Terms of Service

1. Who we are and who may use the service

These Terms of Service (Terms) govern the website at sanctionskit.com, its public directories and tools, and the SanctionsKit dashboard, application programming interface (API), screening, monitoring, evidence, and related services that refer to these Terms (together, the Services). The provider is SanctionsKit, LLC (SanctionsKit, we, us, or our). The effective date of this version is October 1, 2026.

Customer, you, and your mean the business or other organization entering the agreement, or the individual acting in a business or professional capacity if no organization is represented. Authorized Users are individuals the Customer permits to use its account. The Services are intended for business and professional use, rather than personal, family, or household purchases. Authorized Users must be at least 18 and have legal capacity to enter an agreement.

You agree to these Terms when you affirmatively accept them, place an order that incorporates them, or use the Services after being presented with these Terms and notice that the use constitutes acceptance, to the extent that acceptance is recognized by applicable law. A person acting for an organization represents that they have authority to bind it. If you lack that authority or do not agree, do not activate or use an organizational account. Merely appearing in a source record does not make a person a Customer or bind them to these Terms.

2. Orders and the documents that apply

An Order is the plan, price, billing interval, service scope, and other commercial details accepted at checkout or in an order form agreed by both parties. An account alone does not purchase a paid subscription. Free live screening access is subject to the allowance below. A successful checkout redirect alone does not establish payment or a paid subscription; the subscription must be confirmed by the billing service. A separate written agreement signed by both parties may replace or modify these Terms.

If applicable documents conflict, mandatory law and the rights granted by an independent source or open-source licence take precedence within their scope. An executed data processing agreement (DPA), including any applicable transfer terms, controls personal-data processing within its scope. Next, an Order or other signed agreement controls where it expressly changes these Terms; otherwise these Terms control. Purchase-order boilerplate does not change the agreement unless we expressly accept it in writing.

Our Privacy Policy explains personal-data handling. The coverage directory, source-specific notices, and documentation describe current capabilities and operational limits. They do not create an uptime guarantee, a promise that a particular source will remain available, or additional fees. A DPA, service-level agreement, regulated-outsourcing addendum, or residency commitment applies only if actually agreed; this page does not represent that one has already been executed.

3. Accounts, administrators, and security

Provide accurate account, organization, billing, and contact information and keep it current. You control which people and integrations may act for your organization. Your administrators may manage membership, roles, API keys, retention, and other settings within their permissions. An Authorized User should not expect information placed in an organizational workspace to be private from that organization’s authorized administrators and reviewers.

You are responsible for your Authorized Users and integrations, their compliance with these Terms, and activity you authorize through them. Use individual logins, limit privileges, protect API keys and webhook secrets, and remove access when it is no longer appropriate. Do not put production keys in public code, browser applications, request URLs, or logs. Tell us promptly if you discover compromised credentials or unauthorized account access, and revoke affected keys where possible.

We may verify your identity, organization, authority, and eligibility where reasonably needed to administer or secure the Services. You are responsible for your devices, connectivity, application integration, and exported records. Your responsibility for credentials does not excuse a security failure caused by our breach of the agreement or duties imposed on us by law.

4. Service scope, coverage, and human review

The Services compare submitted subjects against selected available sources and provide potential matches, recorded evidence, and review tools. Depending on the source, information may concern sanctions, restrictions, exclusions, enforcement, public office, or other published matters. A source’s presence in a catalog does not mean it is available in your plan, active for screening, complete for a jurisdiction, or suitable for your purpose. Review the selected coverage and its limitations before relying on a result.

A match score expresses matching signals under the applicable policy; it is not a probability of guilt, an identity certification, or a legal risk rating. Shared names, missing identifiers, transliteration, source errors, delayed updates, historical records, and changes in status can cause incorrect or incomplete results. Public office or political exposure does not itself imply sanctions, wrongdoing, or a prohibition on doing business. Allegations, warnings, proceedings, and final determinations must be distinguished using the original source and its context.

