Terms and Conditions

B2B electronic contracting · Plans, add-ons and professional services

Version 0.2 · Effective August 29, 2026

1. Provider identity and scope

These B2B Electronic Contracting Terms and Conditions (the “Terms”) govern the business acquisition and use of the services offered through the website and online store of ETHICSGLOBAL, S.A.P.I. DE C.V., Mexican Federal Taxpayer Registry (RFC) ETH160802QMA, with registered address at Montecito 38, 42nd floor, office 17, Colonia Nápoles, Benito Juárez, Mexico City, Postal Code 03810, Mexico (“EthicsGlobal” or the “Provider”).

The Terms apply to subscription plans, modules, channels, capacities, add-ons, professional services, training, investigations, consulting, content and any other solutions purchased electronically by the Customer. If the Parties enter into a master agreement or another signed bilateral agreement, that agreement will prevail for the matters it expressly governs; these Terms will continue to apply on a supplementary basis to electronic purchases not covered by that agreement.

2. Business-only contracting and authority

The offering is intended exclusively for legal entities, public or private organizations, and individuals acting for business or professional purposes (the “Customer”). It is not a consumer offering and is not directed to anyone under 18 years of age.

Anyone who creates an account, configures a plan, accepts these Terms or places an order represents that: (a) they are at least 18 years old; (b) they act on behalf of the Customer identified in the Order; (c) they have sufficient authority to bind it; (d) the information provided is true and current; and (e) the Services will be used for business or professional purposes. If Services are purchased for an affiliate or beneficiary entity other than the payer, that person warrants that they are also authorized to bind that entity and will be responsible for its compliance.

3. Electronic acceptance and contract formation

The contract is formed when the authorized person checks the acceptance box, confirms the Order, makes or authorizes payment, activates a trial that requires acceptance, or uses the Services after receiving confirmation. A click, electronic signature, portal record, corporate email and data message have the same binding effect as a handwritten signature to the extent permitted by applicable law.

EthicsGlobal may retain as evidence the account identity, contracting entity, date and time, technical connection address, version of the Terms, contents of the Order, authentication methods, payment status and reference, and related communications. The Parties agree that those records may be admitted as evidence of contracting, without prejudice to any mandatory retention or signature requirements.

4. Contract documents and order of precedence

The electronic agreement consists of: (a) the accepted order, quotation or electronic confirmation (the “Order”); (b) the plan, service model and product details displayed when the purchase is confirmed; (c) these Terms; (d) the Data Processing Agreement in Schedule A (the “DPA”); (e) any service levels or specific scopes incorporated into the Order; and (f) the policies expressly linked by those documents.

If there is a conflict, the following order of precedence applies: the Order; the DPA solely for personal-data processing matters; the SLA or specific scope; these Terms; and the informational or commercial content of the website. A general description, demonstration, image, comparison or marketing material does not expand the scope confirmed in the Order.

5. Order, subscribed Plan and limited scope

As applicable, the Order identifies the Customer, plan, service model, number or range of covered persons, companies or entities, countries, workplaces, languages, channels, users, storage, credits, add-ons, deliverables, currency, taxes, billing cycle, start date, subscription period and price. Only items expressly marked as included form part of the Services.

The standard plans are Essential, Advanced, Corporate and Premium. Service models may include Automated Channels or Specialist Support. Availability and specific limits depend on the Order and on the version of the plan details accepted at purchase. EthicsGlobal may offer additional configurations, capacities or commercial names without granting rights to Customers that have not purchased them.

6. Account, administrators and configuration accuracy

The Customer will appoint at least one administrator, keep their details current and protect credentials, authenticators and permissions. Any action taken through an authorized account will be treated as an instruction from the Customer unless the Customer promptly reports unauthorized access.

The Customer is responsible for configuring roles, users, entities, workplaces, languages, categories, workflows and recipients; reviewing whether the subscribed scope is sufficient; and reporting changes that affect price or capacity. EthicsGlobal may request reasonable information to validate the entity, authority, business use, number of covered persons or regulatory requirements.

7. SaaS license and use restrictions

During the paid term, EthicsGlobal grants the Customer a limited, non-exclusive, revocable, non-sublicensable and non-transferable license to access the subscribed modules and use them for its internal ethics, compliance, management, training or analytics purposes.

