General Terms of Service
Introduction
These general terms of service (the “Terms”), as they may be amended from time to time as set out herein, govern the use of the Services provided by Pocketlaw. When we refer to the “parties” we mean the Customer and Pocketlaw together.
By “Agreement” we mean these Terms (including the Data Processing Agreement as set out in Appendix 1), the Order Form, and any other documents referred to in such Order Form.
Subject to the terms and conditions of the Agreement, the Customer subscribes to, and Pocketlaw shall supply, the Services specified in the Order Form.
Services
General
Pocketlaw provides an AI contract lifecycle management platform and other related tools for centralising legal data and automating legal workflows.
Pocketlaw shall endeavour to make the Services available 24/7 except during interruptions for support and maintenance. We will make commercially reasonable efforts to (i) perform maintenance in a way that causes minimum disruption to the Services and (ii) notify the Customer in advance about any suspension of the Services.
The Customer is responsible for obtaining and maintaining, at its own cost, the hardware, software and internet connectivity required to access and use the Services.
Any third-party software, services, or other products (collectively “Third-party Services”) used by the Customer in connection with the Services (including, but not limited to, an integration) may be subject to their own terms and conditions, and the Customer is solely responsible for complying with all terms and conditions governing such third-party services.
Account
The Customer is responsible for safeguarding any access credentials to the Customer’s Account. Should the Customer suspect that its Account or its credentials have been or are being used by a third party, the Customer must notify Pocketlaw immediately.
The Customer warrants that all persons it authorises to create Accounts or use the Services comply with these Terms, and the Customer is responsible for all Users’ use of the Services and for all acts and omissions under its Account.
The Customer shall assign each of its Users with an individual and specific license, which may not be shared, transferred or otherwise used by anyone else, unless specified in the Agreement.
Use of the Services
When the Customer uses the Services, it must always comply with all applicable laws, regulations and public orders. The Customer shall not access the Site or the Platform other than through interfaces provided by us and as otherwise expressly authorised under these Terms. The Customer may not use the Services in a manner contrary to our, or any third party’s, rights and interests. The Customer agrees to comply with all instructions and recommendations provided by us from time to time.
The Customer also agrees not to:
- use the Services in a way that infringes, misappropriates or violates any person’s rights,
- sub-license, sell or otherwise transfer its right to access or use the Services,
- attempt to reverse engineer or derive the source code of the Services or any portion thereof, except as permitted by applicable law,
- modify, customize, port, translate, localize or create derivative works of the Services,
- use any automated or programmatic method to extract Customer Data or Output from the Services,
- use its access to the Services to build a product or service which competes with the Services,
- use the Services in a manner that interferes or attempts to interfere with the proper working of the Services,
- use the Services, directly or indirectly, as the only basis for any decision that could affect the legal rights, obligations, or access to justice of any person or entity., and/or
- use the Services in any way that would constitute or substitute for the provision of legal advice, the practice of law, or automated decision-making about persons or entities.
If Pocketlaw has reasonable grounds to suspect that the Customer (or any of its Users) has violated this Agreement or risks giving rise to an infringement claim from a third party, Pocketlaw will notify the Customer by email and request the Customer to take immediate and appropriate action. Pocketlaw may suspend the Customer's (or the applicable User’s) access to the Services until the requested action is taken if (i) Pocketlaw has reasonable grounds to believe that such breach poses an immediate risk of damage to Pocketlaw, (ii) the Customer fails to comply with the notice within the reasonable time-period set forth in such notice or (iii) the breach is not capable of being remedied. If the Customer fails to take the required action within ten (10) business days after a suspension on two (2) or more occasions during any rolling twelve (12) month period, Pocketlaw may, without prejudice to its other rights and remedies, terminate the Agreement immediately for cause in accordance with Section 4.3.
Although Pocketlaw is not responsible for any Customer Data, it reserves the right (without obligation) to delete any Customer Data if Pocketlaw can substantiate that it has reasonable grounds to believe that the Customer Data violates this Agreement or any applicable law, or risks giving rise to an infringement claim from a third party. Before Pocketlaw deletes any Customer Data in accordance with this Section 2.3.4, Pocketlaw shall provide the Customer with reasonable prior notice, unless it is necessary to delete the Input prior to such notice in order for Pocketlaw to avoid a third-party claim or other material liability or sanctions.
Artificial Intelligence
The Customer bears full responsibility for any and all obligations with respect to the accuracy, quality and legality of the Input, as well as for obtaining legal grounds, consents, and permissions required to use the Input with Pocketlaw AI.
Between the parties, the Customer represents and warrants that the Customer possesses and/or have obtained the necessary legal grounds, consents, and permissions to use all Input with Pocketlaw AI.
Subject to this Agreement, the Customer is allowed to use the Output. For the avoidance of doubt, the Customer is solely responsible for verifying that Output does not infringe on any third-party’s rights.
The Customer acknowledges that, due to the nature of machine learning, the Output may not be unique and that Pocketlaw AI might generate identical or similar output for other customers, Pocketlaw, or any third party.
eSignatures
Pocketlaw warrants that eSignatures generated by the Customer using the native eSignature functionality in the Platform will conform to the minimum requirements for a “simple” electronic signature set out in the eIDAS Regulation.
The Customer acknowledges and agrees that:
- local laws may impose enhanced requirements for the validity of electronic signatures that are not met by the eSignature functionality in the Platform;
- some documents cannot be executed electronically, and the Customer is solely responsible for determining the suitability of each document for eSignature; and
- Pocketlaw cannot verify the identity of signatories.
Pocketlaw is not liable for any loss or damage arising from the full or partial invalidity of any signature created through the Services, except to the extent that the invalidity is caused by a breach by Pocketlaw of Section 2.5.1.