A no-match result means no match was returned under the selected sources, versions, input, and matching rules at that time. It does not establish that a person or transaction is lawful or unrestricted. The Services reject unavailable required coverage rather than silently treating a partial check as complete. You must handle failures and warnings as incomplete work and verify that monitoring, rescreens, and notifications are operating for your intended workflow.

You are responsible for selecting appropriate coverage, confirming identity and current source status, investigating uncertain results, determining applicable legal duties, and making and documenting your decisions. Do not make a decision with legal or similarly significant effects on an individual solely from a score, automated result, or evidence summary. The Services do not replace counsel, independent due diligence, beneficial-ownership investigation, or a complete sanctions, anti-money-laundering, or other compliance program. No regulatory approval, guaranteed compliance, or universal coverage is promised.

Monitoring checks retained subjects through the available monitoring workflow; it is not a guarantee of continuous or immediate detection. It depends on active access, eligible sources, successful jobs, sufficient allowance, and delivery configuration. The public demonstration and sandbox use synthetic information and must not be treated as production screening evidence. Future features and proposed sources are not part of an Order unless expressly agreed.

5. Evidence summaries

Eligible retained results include automatic evidence summaries composed from recorded matching signals, conflicts, and coverage limitations. Summary availability follows retained evidence and review permissions. The summary may present selected examples and does not replace the full screening result or original source records.

A summary can omit relevant facts or lack context that matters to your review. Check each material statement against the cited underlying evidence. The output does not establish identity, authorize a transaction, or make a final case or business decision. You remain responsible for human review and any required explanation, notice, or opportunity to challenge a decision.

The Privacy Policy describes the information used for evidence summaries. Summaries do not recover expired or unretained inputs. The rights in source records continue to apply when those records are referenced in a summary.

6. Source information, licences, and non-affiliation

SanctionsKit, LLC is an independent service provider. SanctionsKit is not affiliated with, sponsored by, endorsed by, or an agent of data source websites, their operators, government agencies, regulators, or the organizations whose records we reference, unless an express statement specifically identifies such a relationship. A link, attribution, name, logo, or source record is for identification and does not establish such a relationship.

Source information may be public-domain material, openly licensed material, or material subject to other conditions. Follow the source-specific attribution, licence, permitted-use, correction, and change notices accompanying the data or linked from its source page. We do not claim ownership of underlying public facts or grant rights beyond those we hold. You must assess the rights needed for your own use and onward disclosure.

Independent source licences control the material they cover. Nothing in these Terms, including restrictions on copying, redistribution, competing services, or termination of access, restricts rights granted directly by those licences or by law. Do not remove required attribution or impose additional restrictions where the applicable licence prohibits them. Open licensing does not eliminate privacy, confidentiality, accuracy, or other applicable legal obligations.

The Camera dei deputati source adaptation, including SanctionsKit normalization of names, dates, and mandate relationships in the relevant source data, is offered under Creative Commons Attribution-ShareAlike 4.0. Preserve the Camera dei deputati attribution, source and licence links, and notices of changes. ShareAlike applies to distributed adaptations as provided in that licence. It does not by itself apply that licence to independent sources, Customer Data, screening decisions, or the SanctionsKit application.

Consult original publisher records for authoritative context, amendments, withdrawals, and current legal effect. Notify us of a suspected source error or outdated record using the source link and a concise explanation. We may correct, restrict, or remove information to reflect source changes, rights, or legal obligations. We do not control a publisher’s website or promise to alter its original records.

7. Permitted use and prohibited conduct

During your authorized access, you may use the Services and documented API within your Order and limits for lawful business screening, review, and related internal workflows, including work you are authorized to perform for your clients. You may share individual reports with authorized colleagues, advisers, regulators, and relevant clients where you have a lawful basis and the source terms permit it. You remain responsible for that disclosure and for preserving context, licence notices, and access controls. Selling access to the Services or operating a general-purpose resale screening service requires a separate agreement; independently licensed source rights remain unaffected.