The Customer may not copy, decompile or reverse engineer; access source code; circumvent limits or security controls; perform scraping or unauthorized intrusive testing; resell, sublicense or exploit the Services for third parties; introduce malware or unlawful content; use the Services for unlawful surveillance, retaliation or discrimination; or develop a competing product through improper access to the Platform. Documented integrations and normal use of subscribed APIs do not violate this clause.

8. Implementation, provisioning and activation

Activation may be automatic or may require validation, payment reconciliation, configuration, requirements gathering, delivery of content, training, testing or acceptance. Purchase confirmation does not mean that all channels or professional services are immediately available.

The Customer will promptly provide logos, domains, content, responsible persons, routing rules, tax information, third-party access and required decisions. If the Customer is delayed, EthicsGlobal may reschedule, proceed with available information or shift dates without liability. Timelines also depend on carriers, portability, DNS, external providers and Customer approvals.

Subscription creation, activation, suspension or change instructions may be exchanged between Odoo and CaseManager through technical integrations, including webhooks. Those administrative signals do not by themselves transfer the substantive content of reports.

9. Nature of the reporting system and Customer decisions

Unless the Order expressly includes a different professional service, EthicsGlobal receives, records, hosts, routes and makes report information available to the Customer, but does not act as an investigative, employment, disciplinary or judicial authority; does not determine whether allegations are true; does not decide responsibility or sanctions; and does not guarantee the absence of false, incomplete or anonymous reports.

The Customer is responsible for defining its policies, notices, recipients, investigation processes, anti-retaliation measures, decisions and local compliance. EthicsGlobal channels are not emergency services. Immediate threats to life, personal safety or property must be reported to local emergency services or competent authorities.

10. Capacities, covered persons and reasonable use

The limits for persons, companies, workplaces, users, countries, languages, storage, credits, hours, sessions, materials, integrations or deliverables are those stated in the Order. Under the Specialist Support model, the total number of covered employees is an essential basis for price, capacity and operations. The Customer will state the actual and verifiable total when subscribing and update it within 10 business days after any material change. Upon reasonable request, it will provide sufficient aggregated evidence to validate the population, without supplying unnecessary individual personal data.

The covered population includes employees and, only when permitted by the plan details, strategic third parties connected with operations—such as suppliers, distributors, franchisees or wholesalers—who use the channel for ethics and compliance matters. It does not include the general public, end consumers, product users, commercial complaints, customer service, technical support, promotions or open campaigns. Using or promoting the ethics line for those purposes, understating the employee count, or extending it to an unsubscribed population constitutes abusive and out-of-scope use.

If there is a population discrepancy or out-of-scope use, EthicsGlobal may recalculate and charge for the correct capacity from the period in which the excess began, require a plan change, temporarily limit channels or volume and, after notice where possible, suspend or terminate the Service. It may act immediately if the use threatens availability, security or capacity for other customers. Any measure will be proportionate and will not release the Customer from accrued charges.

When a feature is described as “unlimited,” it means reasonable business use within the Service purpose, subscribed architecture and security policies; it does not permit resale, abusive automated loads, use by uncovered third parties or consumption that degrades the service.

11. Add-ons, credits, storage and included benefits

Recurring add-ons increase capacity or functionality while active. Unless the Order states otherwise, an addition during a cycle is charged on a prorated basis from activation through the next renewal and, from that renewal onward, for the full period. One-time services are charged when the purchase is confirmed and activated after payment and scope are validated.

Artificial-intelligence credits and other periodic allowances renew at each stated cycle and do not roll over, transfer, convert to cash or survive termination. Subscribed storage is available persistent capacity while active, not a consumable credit; reducing or cancelling it may require exporting or deleting information to return to the applicable limit.

A feature marked as included covers only the quantity, frequency, service model and scope described in the Order. Any excess, repetition, customization or out-of-scope service is quoted separately.

12. One-time corporate investigation benefit

When the Advanced, Corporate or Premium plan details include a corporate investigation, the benefit is granted only once during the commercial lifetime of the Customer and entities under common control, regardless of renewals, plan changes, new subscriptions or later purchases. Essential may purchase investigations as an additional service.