Fees And Payment
Fees
The Customer shall pay the fees for the Services (i) which follow from the Order Form, or (ii) is charged in accordance with Pocketlaw’s offered standard subscription plans from time to time.
Pocketlaw reserves the right to update the fees charged hereunder, applicable on the coming Renewal Term, by giving at least 120 days’ notice.
Termination of the Agreement will in no event relieve the Customer of the obligation to pay any fees payable for the period prior to the effective date of termination as set out in Section 4.1 below, or (unless and to the extent explicitly stated herein) give the Customer a right to a refund of already paid fees (other than pre-paid fees for the period after the effective date of termination).
Payment
Invoices are due thirty (30) days from the invoice date.
If Pocketlaw does not receive any duly invoiced amount by the due date, Pocketlaw may (at its discretion and without limiting Pocketlaw’s rights or remedies hereunder), (i) charge late interest equal to twenty (20) per cent on the overdue amounts, (ii) suspend the Customer's access to the Services, until the overdue amounts are paid in full, provided that Pocketlaw has given at least ten (10) business days’ prior notice of such suspension and payment of the defaulted amount has not been received by Pocketlaw within such period. In case of repeated payment delays by the Customer, Pocketlaw may also condition future subscription renewals and service orders on shorter payment terms.
The fees do not include VAT or any other taxes, levies, duties, or similar governmental charges of any nature, (collectively “taxes”). The Customer is responsible for paying all taxes associated with the Agreement. If Pocketlaw is obligated by law to pay or collect taxes for which the Customer is responsible, Pocketlaw will invoice the Customer and the Customer will pay that amount. The Customer will provide Pocketlaw any information we reasonably request to determine whether Pocketlaw is obligated to collect taxes.
We offer payments by (i) invoice, or (ii) debit or credit card (in cooperation with a third party payment processor). If paying by debit or credit card, the third party payment processor’s terms and conditions will apply. The Customer may be requested to identify itself and credit reports may be pursued by the third party payment processor. The Customer must keep the payment information provided to us accurate and up-to-date.
Term And Termination
Term
The Agreement is valid from the earlier of (i) the Effective Date, and (ii) the date when the Customer starts using the Services, and shall remain in force during the initial period set out in the Order Form (the “Initial Service Term”).
Unless terminated by either Party with no less than ninety (90) days written notice before the expiry of the Initial Service Term, the Agreement shall be automatically prolonged for an additional subscription period (“Renewal Term”), equivalent to the length of the Initial Service Term (each renewal), until terminated by either Party with no less than ninety (90) days written notice, both counting before the expiry of then current Renewal Term.
Unless agreed otherwise in writing, both the Initial Service Term and the Renewal Term are always twelve (12) months.
Termination
Any termination of this Agreement shall be made in writing. To terminate the Services, the Customer needs to notify us in writing to support@pocketlaw.com.
Upon termination, (i) the Customer’s right to access the Services shall terminate, and (ii) all outstanding fees shall be due and payable.
Termination for Cause
We reserve the right to terminate or limit the Services if the Customer:
- Breach or otherwise violate these Terms or any other provisions set up by us;
- Use the Services in any way that does not comply with the intended purposes or is otherwise harmful for us or any third person; or
- In our reasonable opinion, use the Services in violation of any applicable law or regulation.
Upon occurrence of any of these events, we may contact the Customer and request that the Customer remedies its breach of these Terms before terminating or limiting the Services. If we limit the Services for cause, the Customer is still obligated to pay the applicable fees for the Services regardless of such limitation.
Trial account
If the Customer is using the Services free of charge, we may terminate the Services and the Account at our sole discretion.
Warranties And Liability
Services Warranties
During the term of this Agreement, Pocketlaw warrants that (i) the Services will conform materially in accordance with the specifications provided by Pocketlaw and (ii) it will perform the Services in a professional manner, in accordance with generally accepted industry standards.
Except in case of gross negligence or willful misconduct by Pocketlaw, the Customer’s sole and exclusive remedies for a breach of this Section 5.1.1 shall be to (i) request a remedy of the breach, and (ii) if remedial action is not taken or possible and the breach is material, exercise its termination rights under Section 4.3.
Except as expressly provided for in these Terms, the Services are provided on an as-is basis without any warranties of any kind, and we disclaim any and all warranties, whether expressed or implied, including the implied warranties of merchantability, title, fitness for a particular purpose and non-infringement. Pocketlaw does not represent or warrant that the Services will be uninterrupted, timely, or error-free.
Pocketlaw reserves the right, in its sole discretion, at any time to make improvements, additions, modifications (including, subject to Section 5.1.1, removing features), and to correct any errors or defects in the Services, notwithstanding that such measures may temporarily impair the Subscriber’s access to or use of the Services.
We are not responsible for delays and defects outside our control. If any of the Services are impaired by or due to an event outside our control (for example, a delay or interruption caused by any of our suppliers or service providers), then we will endeavour to contact the Customer as soon as possible to let the Customer know, and we will take commercially reasonable steps to minimise the effect of the impairment.
We do not take any responsibility for any customised templates made available to the Customer through the Services. We do not review any customised templates, and we do not update or amend any such templates other than as instructed or agreed to by the Customer. The Customer is solely responsible for the legality, validity and content of any customised templates.
Artificial Intelligence Limitations and Responsibilities
Artificial intelligence technologies are developing rapidly. Pocketlaw continually strives to improve the accuracy, reliability, safety, and usefulness of the Services. Nevertheless, due to the probabilistic nature of the technology, the Services may, in some instances, generate Output that is inaccurate, incomplete or does not correctly represent actual people, places, or facts. The Customer is responsible for assessing the accuracy, completeness and quality of the Output as appropriate for its intended use, including conducting human review where necessary.