Do not use the Services to violate sanctions, export-control, privacy, anti-discrimination, or other applicable law; evade a legal restriction; target or harass people; publish unsupported allegations; impersonate another person; or collect personal information for unsolicited marketing. Do not submit malware, exploit another tenant’s data, bypass authentication or usage limits, probe systems without authorization, overload the Services, or conceal abusive activity behind multiple accounts.

Do not use our proprietary software, account access, or non-public documentation to create an unauthorized substitute service, reverse engineer our software except where applicable law permits it, or remove our proprietary notices. This restriction does not prevent lawful interoperability work, use of documented APIs, legitimate criticism, or exercise of independent source and open-source licence rights.

The Services are not offered as a consumer-reporting service under the U.S. Fair Credit Reporting Act (FCRA). You must not use the Services or results to determine an individual’s eligibility for credit, insurance, employment, housing, or another purpose that would require a consumer report under the FCRA or analogous law. A contractual label does not change legal obligations arising from actual use. Contact us before proposing a use that requires regulated reporting, special licensing, or safeguards beyond the Services as offered.

You may not access or supply the Services where doing so is prohibited by applicable sanctions or export-control law, and may not make them available to a prohibited recipient. Legitimately screening the name of a restricted party for compliance purposes is different from providing that party access. Each party remains responsible for the restrictions applicable to its own conduct.

8. Customer Data, privacy, and processing instructions

Customer Data means the information you or your Authorized Users submit to your workspace or API, including screening subjects, identifiers, uploads, monitoring instructions, case notes, decisions, and other customer-created records. Customer Data excludes independently obtained source information and our software. You retain your rights in Customer Data. You grant us a non-exclusive, limited right to host, copy, transmit, process, and display it only as needed to provide and secure the Services, follow your authorized instructions, meet our legal obligations, and exercise the rights expressly stated in the agreement.

That permission extends to service providers acting for us within the same permitted purposes and applicable processing terms. It does not authorize us to sell Customer Data, publish your private screening activity, or use Customer Data to train general-purpose AI models. Subject to source and third-party rights, you may retain and use the reports and other output produced for you under the agreement. We do not claim ownership of your review decisions.

You are responsible for a lawful basis to collect, submit, screen, retain, and disclose Customer Data, for required notices and permissions, and for responding to individuals whose information you control. If you act for another controller, you must have authority for the instructions and any further processing involved. Do not assume that public availability removes these obligations or that consent is always the correct legal basis.

Submit only relevant and necessary information. Do not submit payment-card data, account passwords, unrelated medical information, biometric templates, or other sensitive material the Services do not request. If your intended processing requires a DPA, a transfer mechanism, special-category or criminal-record conditions, or industry-specific contractual safeguards, those arrangements must be established before that processing begins. A Privacy Policy or acceptance of these Terms alone does not replace a legally required processing agreement or transfer safeguard.

Each party will comply with the data-protection duties applicable to its role. For Customer Data processed on your behalf, your authorized use and settings provide operational instructions, subject to an applicable DPA. For our independent processing, including account administration and independently collected source information, see the Privacy Policy. We will notify affected Customers of a confirmed personal-data breach involving Customer Data without undue delay and provide information and cooperation required by applicable law and any applicable DPA. This does not imply a particular certification or security audit.

9. Confidentiality

Confidential Information is non-public information one party discloses to the other that is marked confidential or reasonably should be understood to be confidential, including Customer Data, credentials, security details, non-public business information, and non-public commercial terms. Information is not confidential to the extent the receiving party can demonstrate it was already lawfully known without restriction, becomes public without breach, is received lawfully from another source without a duty of confidence, or is independently developed without using the disclosing party’s information.