The benefit requires an active paid subscription, is subject to availability in the requested country and language, and covers only the written scope accepted by EthicsGlobal before work begins. It is not transferable, cumulative, redeemable for cash or divisible among multiple matters. Additional hours, interviews, travel, expert work, translations or other activities are quoted separately.

13. Professional services and deliverables

Investigations, training, workshops, e-learning, policies, codes of ethics, consulting, NOM-035 services, analytics, benchmarking, design, awareness campaigns, audiovisual production, integrations, APIs and software development are provided only if listed in the Order and in accordance with the scope, assumptions, dependencies, hours, review rounds and acceptance criteria stated there.

Services that depend on specialists, including investigations, training, workshops and advisory services, are subject to the availability of qualified personnel in the requested language, country, time zone and dates. A date is confirmed only in writing. EthicsGlobal may propose an alternative date, language or specialist if availability does not exist under the requested conditions.

Investigations and training sessions or workshops are delivered remotely unless the Order or a subsequent written confirmation expressly provides for in-person delivery. In-person delivery requires prior agreement on the location, dates, participants and conditions, and may generate additional charges for travel time, transportation, lodging, meals, per diem, taxes, permits and other reasonable expenses, which must be quoted and approved separately before they are incurred.

Before the Customer purchases CaseManager development, integration or software-factory hours, EthicsGlobal may provide a preliminary hour range based on the information initially available. The range is indicative, is not a fixed price or a feasibility warranty, and may change after detailed discovery and analysis. Once the service begins, all time reasonably devoted to the project consumes hours, including requirements gathering, discovery, feasibility analysis, solution design, architecture, planning, estimate refinement, meetings, coordination, documentation, configuration, development, testing and delivery activities. Rework caused by Customer changes, incomplete information or third-party dependencies may also consume hours.

Purchasing hours does not guarantee that every request is feasible, compatible, secure or capable of completion within the time initially considered. EthicsGlobal may review scope, architecture, dependencies, security, privacy, third-party systems and impact on Service stability; it will submit the updated estimate, assumptions and deliverables for Customer approval before performing the relevant development. It may reject requests that are infeasible, unlawful, insecure, incompatible with the architecture or dependent on unsupported third parties.

For investigations purchased by the hour, EthicsGlobal will prepare a plan and estimated range based on available information. Planning, document review, interviews, evidence analysis, coordination, conclusions and preparation of the deliverable consume hours. Duration may increase if new leads, documents, interviewees, locations, languages, lines of inquiry or Customer requirements arise. Before exceeding the approved range or scope, EthicsGlobal will inform the Customer and request authorization for additional hours or scope; if authorization is not granted, it may adjust the plan, deliver the work completed to that point or pause the service. No estimate guarantees a duration or a particular conclusion.

The Customer will review deliverables and provide specific comments within five business days after delivery or within any different period stated in the Order. If no comments are received during that period, the deliverable will be deemed accepted for progress and billing purposes. Corrections required because the deliverable does not meet the agreed scope do not consume review rounds; preference or scope changes may generate an additional quotation.

Compliance services do not constitute legal, tax, medical or expert-witness advice unless the Order expressly states otherwise and the services are delivered by properly licensed professionals. Final decisions, policy adoption, implementation of NOM-035, disciplinary measures and use of results remain the Customer’s responsibility.

14. Prices, currency, conversion and taxes

The binding price, charge currency, frequency, discounts and taxes are those displayed in the Order at confirmation. For Customers in Mexico, charges may be set in Mexican pesos with a U.S.-dollar reference; for other countries, charges may be made in U.S. dollars and a local conversion may be displayed for information only. The card issuer, bank or payment provider may apply its own exchange rate or fees.

Prices exclude VAT, withholding, duties, indirect taxes or other applicable charges unless expressly stated. Each Party is responsible for the taxes legally imposed on it. If the Customer must make a mandatory withholding, it will promptly provide the official certificate and will not apply any setoff or deduction other than one required by law.

15. Payment, recurring charges, invoicing and chargebacks

The Customer authorizes initial and recurring charges to the selected payment method for the amounts and cycles stated in the Order until cancellation takes effect. Card tokens are managed by the payment provider integrated with Odoo; EthicsGlobal does not need to store the full card number. Bank transfers are treated as paid after reconciliation.