Pocketlaw provides self-serve technology in the Customer’s specific direction. We are not a law firm or a substitute for a lawyer, law firm or any other qualified legal professional, and do not give any legal advice. Pocketlaw does not bear any legal responsibility or give any representations or warranties about the accuracy, completeness, correctness, reliability, integrity, usefulness, quality, fitness for purpose or originality of Output,content or any information that is derived from the Services.
The Customer may only use Pocketlaw AI for the purpose of carrying out the Services and is strictly prohibited from using Pocketlaw AI for any other purpose unrelated to the Services, or any content that may infringe, violate, or misappropriate any third party’s intellectual property rights.
Limitation of Liability
In no event shall either Party be liable to the other for: (a) loss of reputation and/or goodwill; (b) loss of profit, loss of revenue, loss of anticipated savings, loss of business and/or loss of opportunities; (c) the Customer’s duty to compensate any third party; or (d) indirect, consequential or special loss, damage or liability even if such loss or damage was reasonably foreseeable.
A Party’s total liability to the other Party, shall not exceed the total fees paid or payable by the Customer for the Services in the twelve (12) months preceding the date of the first incident giving rise to the liability.
Nothing in these Terms shall exclude or limit a party’s liability for: (a) fraud, theft, willful misconduct or gross negligence; (b) the Customer’s payment obligations under this Agreement, or (c) for any other claims based on liability which cannot be limited by law.
To be valid, any claims for damages shall be notified to the other Party no later than twelve (12) months from the time the relevant party became or should have become aware of the event giving rise to the claim, however, never later than 6 months after the expiration or termination of the Agreement.
Indemnification by Pocketlaw
Pocketlaw will defend the Customer against any third-party claim alleging that the Customer’s use of the Services in accordance with this Agreement, infringes the Intellectual Property Rights of such third party. Pocketlaw will indemnify the Customer against all damages, costs, and reasonable attorney’s fees finally awarded against the Customer as a result of such claim.
Pocketlaw shall have no liability or obligation under this section for any claim to the extent that is attributable to (a) any modification of the Services by the Customer not authorised by Pocketlaw, (b) use of the Services that are not in accordance with these Terms, (c) Input, (d) Output that results from Input that is in violation of the Agreement or that the Customer knew or reasonably should have known was likely to lead to violating Output, or (e) use of the Services in combination with products, services, or materials not supplied by Pocketlaw, where the alleged infringement would not have occurred but for such modification or combination.
If the Customer’s use of the Service results, or in Pocketlaw’’s opinion is likely to result, in an infringement claim, Pocketlaw may either: (i) replace the Service with functionally similar products or services; (ii) obtain for the Customer the right to continue using the Service; or if (i) and (ii) are not commercially reasonable, (iii) terminate this Agreement, and refund the Customer any prepaid unused fees.
Indemnification by the Customer
The Customer agrees to defend, indemnify and hold harmless Pocketlaw, its subsidiaries and affiliates and their respective directors, officers, employees and agents from and against all claims and expenses, including legal fees, arising out of or related to:
- any Customer Data;
- any Input and/or the use of the Output;
- fraud the Customer commits or the Customer’s intentional misconduct or gross negligence in connection with any use of the Services;
- the Customer’s violation of any terms for Third-party Services; or
- the Customer’s violation of any applicable law or regulation, or rights of a third party.
Indemnification Procedure
The indemnification obligations in Sections 5.4 and 5.5 is conditioned upon the Party receiving the claim (the “Indemnified Party”) (i) promptly gives the other Party (the “Indemnifying Party”) written notice of any such claim; (ii) makes no admission of liability or settlement without the Indemnifying Party’s prior written consent (except that the Indemnifying Party may not settle any claim unless the settlement unconditionally releases the Indemnified Party of all liability, the settlement does not affect Indemnified Party’s Intellectual Property Rights, and that the Indemnifying Party pays any settlement fees); and (iii) gives the Indemnifying Party sole authority to conduct the defense and any settlement of the claims, as well as providing all reasonable information and assistance, at the Indemnifying Party’s expense.
Confidential Information And Information Security
Confidential Information
“Confidential Information” means all information disclosed by a Party (”Disclosing Party”) to the other Party (”Receiving Party”), whether orally or in writing, (i) that is designated as confidential or, given the nature of the information and the circumstances of disclosure, should be understood to be confidential, (ii) Customer Data, (iii) the Services, (iv) the terms and conditions of the Agreement, and (iv) any business and marketing plans, technology and technical information, product plans and designs, and business processes disclosed by each Party in connection with the Agreement.
Notwithstanding Section 6.1.1, Confidential Information does not include information that (i) is at the time of disclosure, or later becomes, generally known to the public through no fault of the Receiving Party; (ii) was known to the Receiving Party with no obligation of confidentiality prior to disclosure by the Disclosing Party, as proven by records of the Receiving Party; (iii) is rightfully disclosed to the Receiving Party by a third party who did not directly or indirectly obtain the information subject to any confidentiality obligations, or (iv) is at any time independently developed by Receiving Party without the use of Disclosing Party’s Confidential Information as proven by records of Receiving Party.
Confidentiality Undertaking and Permitted Disclosure
The Receiving Party shall (i) keep the Disclosing Party’s Confidential Information confidential, (ii) safeguard all Confidential Information of the other Party with at least the same degree of care (but no less than reasonable care) as it uses to safeguard its own confidential information, and (iii) not use Confidential Information for any purpose outside the scope of the Agreement.
The Receiving Party is permitted to disclose Confidential Information to those of its employees, directors, attorneys, agents, subcontractors, and consultants who (i) need to know the Confidential Information in connection with the purpose, execution and contract management of the Agreement, and (ii) are bound by confidentiality obligations (either through agreement or under law) no less stringent than those in the Agreement.