Each party will use the other’s Confidential Information only to perform the agreement or exercise its rights under it, protect it with at least reasonable care, and disclose it only to people and service providers who need to know and are bound by appropriate confidentiality obligations. A party may disclose information when legally compelled, but will, where legally permitted, give prompt notice and reasonable assistance to seek protection, and disclose only what the requirement calls for.

On termination or a reasonable request, a receiving party will return or delete Confidential Information that is no longer needed, subject to the retention terms below, an applicable DPA, and legitimate legal or recordkeeping requirements. Retained information remains protected. These duties apply during the agreement and continue for three years after its termination, and for trade secrets and protected personal data for as long as they remain protected under applicable law.

10. Fees, billing, and taxes

A new signup receives 250 free completed live screenings for its first eligible workspace. This is one lifetime allowance, shared across its members, API and dashboard. It does not expire or reset each month. No credit card is needed. Joining an existing workspace shares its remaining allowance and does not add another grant. Free access does not automatically become a paid plan or incur a subscription charge. New live checks stop when the allowance is used unless another valid entitlement applies. Saved evidence remains subject to the applicable retention and access rules. Source availability and rights remain separate requirements.

The price, currency, billing interval, included allowance, and material plan limits are shown in your Order. Unless the Order says otherwise, subscription fees are charged in advance for each billing period, in U.S. dollars. Taxes are additional where applicable and disclosed at checkout or on an invoice. You are responsible for taxes on your purchase other than taxes on our net income, and for providing valid exemption or tax-identification information when relevant.

Self-service paid plans offer monthly or annual billing at the prices shown on pricing and confirmed in your Order. Annual subscriptions are billed for the full year in advance; a displayed monthly equivalent is a price comparison, not a monthly installment plan. Paid screening allowances reset monthly under either billing interval. Annual billing does not pool a year of screening allowance, and changing billing frequency does not replenish an already-used monthly allowance. The free lifetime allowance does not reset.

By approving a recurring subscription purchase, you authorize the payment processor to charge the payment method you provide for the agreed recurring fees and applicable taxes until cancellation takes effect. Keep a valid payment method and billing details on file. Stripe processes payments and provides the customer billing portal. Additional terms displayed by the payment provider govern your use of its payment functionality; they do not remove our obligations under your Order.

Plan changes may produce a prorated charge or credit and an immediate invoice, as shown by the billing portal before confirmation. An annual-to-monthly change within the same plan can be scheduled for the end of the paid period. Changes between Starter, Growth, and Scale may take effect immediately, including a change to a lower plan. Review the amount and effective date shown before accepting a change; a proration credit is not an automatic cash refund. Unused paid-plan allowances do not roll over or have a cash value unless your Order expressly provides otherwise. We do not automatically charge for overages: work is limited by your plan allowance and configured subject cap.

Report a suspected billing error promptly to support@sanctionskit.com, preferably within 30 days of the charge, with the invoice reference and explanation. Do not send complete payment-card details. We will investigate a good-faith dispute and correct verified errors; this requested reporting period does not waive non-waivable rights. Undisputed charges remain payable. An inactive or unpaid subscription may prevent production screening while payment is resolved.

11. Renewals, cancellation, and refunds

Unless your Order expressly states otherwise, a paid subscription automatically renews for successive periods of the same duration at the agreed recurring price until cancelled. The default self-service billing interval is monthly; annual billing applies when selected and accepted in your Order. Monthly subscriptions renew monthly and annual subscriptions renew annually. Cancel before the next renewal to prevent the next subscription charge.

An authorized account administrator can cancel in the customer billing portal reached through dashboard billing. If the portal is unavailable or you need assistance, send a cancellation request to support@sanctionskit.com before renewal, identifying your organization and account email. We will verify authority as necessary and process the request using the time it was received, so our processing delay does not create an additional renewal obligation. Keep the cancellation confirmation or request for your records.