The Customer will maintain a valid payment method and accurate tax information. EthicsGlobal may retry failed charges and provide notice of the outstanding amount. To the extent permitted by law, overdue amounts may incur a charge of 5% per month or the lower legal maximum, without exceeding the overdue principal. EthicsGlobal may suspend the Services after five business days’ notice of nonpayment, without extinguishing the debt.

The Customer will not initiate a chargeback for a validly accepted charge without first allowing EthicsGlobal to review the discrepancy. Improper chargebacks, bank costs and reasonable recovery expenses may be charged to the Customer when permitted by law.

16. Term, renewal, cancellation and refunds

A monthly subscription renews for monthly periods and may be cancelled before the next charge. Cancellation takes effect at the end of the paid monthly period: for example, if the cycle began or renewed on the 5th, access continues until the following 5th and no new renewal is generated, provided that cancellation was received before that next charge was processed. An annual subscription is billed in advance for the year even if the website displays a monthly equivalent and renews for annual periods unless non-renewal notice is given at least 30 calendar days in advance. The Order may establish a minimum commitment or different rules.

The Customer may cancel through the portal, the enabled electronic function or verifiable notice to EthicsGlobal. Disabling users, ceasing to use the Service or removing a payment method does not constitute cancellation. Except where required by law, for an uncured breach attributable to EthicsGlobal, or as expressly stated in the Order, paid amounts are nonrefundable and no credits are provided for partial periods, unused capacity or included services not requested.

If the Customer terminates a minimum-term commitment early without cause attributable to EthicsGlobal, it must pay the remaining amounts stated in the Order. Any mandatory rights that exceptionally apply will prevail over this clause.

17. Plan changes, additions, removals and capacity reductions

Upgrades and recurring add-ons may be activated immediately with a prorated charge through the next renewal. Plan downgrades, recurring add-on removals or capacity reductions normally take effect at the next renewal and do not generate a refund for the current period.

Before a reduction, the Customer must remove users, data, domains, channels or configurations that exceed the new limit. EthicsGlobal may prevent the reduction, temporarily maintain restricted access or quote excess capacity until the Customer completes the adjustment. A reduction does not reset one-time benefits or restore expired credits.

18. Free trials, demonstrations and beta features

The standard trial, when available, may enable the Advanced plan under the Automated Channels model for 30 days and exclude the Contact Center, telephone numbers or other identified features. A trial may have technical limits, demonstration data or reduced capacity and is provided “as is.”

A trial does not become a paid subscription without an additional acceptance that displays the price and payment method. At the end of the trial, EthicsGlobal may disable access and delete trial data after a reasonable period. Beta, preview or evaluation features may change or be withdrawn and have no SLA or continuity warranty unless agreed in writing.

19. Support, maintenance and service levels

EthicsGlobal will provide support and maintenance in accordance with the plan and current channels. Premium support, when included or purchased, provides priority handling and an initial contact or diagnosis within the period published or confirmed in the Order; it is not a guarantee of resolution within that same period.

EthicsGlobal may perform scheduled maintenance, security updates, corrections, improvements and technical changes. Notified maintenance windows, external-provider unavailability, force majeure, Customer actions, unsupported configurations, the public Internet and authorized suspensions are not treated as availability breaches. Service credits, if any, must be stated in an SLA and will be the exclusive remedy for that metric, except in cases of willful misconduct, gross negligence or mandatory law.

20. Customer Data, privacy and applicable documents

Data, content, reports, case files, documents and configurations entered into the Services by the Customer or its users belong to the Customer or their lawful owners (“Customer Data”). EthicsGlobal does not acquire ownership and processes them to provide, protect, maintain and technically improve the Services in accordance with the Order and the DPA.

Processing related to the website, checkout, business accounts and marketing is described in the EthicsGlobal Privacy Notice available at /privacy. Information received through ethics reporting systems is also governed by the notice available at /reporting-privacy and, when available, by the customer organization’s supplemental notice. For processing on the Customer’s behalf, the Customer normally acts as controller and EthicsGlobal as processor, operator or service provider.

