Sentiora OÜ (Registry Code: 17522027, Registered Address: Ahtri tn 12, Kesklinna linnaosa, Tallinn 15551, Estonia), trading as Project Risk Manager (“PRM“, “we”, “us” or “our”), provides a hosted software-as-a-service platform for project risk management, governance, and project control (the “Service“). These Terms and Conditions (“Terms“) govern access to and use of the Service by any organisation that registers for a subscription (“Subscriber“, “you” or “your”) and by the individual users it authorises to access its account (“Users“).
By creating an account, clicking “I agree”, or otherwise accessing or using the Service, you confirm that you have the authority to bind the Subscriber to these Terms and that the Subscriber accepts them. If you do not agree, you must not use the Service.
1. Definitions
- “Account” means the Subscriber’s registered organisation account on the Service, together with the individual User accounts created under it.
- “Content” means any data, text, files, attachments and other material that a Subscriber or its Users submit to, or generate within, the Service, including project and risk records, mitigation actions and uploaded attachments.
- “Order” means the subscription plan, seat count, term, and fees selected by the Subscriber at sign-up or agreed via a separate order form.
- “Personal Information” has the meaning given in our Privacy Policy and includes any information relating to an identified or identifiable individual processed through the Service.
- “Privacy Policy” means our privacy policy published at https://project-risk-manager.com/privacy-policy/, as updated from time to time, which is incorporated into these Terms by reference.
- “Sub-processor” means a third-party service provider engaged by us to process Personal Information in connection with the Service, as listed in Clause 9.
2. The Service
PRM is a closed, invitation-only platform. Subscriber Accounts are created by an organisation administrator, who invites Users and assigns each of them one of the following roles: Organisation Owner, Project Owner, Risk Owner, or Guest. Access to project and risk data is scoped to the Subscriber’s organisation and further restricted by role; Users can generally see only the projects and risks they are entitled to see.
We may add, change, or discontinue features of the Service from time to time. We will use reasonable efforts to give advance notice of any change that materially reduces the core functionality of the Service.
3. Eligibility and Registration
The Service is intended for business and organisational use. By registering, the Subscriber represents that:
- It has the authority to enter into these Terms on behalf of the organisation it represents;
- The information it provides at registration, and at any time thereafter, is accurate and will be kept up to date; and
- It will ensure that each User it invites is authorised to access the Service on the Subscriber’s behalf and complies with these Terms.
Each User account is for the use of the named individual only and may not be shared. The Subscriber is responsible for all activity that occurs under its Account, including that of every User it invites, and for promptly removing Users who no longer require access (for example, on a person leaving the organisation or project).
4. Subscription, Fees, and Payment
Access to the Service is provided on a subscription basis, on the plan, seat count, and term set out in the applicable Order. Fees are payable in advance for the applicable billing period unless otherwise agreed in writing.
All online payments are processed by Stripe, our third-party payment processor. We do not receive, transmit or store card or bank details; these are held only by Stripe. We can read back limited subscription metadata from Stripe, such as subscription status, seat quantity, and trial end date, in order to administer the Account.
Unless otherwise stated in the Order, subscriptions renew automatically for successive periods equal to the expiring term, at our then-current fees, unless either party gives notice of non-renewal before the end of the then-current term. We may change our fees on renewal by giving the Subscriber at least 30 days’ notice.
Fees are exclusive of any applicable taxes, levies or duties, which the Subscriber is responsible for in addition to the fees, except for taxes based on our net income. Except as expressly stated in these Terms or required by law, fees are non-refundable.
5. Acceptable Use
The Subscriber and its Users must not, and must not permit any third party to:
- Use the Service in violation of any applicable law, including privacy, data protection, and export control laws;
- Upload or submit Content that is unlawful, infringing, defamatory, or that the Subscriber does not have the right to submit;
- Attempt to gain unauthorised access to the Service, other Subscribers’ data, or the systems or networks supporting the Service;
- Reverse engineer, decompile, or attempt to derive the source code of the Service, except to the extent this restriction is prohibited by applicable law;
- Use the Service to build a competing product, or resell, sublicense or make the Service available to any third party otherwise than as contemplated by these Terms; or
- Introduce any virus, malware or other harmful code to the Service.
Free-text fields (such as risk titles, descriptions, notes, and metadata fields) and uploaded attachments are entered by Users at their own discretion. The Subscriber is responsible for ensuring that Content entered into the Service, including any Personal Information about third parties that Users choose to include in free-text fields or attachments, is entered lawfully and only to the extent necessary for the Subscriber’s project risk management purposes.
