Terms of Service

Assembley performs three functions:

• (a) Recording. The Services create Records of what occurred through the Services: votes as submitted, presence as registered, actions as performed, and the time at which each occurred.

• (b) Calculation. The Services perform arithmetic on those Records in accordance with the Configured Parameters supplied by the Customer, and present the results of that arithmetic.

• (c) Attestation. The Services produce tamper-evident material intended to make it detectable if a Record has been modified after it was created.

Assembley does not make Determinations.

The Services do not decide, and do not purport to decide:

• whether an Assembly is legally required;

• whether an Assembly was validly convened;

• whether notice requirements were satisfied;

• who is entitled to participate;

• who is entitled to vote, or with what weight;

• whether a proxy is valid;

• which voting threshold or majority rule applies;

• whether quorum has been validly established;

• whether a resolution has been validly adopted;

• whether an election complies with applicable law or constitutional documents; or

• whether any Assembly, vote, resolution or election is legally valid or legally effective.

• These are matters for the Customer, its governing bodies, its chair, and its legal advisers.

Because Assembley does not make Determinations:

• the Services present arithmetic and the Configured Parameters on which it was performed, rather than verdicts;

• where the Services identify a discrepancy between a Configured Parameter and the recorded position, they present it as a factual observation, not as a legal assessment (section 7);

• the result of an agenda item is recorded as an Outcome Declaration made by a human being, not as a conclusion reached by the Services (section 9);

• generated documents are drafts derived from Records, requiring review and adoption by the Customer (section 14); and

• Evidence Packages attest to the internal consistency of Records, and to nothing beyond that (section 11.3).

Assembley does not provide legal advice.

Information, workflows, templates, configuration options, default settings, guidance, help content and support communications made available through or in connection with the Services do not constitute legal advice, and do not constitute a Determination.

The Customer should obtain independent legal advice where appropriate.

Where any other provision of these Terms, any Documentation, any marketing material, or any statement made by or on behalf of Assembley could be read as a Determination or as a representation that the Services produce a Determination, this section 3 prevails.

Each Configured Parameter is the Customer's own declaration of its own rules. It is not a selection endorsed, verified or validated by Assembley.

When the Customer enters a majority requirement, a quorum definition, a notice period, a voting weight, a share class, an eligibility list or a ballot method, the Customer is stating what its articles of association, bylaws, statutes, shareholder agreements, membership rules or applicable law require. Assembley records that statement and calculates in accordance with it.

The Customer is responsible for configuring each Assembly correctly, including:

• identifying eligible Participants;

• entering or importing participant data;

• assigning voting rights and voting weights;

• configuring agenda items and ballot methods;

• configuring quorum definitions, including the basis on which quorum is measured;

• configuring majority requirements, including the treatment of abstentions and blank votes;

• configuring notice periods and proxy arrangements;

• setting voting periods;

• reviewing the configuration before the Assembly opens; and

• reviewing Records and Calculations before relying on them.

Assembley is not responsible for the consequences of a Configured Parameter that does not reflect the Customer's actual requirements.

Where the Services present Calculations, they also present the Configured Parameters on which the Calculation was performed. The Customer is responsible for verifying that those parameters are correct.

The Services may identify discrepancies between a Configured Parameter and the recorded position — for example, that the interval between the recorded dispatch of notice and the scheduled date of the Assembly is shorter than the configured notice period, or that recorded presence is below a configured quorum requirement.

Such observations are factual statements about the Records. They are not legal assessments, and they are not Determinations.

The Services do not prevent an Assembly from proceeding on the basis of such an observation, because refusing to proceed would itself constitute a Determination.

Where an observation is presented, the Services may require an Authorised User to acknowledge it before proceeding. The acknowledgement, including the identity of the acknowledging user, the time of acknowledgement and the observation acknowledged, is recorded as a Record and forms part of the Attestation material.

The absence of an observation does not indicate that an Assembly, a configuration or a process is lawful, valid or sufficient. The Services observe only what the Configured Parameters and the Records permit them to observe.

The Services provide technical mechanisms intended to support reliable and auditable recording of votes. These may include access controls, voting controls, weighted and split voting, duplicate-submission prevention, presence registration, timestamping, activity logs, hash chains, Merkle roots and Evidence Packages.