The Customer warrants that it has sufficient notices, legal bases, authorizations and instructions for Customer Data. EthicsGlobal may generate and use aggregated statistics or irreversibly anonymized data that do not identify a person or Customer or reveal confidential information. These metrics may include, for example, usage volumes, numbers of investigation plans, general report categories, applied workflows and types of measures or sanctions based on catalogs, but never the substantive content of a report or Customer personal data.

21. Security, hosting, backup and data residency

EthicsGlobal applies reasonable administrative, physical and technical measures proportionate to risk, including access controls, authentication, logical segregation, logging, monitoring, backup, continuity and encryption in transit and at rest. Depending on the subscribed architecture, key management may use AWS Key Management Service (KMS) and, under certain plans, Customer-controlled keys.

The Platform and its components may operate on Amazon Web Services infrastructure and other providers. Data regions, replicas, backups and localization commitments are binding only if stated in the accepted Order or technical documentation. When a specific region is subscribed, EthicsGlobal will endeavor to keep copies containing Customer Data within the agreed architecture, subject to support, security and documented legal obligations.

No system is absolutely invulnerable. EthicsGlobal will notify security incidents affecting Customer Data without undue delay, in accordance with the DPA, and will reasonably cooperate with the Customer.

22. Subprocessors, telecommunications and third-party services

EthicsGlobal may use subprocessors and providers of infrastructure, hosting, telecommunications, international numbers, email, messaging, chat, payments, support, translation and security. Current provider categories include AWS, carriers such as Alestra, international-number providers such as TollFreeForwarding, Mailcow-based email infrastructure, Chatwoot, Odoo and payment processors; the specific provider depends on the Service and may be replaced with an equivalent provider.

Numbers, short codes, WhatsApp, email, domains and other channels depend on availability, regulation, carriers and third-party policies. EthicsGlobal does not guarantee portability, universal coverage or retention of a specific number unless committed in writing. The Customer will comply with channel rules and will not use them for emergency calls or unlawful communications.

23. Artificial intelligence and human decisions

Artificial-intelligence features may assist in summarizing, classifying, translating, searching, suggesting or analyzing information. Outputs may be incomplete or inaccurate and do not replace human review, a professional investigation or legal advice. The Customer is responsible for validating outputs before making decisions that affect individuals.

EthicsGlobal does not use Customer Data, report content or personal data to train general-purpose artificial-intelligence models. AI providers, use limits, residency and applicable controls are subject to the Order, the DPA and the enabled configuration. This prohibition does not prevent the production of aggregated metrics or irreversibly anonymized information under clause 20.

24. Confidentiality

Each Party will protect nonpublic information received from the other using no less than reasonable care, use it only to perform the agreement, and disclose it only to persons who need to know and are subject to equivalent obligations. Information is not confidential if it becomes public without breach, was already lawfully known, is lawfully obtained from a third party, or is independently developed.

A Party may disclose information when required by a competent authority, seeking—where legally permitted—to provide advance notice and limit the disclosure. The obligation survives during the term and for two years afterward; Customer Data, personal data and trade secrets are protected for the longer period required by law or by their nature.

25. Intellectual property and deliverables

EthicsGlobal and its licensors retain all rights in the Platform, code, models, interfaces, trademarks, methodologies, templates, base content, documentation, improvements and know-how. The Customer retains its Data and pre-existing materials. No provision transfers ownership unless expressly agreed in writing.

Unless the Order states otherwise, specific deliverables are licensed to the Customer, once paid, for internal, non-exclusive and non-transferable use; EthicsGlobal retains reusable tools, components, knowledge and underlying materials. Custom software or integrations are governed by the license and ownership terms in the Order. Feedback or suggestions may be used to improve the Services without identifying the Customer or disclosing its confidential information.

26. Warranties and disclaimers

EthicsGlobal will perform the Services with reasonable professional care and will endeavor to have the Platform operate substantially in accordance with the applicable documentation. If the Customer reports a reproducible nonconformity, the primary remedy will be to correct it, reperform the affected Service or, if that is not reasonably possible, terminate that portion and refund the corresponding unearned prepaid amount.

Except for express warranties and mandatory law, the Services are provided “as is” and as available. EthicsGlobal does not warrant that they will be uninterrupted or entirely error-free; that any channel will receive a particular number or quality of reports; that third-party information is accurate; or that use alone ensures regulatory compliance or business, employment, legal or reputational outcomes.