6. Content and Intellectual Property
As between the parties, the Subscriber retains all rights, title, and interest in and to its Content. The Subscriber grants us a non-exclusive, worldwide licence to host, copy, transmit, display, and otherwise process its Content solely as necessary to provide, support, and improve the Service, and as otherwise permitted under these Terms and our Privacy Policy.
We and our licensors retain all rights, title, and interest in and to the Service itself, including its software, design, trademarks, and documentation. Except for the limited right to access and use the Service granted under these Terms, no rights are transferred to the Subscriber or any User.
Subject to Clause 9, we will not access, use or disclose Subscriber Content except: to provide and support the Service (including troubleshooting, which may require access to production data to resolve a fault); as instructed by the Subscriber; where aggregated and de-identified so that it does not identify the Subscriber or any individual; or as required by law.
7. Confidentiality
Each party may receive information from the other that is designated as confidential or that would reasonably be understood to be confidential given the nature of the information and the circumstances of disclosure (“Confidential Information”). Each party will use the other’s Confidential Information only to exercise its rights and perform its obligations under these Terms and will protect it using at least the same degree of care it uses for its own confidential information of similar nature, and no less than reasonable care. This clause does not apply to information that is, or becomes, public other than through breach of these Terms, was already known to the receiving party without an obligation of confidentiality, or is required to be disclosed by law, provided the disclosing party is given reasonable notice where legally permitted.
8. Data Protection and Privacy
We process Personal Information submitted to the Service in accordance with our Privacy Policy, available at https://project-risk-manager.com/privacy-policy/, which forms part of these Terms. In summary:
- Personal Information processed through the Service principally comprises User account and identity data (name and email address, and an optional profile photo), role and project-assignment data, an authorship trail of actions taken in the Service, technical and security data (such as authentication session data, IP address, and device and browser identifiers), and any Personal Information that Users choose to include within free-text fields or uploaded attachments.
- Where a User opts in, we also collect limited product-analytics, session-recording, and in-app feedback data; the Service is fully functional without this, and it is never collected unless the individual actively opts in.
- We retain Account data for as long as the Subscriber remains subscribed to the Service. If a subscription expires and is not renewed, the associated data is automatically deleted 90 days after expiry. A Subscriber may request deletion of its Account and associated data at any time.
- Data is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256) and is continuously backed up. The Service is multi-tenant: Subscriber data is logically, not physically, separated from that of other Subscribers, with every organisation-scoped record carrying an organisation identifier and access checked against the requesting User’s active membership of that organisation before data is returned.
The Subscriber is responsible for ensuring it has an appropriate lawful basis, and, where applicable under laws such as the EU/UK GDPR or Australian Privacy Act 1988 (Cth), that it has given any Users and other individuals whose Personal Information is entered into the Service appropriate notice of the collection and disclosure described in this Clause 8 and our Privacy Policy, including of the overseas storage and disclosures described in Clause 9. Where the Subscriber requires a separate data processing agreement to support its own regulatory obligations, it should contact us at the details in Clause 17.
9. Sub-processors and International Data Transfers
We engage the following Sub-processors to support the Service. Personal Information may accordingly be stored and processed outside the Subscriber’s own country, including in the United Kingdom, the United States, the Netherlands and Australia, as set out below:
- AWS (United Kingdom) — Application hosting, primary database and file storage; necessary for the Service.
- Clerk (United States) — Authentication, session management, and invitation emails; necessary for the Service.
- Stripe (United States) — Payment processing; necessary for the Service; card and bank details are held only by Stripe.
- SuprSend (United States) — Notification delivery (e.g., due and overdue mitigation-action alerts); necessary for the Service.
- Mixpanel (Netherlands) — Product analytics and session recording; optional, and used only for Users who opt in.
- Userback (Australia) — In-app feedback collection; optional, and used only for Users who opt in.
We may update this list of Sub-processors from time to time, including to add or replace providers, and will keep the current list available on request. We remain responsible for each Sub-processor’s compliance with the confidentiality and security commitments in these Terms and our Privacy Policy.
10. Security
We maintain administrative, technical, and physical safeguards designed to protect the confidentiality, integrity and availability of Subscriber Content, including the encryption, backup, access-control and multi-tenant isolation measures described in Clause 8. No method of transmission or storage is completely secure; the Subscriber acknowledges that it uses the Service on this basis and remains responsible for maintaining the confidentiality of its Users’ login credentials.