The Receiving Party is also permitted to disclose Confidential Information if compelled by applicable law or a binding decision or order by any authority, regulator, governmental body or court of competent jurisdiction. If the Receiving Party becomes subject to a compelled disclosure proceeding which concerns Confidential Information, it shall, to the extent not prevented by law, provide the Disclosing Party with notice of the proceeding and compelled disclosure and cooperate in any effort to obtain confidential treatment of the Confidential Information.
The Customer acknowledges that by using Pocketlaw AI, Input will be submitted to, and Output will be received from, the third-party providers of large language models and any related products used by Pocketlaw AI from time to time (in accordance with such provider’s terms and conditions).
No Customer Data, will be used, directly or indirectly, to train any foundational artificial intelligence models.
Pocketlaw is ISO270001 and SOC 2 Type II certified and shall maintain the certification, or a corresponding certification or standard, throughout the Term. Provided that we comply with this warranty and employ appropriate technical and organizational security measures to protect the Customer’s data, we are not liable for any loss of Customer Data. Pocketlaw is in no situation responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party, except those third parties engaged by Pocketlaw to maintain and back up Customer Data.
Intellectual Property Rights
Pocketlaw’s rights
Pocketlaw owns all rights, title, and interest in and to the Services, including but not limited to all Intellectual Property Rights included therein, as well as modifications, updates and upgrades thereof. Except as explicitly stated in these Terms, nothing in this Agreement shall be considered a transfer or license to those rights.
Licence
Pocketlaw grants the Customer a revocable, non-exclusive, non-transferable and limited licence for the number of individual Users stated in the Order Form, to access and use the Services specified in the Order Form. Upon expiry or termination of the Services, this right and licence shall end.
Other
The Customer must not tamper with, attempt to gain unauthorised access to, modify, hack, repair or otherwise adjust any of our material, source codes or other information for any purposes.
The Customer reserves all right, title, and interest in and to the Customer Data and Output.
Feedback, comments, ideas and suggestions for developments and improvements of the Service from the Customer may be used by Pocketlaw without restriction or compensation, and any Intellectual Property Rights resulting therefrom shall vest exclusively in Pocketlaw.
Pocketlaw may collect Usage Data to develop, improve, support, and operate its Services. Pocketlaw may not disclose Usage Data to any third party except (i) as permitted under Section 6 (Confidential Information and Information Security), or (ii) to the extent that the Usage Data has been aggregated and anonymized so that the Customer and its Users cannot be identified.
Personal Data
The Customer acknowledges that it is the data controller for any personal data processed by us on the Customer’s behalf in conjunction with its use of the Services. The Customer also acknowledges that we are considered as the Customer’s data processor; therefore, by agreeing to these Terms we enter into the data processing agreement attached to these Terms as “Appendix 1 - Data Processing Agreement”, which shall remain in effect for as long as we process personal data on the Customer’s behalf.
Pocketlaw will also process personal data for its own purposes, in the capacity of data controller, as described in our Privacy Policy.
Both parties deem that any personal data which may be processed as a result from the access to or utilisation of Pocketlaw AI is processed by the provider of that large language model in its capacity as a sub-processor.
Outsourcing
If the Customer is subject to the Digital Operational Resilience Act (DORA) and determines that the services provided by Pocketlaw are critical or important functions under DORA, the Customer must promptly notify Pocketlaw. The Customer is responsible for ensuring compliance with DORA's requirements concerning such services.
If receiving notification as per Section 10.1, Pocketlaw will against standard consultancy fee, and payment of costs, collaborate with the Customer to prepare the necessary documentation to facilitate compliance with DORA.
Miscellaneous
Notices
Except as otherwise specified in the Agreement, all notices, permissions, and approvals shall be in writing and shall be deemed to have been given upon (i) personal delivery; (ii) the second business day after mailing; or (iii) the day of sending by email. Notices of termination of the Agreement shall be addressed to support@pocketlaw.com and the Customer’s key account manager. All other notices under the Agreement shall be provided to the parties’ respective contact person as specified in the Order Form.
Marketing
The Customer grants Pocketlaw the right to use the Customer’s company logo(s), company name(s), trademark(s), and user quotes as reference material for marketing material. Upon the Customer’s written request, Pocketlaw shall immediately cease any further use of such materials as instructed by the Customer.
Waiver
No failure or delay by either party in exercising any right under the Terms will constitute a waiver of that right. No waiver under the Terms will be effective unless made in writing and signed by an authorised representative of the party being deemed to have granted the waiver.
Entire Agreement
These Terms, the Order Form, and any other documents referred to in such Order Form and in these Terms, constitute the whole agreement between the parties and supersede any previous arrangement, understanding or agreement between them relating to the subject matter they cover. In case of discrepancy between an Order Form and these Terms, the Order Form shall prevail.
The Customer acknowledges and agrees that when entering into an agreement for the Services, the Customer does not rely on any undertaking, promise, assurance, statement, representation, warranty or understanding (whether in writing or not) of any person relating to the Services.
Assignment
The Customer may not assign any of its rights or obligations under these Terms to any person without our prior written consent. We may assign the Terms, and we may assign, transfer or subcontract any of our rights or obligations under the Terms, to any person without the Customer’s prior consent.
Subcontractors
Pocketlaw may use subcontractors (incl. online, web-based applications, and offline software products or services) for the provision of the Services. Pocketlaw shall be liable for its subcontractors actions and omissions as for its own, and remain the Customer’s sole point of contact in relation to the Services.
Severability
In the event any provision of this Agreement is wholly or partly invalid, the validity of this Agreement as a whole shall not be affected, and the remaining provisions of this Agreement shall remain valid. To the extent that such invalidity materially affects a party’s benefit from, or performance under, this Agreement, it shall be reasonably amended.