The Services record votes as submitted through the Services. A Record establishes that a submission was received through the Services at a given time using given credentials. It does not establish that the submission was made by a particular natural person, that the person was entitled to vote, or that the vote is valid. See section 12.

The Services calculate totals from the Records in accordance with the Configured Parameters and present those totals together with the parameters applied.

The treatment of abstentions and blank votes, the basis on which quorum is measured (including whether it is measured by registered presence or by votes cast, and whether by capital or by voting rights), and the majority requirement applied are Configured Parameters declared by the Customer under section 5. Assembley does not determine which treatment is correct for the Customer.

The Customer is responsible for reviewing Records and Calculations before relying on them for any purpose.

If the Customer believes that recording or calculation has been affected by a technical error, the Customer shall notify Assembley as soon as reasonably possible and, where possible, before relying on the affected material. Assembley will investigate reported technical issues in accordance with its support procedures and section 41.

Where the Services support non-attributed ballots, the Customer may configure an agenda item so that the Services do not store the association between an individual Participant and that Participant's voting choice.

The availability of this functionality depends on the applicable plan and is described in the Documentation. Where it is not available or not enabled, votes are recorded in attributed form.

Anonymity is a property of the circumstances of a ballot, not a property that software can guarantee.

The Customer acknowledges that, irrespective of how the Services store or do not store data:

• an individual's voting choice may be inferable from an aggregate result, particularly where the number of voters is small or voting weights are unevenly distributed;

• proxy arrangements, presence records and turnout figures may permit inferences;

• information held outside the Services may permit inferences; and

• incorrect configuration may result in votes being recorded in attributed form.

Assembley does not represent that a third party cannot infer an individual's voting preference. Assembley's undertaking is limited to the storage behaviour described in the Documentation for the functionality actually enabled.

The Services create Records documenting the history of an Assembly, which may include timestamps, administrative actions, participant actions, submitted votes, configuration changes, access events, acknowledgements under section 7.2, Outcome Declarations, hashes and chain data.

Certain Records are designed to be append-only and tamper-evident. Modification or deletion of such a Record is detectable and will render the associated Attestation material inconsistent.

The design makes modification detectable; it does not make modification impossible.

An Evidence Package demonstrates that the Records held by Assembley for an Assembly are internally consistent and have not been modified since they were created.

An Evidence Package does not demonstrate:

• that votes were cast by the persons entitled to cast them;

• that Participants were correctly identified or authenticated;

• that the Assembly was validly convened;

• that quorum, thresholds or majority requirements were correctly derived from the Customer's constitutional documents or from law;

• that a resolution or election is valid, effective or binding; or

• that any document produced by the Customer accurately reflects the Assembly.

Assembley makes no representation as to whether an Evidence Package will be accepted as evidence by any court, authority or tribunal. Admissibility and evidential weight are determined by the relevant forum.

Records are retained in accordance with section 19. The Customer instructs Assembley to maintain Records in append-only form for the retention period stated there, and acknowledges that this constitutes a documented limitation on deletion, applied for the purpose of preserving evidence and the integrity of records relating to legal claims.

Where the Customer requires assistance from Assembley in connection with a dispute, investigation or proceeding – including verification of an Evidence Package, explanation of Attestation mechanisms, or written or oral statements – such assistance is provided, if at all, subject to separate written agreement and at Assembley's applicable rates. Assembley is under no obligation to provide such assistance except as required by law.

Unless a plan expressly includes electronic identification, the Services verify control of an access credential – such as an email address, a link, a meeting code or a one-time code. They do not verify the identity of a natural person.

A Record establishes that a submission was made using a given credential at a given time. It does not establish who used that credential.

The Customer is responsible for determining what level of assurance its Assembly requires, for selecting the corresponding configuration, for the accuracy of the contact details to which credentials are sent, and for the consequences of a credential being forwarded, shared or intercepted.

Where electronic identification functionality (such as MitID or comparable schemes) is described in the Documentation as available on the Customer's plan and is enabled by the Customer, the assurance provided is that of the relevant scheme. Functionality not described in the Documentation as currently available does not form part of the Services, irrespective of any statement in a roadmap, presentation, proposal or other communication.

