Purpose and scope

These Terms of Use govern access to and use of the website aurisk.io and the self-assessment platform aurisk.streamlit.app, owned by Marc Sabater i Pérez (see Legal Notice). Use of the Site and the Platform implies full acceptance of these terms.

Description of the service

Aurisk offers an AI-guided self-assessment platform against various certification standards. Users can register, activate the plan(s) corresponding to the certifications they are interested in, and progress through the controls of each standard by providing documentary evidence, which is assessed using artificial intelligence. Upon completing the assessment, the user may request to be put in contact with Aurisk Consulting for an official audit, subject to its own commercial terms.

User registration

Access to certain features requires registration using an email address and password. The user is responsible for the accuracy of the information provided and for safeguarding their login credentials.

Proper use of the Platform

The user agrees to use the Platform diligently and not to submit unlawful or offensive content, or content that infringes the rights of third parties, and not to take any action that could damage, disable or overload the Platform, or prevent its normal use by other users.

Guidance-only nature of results

Assessment results generated by the Platform are guidance in nature and do not constitute an official certification. Aurisk is not an accredited certification body. Obtaining an official certification requires an independent audit carried out in accordance with the requirements of the relevant scheme.

Plans and pricing

The pricing terms for the various available plans are published on the «Pricing» section of the Site and may be changed. Any change to the terms of a plan already activated by a user will be communicated to them with reasonable notice.

Intellectual property

All content, features and elements of the Platform are the property of the owner or of third-party licensors, and their use is limited to what is strictly necessary to use the service under these terms.

Data protection

The processing of personal data provided by the user is governed by the Site’s Privacy Policy.

Changes to these terms

These Terms of Use may be amended. Amendments will be published on this same page and, where they affect registered users, will be notified by email.

Governing law

These terms are governed by Spanish law, on the same terms set out in the Legal Notice.

---

DATA PROCESSING ADDENDUM

When an organization uses the Platform and uploads evidence containing personal data belonging to third parties (for example, its own employees or customers) for assessment against the controls of a certification standard, Aurisk acts as the data processor for that data under Article 28 of Regulation (EU) 2016/679 (GDPR), with the user organization acting as the data controller.

In such cases, upon onboarding as a client, a Data Processing Agreement (DPA) is formalized with the organization, covering, among other matters:

• Subject matter, duration, nature and purpose of the processing.
• Type of personal data and categories of data subjects affected.
• Processor obligations: confidentiality, implementation of technical and organizational security measures, no sub-processing without authorization, and assistance to the controller in responding to data subject rights requests and managing any potential security incidents.
• Handling of data and evidence once the service relationship ends.
• Making available to the controller the information necessary to demonstrate compliance with these obligations.

If your organization needs to formalize this agreement, you can request it by writing to info@aurisk.io with your company name and the plan you are subscribed to.