Force majeure
Except for payment obligations under the Agreement, neither Party will be liable for failure to perform or inadequate performance under the Agreement to the extent caused by a condition that was beyond the party’s reasonable control and which substantially affects the party’s or its subcontractors’ performance, including, for example, a natural disaster, epidemic or pandemic, act of war or terrorism, riot or civil unrest, labour conditions such as boycott, strike, lock-out, governmental action, disruption of telecommunications, failure or delay of internet services providers or widespread internet disturbance, disruption of power or other essential services.
A party claiming that circumstances described in Section 10.8.1 prevents it from performing in accordance with the Agreement shall use commercially reasonable efforts to overcome and mitigate the effects of such circumstances.
If the performance of the Services in substantial respects is prevented for a period exceeding one (1) month due to a circumstance stated in Section 10.8.1, either party shall have the right to terminate the Agreement in writing, without incurring any liability for compensation.
Amendments
Pocketlaw may modify these Terms (and the resulting Acceptable Use Policy) at any time by publishing the updated Terms on its website. In the event of changes which are not minor and may affect the Customer, the Customer will be notified via email. Amendments to the Terms become effective thirty (30) days following the day they are published.
If an amendment materially adversely affects the Customer’s rights or obligations, then the Customer may terminate the Agreement without penalty upon notice to Pocketlaw no later than five (5) days prior to the effective date of the revised general terms and conditions.
All new functionalities and features introduced and added to the Services will be subject to what is stipulated in these Terms.
Governing Law And Disputes
These Terms and all non-contractual obligations arising in any way whatsoever out of or in connection with these Terms are governed by and construed in accordance with substantive Swedish law, without regard to any principles concerning the choice of law.
Any dispute, controversy or claim arising out of or in connection with these Terms, or the breach, termination or invalidity thereof, shall be finally settled by arbitration administered by the SCC Arbitration Institute (the “SCC”).
The Rules for Expedited Arbitrations shall apply, unless the SCC in its discretion determines, considering the complexity of the case, the amount in dispute and other circumstances, that the Arbitration Rules shall apply. In the latter case, the SCC shall also decide whether the Arbitral Tribunal shall be composed of one or three arbitrators.
The seat of arbitration shall be Stockholm. The language to be used in the arbitral proceedings shall be English.
The parties agree that all arbitral proceedings conducted under this arbitration section shall be kept confidential, and all information, documentation, materials in whatever form disclosed during such arbitral proceedings shall be used solely for the purpose of those proceedings.
Company Information
Pocket Solutions AB is a limited liability company registered in Sweden.
Registered address: Drottninggatan 98, 111 60 Stockholm, Sweden
Company registration number: 559169-9623
VAT registration number: SE559169-962301
Pocketlaw Limited is an entity registered in the United Kingdom
Registered address: 78 York Street, London, United Kingdom, W1H 1DP
Company number: 13149151
Definitions
“Acceptable Use Policy” means Pocketlaw’s Acceptable Use Policy available on our website.
“Agreement” means these Terms (including the Data Processing Agreement as set out in Appendix 1), the Order Form, and any other documents referred to in such Order Form and in these Terms.
“Account” means the account that the Customer registers and creates on the Site and/or in the Platform.
“Platform” means our Platform accessible via computer or mobile device (app.pocketlaw.com) relating to the Services.
“Confidential Information” is defined in Section 6 “Confidential Information and Information Security”.
“Contact Information” means support@pocketlaw.com.
“Customer” means the legal entity that is using the Services under these Terms, any of the Customer’s affiliates together with the Customer’s directors, employees, and representatives, and the Customer’s affiliates’ directors, employees, and representatives.
“Customer Data” means any file or other data created or uploaded to, stored in, or otherwise made available on the Platform by or on behalf of the Customer in connection with the use of the Services, excluding any data generated by Pocketlaw in connection with the operation, security, or improvement of the Services (such as usage data, logs, and aggregated statistics)
“Effective Date” means the date when the Order Form is signed by duly authorised representatives of both Parties.
“Initial Service Term” is defined in Section “Term and Termination”.
“Input” means the data, documents, software, Third-party Services, and other content (including prompts) uploaded, accessed, stored, or submitted in any manner for the use of Pocketlaw AI by or on behalf of the Customer.
“Order Form” means the order form for the Services under the Agreement that has been signed by both parties.
“Output” means any content, data, information, material, document, or other result generated and returned by the Services based on the Customer’s Input or use of the Services, including any content generated by Pocketlaw AI or other automated features. means the output generated and returned by the Services based on the Input when using Pocketlaw AI.
“Pocketlaw” means Pocket Solutions AB (a limited liability company incorporated under the laws of Sweden with company registration number 559169-9623), its subsidiary Pocketlaw Limited (an entity registered in the United Kingdom with company number 13149151) or any other subsidiary or affiliate (jointly “Pocketlaw”, “us”, “our” or “we”).
“Pocketlaw AI” means any feature of the Service that is powered by large language models, such as Open AI’s GPT-models, or any other large language model, that assists with various legal tasks including, but not limited to, document review, analytics, drafting, search, metadata tagging and research.
“Privacy Policy” means the applicable Privacy Policy available on our Site, which describes how we process the Customer’s personal data.
“Renewal Term” is defined in Section “Term and Termination”.
“Services” means the Pocketlaw AI contract lifecycle management platform, consisting of a cloud-based service accessible through a web browser, plug-ins and add-ins for other software, and any related documentation or modules provided by Pocketlaw to the Customer under this agreement.
“Site” means our website (https://Pocketlaw.com).
“Third-party Services” is defined in Section “Services”.
“Usage Data” means information reflecting the access, interaction, or use of the Services by or on behalf of Customer and individual end users, including frequency, duration, volume, features, functions, visit, session, click through or click stream data, and statistical or other analysis, information, or data based on, or derivative works of, the foregoing. Usage Data does not include any Customer Content.
