose.
Commercial Terms and Contracting
The Service is generally offered on a paid subscription basis. Available plans, features,
limitations, pricing, free-trial terms, and any usage allowances are described on the
Website or during the contracting process and may change from time to time.
A contract is formed when we accept an order and payment has been successfully authorised or
received, subject to any account verification, fraud checks, onboarding requirements, or
activation conditions we may reasonably apply.
Unless expressly stated otherwise, purchase of the Service requires creation of an account
or workspace through which the Service is delivered and administered.
RiskOnyx grants the User a limited, revocable, non-exclusive, non-transferable licence with
no right to sublicense to access and use the Service during the contracted subscription
period, solely in accordance with these Terms and the applicable plan.
Subscriptions continue for the selected period and renew automatically unless cancelled
before renewal in accordance with the applicable plan terms. We will make cancellation
reasonably accessible and will provide any notices required by law.
If payment fails, we may suspend access after a reasonable cure period. We may preserve
customer data for a limited period after suspension or expiry, but we are not required to
preserve data indefinitely unless otherwise agreed in writing or required by law.
Participation in any affiliate, referral, reseller, distributor, or partner programme
requires a separate agreement or expressly published programme terms. These Terms do not by
themselves grant any right to sell, distribute, or earn commission in relation to the
Service.
Delivery and Activation
The Service is activated within the period indicated during purchase or otherwise
communicated before completion of the order, provided we have received full payment and the
required account information.
Until activation conditions have been met, the User does not acquire any operative right to
access or use the Service.
We may use subcontractors, service providers, and infrastructure partners to deliver the
Service, provided that doing so does not relieve us of responsibilities that cannot be
delegated by law.
Price, Billing, Plan Changes, and Usage Limits
The total price payable shall be shown before payment is completed. Prices are shown
inclusive of taxes where legally required to be displayed in that way, unless otherwise
stated.
The official billing currency is EUR. Where payment is made in another currency, the
applicable exchange rate shall be the rate applied by the payment processor or, failing
that, another reasonable market-based reference rate available at the time of payment.
Where a plan includes usage-based limits, such as limits on the number of AI systems, users,
storage, API calls, specialist-review credits, or other measurable service elements, those
limits and any overage charges shall be described on the Website or during contracting.
Automatic overage billing will apply only where the User has expressly enabled it.
Temporary promotions, discounts, trials, or special commercial terms do not create an
acquired right to future continuation of those terms unless expressly agreed otherwise in
writing.
The User may change plan subject to the options then made available by RiskOnyx. Unless
otherwise stated, upgrades may take effect immediately and downgrades may take effect at the
start of the next billing period. Any credit treatment, proration, or carry-forward shall be
governed by the billing terms disclosed at the time of the change.
Payment Methods
Accepted payment methods shall be displayed during the purchase process. Payments may be
processed through third-party providers. RiskOnyx does not store full payment card details
unless expressly stated and lawfully permitted.
If a payment fails, is rejected, reversed, charged back, or later determined to be
fraudulent, we may suspend or terminate access, recover outstanding sums, and charge
reasonable costs directly arising from the failed payment to the extent permitted by law.
Where recurring payment authority is granted through a payment provider such as PayPal or
another processor, the User may withdraw that authority through the relevant payment
provider settings, subject to any amounts already due under the contract.
Cancellation, Withdrawal, and Refunds
The User may cancel a subscription at any time. Unless otherwise stated, cancellation takes
effect at the end of the current paid subscription period and no further renewal charges
shall be made after that point.
Where the User is a consumer and has a statutory right of withdrawal under applicable law,
that right remains unaffected. Where legally permitted, if the User has requested the
Service to begin during the withdrawal period, we may deduct the proportion of the Service
already supplied before withdrawal.
If RiskOnyx offers a separate commercial satisfaction guarantee or business-user refund
policy, the scope, duration, and exclusions of that policy shall be the ones expressly
stated on the Website or in the applicable commercial terms. Unless expressly stated
otherwise, no refund is due merely because the User has ceased to use the Service before the
end of the paid period.
Cancellation or expiry of the Service does not relieve the User of any obligation to pay
charges already accrued or lawfully due under the contract.
Warranties
We will provide the Service with reasonable care and skill and substantially in accordance
with the description of the Service then in force, subject to planned maintenance, updates,
legal requirements, third-party dependencies, and the limitations set out in these Terms.
Except to the extent required by law, the Service is provided on an “as available” and “as
updated from time to time” basis, and we do not warrant that it will be uninterrupted,
error-free, suitable for every purpose, or compliant with every legal or regulatory
requirement relevant to every user context.
Nothing in these Terms limits any non-excludable legal rights that may apply to consumers
under applicable law.
Liability
The User is responsible for its own use of the Service, including the suitability of
outputs, records, workflows, reports, or other material for the User’s specific legal,
regulatory, contractual, or operational context.
To the extent permitted by law, RiskOnyx shall be liable only for direct losses that are
reasonably foreseeable at the time the contract is formed and that arise directly from our
breach of these Terms, negligence, or other liability that cannot lawfully be excluded.
To the extent permitted by law, RiskOnyx shall not be liable for indirect or consequential
loss, loss of profit, loss of revenue, loss of opportunity, loss of reputation, loss of
anticipated savings, loss arising from third-party systems or integrations, or loss caused
by the User’s failure to review or validate outputs before relying on them.