Ordinary cancellation takes effect at the end of the current paid billing period. You may continue using the paid Services during that period within the agreement and available allowance. Deleting an integration, revoking an API key, stopping monitoring, or ceasing to use the Services does not by itself cancel a subscription. Closing a workspace or requesting deletion should be coordinated with cancellation and any needed export.

Except where required by law, stated in your Order, or provided below, fees for a started billing period are non-refundable, and there are no partial-period refunds for ordinary cancellation or unused allowance. We will refund a verified duplicate or erroneous charge. If you terminate because of our uncured material breach, or we discontinue a paid Service or terminate your paid access for convenience before the paid period ends, we will refund prepaid fees attributable to the unused affected period. An agreed service remedy may also provide a refund. These exceptions do not depend on ordinary cancellation eligibility.

We will give at least 30 days’ advance notice by account email or a prominent account notice of an increase to a recurring subscription fee. The increase will apply no earlier than the next renewal after that notice period, unless you expressly agree otherwise. You may cancel before the increase takes effect. Any longer notice, consent, renewal reminder, or cancellation right required by applicable law will apply. A free demonstration or synthetic sandbox does not become a paid subscription without a separate authorized purchase.

12. Usage, evidence, and retention

Usage counts completed subjects, including individual screens, completed batch rows, and monitoring rescreens. Properly idempotent retries do not count twice, and failed rows or failed screens do not count as completed subjects. A new request is new usage even if it concerns the same subject. Accepted batch work may reserve allowance before completion. Sandbox usage is separate. See usage documentation for the applicable counters and limits.

You are responsible for choosing a retention policy that fits your legal and business needs. New workspaces default to 10 calendar years of standard evidence retention on every paid plan; existing workspaces keep their configured policy. Administrators can choose 1 to 10 calendar years or 1 to 3,650 days. Open standard review cases preserve still-available evidence until completion. The policy saved for the case begins its retention period at review completion, or requires a recorded relationship-end or business event; when both apply, the later event starts the period. This protection cannot restore previously expired information. Existing standalone screenings keep their recorded deadlines; available case evidence follows the case lifecycle under the workspace’s preserved policy.

Transient minimal retention is available only for individual API-key screenings when organization and policy controls do not require retained review, external checks, or an event-based retention trigger. Accepted minimal mode creates no review case. It omits the retained submitted subject and request and keeps reduced evidence for 24 hours. Dashboard screenings, batches, and monitoring use standard retention. The immediate response and copies you store may still contain submitted information. Monitoring requires retention of its subject; stopping monitoring does not automatically delete all prior results.

Your plan also has a private-file allowance, separate from completed screening counts. Private bulk screening uploads, supporting text attachments, and outstanding upload reservations count against it. Database screening evidence and external document links do not count toward it. New files are rejected at the allowance until capacity becomes available or an authorized plan upgrade increases it. No automatic storage overage charges apply, and reaching capacity does not shorten the retention of existing evidence. Separate self-service storage add-ons are not offered. See pricing for capacities and file limits.

Original PDFs, images, and passport scans are uploaded by your organization directly to its chosen document service and linked in SanctionsKit. We store the reference and reviewer assertions, not the original file, and do not upload, fetch, copy, or independently verify it. Your organization is responsible for the original’s access, security, and retention in that service. Adding a service or approving its HTTPS URL does not connect accounts, grant upload access, or establish the suitability of its security configuration.

Bulk screening uploads expire after 24 hours; supporting text attachments follow case evidence retention. Webhook delivery history expires after 90 days, and audit events after 365 days under the documented application policies. Eligible holds may extend still-available evidence to a date or until explicitly released; each hold and release has an attributed reason, and releasing one hold leaves other active holds in effect; they cannot restore expired records or information intentionally omitted by minimal retention. Case holds do not preserve originals in external document services. Source records and source versions follow their own rights and retention rules. More detail, including distinctions between record types, is in retention documentation and the Privacy Policy.

