Regzact Terms & Conditions

Client Terms & Conditions

Including Data Processing Agreement (Schedule 1)

Version 1.0 | March 2026

IMPORTANT

These Terms & Conditions (including the Data Processing Agreement at Schedule 1) form a single, binding agreement between the Client and Regzact. By completing registration on the Regzact platform, the Client accepts these Terms in full. They remain in force for the duration of the relationship. Individual SMS campaigns and Sender ID authorisations are governed by separate operational forms and do not require re-acceptance of this agreement.

PART A: GENERAL TERMS & CONDITIONS

Definitions and Interpretation

1.1 In these Terms & Conditions, unless the context otherwise requires, the following terms shall have the meanings set out below:

“Client” means the entity identified during Registration on the Platform, which may include (without limitation) insurance intermediaries, brokers, managing general agents, insurers, or other regulated or unregulated entities, acting as Data Controller in respect of Customer Personal Data.

“Platform” means the Regzact web-based compliance platform, including all features and functionality made available to the Client from time to time, as described in Section 2.

“Registration” means the completion of the Client registration process on the Platform, including the creation of a Client account and the affirmative acceptance of these Terms & Conditions (including the Data Processing Agreement at Schedule 1) via the acceptance mechanism presented during that process.

“Regzact” means Regzact Limited, a company registered in Ireland, acting as Data Processor on the Client’s instructions. Regzact is registered with the Data Protection Commission as a Data Processor and with ComReg as a third-party SMS provider.

“Customer” means a natural person who is a recipient of communications sent by the Client via the Platform, or whose personal data is otherwise processed by Regzact on the Client’s behalf in connection with the Services.

“Services” means all services provided by Regzact to the Client via the Platform, including (without limitation) SMS and email communications, document storage and management, onboarding workflows, questionnaire distribution and collection, compliance register tools, and AI-assisted features.

“Sender ID” means the Alphanumeric Sender ID registered with ComReg’s SMS Sender ID Registry and authorised by the Client for use by Regzact, as specified in a Sender ID Authorisation Form.

“Sender ID Authorisation Form” means the separate operational form by which the Client authorises Regzact to send SMS messages using a specific Sender ID.

“AI Output” means any content generated by artificial intelligence features within the Platform, including summaries, recommendations, suggested responses, or other machine-generated text.

“Personal Data”, “Data Controller”, “Data Processor”, “Data Subject”, “Processing”, “Personal Data Breach”, and “Sub-processor” shall have the meanings given to them in the GDPR.

“GDPR” means Regulation (EU) 2016/679 (General Data Protection Regulation).

“Data Protection Laws” means the GDPR, the Data Protection Act 2018, the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011 (S.I. No. 336/2011) (“ePrivacy Regulations”), and any successor legislation.

“ASAI” means the Advertising Standards Authority for Ireland.

“ComReg” means the Commission for Communications Regulation.

“DPC” means the Data Protection Commission of Ireland.

“Consumer Protection Code” means the Central Bank of Ireland’s Consumer Protection Code 2012 (as amended).

“Ofcom” means the Office of Communications in the UK.

“ICO” means the Information Commissioner’s Office in the UK.

“FCA Handbook” refers to the Financial Conduct Authority conduct rules in the UK.

“ICOBS” means the Insurance Conduct of Business sourcebook in the UK.

Platform and Services

2.1 Platform Functionality. The Platform includes, but is not limited to, the following features (which may be updated, expanded, or modified by Regzact from time to time):

(a) SMS and email communications to Customers on behalf of the Client;

(b) document storage and management;

(d) questionnaire distribution and response collection;

(e) compliance registers (including complaints registers);

(f) AI-assisted summarisation and response generation.

2.2 Not all features may be available under every subscription plan. The features available to the Client are determined by the Client’s active plan on the Platform.

2.3 Regzact reserves the right to modify, suspend, or discontinue any feature of the Platform at any time, with reasonable notice where practicable. Regzact shall not be liable for any modification, suspension, or discontinuation of features.

SMS and Email Communications

3.1 Where the Client uses the Platform to send SMS or email communications to Customers, Regzact transmits those communications at the Client’s request and on the Client’s instructions.