As between Assembley and the Customer, the Customer retains all rights, title and interest in Customer Data. Nothing in these Terms transfers ownership of Customer Data to Assembley.

The Customer grants Assembley a limited, non-exclusive right to host, copy, transmit, process and otherwise use Customer Data solely to provide, maintain and secure the Services, provide support, comply with the Customer's instructions, prevent fraud and abuse, comply with applicable law, and perform the applicable agreement.

The Customer represents and warrants that it has all necessary rights and permissions to provide Customer Data to Assembley, that the collection and use of Customer Data is lawful, that required privacy notices have been provided to Participants, that an appropriate legal basis exists for the processing, that its instructions to Assembley are lawful, and that Customer Data does not violate applicable law or third-party rights.

The Services are designed to operate on a minimal set of participant data. Except as provided below, the Customer shall not submit to the Services personal data that is not necessary for the conduct of the Assembly, and in particular shall not submit special categories of personal data within the meaning of Article 9(1) GDPR, personal data relating to criminal convictions and offences, national identification numbers or payment card data.

Where the Customer is an association, trade union, religious community, political party or similar body whose purpose is itself of a nature referred to in Article 9(1) GDPR, the fact of membership may constitute special category data. Such membership data may be submitted to the Services, and the Customer instructs Assembley to process it, on condition that the Customer relies on Article 9(2)(d) GDPR or another applicable exception under Article 9(2), does not submit further special category data beyond what follows from membership itself, and applies appropriate access restrictions within the Services. Section 6.2 of the DPA governs this processing.

Any other submission of the categories of data referred to above requires the express written agreement of Assembley.

Assembley may, without liability to the Customer, decline to process, or require the removal of, Customer Data submitted in breach of this section.

For personal data relating to Participants, shareholders, members, votes, presence and Assembly conduct, the Customer is the data controller and Assembley is the data processor.

For personal data relating to Account registration, billing, security and access logs, service administration, support correspondence and direct marketing to its own contacts, Assembley is an independent data controller. Such processing is described in the Assembley Privacy Policy.

The Data Processing Agreement ("DPA") available at assembley.co/dpa is incorporated into these Terms and is concluded between the parties on acceptance of these Terms, without further action. No separate signature is required, and no Customer is without a DPA. It governs Assembley’s processing as a processor, including the roles and scope of processing (DPA sections 3 to 5), special categories of personal data (section 6), confidentiality (section 8), security measures (section 9 and Annex II), sub-processors (section 10 and Annex III), retention, deletion and the limits of erasure (section 11), assistance with data subject rights (section 12), personal data breaches (section 13), information and audit (section 15), international transfers (section 16), and the description of the processing set out in Annex I.

Where the Customer requires an individually negotiated data processing agreement, it may be agreed in an Order or separate signed agreement. In matters of data protection, the DPA prevails over these Terms.

The Customer's instructions to Assembley are those set out in these Terms, the DPA, the Order and the configuration made by the Customer through the Services.

The Customer acknowledges that the append-only design described in section 11 means that certain Records cannot be deleted or altered without destroying the integrity of the associated Attestation material, and that Assembley retains such Records for the period set out in section 19 on the Customer’s instruction and for the purpose of establishing, exercising or defending legal claims within the meaning of Article 17(3)(e) GDPR.

The Customer is responsible for informing Participants of this in the privacy information the Customer provides to them.

You must provide accurate, current and complete information when creating an Account, and keep it reasonably up to date.

You are responsible for maintaining the confidentiality of authentication credentials, for using appropriate security practices, for preventing unauthorised access to your Account, and for notifying Assembley promptly at security@assembley.co of any suspected unauthorised access.

You must not share authentication credentials in a manner that permits unauthorised persons to access the Services.

The Customer is responsible for activity performed through its Accounts by its Authorised Users, except to the extent caused by Assembley's breach of these Terms or applicable law.

Organisation administrators may have extensive permissions, including creating Assemblies, uploading participant data, modifying configuration, inviting Participants, assigning roles, recording Outcome Declarations, and accessing Records and Evidence Packages.

