Terms of service

Supplier

ArenOrg AS, organisation number {{SUPPLIER_ORG_NUMBER}}, {{SUPPLIER_ADDRESS}}.

Customer

The company named as customer in the subscription agreement.

Service

4Auditee, the hosted quality management system, including its AI Features where they are part of the Subscription, and the Documentation.

Subscription

The base subscription with the sites, users, standards and add-ons stated in the subscription agreement, as changed under section 11.

Subscription Term

The initial term in the subscription agreement and each renewal of it. A "subscription year" is each twelve-month period from the start date.

Workspace

The Customer's own instance of the Service.

Site

A location of the Customer registered in the Workspace.

User

A person with an account in the Workspace. Users who administer, audit or approve count towards the users in the Subscription; users who only read documents and hold training records do not.

Administrator

A User given the organisation administrator role, who may manage the Workspace and the Subscription on the Customer's behalf.

Customer Data

All data the Customer or its Users put into the Service, and the records the Service creates from it, including documents, procedures, records, audit findings, risk assessments and training material.

AI Features

Functions of the Service that send content to a third-party artificial intelligence model and return its output.

Documentation

The help and guidance the Supplier provides for the Service.

Sub-processor

A third party the Supplier uses to process personal data in Customer Data, as listed at https://4auditee.com/subprocessors.

The Supplier grants the Customer a non-exclusive, non-transferable right, for the Subscription Term, for its Users to use the Service for the Customer's internal business purposes in accordance with these terms.

The Supplier develops the Service continuously. It will not remove a material function the Customer uses without at least 30 days' notice, and Customer Data held by a removed function remains available for export.

Customer Data belongs to the Customer. The Supplier acquires no rights in it other than the right to process it to provide the Service in accordance with the agreement. The Supplier claims no ownership of documents, procedures, records, audit findings, risk assessments, training material or other content the Customer creates in the Service.

An Administrator can export Customer Data from the Service at any time without the Supplier's involvement. The export provides the Customer's registers as a spreadsheet, together with the attached files. Customer Data that is not included in the export is provided by the Supplier on request, without charge, within 30 days.

The Supplier will not delete or withhold Customer Data because an invoice is unpaid. Personal data in Customer Data is processed under Appendix 2.

The Supplier and its licensors own the Service and all intellectual property in it, including the software and source code, architecture and database structure, workflows, templates and content created by the Supplier, user interface and design, trademarks, Documentation and the underlying technology. No rights are granted except those in section 2.

Templates supplied by the Supplier may be used and adapted by the Customer within the Service; the documents the Customer creates from them are Customer Data.

The Customer is responsible for:

• keeping accounts secure, assigning appropriate permissions, and removing Users who leave;
• ensuring that its Users comply with these terms;
• the content its Users enter, and its right to enter it;
• processing personal data lawfully, including informing its employees that their competence and training records are kept in the Service;
• deciding how long its quality records are kept;
• determining the legal, regulatory, certification and scheme requirements that apply to it.

The Customer and its Users must not:

• attempt to gain unauthorised access to the Service, another customer's workspace or the underlying systems;
• use another person's credentials, or circumvent access restrictions or usage limits;
• interfere with or disrupt the Service, or introduce malicious code;
• scrape the Service by automated means, or test or attack its infrastructure without written permission;
• reverse engineer the Service, except to the extent the law permits this despite contractual restriction;
• use the Service unlawfully or to store content the Customer has no right to store.

The Service helps the Customer operate and evidence its quality management system. It does not certify the Customer, and using it does not establish compliance with ASC, MSC, GLOBALG.A.P., ISO, BRCGS, IFS or any other standard or law. Templates, checklists and AI suggestions are tools; they are not certification decisions or professional or legal advice. Approval of documents and decisions about compliance remain with the Customer.

References to third-party standards identify the standards the Customer works with. They do not imply sponsorship, accreditation, affiliation or endorsement by the standard owners. The Supplier does not reproduce copyrighted standard text in the Service unless it holds the necessary rights; a Customer that uploads standard text is responsible for holding the right to do so.