Export required evidence while it is available and maintain your own lawful records. We do not promise an indefinite archive, a recoverable copy of deleted inputs, or a post-termination export window. Contact us before closing an account if you need assistance retrieving still-available information. After access ends, applicable retention, deletion, and DPA requirements continue; billing records, limited security or audit information, and information subject to a legal hold may remain where justified. Provider backups expire under their own applicable schedules rather than immediate per-record erasure. Expired or deleted evidence may make historical replay impossible.

13. Intellectual property and feedback

We and our licensors retain rights in the Services’ software, interface, original documentation, branding, and other proprietary material. Subject to the agreement, you receive a limited, non-exclusive right to access and use those materials as needed for your authorized use during the term. Separate licences control any open-source software or independently licensed materials supplied with the Services. No right to use our trademarks or imply our endorsement is granted.

Customer Data, public-domain information, independently licensed source material, and rights in your own systems remain separate from our proprietary rights. Subject to those distinctions and applicable source conditions, you may retain exported reports after your subscription ends. Termination of account access does not revoke independent licence rights in material already lawfully obtained.

If you voluntarily provide product suggestions, you grant us permission to use them without payment or attribution to improve the Services. This permission does not transfer ownership of Customer Data or authorize disclosure of your Confidential Information. We will not use your name or logo as a customer endorsement without your permission.

14. Third-party services and links

The Services depend on providers for functions such as hosting, storage, authentication, billing, and messaging. Our use of providers does not relieve us of the obligations we owe under the agreement or applicable law. Provider processing is described in the Privacy Policy and any applicable DPA.

When you follow a link to a data source website or separately connect your own third-party application, your relationship with that third party is governed by its own terms and privacy practices. We do not control those independent services or guarantee their availability or content. You are responsible for authorizing your own integrations and assessing data sent to destinations you configure, including webhooks and exported files.

15. Service changes, support, and suspension

You can contact support@sanctionskit.com for account and technical support. Include relevant request or invoice references and a description of the issue, rather than live keys or unnecessary personal data. A response-time commitment, uptime commitment, service credit, or dedicated support schedule applies only if included in an agreed Order or service-level agreement.

We may maintain, correct, and improve the Services and may change or withdraw a source because of rights, legal requirements, publisher changes, reliability, or safety. We will give reasonable advance notice of planned changes that materially reduce a paid Service, except when advance notice is impracticable or would create a security or legal risk. If a material reduction prevents the principal use agreed in your Order and we cannot provide a reasonable alternative, you may terminate the affected paid Service and receive a refund for its unused prepaid period.

We may restrict or suspend access to the extent reasonably necessary if we reasonably believe there is a security threat, unlawful or materially prohibited use, compromised credentials, a legal requirement, or a material breach. Production work requires an active paid subscription or a valid evaluation or expressly granted entitlement, together with available allowance. Where feasible, we will explain a restriction and allow you to resolve it before suspending access; urgent security, legal, or misuse concerns may require immediate action. We will limit a suspension to its justified scope and restore access when its basis is resolved.

Free, preview, and experimental features may change or end without a continuing availability commitment. Do not use a feature identified as experimental as the sole basis for a critical compliance process.

16. Termination and its consequences

The agreement continues while you use the Services or have an active Order. You may end a subscription under Section 11 and request account closure through support. Either party may terminate an affected Order for a material breach the other party fails to cure within 30 days after written notice describing the breach. A party may terminate immediately where a material breach cannot reasonably be cured, continued performance would be unlawful, or immediate termination is necessary to address serious security threats or intentional abuse.

We may end a free account or decline a future renewal on reasonable notice. We may terminate a paid Order for convenience on at least 30 days’ notice, with the unused-period refund described in Section 11. Termination does not excuse fees already properly incurred, and does not create an obligation to pay subscription periods after termination takes effect unless an expressly agreed minimum commitment applies.