The Customer is responsible for selecting appropriate administrators and for restricting administrative access to authorised individuals.

Assembley and its licensors retain all rights, title and interest in the Assembley software, source code, object code, interfaces, architecture, databases and database structures, documentation, trademarks, logos, designs, workflows, algorithms, security and cryptographic implementations, evidence-generation technology, know-how and other intellectual property used to provide the Services.

Except for the limited rights expressly granted under these Terms, no rights are transferred to the Customer.

Subject to payment of applicable fees and compliance with these Terms, Assembley grants the Customer a limited, non-exclusive, non-transferable and non-sublicensable right to access and use the Services during the applicable Subscription Term for the Customer's internal business or organisational purposes.

The Customer retains all rights in its own materials, including documents uploaded to the Services and documents generated from its Records under section 14, and may use, reproduce and distribute them without restriction by Assembley.

The Customer shall pay the fees specified in the applicable Order or published pricing. Fees may depend on subscription plan, participant or voter limits, functionality, organisation size or other commercial parameters.

Fees are exclusive of VAT and applicable taxes unless expressly stated otherwise. The Customer is responsible for applicable taxes other than taxes imposed on Assembley's income.

Prices are shown exclusive of VAT. VAT is calculated and added at checkout. Danish VAT is charged unless the Customer is established in another EU Member State and provides a VAT identification number validated in the VIES system, in which case the reverse charge mechanism applies and the Customer accounts for the VAT. Where the Customer is established outside the EU, VAT is charged or not charged in accordance with the applicable place-of-supply rules.

The Customer shall provide accurate and complete billing details, including its legal name, address and any VAT identification number, and shall keep them up to date. The Customer bears the consequences of inaccurate billing details, including any VAT subsequently charged.

Where fees are invoiced, invoices are payable within the period specified on the applicable invoice or Order. If no period is specified, invoices are payable within 14 days.

One Meeting Purchases and Annual Subscriptions are paid at the time of purchase by card, including card wallets such as Apple Pay and Google Pay, through Stripe Checkout. The Customer must complete any authentication required by its card issuer, and a renewal may fail if authentication is not completed. An Annual Subscription is charged to the same payment method on each renewal unless it has been cancelled under section 38.1.

If payment is overdue, Assembley may charge interest in accordance with the Danish Interest Act (renteloven) and reasonable collection costs to the extent permitted by applicable law.

If fees remain unpaid after reasonable notice, Assembley may suspend access to the affected Services until payment is received. Where reasonably possible, Assembley will provide advance notice before suspending access.

A One Meeting Purchase is made for one Assembly identified at the time of purchase, for the number of Participants entitled to vote and the add-ons selected at that time. It covers that Assembly from the notice convening it until the Assembly is closed, including the Records, generated documents and Evidence Packages produced for it.

A One Meeting Purchase is used when the first of the following occurs: the notice convening the Assembly is sent through the Services, or the Assembly is opened for participation or voting. Once used, it cannot be transferred to another Assembly.

A One Meeting Purchase that has not been used does not expire while the Customer's Account remains open. If the Account is closed by the Customer, any unused One Meeting Purchase lapses without refund. If the Account is closed by Assembley under section 30, or the Services or the plan are discontinued, section 28.8 applies. On request, Assembley will transfer an unused One Meeting Purchase to another Assembly of the same Customer, within the limits for which it was purchased. An Assembly that is adjourned, or re-convened on the same agenda within three months, is the same Assembly.

The price of a One Meeting Purchase is fixed when it is paid. A Test Assembly does not use a One Meeting Purchase. The Customer retains access to the Records and Evidence Packages of the Assembly for as long as they are retained under section 19(b), and to generated documents for as long as they are retained under section 19(a).

An Annual Subscription runs for 12 months from the date of payment and renews in accordance with section 38.1. The fee for each Subscription Term is payable in advance. Where the price of an Annual Subscription is shown as a monthly amount, the full annual fee is stated before payment and is charged in advance for the whole Subscription Term.

An upgrade during a Subscription Term, including an increase in the number of Participants entitled to vote or the addition of an add-on, takes effect when the fee for the remainder of the Subscription Term, calculated pro rata, has been paid. A downgrade takes effect from the next renewal date.