27. Limitation of liability

Except for willful misconduct, gross negligence, liabilities that cannot legally be limited, intellectual-property infringement attributable to EthicsGlobal, or breaches of confidentiality and personal data to the extent the law prohibits limitation, neither Party will be liable for indirect, special or punitive damages or for loss of opportunity, profit, business, reputation or data recoverable through reasonable backups.

EthicsGlobal’s aggregate liability arising from an Order will not exceed the amounts actually paid by the Customer for the affected portion during the 12 months preceding the event giving rise to the claim. If the Service had been provided for less than 12 months, the amount actually paid will be used. This limitation reasonably allocates risk and applies to every permitted theory of liability.

EthicsGlobal is not liable for Customer decisions or omissions; false reports or third-party content; Customer instructions, data or configurations; interruptions of carriers or external services outside its reasonable control; or use contrary to the Order or documentation.

28. Indemnification

The Customer will defend and indemnify EthicsGlobal against third-party claims arising from its Data, instructions, report-related decisions, unlawful use, lack of legal basis, failure to provide notices or honor rights, or breach of these Terms. EthicsGlobal will defend the Customer against a claim that the standard Platform, when used in accordance with the agreement, infringes a third party’s intellectual property.

The indemnified Party will provide prompt notice, allow the other Party to control the defense and reasonably cooperate. No settlement may admit liability, impose obligations or affect the indemnified Party’s rights without its reasonable consent. Exclusions for Customer modifications, combinations or materials apply to the intellectual-property indemnity.

29. Suspension and termination

EthicsGlobal may suspend all or part of the Services for nonpayment; security risk; unlawful or abusive use; harm to third parties or infrastructure; serious breach of confidentiality, data or intellectual property; or an authority’s requirement. Where possible, it will provide notice of the reason and an opportunity to cure. In an emergency, it may act immediately.

Either Party may terminate for a material breach not cured within 30 calendar days after notice, insolvency or cessation of operations. EthicsGlobal may terminate immediately for fraud, criminal use, serious repeated breach or a third month in arrears. Termination does not eliminate accrued payments, and provisions that by their nature should continue will survive.

30. Data export, return and deletion

During the subscription, the Customer may use enabled export functions. Upon termination, it may request within 30 calendar days a reasonable export in a standard format, subject to verification, payment of outstanding amounts and charges for special services. After that period, EthicsGlobal may block, delete or anonymize Customer Data in accordance with the DPA, the Order, legal obligations and normal backup cycles.

Termination of an add-on or reduction of storage does not require EthicsGlobal to retain data exceeding the remaining capacity. The Customer is responsible for downloading required information and retaining its own legal or regulatory copies.

31. Compliance, anti-corruption and international trade

Each Party will comply with the laws applicable to its activities, including anti-corruption, sanctions, export controls, employment and data-protection laws. Neither Party will offer or accept bribes or improper payments. The Customer will not use the Services in a prohibited jurisdiction or for a prohibited person, or upload information whose export or international access is restricted, without disclosing and agreeing appropriate controls.

32. Force majeure

Neither Party will be liable for delay or failure caused by events outside its reasonable control, including disasters, conflicts, epidemics, widespread Internet or cloud failures, government action, or interruptions of telecommunications, energy or critical providers, provided that it gives notice where possible, mitigates and resumes performance. Force majeure does not eliminate accrued payment obligations.

33. Changes to the Terms and Services

EthicsGlobal may update these Terms for legal, security, technological, operational or service-model changes. Material changes will be notified through the website, portal or email and normally take effect at the next renewal or 30 days later, whichever is later. Urgent changes required by law or security may take effect immediately.

If an update materially reduces rights during a prepaid period, the Customer may object before it takes effect; the Parties will seek a solution and, if none is possible, the Customer may terminate the affected portion and receive a prorated refund of the unearned amount. Continued use or renewal after the effective date constitutes acceptance of the updated version.

34. Notices, assignment and relationship of the Parties

Notices may be sent to the registered email, address, portal or administrative account. The Customer will keep those details current. Operational communications are deemed received when posted in the portal or sent to the registered email; material-breach notices will be sent by a verifiable method.

