Acceptable Use Policy

3.1 Content and Data Misuse

Customer must not use the Platform to:

• •Extract, copy, or redistribute risk libraries, assessment templates, or regulatory content for competitive purposes.
• •Upload content that violates third-party intellectual property rights.
• •Store personal data beyond what is necessary for legitimate compliance purposes.
• •Process special category data without appropriate legal basis and safeguards.

3.2 Security and Access

Customer must not use the Platform to:

• •Attempt to gain unauthorized access to the Platform, systems, or data, or to tenant environments other than Customer's own.
• •Circumvent, disable, or interfere with security features including MFA and SSO.
• •Share login credentials or authentication tokens with unauthorized parties.
• •Conduct vulnerability scanning, penetration testing, or security assessments without prior written authorization.
• •Introduce Malicious Code or any software designed to disrupt the Platform.

3.3 Compliance Abuse

Customer must not use the Platform to:

• •Use the Platform for unlawful, fraudulent, misleading, or unethical purposes, or generate fraudulent compliance records or falsify audit documentation.
• •Misuse the DSR portal to submit vexatious or illegitimate requests.
• •Misrepresent compliance status to regulators or auditors using Platform outputs.
• •Conduct benchmarking or comparative analysis intended for publication without WLC's prior written consent.
• •Resell, sublicense, lease, or otherwise make the Platform available to any third party, other than Customer's Affiliates and authorized Users acting within Customer's account, except as expressly permitted under the MSA.
• •Use the Platform or any WLC's confidential information to train artificial intelligence, machine learning, or similar models, except as expressly permitted by WLC in writing.

3.4 Technical Restrictions

Customer must not use the Platform to:

• •Reverse engineer, decompile, or disassemble any part of the Platform.
• •Use automated scripts, bots, or scrapers without authorization.
• •Exceed reasonable API rate limits or attempt to overload Platform infrastructure.
• •Interfere with other Tenants' use of the Platform.

3.5 Prohibited Multi-entity and Managed Service Use

The Platform is designed to support a legal entity and its Affiliates in managing their own governance, risk, and compliance activities. A consultant, data protection officer, or compliance professional engaged by Customer may use the Platform solely to manage compliance activities of Customer and its Affiliates within a single Tenant.

The Platform is not designed or licensed for use as a managed service or compliance office tool through which a single Customer Tenant is used to serve multiple separate, unrelated client organisations. Each independent legal entity, or group of legal entities under common control, that does not qualify as Customer or an Affiliate of Customer, is required to hold its own subscription to the Platform.

Accordingly, Customer must not:

• •Use a single Tenant to manage, administer, or process governance, risk, and compliance activities described in Section 2 above, on behalf of legal entities that are not Customer or its Affiliates.
• •Act as a compliance office, managed service provider, or intermediary by using Customer's Tenant to produce, maintain, or deliver Platform outputs for the benefit of legal entities that do not qualify as Affiliates of Customer.
• •Grant access to Customer's Tenant to individuals or users acting on behalf of, or for the primary benefit of, legal entities that are not Customer or its Affiliates.
• •Use a single subscription in a manner that circumvents the multi-entity use restriction set out in MSA Section 3.12.

For the avoidance of doubt, this Section 3.5 does not prohibit Customer from: (i) producing compliance outputs, reports, or assessments that reference or relate to third parties in the ordinary course of Customer's own compliance activities, where such references are incidental to Customer's own compliance programme; or (ii) using the Platform in connection with services provided under a separate written agreement with Service Provider expressly authorising such use, including where Customer is an authorised partner or reseller of Service Provider.