“User” means any person within the Customer’s organisation (employees and representatives) that the Customer authorises to use the Services.
Capitalised terms that are used but not defined in this document shall have the meaning set out in the Order Form.
Appendix 1 - Data Processing Agreement
Background
This data processing agreement (the ”DPA”) governs the processing of Personal Data in the course of the provision of the Services provided by Pocketlaw or its Affiliates (“Processor”) to the Customer (“Controller”) and forms part of the Agreement between the Parties. In the case of conflict or ambiguity between the Agreement and the DPA, the provisions in the Agreement will prevail.
The DPA contains the mandatory Sections required by Article 28(3) of the General Data Protection Regulation (EU) 2016/679) for contracts between controllers and processors and the General Data Protection Regulation (EU) 2016/679).
The DPA includes the following Schedules:
Schedule 1 - Existing and Approved Sub-Processor
Schedule 2 - Technical and Organisational Security Measures
Schedule 3 - Contact Details
Personal Data Types And Processing Purposes
The Controller appoints the Processor to process data which identifies the Controller’s:
- Employees;
- Customers;
- Suppliers;
- Consultants;
- Business contacts;
- Distributors;
- Board members; and
- All other categories of data subject as determined by the Controller in accessing and using the Services provided by Pocketlaw.
The Controller may submit Personal Data to the Processor, the extent of which is determined and controlled by the Controller in compliance with Applicable Laws and which may include:
- Contact details;
- National Insurance Number;
- Employee salary details;
- Location data; and
- All other categories of personal data as determined by the Controller in accessing and using the Services provided by us.
The Processor processes personal data which:
- The Controller’s employees or authorised users add to any Pocketlaw Services
The Controller collects from its Data Subjects
The purpose for processing personal data (the “Purpose”): To enable the Processor to provide the Services to the Controller in accordance with the documented instructions.
Processing activities: Processing necessary to provide, maintain, and update the Services.
Data Processor’s Obligations
The Processor will observe and abide by the principles set out in Article 5 of the GDPR in connection with each and every Processing.
The Processor confirms that the Controller is not required to take any further action to ensure that the Processor fulfils its obligations in terms of expert knowledge, reliability and resources, to implement technical and organisational measures which will meet the requirements under Applicable Law, including for the security of Processing.
The Processor will only process the Personal Data to the extent, and in such a manner, as is necessary for the Purposes in accordance with the Controller’s written instructions. The Processor will not Process the Personal Data for any other purpose or in a way that does not comply with this DPA or the Data Protection Legislation.
The Processor will, upon the request of the Controller, reasonably assist the Controller, at no additional cost, with meeting the Controller’s compliance obligations under the Data Protection Legislation, taking into account the nature of the Processor's processing and the information available to the Processor, including in relation to Data Subject rights, data protection impact assessments and reporting to and consulting with the Supervisory Authority or other relevant regulator under the Data Protection Legislation.
The Processor must promptly notify the Controller if, in its opinion, the Controller's instructions do not comply with Applicable Law. If the Processor deems any written instructions provided by the Controller as incomplete, deficient, or false, the Processor must promptly inform the Controller. The Processor is permitted to refrain from following the Controller's instructions if they contravene Applicable Law.
Controller’s Obligations
The Controller determines the purposes and means for processing Personal Data. The Controller retains control of the Personal Data and remains responsible for its regulatory and compliance obligations under the applicable Data Protection Legislation, including but not limited to providing any required notices and obtaining any required consents, and for the written processing instructions it gives to the Processor.
The Controller retains responsibility for relations with data subjects in the processing of personal data.
The Controller is responsible for ensuring that personal data is accurate and up to date.
Data Breach
In the event of a breach of security leading to the accidental, unauthorised or unlawful destruction, loss, alteration, disclosure of, or access to, the personal data (“Personal Data Breach”), the processor must, without undue delay and latest within eight (8) hours from the time of discovering the Personal Data Breach, provide written notice to the Controller.
The information will, to the extent that it is available to the Processor, contain the following:
- A description of the circumstances surrounding the Personal Data Breach
- A description of the nature of the Personal Data Breach and, where possible, the categories and the approximate number of data subjects affected by the incident.
- A description of the potential consequences of the Personal Data Breach in question
- A description of the measures taken or proposed to remedy the Personal Data Breach, as well as when implementing such measures may be appropriate, and measures for reducing the potential negative effects of such an incident.
- Contact details of relevant contact person who can provide further information to the Controller
Where it is initially not possible for the Processor to provide information to the Controller, the information may be provided in installments without further undue delay.
Audit Rights
On the Controller’s written request, the Processor must provide the Controller with any information reasonably required for the Controller to confirm the Processor’s compliance with its obligations under this DPA and Applicable Law.
The Controller must give the Processor at least ten (10) business days written notice of any planned audits or inspections.
Any audit conducted in accordance with this section may only be conducted:
- during normal business hours;
- after the Controller has confirmed that any appointed representative, whether working for the Controller or acting an authorised third party, carrying out the audit is subject to a confidentiality agreement that is appropriate in relation to the Personal Data and the information to be audited; and
- in accordance with the Processor’s internal policies and security-related procedures.
Each party shall bear its own costs incurred in relation to the audit.
If the Controller is reasonably required to conduct more than one audit in accordance with this section within any twelve (12) month period, the Controller shall bear all costs reasonably incurred by the Controller in conducting the audit.