Where the Subscription includes AI Features, content the Customer submits to them is sent to a third-party AI provider listed as a Sub-processor, which returns output to the Service. The Supplier does not use Customer Data to train its own models. The provider's handling of submitted content is governed by Appendix 2 and the Sub-processor list.

AI output may be incomplete or wrong. It must be reviewed by a qualified person before it is relied on. The AI Features do not replace an auditor, a certification body, a lawyer or the Customer's own compliance decisions.

An Administrator can switch AI Features off for parts of the Workspace. The Customer should submit confidential or sensitive information only in accordance with its own policies.

The Supplier uses commercially reasonable efforts to keep the Service available. No guaranteed uptime level or service-credit scheme applies. Interruptions may occur because of maintenance, infrastructure or provider failures, security measures, or events outside the Supplier's reasonable control. Planned maintenance that requires significant downtime is normally announced in advance.

Support is provided by email to contact@arenorg.com during Norwegian business hours.

• Fees are stated in the subscription agreement, in the currency stated there, excluding VAT and other applicable taxes, which are added to the invoice.
• The Subscription is invoiced annually in advance at the start of each subscription year. Invoices are payable within 14 days of the invoice date.
• Late payment accrues interest under the Norwegian Late Payment Interest Act (forsinkelsesrenteloven). The Supplier sends a written reminder before taking any further step.
• If an amount is more than 30 days overdue and remains unpaid 14 days after a written notice warning of suspension, the Supplier may suspend access to the Service. Customer Data is retained during suspension, and access is restored promptly once the overdue amount is paid.
• Fees paid are not refunded, including when the Customer chooses not to renew or stops using the Service during a subscription year, except as stated in sections 12 and 17 and in Appendix 2, section 6.

The Customer authorises its Administrators to change the Subscription in the Service, including adding or removing sites, users, standards and the AI add-on. The price of a change is shown before it is confirmed, and a confirmed change is a binding amendment to the subscription agreement. Each change is recorded with who made it, when, and its price.

• An increase applies at once and is charged for the remaining days of the current subscription year. Changes made in the first 30 days of the first subscription year are included in that year's invoice.
• A reduction lowers the price from the next renewal. No refund is given for the current subscription year.
• The Supplier may change its price list. A new price applies to the Customer only from its next subscription year, and the Supplier gives notice at least 60 days before that renewal, so the Customer can decide not to renew.

Term and renewal. The agreement runs for the initial term in the subscription agreement and renews automatically for further twelve-month periods. Either party may prevent a renewal by written notice given at least 30 days before the renewal date. Notice of non-renewal does not end the current Subscription Term early: the agreement expires at the end of it, the Customer keeps access until then, and fees for that term remain payable. Neither party may terminate the agreement for convenience during a Subscription Term.

Termination for breach. Either party may terminate the agreement with immediate effect by notice if the other party materially breaches it and does not remedy the breach within 30 days of notice describing it. If the Customer terminates for the Supplier's material breach, the Supplier refunds the fees paid for the remaining, unused part of the Subscription Term.

Immediate termination. Either party may terminate with immediate effect by notice if the other becomes insolvent, enters bankruptcy or debt negotiation, ceases business, or commits fraud in connection with the agreement. The Supplier may also terminate with immediate effect for unlawful use of the Service or a serious breach of section 6 that puts the Service or other customers at risk.

Suspension. The Supplier may suspend access, in whole or for particular Users, without terminating the agreement: for overdue payment as section 10 describes, or immediately where needed to stop unlawful use, a security threat or a serious breach of section 6. The Supplier informs the Customer of the reason and restores access when the reason no longer applies. Customer Data is retained during suspension.

For 30 days after the agreement expires or is terminated, the Customer can export its Customer Data as section 3 describes. After that period the Supplier deletes Customer Data within 30 days, as Appendix 2, section 10 sets out. Copies in backups are removed as the backups expire.