When paid access ends, production screening, scheduled monitoring, and integrations dependent on that access may stop. You must stop using access rights that have ended. Retained data, exports, confidentiality, independent source licences, accrued payment obligations, refunds, intellectual property, disclaimers, liability, indemnification for covered claims, and dispute provisions remain governed by the sections that by their nature need to continue. There is no obligation to recreate expired or deleted evidence.

17. Warranties and service limitations

Each party represents that it has authority to enter and perform the agreement. We will provide paid Services with reasonable care and skill and in material accordance with the functions expressly agreed in your Order. Tell us promptly if the paid Service materially fails to meet that commitment so we can investigate and make reasonable efforts to correct the issue. If we cannot correct a material failure within 30 days after receiving sufficient detail, you may terminate the affected Service and obtain a refund of its unused prepaid fees. This remedy does not limit a right or remedy that cannot lawfully be excluded.

Except for those express commitments, an agreed Order, and rights that applicable law does not permit us to exclude, the Services, source information, and evidence summaries are provided as available without implied warranties, including merchantability, fitness for a particular purpose, non-infringement, or accuracy. We do not warrant uninterrupted or error-free operation, that every source or identity will be covered, or that use will satisfy your legal duties or prevent a regulatory penalty.

These limits do not excuse our express obligations to protect Customer Data, comply with an applicable DPA, perform with reasonable care and skill, or honor required statutory rights. Customers must make their own assessment of suitability for regulated uses and obtain any additional contract or controls required for them.

18. Limitations of liability

To the extent permitted by applicable law and subject to the exceptions below, neither party is liable to the other under the agreement for lost profits, lost revenue, lost business opportunities, or indirect, consequential, special, exemplary, or punitive damages. This applies regardless of the legal theory and even if the possibility was known. Reasonable direct costs of responding to a breach of confidentiality or data-security obligations are not excluded merely because they involve restoration or investigation.

Subject to the same exceptions, each party’s total aggregate liability arising from or relating to the agreement will not exceed the greater of US$100 or the fees paid or payable by the Customer for the affected Services during the 12 months immediately preceding the first event giving rise to the claim. Related events form a single claim for this purpose, and multiple claims do not multiply the cap. The cap also applies to the indemnity obligations in Section 19 unless an applicable signed agreement expressly provides otherwise.

Neither the damages exclusions nor the cap limits liability for fraud, fraudulent misrepresentation, willful misconduct, gross negligence, death or personal injury caused by negligence, or any liability that cannot lawfully be excluded or limited. They do not limit your obligation to pay fees properly due, our obligation to make an expressly required refund, or either party’s ability to seek legally available injunctive relief. They do not restrict an individual’s rights against a controller or processor under applicable data-protection law or a regulator’s authority.

The parties have allocated risk through these limits and the agreed pricing. Where applicable law requires a different standard or prohibits a particular limitation, the limitation applies only to the extent lawful, and the remaining provisions continue to apply.

19. Third-party claims and indemnification

You will defend us against a third-party claim to the extent it arises from Customer Data you supplied without necessary rights or from your or your Authorized Users’ unlawful use or material breach of Section 7, and pay damages and reasonable legal costs finally awarded or included in a settlement you approve. This does not cover a claim to the extent caused by our breach of the agreement, unlawful conduct, negligence, or use of Customer Data outside your lawful instructions.

We will defend you against a third-party claim that the SanctionsKit software we provide, when used as authorized, infringes that party’s copyright or trade secret, and pay damages and reasonable legal costs finally awarded or included in a settlement we approve. This undertaking does not cover independently licensed source information, Customer Data, your modifications, or combinations with materials we did not provide where the claim would not otherwise arise.

The party seeking protection must give prompt written notice, reasonable cooperation at the defending party’s expense, and control of the defense to the defending party using reasonably qualified counsel. Delay in notice reduces an obligation only to the extent it materially prejudices the defense. The protected party may participate through its own counsel at its expense. No settlement may admit fault for, impose non-monetary obligations on, or fail to fully release the protected party without its written consent, which will not be unreasonably withheld.