Sub-Processors
The Processor may only authorise a third-party (a sub-processor) to process the Personal Data if:
- the Controller is provided with an opportunity to object to the appointment of each sub-processor within thirty (30) days after the Processor supplies the Controller with full details in writing regarding such sub-processor;
- the Processor enters into a written contract with the sub-processor that contains data protection obligations that provide at least the same level of protection for Personal Data as those contained in the DPA, to the extent applicable to the services provided by the sub-processor;
- the Processor maintains control over all of the Personal Data it entrusts to the sub-processor; and
- the sub-processor’s contract terminates automatically on termination of this DPA for any reason.
The Processor shall keep an up-to-date list of all its approved sub-processors. The list must be made available to the Controller upon request. Those sub-processors approved as at the commencement of this DPA are as set out in Schedule 1. If the Controller reasonably objects to the appointment of a new sub-processor it must provide written details of the reasonable grounds for its objection and the Processor will use commercially reasonable efforts to make a change to the Services to avoid Processing of Personal Data by the objected to sub-processor or to appoint an alternative sub-processor. If the Processor is unable to make such a change to the Services or appoint an alternative sub-processor within thirty (30) business days, either party shall have the right to terminate this DPA and (if applicable) the Agreement.
On the Controller’s written request, the Processor shall provide copies or relevant extracts (at the Processor’s sole discretion) of the Processor’s data processing agreements with sub-processors.
The Processor shall keep an up-to-date list of all its approved sub-processors. The list must be made available to the Controller upon request.
If a sub-processor fails to comply with its obligations under the data processing agreement between the sub-processor and the Processor, the Processor remains fully liable to the Controller for the sub-processor’s performance of the Controller’s obligations under the DPA.
Records And Data Protection Officer
The Processor will keep written records (“Records”) of all data processing activities related to the DPA. The Records will be made accessible to the Controller upon request.
If the Processing or nature of business activities require the Processor to appoint a DPO in accordance with Applicable Law, the contact details of the DPO will be provided in Schedule 3.
Contact With Authorities, Data Subject Requests
The Processor will inform the Controller without undue delay of any contact from Data Subjects, relevant authorities, courts or regulators (including the Supervisory Authority), or third parties concerned with the Processor’s Processing of Personal Data on behalf of the Controller.
If the Data Subject makes a request to exercise their Data Protection Legislation rights to the Processor, the Processor will refer the Data Subject to the Controller.
The Processor will accommodate inspections as required by domestic law, courts or regulators (including the Supervisory Authority).
The Processor is not permitted to represent the Controller’s interests or in any other way act on behalf of the Controller towards any Data Subject, authority or any other relevant third party.
Technical And Organisational Security Measures
The Controller will adopt the appropriate organisational and technical security measures to protect personal data under the DPA from unauthorised and illegal access. This includes ensuring sufficient physical access controls, system access controls, data access controls and data backups.
The suitability of technical and organisational measures will be assessed regarding the latest technology available, associated costs for adoption, sensitivity of data concerned by the processing acts of the Processor, in addition to any risks to the rights and freedoms of data subjects.
If the Controller assesses the risk level of Processing by the Processor as high, and thereby conduct an impact assessment, the Controller must share the result of such an assessment so that this can be factored into a decision of what is a sufficient level of technical and organisational measures.
The Processor must follow any decisions issued by the Supervisory Authority or any other supervisory authority on measures to meet the security requirements in Applicable Law and all other requirements relating to the Personal Data Assistant in accordance with Applicable Law.
The Processor must comply with any decisions and consultation opinions issued by the supervisory authority on measures necessary to meet the security standards in accordance with Applicable Law and all other requirements relating to the Controller’s obligations under Applicable Law.
The Processor must ensure its employees, sub-processors and, where applicable, the employees of its sub-processors only have access to the Personal Data to the extent to which it is necessary and that those who have access to the Personal Data maintain the confidentiality of such information (e.g. by signing an individual confidentiality agreement).
Only employees or assigned individuals of the Processor deemed to have the necessary level of knowledge in relation to the nature and scope of the Personal Data processing may process the Personal Data.
Computer equipment, storage media and other equipment used in the processing of personal data performed by the Processor must be stored so that unauthorised persons cannot gain access to them.
The security in the Processor’s physical premises where personal data is processed must be suitable and secure regarding locking equipment, functioning alarm equipment, protection against fire, water and burglary, and protection against power outages. The equipment used to process Personal Data must have good protection against theft and events that may destroy the equipment and/or Personal Data.
CONTROL OVER PERSONAL DATA
The Processor must ensure that the Personal Data remains protected against unauthorised, unlawful and unintentional destruction, modification and distortion. The Personal Data must be protected from unauthorised access during storage, transfer and other treatment. The Processor must not access Personal Data unless the identity of the recipient has been verified.
Data Transfers Outside The EU/EES
The Processor primarily processes the Personal Data of the Controller within the EU/EES. If Personal Data is not processed within the EU/EES, the Processor must ensure that processing takes place according to Applicable Law by ensuring that one of the following criteria is met:
There is a decision from the European Commission that the country ensures an adequate level of protection for the Personal Data;
The Processor applies the European Commission's standard contractual clauses (SSCs) for third country transfers; and
The Processor has adopted other appropriate safeguards which fulfil requirements under Applicable Law.
Liability And Indemnities
The Parties are free from liability for obligations arising under the DPA in cases where performance is hindered by a circumstance of an extraordinary nature beyond the Party's control which the Party could not reasonably be expected to have considered and whose consequences the Party could not reasonably have avoided.
The Processor’s liability arising out of or relating to this DPA, whether in contract, tort (including negligence), breach of statutory duty, or otherwise is subject to the “Limitation of Liability” section of the Terms, and any reference in such section to our total liability means our aggregate liability under the Agreement and this DPA together.
The Processor agrees to indemnify the Controller for any damages incurred by the Controller as a direct result of the Processor processing Personal Data against the Controller’s instructions according to the DPA and Applicable Law.
