Corbiere platform terms and conditions

1.1These Terms and Conditions (the “Terms”) govern access to and use of Corbiere, a data subject access request management platform (the “Platform”) operated by Comtech Solutions Limited, a company incorporated in Jersey under the Companies (Jersey) Law 1991 with registered number 101874 and registered office at 9 Hope Street, St Helier, Jersey (“Comtech”, “we”, “us”).

1.2The Platform is provided to business customers only. By creating an organisation account, accepting an invitation issued under an organisation account, or otherwise using the Platform, the organisation on whose behalf the account is operated (the “Customer”) agrees to these Terms. The individual accepting these Terms warrants that they have authority to bind the Customer. The Platform is not offered to consumers, and nothing in these Terms grants rights to any individual acting outside a business, professional or public function.

1.3These Terms comprise the main body (clauses 1 to 17), the Data Processing Terms at Schedule 1, the Processing Particulars at Schedule 2 and the Approved Sub-processors list at Schedule 3 (together, the “Agreement”). If there is a conflict, Schedule 1 prevails over the main body in respect of the Processing of Case Content, and the main body prevails otherwise.

2.1In this Agreement: “Account Data” means personal data relating to the Customer’s Users and billing contacts that Comtech processes as controller, as described in the Corbiere Privacy Notice; “AI Feature” means the optional artificial-intelligence assistance feature described in clause 6; “Case” means a data subject request record created in the Platform by or for the Customer; “Case Allowance” means the maximum number of Cases that may be created under the Customer’s Plan in the relevant Plan Year, as stated on the Platform’s pricing page or in the applicable order; “Case Credit” means a credit entitling the Customer to create one additional Case, purchased under clause 7.3 or as a Single Case Purchase; “Case Content” means the content of Cases, including requester details, identity documents, uploaded evidence, review decisions, redactions, correspondence and disclosure bundles; “Data Protection Law” means the Data Protection (Jersey) Law 2018 (“DPJL 2018”) and, to the extent applicable to the Processing concerned, the Data Protection (Bailiwick of Guernsey) Law, 2017, the UK GDPR and Data Protection Act 2018, and the EU GDPR, in each case as amended; “Fees” means the subscription and any other charges for the Platform; “Plan” means the subscription tier selected by the Customer, which determines the features, Case Allowance, number of permitted Users and other limits applicable to the Customer’s use of the Platform; “Plan Year” means each successive period of 12 months from the date the Customer’s subscription commences (or its anniversary), to which the Case Allowance applies regardless of whether Fees are billed monthly or annually; “Single Case Purchase” means a one-time purchase of a single Case Credit without a subscription, as described in clause 7.6; “Processing”, “controller”, “processor”, “personal data”, “data subject” and “personal data breach” have the meanings given in the DPJL 2018; “Users” means the individuals the Customer authorises to access its organisation account.

3.1Subject to payment of the Fees and compliance with this Agreement, Comtech grants the Customer a non-exclusive, non-transferable right for its Users to access and use the Platform during the Term, within the features, Case Allowance and other limits of the Customer’s Plan, for the purpose of managing data subject requests in the course of the Customer’s business, including where the Customer is a professional adviser managing requests on behalf of its own clients.

3.2Comtech will provide the Platform with reasonable skill and care and will use reasonable endeavours to make it available continuously, save for planned maintenance and circumstances beyond Comtech’s reasonable control. The Platform is provided on a software-as-a-service basis; Comtech may improve or modify features from time to time provided the core functionality of the Platform is not materially reduced during a paid subscription period.

3.3The Customer acknowledges that the Platform is a tool that supports the Customer’s own compliance processes. Comtech does not provide legal advice, and use of the Platform does not of itself discharge the Customer’s obligations under Data Protection Law, including its duty to respond to data subject requests within the statutory period.

4.1The Customer is responsible for its Users, for maintaining the accuracy of its account information, and for all activity under its organisation account. The Customer shall not exceed the number of Users permitted by its Plan and shall ensure that each User keeps their credentials confidential, completes the sign-in verification steps required by the Platform, and does not share accounts, including to circumvent Plan User limits.

4.2The Customer shall promptly disable Users who no longer require access, using the administrative functions provided, and shall notify Comtech without undue delay at dpo@comtech-solutions.co.uk if it suspects unauthorised access to its account.