If a renewal payment fails, the Annual Subscription becomes past due and the payment is retried automatically. The Customer is notified by email of each failed payment and of any authentication required. If all retries fail, the Annual Subscription is cancelled, the renewal fee ceases to be payable, and the Customer's organisation reverts to the Free plan. Records, generated documents and Evidence Packages already produced remain available under section 19. The Customer is responsible for keeping a valid payment method on file, in particular ahead of a scheduled Assembly.

Fees for One Meeting Purchases and Annual Subscriptions are non-refundable. No refund is given where a One Meeting Purchase is not used, where an Assembly is cancelled, postponed or conducted by other means, where fewer Participants take part than the number purchased, or where an Annual Subscription is cancelled or not used during its Subscription Term.

This section does not apply where the Customer terminates under section 38.3 for Assembley's breach, or where Assembley terminates or discontinues the Services or the relevant plan other than for the Customer's breach; in those cases an unused One Meeting Purchase is refunded in full and an Annual Subscription pro rata. This section does not limit sections 41.3, 43 and 54 of these Terms, section 10.3 of the DPA, section 40 or mandatory law.

Card payments are processed by a third-party payment service provider, currently Stripe. Payment card details are submitted directly to the payment service provider and are not received or stored by Assembley. By making a purchase, the Customer authorises Assembley, through the payment service provider, to charge the selected payment method for the fees due, including on each renewal of an Annual Subscription.

Receipts and invoices are issued electronically and made available in the Services or sent to the Customer's billing email address. An order confirmation is sent by email once the purchase has been registered.

Prices are stated exclusive of VAT in euro on the English-language website and in Danish kroner on the Danish-language website. The currency of the Customer's first purchase applies to all later purchases and renewals unless Assembley agrees otherwise.

Assembley aims to provide a reliable and secure service. The Services are provided over the internet and may be unavailable from time to time. Assembley does not undertake that the Services will be uninterrupted or error-free unless an applicable Service Level Agreement expressly provides otherwise.

Assembley may perform planned maintenance, upgrades and other changes. Where reasonably practicable, advance notice will be given of material maintenance expected to affect availability.

Emergency maintenance may be performed without advance notice where reasonably necessary to protect security, address vulnerabilities, prevent data loss, comply with law, or maintain the integrity of the Services.

The Customer shall not rely on the Services as its sole means of conducting an Assembly.

The Customer is responsible for determining whether it requires backup communication channels, alternative voting procedures, contingency meeting arrangements, alternative means of contacting Participants, or other business continuity measures, and for putting them in place before the Assembly.

The Customer bears the risk of interruption to an Assembly arising from unavailability of the Services, of the internet, of Third-Party Services or of Participants' own systems, subject to section 44.3.

Assembley implements technical and organisational measures designed to protect the Services and Customer Data. The measures in force are described in the DPA and in the security documentation referred to there, and may include encryption in transit and at rest, role-based access controls, database access controls, authentication controls, monitoring and logging, vulnerability management, secure development practices and incident response procedures.

Assembley describes the measures it applies. Assembley does not represent that the Services or any data are secure against all forms of attack, unauthorised access or compromise. No internet-based service can be.

The Customer is responsible for the security of its own systems, devices, Accounts and credentials, and for the security practices of its Authorised Users and Participants.

Suspected vulnerabilities should be reported to security@assembley.co. Testing conducted in accordance with the responsible disclosure process published at assembley.co/security does not breach section 23.

The Subscription Term is specified in the Order or subscription. Unless otherwise stated, subscriptions renew automatically for successive periods equal to the initial Subscription Term.

Assembley will send, or arrange for its payment service provider to send, a renewal reminder to the Customer's billing email address at least 30 days before the renewal date. The Customer may cancel an Annual Subscription at any time before the renewal date, in the billing settings of the Services or by notice to Assembley; the Annual Subscription then ends at the end of the current Subscription Term. For any other subscription, either party may prevent renewal by giving notice no later than 30 days before the end of the current Subscription Term, and Assembley may prevent renewal of an Annual Subscription in the same way.