The Customer may not assign the agreement without prior authorization. EthicsGlobal may assign it to an affiliate or successor in a merger, reorganization, asset sale or change of control, provided the assignee assumes the obligations. The Parties are independent contractors; no partnership, agency, representation, employment relationship or personnel supply arrangement exists.

35. Entire agreement, severability and no waiver

The contract documents constitute the entire agreement regarding the Order and replace previous proposals or communications concerning the same scope. If a provision is invalid, it will be adjusted only to the minimum extent necessary and the remaining provisions will continue. Failure to exercise a right is not a waiver. Headings assist reading and do not alter interpretation.

36. Language, governing law and jurisdiction

EthicsGlobal may provide Spanish, English and Portuguese versions. The translations are intended to be legally equivalent; if there is any discrepancy, the Spanish version prevails unless mandatory law requires otherwise or the Order expressly identifies a different governing language.

The agreement is governed by the federal laws of Mexico, without regard to conflict-of-laws rules. Before commencing litigation, the Parties will seek in good faith to resolve the dispute for 30 calendar days. If no resolution is reached, they submit to the competent courts of Mexico City and waive any other permitted venue.

37. Contact

Provider: ETHICSGLOBAL, S.A.P.I. DE C.V. · Address: Montecito 38, 42nd floor, office 17, Colonia Nápoles, Benito Juárez, Mexico City, Postal Code 03810, Mexico. Privacy: privacy@ethicsglobal.com. Sales, billing, cancellations and contractual notices: sales@ethicsglobal.com, without prejudice to the specific channel stated in the Order or portal. For support, the Customer must use the support channel or email stated in the Order or the current contact page.

Schedule A · Global Data Processing Agreement (DPA)

A1. Application, roles and duration

This DPA forms part of the Terms when EthicsGlobal processes Personal Data on behalf of the Customer to provide the Services. The Customer is the controller and EthicsGlobal is the processor, operator or service provider, except for limited processing in which each Party independently determines its own purposes.

Processing continues during service delivery and for the subsequent period necessary for return, backup, security, defense of rights and legal obligations. If there is a conflict concerning personal data, this DPA prevails over the Terms; the Order prevails only if it expressly identifies the data-protection amendment and complies with applicable law.

A2. Subject matter, nature and purposes

The subject matter is to host, receive, organize, transmit, retrieve, protect, back up, support and make Personal Data available through the Platform and subscribed services. The purposes are to operate channels and case files, administer users and subscriptions, provide support, carry out documented instructions, maintain security and continuity, and produce contracted deliverables.

The Order, the Customer’s lawful configuration and documented use of features constitute instructions. EthicsGlobal will inform the Customer if it considers that an instruction violates data-protection law, unless legally prohibited, and may suspend the affected operation while the matter is clarified.

A3. Data subjects and categories of data

Data subjects may include employees, former employees, candidates, contractors, suppliers, customers, representatives, reporters, persons named in reports, witnesses, affected persons, investigators, authorized users and third parties connected with a report, training, survey or service.

Data may include identification, contact details, employment or commercial relationship, account and authentication data, technical activity, opinions, communications, facts, case files, evidence and documents. Depending on the report, it may include sensitive data or special categories, health, biometric, union, ideological, financial or judicial data, data relating to alleged offenses, or other protected data. The Customer will limit collection to what is necessary.

A4. Customer obligations

The Customer will document purposes and legal bases; provide notices; respond to rights requests; configure access; ensure that its instructions are lawful; and refrain from uploading unnecessary or prohibited data. It will also determine retention, investigations, disclosures, decisions and the lawfulness of transfers it instructs.

A5. Authorized personnel and confidentiality

EthicsGlobal will limit access to authorized personnel who need the data for their duties, are subject to confidentiality and receive appropriate training. It will maintain least-privilege controls and revoke access when no longer required.

A6. Technical and organizational measures

EthicsGlobal will maintain measures proportionate to risk, such as identity and access management, authentication, logical segregation, logging and monitoring, encryption in transit and at rest where applicable, vulnerability management, backup, recovery, continuity, change and incident management, and provider assessment. The architecture may use AWS KMS and additional subscribed controls.