4.3The Customer shall not, and shall ensure its Users do not: use the Platform for any unlawful purpose; upload material that infringes third-party rights or contains malicious code; attempt to access another organisation’s data or circumvent the Platform’s tenant isolation, authentication or other security controls; resell or provide access to the Platform to third parties except to its own clients’ matters as contemplated by clause 3.1; or use the Platform to store data not reasonably related to the management of data subject requests.

5.1The parties acknowledge that, in respect of Case Content, the Customer (or, where the Customer is a professional adviser acting for a client, that client) is the controller, and Comtech is a processor acting on the Customer’s documented instructions. Schedule 1 applies to that Processing and is entered into pursuant to Article 19(2) of the DPJL 2018.

5.2Where the Customer uses the Platform on behalf of a client, the Customer warrants that it is authorised by the relevant controller to instruct Comtech in respect of the Processing of that controller’s Case Content, and the Customer shall be responsible to Comtech for the acts and omissions of that controller as if they were its own.

5.3In respect of Account Data, Comtech is an independent controller and shall process such data in accordance with Data Protection Law and the Corbiere Privacy Notice. Nothing in Schedule 1 applies to Account Data.

5.4Each party shall comply with Data Protection Law in respect of its own obligations arising from this Agreement. The Customer is solely responsible for the lawfulness of the Case Content it processes on the Platform, including establishing a lawful basis, providing transparency information to data subjects, verifying requester identity decisions, applying exemptions, and setting and operating retention periods for Case Content. The Customer acknowledges that the Platform provides deletion functions but does not apply an automatic retention schedule to Case Content.

6.1The AI Feature is disabled by default and operates only where the Customer’s administrator expressly enables it for the Customer’s organisation. Where it is not enabled, no Case Content is transmitted to any artificial-intelligence provider. The Customer may also disable the AI Feature for any individual Case, with a reason recorded in the audit trail, whatever the organisation-level setting says.

6.2Where the AI Feature is enabled, the Customer’s administrator selects one of four model-and-region configurations offered by the Platform: Claude Sonnet 4.5 on Amazon Bedrock in the EU (Ireland), provided by Amazon Web Services EMEA SARL; Claude Sonnet 4.5 on the direct Anthropic API, provided by Anthropic, PBC and processed in the United States; or GPT-4.1 on the Azure OpenAI Service in UK South or EU (Sweden Central), provided by the Microsoft contracting entity on the Customer’s Azure agreement. Anthropic does not offer a European or United Kingdom regional endpoint for Claude, and Comtech makes no representation that it does. No other configuration is reachable from the Platform. Comtech shall send AI requests only to the configuration so selected and shall not route them to another provider or region for capacity, failover or load balancing. The residency, subprocessor, transfer, retention and onward-transfer position for each configuration is set out in the AI data residency and subprocessor policy published at corbiere-data.com/ai-residency, which forms part of this Agreement.

6.3Only the passage or document the User is working on, together with the instruction for the relevant feature, is transmitted through Comtech’s server-side proxy to the selected provider as a sub-processor. Whole Case files are not uploaded to the provider, vault credentials are never transmitted, and material marked out of scope is excluded. No broker, router, evaluation, benchmarking or analytics service receives prompts or responses, and under the Azure configurations OpenAI receives no data because the model runs within Microsoft’s own tenancy.

6.4Retention by the AI provider differs by configuration and is not zero in every case. Under the Amazon Bedrock configuration, prompts and outputs are not stored after the response is returned and Bedrock model invocation logging is not enabled. Under the direct Anthropic configuration, inputs and outputs are deleted within 30 days by default; zero data retention is a separate agreement between the Customer and Anthropic, is available only for eligible products, and is subject to Anthropic’s own carve-outs, including retention of prompts and outputs for certain covered models and longer retention of content flagged by trust and safety processes. Under the Azure configurations, prompts and generated content are stored for up to 30 days for abuse monitoring and flagged content may be reviewed by authorised Microsoft staff, unless Microsoft has approved modified abuse monitoring for the resource. Under no configuration is submitted data used to train a model. The Platform does not store AI prompts or responses; it records only usage metadata (model, region, User, organisation and timestamp) for metering and accountability, retained for 24 months.