For the avoidance of doubt, we shall not be liable for any loss of profit, or any indirect or consequential loss arising in connection with this DPA.
Confidentiality
The Processor is not permitted to use information or any other material which they are provided access to to fulfil the DPA or the Agreement for any other purpose than those which are necessary to fulfil their obligations under this DPA or the Agreement.
The Processor will maintain the confidentiality of the Personal Data and will not disclose the Personal Data to third parties unless the Controller, DPA or Agreement specifically authorises the disclosure, or as required by domestic law, court or regulator (including the Supervisory Authority). The agreement of confidentiality between the parties is valid from the date on which the Parties enter into the Agreement until the Processor returns or destroys the Personal Data in accordance with this DPA. The Processor will ensure that confidentiality is maintained by its employees and all other parties involved with the business or work undertaken on their behalf.
Validity And Termination
This DPA will remain in full force and effect so long as the Processor is processing Personal Data on behalf of the Controller or until the DPA is replaced by a different data processing agreement.
The duties and obligations of the Processor in relation to DPA will remain in full force and effect despite the Agreement being terminated, so long as the Processor is Processing Personal Data on behalf of the Controller.
Deletion And Return Of Personal Data
Upon termination of the DPA, the Processor and any other potential sub-processors will either destroy or return the Personal Data concerned by the DPA to the Controller.
If the Controller has not requested destruction or return of the Personal Data concerned by the DPA within twelve (12) months from the date of which the DPA has terminated as agreed by the Parties, the Processor must destroy the Personal Data.
Applicable Law And Dispute Resolution
This agreement and any dispute or claim arising out of or in connection with it or its subject matter or formation (including non-contractual disputes or claims) shall be governed by and construed in accordance with the laws of Sweden.
The specified dispute resolution mechanism applicable in the Agreement will be applicable in this DPA.
Definitions And Interpretation
The terms used in this DPA shall have the same meaning as ascribed to them in Article 4 of the GDPR. Furthermore, the following definitions and rules of interpretation apply in the DPA:
“Applicable Law” refers to the legislation applicable to the processing of Personal Data under the DPA, including the GDPR, supplementary national legislation, as well as practices, guidelines and recommendations issued by a Supervisory Authority.
“Supervisory Authority” means a supervisory authority within the EU, such as the Swedish Authority for Privacy Protection, or another supervisory authority which on the basis of law has the authority to conduct supervisory activities over the Controllers operation.
“Personal Data” means any information relating to an identified or identifiable living individual that is processed by the Processor on behalf of the Controller as a result of, or in connection with, the provision of the Services under the Agreement (in the DPA “Personal Data” is used synonymously with “Personal Data for which the Data Controller is responsible for and which the Data Controller processes on behalf of the Data Processor”).
“Data Controller” means the company/organisation that sets out the purposes for which data is processed and is thereby held responsible for ensuring that Personal Data is processed in accordance with Applicable Law. The parties agree and acknowledge that for the purpose of the Data Protection Legislation the customer is the Data Controller.
“Data Processor” is the company/organisation that processes personal data on behalf of the Data Controller and is therefore only permitted to process data in accordance with the Controller’s written instructions. The Parties agree and acknowledge that for the purpose of the Data Protection Legislation, Pocketlaw is the Data Processor.
“Data Subject” is the identified or identifiable living individual to whom the Personal Data relates.
“Processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Unless otherwise defined in the DPA, capitalised terms used in this DPA shall have the same meaning as those given in the Agreement.
Schedules To Data Processing Agreement
Schedule 1: Existing and authorised sub-processors
Name: Amazon Web Services (AWS)
Type of Service: Data storage and distribution network (CDN)
Website: https://docs.aws.amazon.com/
Personal Data Processed: All details provided by the Controller in accessing the Pocketlaw platform and services, such as name, address, email address, phone number and company role.
Data residency: EU/EES
Name: Signicat
Type of Service: eSigning
Website: https://www.signicat.com/
Personal Data Processed: Name, contact information, national identity number and customer engagement details.
Data residency: EU/EES
Name: Idura
Type of Service: eSigning
Website: https://idura.eu/
Personal Data Processed: Name, contact information, national identity number and customer engagement details.
Data residency: EU/EES
Name: Microsoft Azure
Type of Service: Data storage and distribution network (CDN)
Website: https://azure.microsoft.com/en-us/
Personal Data Processed: All details provided by the Controller in accessing the Pocketlaw platform and services, such as name, address, email address, phone number, company role, etc.
Data residency: EU/EES
Name: OpenAI
Type of Service: AI tool
Website: https://openai.com/
Personal Data Processed: Any personal data provided to Pocketlaw AI
Data residency: EU/EES
Name: Google Cloud
Type of Service: Vertex AI
Website: https://cloud.google.com/vertex-ai
Personal Data Processed: Any personal data provided to Pocketlaw AI
Data residency: EU/EES
Name: UserGuiding
Type of Service: User Onboarding and Engagement Tool
Website: https://userguiding.com/
Personal Data Processed: Name, email address, user activity data, IP address, browser type, Internet Service Provider, date/time stamp, referring/exit pages, and clicked pages.
Data residency: EU/EES
______________________________________________________________________
Schedule 2: Technical and organisational security measures
The Processor has adapted the following technical and organisational measures to ensure that personal data is processed securely and that they are protected from loss, misuse and unlawful or unauthorised access.
Technical security measures are measures which are adopted through technical solutions.
Encryption
- Access control level
- Access log
- VPC
- Secure network
- Regular security inspection
- Two-factor authentication
- Password management software for all passwords
SSL
Organisational security measures are measures which are adopted in working methods and routines within the organisation.
- Internal policies and procedures
- Login and password management
- Physical security (premises etc.)
______________________________________________________________________
Schedule 3: Contact details
Support@pocketlaw.com