For an infringement claim against our software, we may obtain continued-use rights or modify or replace the affected functionality without materially reducing its agreed function. If neither is commercially reasonable, we may end the affected Service and refund its unused prepaid fees. These undertakings apply only to third-party claims and are subject to Section 18; they do not expand your liability to cover our own fault or displace mandatory legal remedies.

20. Disputes and applicable law

Before starting ordinary proceedings, each party should send the other a written description of the dispute and the requested resolution. Send notices to us at support@sanctionskit.com. We will attempt in good faith to resolve the dispute within 30 days after receipt. Either party may seek urgent protective relief, preserve a filing deadline, or bring a claim where applicable law does not permit this informal step to be required.

If an Order signed by both parties specifies governing law and courts, those provisions apply subject to mandatory law. Otherwise, the agreement is governed by the law determined under the applicable conflict-of-law rules, and disputes may be brought before courts that have jurisdiction under applicable law. These Terms do not impose a particular state’s law or an exclusive forum when none has been agreed.

These Terms do not require binding arbitration, waive a jury trial, shorten a statutory claim period, or waive a right to participate in a class or representative proceeding. Mandatory rights under applicable consumer, privacy, or other law continue to apply even though the Services are intended for business use. Neither party may prevent an individual from contacting a regulator or exercising rights that cannot be waived.

21. Notices and changes to these Terms

You agree that ordinary service, billing, security, and contract notices may be delivered electronically to the account contact you maintain or through a prominent account notice. Keep your contact details current. Electronic acceptance and signatures have the effect applicable law gives them. Legal process must still be served in a manner permitted by law; ordinary support email does not waive formal service requirements.

We may update these Terms to reflect changes in the Services, law, or business practices. We will publish the updated text and effective date. For material changes affecting an existing Customer, we will provide at least 30 days’ advance notice through account email or a prominent account notice, unless a shorter period is necessary for law or an urgent security reason. We will explain the shorter period where permitted. Changes will not apply retroactively to disputes or conduct occurring before their effective date.

A change to an existing paid commitment applies at renewal or when expressly accepted, except a change that law requires earlier. If you do not agree to a proposed change, cancel before it applies. We will obtain affirmative acceptance where required by law, and posting a new version alone does not substitute for required consent. Price changes remain subject to Section 11, and a signed agreement may be changed only as it provides.

22. General provisions and contact

The agreement, including applicable Orders and signed addenda, is the entire agreement about its subject and replaces prior proposals or discussions on that subject. Each party remains an independent contractor; the agreement creates no partnership, employment, fiduciary, or agency relationship. Neither party may bind the other without express authority.

Neither party may assign the agreement without the other’s written consent, which will not be unreasonably withheld, except to a successor in a merger, reorganization, or sale of substantially all relevant assets that assumes the agreement and can lawfully perform it. Assignment does not remove obligations already incurred or reduce required personal-data protections. We will notify affected Customers of an assignment. There are no intended third-party beneficiaries except where mandatory law or an express licence grants rights directly.

A party is not responsible for delay caused by events beyond its reasonable control if it takes reasonable steps to mitigate the effects and resumes performance promptly. This does not excuse payment for Services already provided, confidentiality or data-protection duties that remain performable, or refunds otherwise due. If such an event substantially prevents paid performance for more than 30 consecutive days, either party may terminate the affected Service and we will refund the unused prepaid period.

If a provision is unenforceable, it will be applied to the lawful extent possible or severed, and the remainder will continue unless doing so would defeat the agreement’s essential purpose. A failure or delay to enforce a right is not a waiver. A waiver must be clear and does not waive a later breach. Headings and the Plain English summary aid reading and do not override the numbered terms.

For contractual notices, account questions, cancellation assistance, or concerns about the Services, contact SanctionsKit, LLC at support@sanctionskit.com or through our contact page. Use a short description and relevant references; do not include passwords, API keys, payment-card details, or unnecessary screening information.