6.5AI-generated output is suggestive only. The Customer shall ensure that a human reviewer assesses any AI output before it influences a decision about a data subject and acknowledges that responsibility for decisions on Cases rests entirely with the Customer. Enabling the AI Feature, and selecting a configuration, constitutes the Customer’s documented instruction to engage the provider named against that configuration as a sub-processor for its organisation. The Customer remains responsible for satisfying itself that the region it selects is lawful for its own transfers under the Data Protection Law applicable to it, and for recording that assessment.

6.6Each change of model or region is available only to an administrator and is written to the audit trail with the person, time, previous value and new value. Comtech shall give notice of any change to the list of available configurations in accordance with paragraph 7 of Schedule 1.

6.7The AI Feature is subject to fair-use limits to protect the integrity and cost of the service, currently a rate limit of 5 requests per minute per organisation and a default cap of 25 requests per User per day, or such other limits as are stated for the Customer’s Plan. Comtech may vary these limits on reasonable notice and may throttle or temporarily suspend the AI Feature where usage materially exceeds them or degrades the service for other customers. Exceeding a fair-use limit pauses the AI Feature until the limit resets; it does not affect access to the rest of the Platform.

7.1Fees are determined by the Customer’s Plan and are as set out in the applicable order or the Platform’s pricing page at the point of subscription or renewal, are stated in pounds sterling, are exclusive of GST or other applicable taxes, and are payable in advance (monthly or annually, as selected) by the payment methods supported by the Platform. Payments are processed by Stripe; Comtech does not receive or store card numbers.

7.2Each Plan includes a Case Allowance for each Plan Year and a maximum number of Users, each as stated on the pricing page. The Case Allowance applies per Plan Year even where Fees are billed monthly. Unused Case Allowance and unused Case Credits do not roll over into a subsequent Plan Year. Case Credits purchased under clause 7.3 remain valid for 6 months from purchase. Comtech shall not delete or suspend access to existing Cases, or to export functions, by reason only of a Case Allowance being exhausted or a Plan’s User limit being reached.

7.3When the Customer’s Case Allowance for a Plan Year is exhausted, the Customer may create further Cases by purchasing additional Case Credits at the per-case rate applicable to its Plan as stated on the pricing page, or by upgrading its Plan. Case Credit purchases are payable at the point of purchase.

7.4The Customer may upgrade its Plan at any time, with the change taking effect immediately and the subscription Fees prorated for the remainder of the current billing period. Downgrades take effect from the start of the next billing period, and the Customer is responsible for ensuring its usage, including its number of active Users, fits within the lower Plan’s limits from that date.

7.5Subscriptions renew automatically for successive billing periods unless cancelled before renewal. Except where this Agreement expressly provides for a refund (including paragraph 7 of Schedule 1 and clause 14.1), Fees and Case Credits are non-refundable and cancellation takes effect from the end of the current billing period, during which the Platform remains available.

7.6A Single Case Purchase provides one Case Credit and access to the Platform for the management of that Case only, without a subscription and without automatic renewal. Access under a Single Case Purchase continues until the earlier of the closure of the Case and 12 months from purchase, followed by the export wind-down period in clause 13.4. These Terms, including Schedule 1, apply to a Single Case Purchase as if references to the Term were to that access period, and clause 7.5 (non-refundability) applies from the point the Case is created.

7.7Comtech may revise Fees, Case Credit rates or Plan limits on not less than 30 days’ notice, taking effect from the next renewal (or, for Case Credit rates, for purchases made after the notice period). If undisputed Fees remain unpaid 21 days after they fall due, Comtech may suspend access on 7 days’ further notice until payment is made.

8.1Comtech and its licensors own all intellectual property rights in the Platform. No rights are granted to the Customer other than the right of use in clause 3.1.

8.2The Customer and its clients retain all rights in Case Content. The Customer grants Comtech a non-exclusive licence to host, transmit, display and otherwise process Case Content solely as necessary to provide the Platform in accordance with this Agreement.

8.3Comtech may use aggregated, anonymised usage statistics that do not identify any individual, the Customer or any Case for the purpose of operating and improving the Platform. For the avoidance of doubt, Comtech shall not use Case Content to develop or train artificial-intelligence models.