Nothing in these Terms excludes or limits liability for death or personal injury caused by
negligence, fraud or fraudulent misrepresentation, wilful misconduct, gross negligence where
it cannot lawfully be excluded, breach of data protection obligations to the extent such
liability cannot lawfully be excluded, or any other liability that the law does not permit
us to exclude or limit.
Where the User is not a consumer, and to the extent permitted by law, RiskOnyx’s aggregate
liability arising out of or in connection with the Service, whether in contract, tort, or
otherwise, shall not exceed the greater of EUR 1,000 and the total amounts actually paid by
the User to RiskOnyx for the affected Service during the 12 months immediately preceding the
event giving rise to the claim.
The Service may include or connect with third-party services, data sources, or integrations.
We do not control third-party services and are not responsible for their availability,
content, performance, security, or compliance. Their use remains subject to the terms agreed
between the User and those third parties.
We may temporarily interrupt the Service for maintenance, updates, security reasons,
technical changes, legal compliance, or circumstances outside our reasonable control,
including force majeure events.
Intellectual Property and Customer Content
All rights, title, and interest in and to the Website, the Service, the software,
interfaces, workflows, taxonomies, methodologies, documentation, know-how, databases,
designs, and other elements of the RiskOnyx platform remain the exclusive property of
RiskOnyx or its licensors.
Subject to payment of the applicable fees and compliance with these Terms, the User may use
the Service and may use for its own internal business, compliance, regulatory, procurement,
audit, and contractual purposes the records, reports, exports, inventories, governance
materials, or other outputs generated through the Service for that User’s workspace.
The User may not reproduce, distribute, resell, sublicense, reverse engineer, decompile,
create derivative products from, or otherwise exploit the Service or any substantial part of
it, except to the extent expressly permitted by law or expressly authorised in writing by
RiskOnyx.
The User retains ownership of content, data, documents, and materials it uploads to the
Service. The User grants RiskOnyx a non-exclusive, worldwide, royalty-free licence to host,
store, process, reproduce, adapt, transmit, and display such content solely to the extent
necessary to provide, secure, maintain, improve, and support the contracted Service, and as
otherwise permitted by the Privacy Policy, DPA, or applicable law.
RiskOnyx may remove or restrict access to content that it reasonably believes is unlawful,
infringing, abusive, harmful, or in breach of these Terms.
RiskOnyx, its name, logos, and other distinctive signs are protected trademarks or
distinctive signs belonging to RiskOnyx or its licensors.
Privacy and Data Processing
For information about how we process personal data in relation to the Website, account
administration, billing, support, and business operations, Users should consult the Privacy
Policy published on the Website.
To the extent RiskOnyx processes personal data on behalf of a customer in connection with
the Service, such processing shall be governed by the applicable Data Processing Agreement
or other written data-processing terms between the parties.
RiskOnyx will process service-related personal data only as reasonably necessary to provide,
secure, support, and improve the Service, to comply with law, and as otherwise permitted by
the contract, the Privacy Policy, the DPA, and applicable law.
Where personal data is transferred internationally, RiskOnyx will rely on an appropriate
lawful transfer mechanism recognised by applicable law, such as adequacy decisions, standard
contractual clauses, or another legally valid mechanism.
Modification of the Terms
RiskOnyx may modify these Terms from time to time. Where required by law or where the
changes are material, we will notify Users through appropriate channels before the changes
take effect.
Unless otherwise required by law, continued use of the Service after the effective date of
the updated Terms shall constitute acceptance of the modified Terms. If the User does not
agree, it must stop using the Service and may cancel in accordance with these Terms.
If any provision of these Terms is held invalid or unenforceable, the remaining provisions
shall remain in full force and effect, and the invalid provision shall be interpreted or
replaced to the minimum extent necessary to make it valid and enforceable while preserving
the original commercial intent as far as possible.
Governing Law and Jurisdiction
These Terms shall be governed by the laws of Spain, without regard to conflict-of-laws
rules, except to the extent that mandatory consumer-protection rules in the User’s country
of residence apply and prevail by law.
Where the User is not a consumer, the courts of Barcelona, Spain shall have exclusive
jurisdiction over any dispute arising out of or in connection with these Terms or the
Service.
Nothing in these Terms prevents a consumer from relying on any mandatory rights to bring
proceedings in the courts of their country of residence where such rights are granted by
applicable law.
Artificial Intelligence and Automated Assistance
RiskOnyx may use automated systems, machine-learning tools, or artificial-intelligence-based
functionalities to help classify, analyse, summarise, structure, visualise, or otherwise
support AI governance and compliance-related information within the Service.
The User acknowledges that automated outputs may contain errors, omissions, simplifications,
or inaccuracies and may not be fully adapted to the User’s activity, sector, geography, or
specific legal or regulatory circumstances. The User must review outputs before relying on
them, publishing them, communicating them to third parties, or incorporating them into
operational, contractual, compliance, or governance processes.
Unless expressly stated otherwise, RiskOnyx will not use customer content to train
general-purpose models of RiskOnyx or third parties beyond what is necessary to provide,
secure, maintain, and improve the contracted Service, subject always to the Privacy Policy,
DPA, and applicable law.