The Customer may terminate its subscription in accordance with the applicable Order. Unless otherwise agreed or required by law, termination does not entitle the Customer to a refund of prepaid fees for the unused portion of a Subscription Term. Section 28.8 applies.

Either party may terminate if the other materially breaches these Terms and fails to remedy the breach within 30 days after written notice. A shorter period may apply where the breach cannot reasonably be remedied or where immediate termination is permitted by law.

Either party may terminate, to the extent permitted by applicable law, if the other becomes insolvent, enters liquidation, ceases substantially all business activities or becomes subject to comparable insolvency proceedings.

During an applicable paid Subscription Term, Assembley warrants that:

• (a) Recording – Records will reflect the data submitted through the Services at the time of submission;

• (b) Calculation – Calculations will be arithmetically correct given the Records and the Configured Parameters applied;

• (c) Attestation – Attestation mechanisms will operate as described in the Documentation, such that modification of a Record after its creation renders the associated Attestation material inconsistent; and

• (d) Care – the Services will be provided with reasonable care and skill and will materially conform to the Documentation.

Assembley gives no warranty as to the correctness, sufficiency, lawfulness or validity of any Configured Parameter, any Determination, any Assembly, any Outcome Declaration, or any document adopted by the Customer. These are outside Assembley's function as described in section 3.

The warranties in section 41.1 do not apply to failures caused by incorrect or incomplete configuration or Customer Data, Customer misuse, unauthorised modifications, Third-Party Services outside Assembley's reasonable control, force majeure, internet or telecommunications failures, free plans, trials, Test Assemblies or beta functionality, or other circumstances outside Assembley's reasonable control.

The Customer's exclusive remedies for breach of section 41.1 are, in order:

• (a) Correction – Assembley will correct the non-conformity within a reasonable period;

• (b) Credit – if correction is not achieved within a reasonable period, a proportionate credit against fees for the affected period;

• (c) Termination – if the non-conformity is material and remains uncorrected, termination of the affected Services with a pro-rata refund of prepaid fees for the unused portion of the Subscription Term,

together with damages subject to sections 44 and 45.

Except as expressly stated in section 41.1 and to the maximum extent permitted by applicable law, the Services are provided without further warranties, express or implied.

In particular, Assembley does not warrant that the Services will be uninterrupted or error-free, that any Assembly will comply with applicable law, that any governance decision will be valid, that any election will not be challenged, that any Participant will be able to access the Services, that any message will be delivered, that any Third-Party Service will remain available, or that the Services will satisfy any Customer-specific requirement.

To the maximum extent permitted by applicable Danish law, neither party is liable to the other for indirect loss, consequential loss, loss of anticipated savings, loss of goodwill or reputation, loss of business opportunity, or loss of profits, except where such exclusion is prohibited by mandatory law.

To the maximum extent permitted by applicable law, Assembley's aggregate liability arising out of or relating to the Services or these Terms shall not exceed the greater of:

• (a) the total fees paid by the Customer to Assembley during the 12 months preceding the event giving rise to the claim; or

• (b) DKK 10,000.

Where the claim arises before 12 months of fees have been paid, the first limb is calculated on the fees paid or payable for the applicable initial Subscription Term.

The parties may agree a different cap in an Order or separately signed agreement.

Nothing in these Terms limits liability to the extent such limitation is prohibited by mandatory law, and in particular nothing limits liability for death or personal injury caused by negligence, wilful misconduct, gross negligence, fraud or fraudulent misrepresentation, or any other liability that cannot lawfully be excluded or limited.

Section 44.2 applies to claims between the parties arising from data protection matters, including claims for recourse under Article 82(5) GDPR.

Nothing in these Terms affects the rights of a data subject to bring a claim against either party under Article 82 GDPR, and nothing in these Terms purports to limit such a claim.

Each party bears its own administrative fines imposed on it under Article 83 GDPR, except to the extent the fine results from the other party's breach of these Terms, the DPA or applicable law, in which case recourse is subject to section 44.2.

The Customer acknowledges that the fees for the Services reflect the allocation of risk in these Terms, and in particular the function described in section 3 and the responsibilities allocated to the Customer in sections 5, 12, 13, 22, 24 and 31.3.