9.1Each party shall keep confidential all non-public information received from the other in connection with this Agreement, use it only to perform this Agreement, and disclose it only to personnel and advisers who need it and are bound by duties of confidence, or where disclosure is required by law or a competent authority. This clause survives termination for 5 years, and indefinitely for Case Content.

10.1Comtech shall implement and maintain appropriate technical and organisational measures to protect personal data on the Platform as required by Article 21 of the DPJL 2018, including the measures described in paragraph 5 of Schedule 1. The Customer acknowledges that the Platform is architected so that Comtech personnel have no application-level means of reading Case Content, and that certain protections (including User credential hygiene, second-factor enrolment, permission assignment and retention operation) depend on the Customer’s own administration.

11.1Each party warrants that it has the power and authority to enter into this Agreement. Comtech warrants that the Platform will perform materially as described in its documentation. Except as expressly stated in this Agreement, all other warranties, conditions and terms implied by law are excluded to the fullest extent permitted by Jersey law.

11.2Comtech does not warrant that the Platform will be uninterrupted or error-free, nor that use of the Platform will ensure the Customer’s compliance with Data Protection Law or any other law.

12.1Nothing in this Agreement excludes or limits either party’s liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any other liability that cannot be excluded or limited under Jersey law. Nothing in this Agreement excludes or limits any liability of either party to data subjects or to the Data Protection Authority under the DPJL 2018, nor affects any right of contribution between the parties in respect of such liability.

12.2Subject to clause 12.1, neither party shall be liable for loss of profits, loss of business, loss of anticipated savings, or any indirect or consequential loss.

12.3Subject to clauses 12.1 and 12.2, each party’s total aggregate liability arising out of or in connection with this Agreement in any 12-month period shall not exceed the greater of £10,000 and 125% of the Fees paid or payable by the Customer in that period.

12.4The Customer shall indemnify Comtech against losses arising from claims that Case Content uploaded by the Customer infringes third-party rights or was processed on the Platform without a lawful basis or necessary authority, except to the extent caused by Comtech’s breach of this Agreement.

13.1This Agreement commences when the Customer’s organisation account is created and continues until terminated in accordance with this clause (the “Term”).

13.2Comtech may suspend access immediately where reasonably necessary to protect the security or integrity of the Platform or other customers’ data, or where required by law, giving notice as soon as practicable.

13.3Either party may terminate on notice with effect from the end of the current subscription period, and either party may terminate immediately on written notice if the other commits a material breach that is not remedied within 30 days of notice, or becomes insolvent, is declared en désastre, or enters any analogous procedure in any jurisdiction.

13.4On termination or expiry, the Customer may export Case Content using the Platform’s export functions during a wind-down period of 30 days, after which paragraph 10 of Schedule 1 (deletion) applies. Clauses which by their nature should survive termination, including clauses 8, 9, 12 and 16, shall survive.

14.1Comtech may amend these Terms by giving the Customer not less than 30 days’ notice by email or in-Platform notice. Amendments take effect from the next renewal, except amendments required by law or necessary for security, which may take effect sooner. If an amendment materially disadvantages the Customer, the Customer may terminate at the end of the notice period without penalty. Changes to Schedule 3 are governed by paragraph 7 of Schedule 1, not this clause.

15.1Notices under this Agreement shall be in writing and sent, in the case of the Customer, to the administrator email address on the account and, in the case of Comtech, to dpo@comtech-solutions.co.uk or its registered office. Notices sent by email are deemed received on the next business day in Jersey.

16.1This Agreement constitutes the entire agreement between the parties in relation to the Platform and supersedes all prior arrangements. Neither party has relied on any statement not set out in this Agreement, provided that nothing limits liability for fraudulent misrepresentation. The Customer may not assign this Agreement without Comtech’s prior written consent, not to be unreasonably withheld; Comtech may assign to an affiliate or in connection with a transfer of the business. No failure to exercise a right is a waiver of it. If any provision is found invalid, the remainder continues in force. A person who is not a party has no right to enforce any term of this Agreement. Nothing in this Agreement creates a partnership or agency between the parties.

17.1This Agreement and any non-contractual obligations arising out of or in connection with it are governed by the law of Jersey, and the parties submit to the exclusive jurisdiction of the courts of Jersey, save that Comtech may seek injunctive relief in any court of competent jurisdiction to protect its intellectual property or the security of the Platform.