Measures may evolve to improve security provided they do not materially reduce the overall level of protection. Specific data-residency, RPO, RTO, backup-retention, Customer-key or certification parameters are binding only if stated in the Order or a technical schedule.

A7. Subprocessors

The Customer grants general authorization to use necessary subprocessors. EthicsGlobal will impose equivalent data-protection obligations and remain responsible to the Customer for their performance. It may maintain a list or categories of subprocessors on the website or provide them upon request.

Where required by law, EthicsGlobal will give notice of a material new subprocessor before it processes Personal Data. The Customer may object within 15 days for reasonable and documented data-protection grounds. The Parties will seek an alternative; if no reasonable solution exists, either Party may terminate only the affected Service.

A8. Transfers and international access

EthicsGlobal will process data in the agreed regions and may allow controlled remote access for support. If a restricted international transfer occurs, the Parties will use the applicable recognized mechanism, including adequacy decisions, standard contractual clauses, UK addenda, Brazilian clauses or safeguards, and supplementary measures.

Where necessary, the Parties will enter into or incorporate the controller-to-processor module of the current standard clauses and complete the technical annexes using the Order and this DPA. No reference creates a data-residency warranty different from the one expressly subscribed.

A9. Data-subject requests

EthicsGlobal will refer requests relating to Customer Data to the Customer and will not respond substantively unless instructed or legally required. It will provide reasonable assistance, taking into account the nature of processing and available features. The Customer will verify identity, apply exceptions and issue the response.

A10. Incidents

EthicsGlobal will notify the Customer without undue delay after confirming a Personal Data breach for which it is responsible. As information becomes available, the notice will include the nature, approximate categories and volume, contact, likely consequences, and measures taken or proposed. It may provide information in phases if everything cannot be provided at once.

The Customer determines and makes notifications to data subjects and authorities unless EthicsGlobal has a direct legal duty. Notice does not constitute an admission of liability.

A11. Assessments, consultations and audits

EthicsGlobal will provide information reasonably necessary to demonstrate compliance and assist with impact assessments or regulatory consultations related to the Services. The Customer will first use available documentation, questionnaires, reports or certifications.

With reasonable notice and no more than once a year—except after an incident or authority requirement—the Customer may audit the relevant scope through an independent auditor bound by confidentiality, without accessing other customers’ data or compromising security. The Customer bears extraordinary costs unless a material EthicsGlobal breach is confirmed.

A12. Return and deletion

Upon termination, EthicsGlobal will return or delete Personal Data in accordance with clause 30 and the Customer’s instruction, except where legally retained. Backup copies will be deleted through normal cycles and remain protected and outside active use until rotation.

A13. EthicsGlobal’s independent processing

EthicsGlobal may act as an independent controller for billing data, infrastructure security, fraud prevention, contracting evidence, legal compliance, defense of rights and its own business relationships. That processing is governed by /privacy and does not authorize the use of substantive report content for marketing.

A14. Mexico supplement

Where Mexico’s Federal Law on Protection of Personal Data Held by Private Parties applies, EthicsGlobal will act as processor following the controller’s instructions, maintain confidentiality, apply security measures and assist with rights of access, rectification, cancellation and objection. Domestic disclosures and transfers will be distinguished in accordance with the law and applicable notice.

A15. EEA, United Kingdom and Switzerland supplement

Where the GDPR, UK GDPR or equivalent Swiss law applies, this DPA is intended to cover the elements of a controller-processor contract: documented instructions, confidentiality, security, subprocessors, assistance with rights, assessments and incidents, return or deletion, and audits. The Customer will document legal basis, transparency and any transfer assessment.

A16. Brazil supplement

Where the LGPD applies, the Customer normally acts as controller and EthicsGlobal as operator processing under lawful instructions. The Parties will cooperate regarding rights, incidents, records, security, the data protection officer and international transfers in accordance with the LGPD and ANPD regulations.

Schedule B · Commercial rules for plans, add-ons and consumption

The following table explains how the commercial categories are interpreted. It does not replace the specific limits, prices or contents of the accepted Order.

Schedule C · Rules by Service type

These operating rules apply only to Services included in the Order and remain subordinate to the specific agreed scope.

Version 0.2 · August 29, 2026 · EthicsGlobal