Each party keeps confidential the other party's non-public information that it receives under the agreement — for the Customer, including its quality-system records, documents, audit findings, supplier and customer information, business processes and commercial terms; for the Supplier, including its pricing, commercial terms, product plans and technical and security information — and uses it only to perform the agreement. This does not apply to information that is or becomes public without breach, that the receiving party developed independently or obtained lawfully from someone else, or that must be disclosed by law or by order of a court or authority, in which case the other party is informed where the law allows.

These obligations continue for five years after the agreement ends, and for as long as the information remains confidential in the case of Customer Data and security information.

• Neither party is liable for indirect or consequential loss, including loss of profit, revenue, business or goodwill, to the extent Norwegian law permits.
• Each party's total aggregate liability arising out of or in connection with the agreement is limited to the fees paid and payable by the Customer for the twelve months before the event giving rise to the claim.
• For breaches of section 14 or of Appendix 2, the limit is twice that amount, in aggregate.
• The limits do not apply to liability for gross negligence, wilful misconduct or fraud, to liability that cannot be limited by law, or to the Customer's obligation to pay fees.
• The Supplier defends the Customer against a third-party claim that the Service, as provided by the Supplier, infringes that party's intellectual property rights, and pays damages finally awarded, within the limit for section 14. This does not apply to Customer Data or to content the Customer adds.

Neither party is liable for failure or delay caused by an event outside its reasonable control that it could not reasonably have avoided or overcome, such as natural disasters, war, government action, major failures of power, telecommunications, internet or cloud infrastructure, or cyber attacks that reasonable security measures could not prevent. The affected party informs the other promptly. Payment obligations already due are not suspended. If the event lasts more than 60 days, either party may terminate the agreement by notice.

The Supplier may publish new versions of these terms and of Appendix 2. A new version that affects the Customer's rights is notified at least 30 days before it takes effect, and the Customer's Administrator is asked to accept it in the Service; each acceptance is recorded with the version accepted. If a change materially reduces what the Customer receives, the Customer may instead terminate the agreement with effect from the date the change would apply, and the Supplier refunds the fees paid for the remaining, unused part of the Subscription Term.

Routine communication about the Service may be given by email or in the Service. Notices of termination, non-renewal, suspension, breach, changes under section 17 and other legal notices must be given in writing by email to the notice addresses in the subscription agreement — for the Customer, the Administrator's email address stated there; for the Supplier, contact@arenorg.com. A notice is received when sent, unless the sender receives a delivery failure.

The Supplier will not use the Customer's name or logo in marketing or as a reference without the Customer's prior written permission, which the Customer may withdraw at any time.

• Entire agreement. The subscription agreement and its appendices are the entire agreement on its subject and replace earlier discussions. Terms on the Customer's purchase orders do not apply.
• Order of precedence. The subscription agreement prevails, then Appendix 2 for anything concerning personal data, then these terms.
• Severability. If a provision is invalid, the rest remains in force and the invalid provision is replaced by a valid one as close to its purpose as possible.
• Waiver. Failing or delaying to exercise a right does not waive it.
• Assignment. Neither party may transfer the agreement without the other's written consent, which is not unreasonably withheld, except that either party may transfer it to a successor of its business on notice.
• Subcontractors. The Supplier may use subcontractors and remains responsible for their performance. Sub-processors of personal data are governed by Appendix 2.
• Electronic execution. The agreement may be concluded electronically, including by acceptance in the Service, and in counterparts. An electronic acceptance has the same effect as a handwritten signature.
• Relationship. The parties are independent contractors. Nothing in the agreement creates a partnership, agency or employment relationship.

The agreement is governed by Norwegian law. The parties will first try to resolve a dispute by negotiation. Disputes that are not resolved are decided by the Norwegian courts, with Oslo District Court (Oslo tingrett) as the agreed venue.