If we become aware of a security incident affecting Subscriber Content, we will notify the Subscriber without undue delay and provide reasonably requested information to help the Subscriber meet its own notification obligations, where applicable.
11. Access, Correction, and Individual Rights
Users can view and update their own name and avatar directly within the Service. Changes to role, project assignment, risk ownership or organisation membership can only be made by an Organisation Owner or Project Owner for the relevant Subscriber. Requests from individuals for access to, or correction of, Personal Information held about them (including a full copy of information such as the authorship trail, notification history or analytics data) may be made via our website contact page or the in-app Feedback button, or through the Subscriber’s own Organisation Owner. We aim to respond to such requests within 48 hours of receipt.
We recommend that Subscribers conduct a periodic review of User access and risk ownership as part of their own onboarding and offboarding processes, to help ensure that accounts and role assignments remain accurate and current.
12. Service Availability and Support
We will use commercially reasonable efforts to make the Service available and to provide support for reported issues, but we do not guarantee uninterrupted or error-free operation. The Service may be unavailable from time to time for scheduled maintenance, emergency maintenance, or reasons outside our reasonable control.
13. Suspension and Termination
Either party may terminate these Terms for the Subscriber’s convenience at the end of the then-current subscription term by giving notice in accordance with Clause 4. We may suspend or terminate access to the Service immediately if: fees are overdue and remain unpaid after reasonable notice; the Subscriber or a User materially breaches these Terms, including the Acceptable Use provisions in Clause 5, and (where the breach is capable of remedy) fails to remedy it within a reasonable period after notice; or we reasonably believe suspension is necessary to prevent harm to the Service, other Subscribers, or any person.
On termination or expiry, the Subscriber’s right to access the Service ends. Subscriber Content will be retained and then deleted in accordance with the retention periods described in Clause 8, unless a longer period is required by law.
14. Disclaimer of Warranties
To the maximum extent permitted by applicable law, the Service is provided “as is” and “as available”, without warranties of any kind, whether express, implied or statutory, including any implied warranties of merchantability, fitness for a particular purpose, or non-infringement. Nothing in this Clause 14 is intended to exclude, restrict or modify any consumer guarantee, right or remedy conferred on the Subscriber by applicable law (including individual country or regional Consumer Law) that cannot lawfully be excluded, restricted or modified.
15. Limitation of Liability
To the maximum extent permitted by applicable law, neither party will be liable to the other for any indirect, incidental, special, consequential or punitive damages, or for any loss of profits, revenue, data or goodwill, arising out of or relating to these Terms or the Service, even if advised of the possibility of such damages.
To the maximum extent permitted by applicable law, each party’s total aggregate liability arising out of or relating to these Terms will not exceed the total fees paid or payable by the Subscriber to us in the 12 months immediately preceding the event giving rise to the claim. This limitation does not apply to a party’s liability for death or personal injury caused by its negligence, fraud, or any liability that cannot lawfully be limited or excluded.
16. Governing Law and Disputes
These Terms are governed by the laws of Estonia, without regard to its conflict-of-laws principles, and the parties submit to the exclusive jurisdiction of the courts of Estonia, save that nothing in this Clause 16 limits any mandatory right the Subscriber may have to bring proceedings in its own jurisdiction under applicable consumer or privacy law that cannot be contracted out of.
17. Changes to these Terms; Contact
We may update these Terms from time to time, for example to reflect changes to the Service, our Sub-processors, or applicable law. We will provide reasonable advance notice of material changes (for example, by email or an in-app notice) before they take effect. Continued use of the Service after a change takes effect constitutes acceptance of the updated Terms.
Questions about these Terms, or requests relating to Personal Information, can be sent to us via our website contact page, or via the in-app Feedback button. Registered office: Sentiora OÜ, Ahtri tn 12, Kesklinna linnaosa, Tallinn 15551, Estonia (registry code 17522027).
18. General
- Entire agreement: These Terms, together with the Order and the Privacy Policy, constitute the entire agreement between the parties regarding the Service and supersede any prior agreements on the same subject.
- Severability: If any provision of these Terms is held unenforceable, the remaining provisions remain in full force and effect.
- Assignment: The Subscriber may not assign these Terms without our prior written consent, except to a successor in connection with a merger, acquisition or sale of substantially all its assets. We may assign these Terms in connection with a similar transaction.
- Force majeure: Neither party is liable for delay or failure to perform caused by circumstances beyond its reasonable control.
- No waiver: A failure to enforce any provision of these Terms is not a waiver of that or any other provision.