3.2 Regzact uses a third-party SMS service provider as its upstream Originating Participating Aggregator (OPA) to transmit SMS messages. The identity of the current OPA is set out in Annex C to Schedule 1. Messages are sent using the Client’s own registered Alphanumeric Sender ID.

3.3 Regzact will create and maintain a dedicated sub-account within its SMS service provider for each Client, ensuring logical separation of message logs, delivery receipts, and personal data.

3.4 Regulatory vs. Marketing Communications. The SMS and email Services are intended for regulatory, transactional, and service communications required or permitted under applicable regulation, the Consumer Protection Code, or similar obligations. The Client acknowledges that where any communication contains or could be construed as containing direct marketing content, the Client is solely responsible for ensuring valid consent has been obtained in accordance with SI 336/2011 and the GDPR. Regzact does not determine the content or purpose of messages and relies on the Client’s classification.

3.5 Sending Hours. The Client confirms that SMS communications shall not be transmitted between 21:00 and 09:00 GMT, in line with ASAI guidelines. Regzact will enforce this restriction at platform level.

3.6 Sender ID Registration. The Client shall ensure that its Sender ID is registered with ComReg’s SMS Sender ID Registry, that Regzact’s designated OPA (as identified in Annex C to Schedule 1) is listed as the OPA, and that Regzact is listed as a Third Party. Failure to complete these registrations may result in messages being tagged as “Likely Scam” or blocked.

No Reliance and No Compliance Guarantee

4.1 Regzact does not guarantee regulatory compliance. The Platform is provided as a tool to assist the Client with compliance-related processes, but it does not verify the completeness or correctness of data entered by the Client, and does not assume responsibility for regulatory outcomes.

4.2 The Client remains solely responsible for compliance with all applicable laws and regulations, including (without limitation) the GDPR, Data Protection Laws, the Consumer Protection Code, and any sectoral regulation applicable to the Client’s business.

4.3 Regzact does not provide legal, regulatory, tax, or professional advice. Any guidance, templates, or suggested wording provided within the Platform is for informational purposes only and should not be treated as a substitute for independent professional advice.

AI Functionality

5.1 The Platform may provide AI-generated outputs (“AI Outputs”), including summaries, recommendations, suggested responses, or draft text.

5.2 The Client acknowledges and agrees that:

(a) AI Outputs may be incomplete, inaccurate, or unsuitable for the Client’s specific circumstances;

(b) AI Outputs are provided for informational and assistive purposes only;

(d) AI Outputs do not constitute legal, regulatory, or professional advice.

5.3 The Client is solely responsible for reviewing, validating, and approving all AI Outputs before any reliance, use, distribution, or onward transmission. Regzact accepts no liability for any loss or damage arising from the Client’s reliance on AI Outputs without independent verification.

Document Storage and Management

6.1 The Platform may provide document storage and management functionality. The Client is solely responsible for:

(a) the accuracy, completeness, and legality of all documents uploaded to the Platform;

(b) ensuring that documents stored on the Platform are kept up to date;

6.2 Regzact does not verify, audit, or review the content of documents uploaded by the Client. Regzact stores documents as instructed by the Client and shall not be liable for the content of any document.

Questionnaires and Responses

7.1 The Platform may facilitate the distribution of questionnaires and the collection of responses on behalf of the Client.

7.2 Regzact does not verify the accuracy, completeness, or truthfulness of responses received. The Client is solely responsible for reviewing all responses and for any decisions made on the basis of such responses.

Compliance Registers

8.1 The Platform may include tools for maintaining compliance registers (for example, complaints registers, breaches registers, or training records).

8.2 These tools are provided for the Client’s convenience only. They do not guarantee regulatory compliance. The Client is solely responsible for ensuring that any registers maintained on the Platform meet all applicable regulatory requirements, including requirements as to content, format, retention, and reporting.

Client Obligations

9.1 Data Controller Status. The Client is and shall remain the Data Controller for all Customer Personal Data processed by Regzact under these Terms. The Client is responsible for the lawfulness of its own data collection and for providing documented instructions to Regzact.

9.2 Lawful Basis and Consent. The Client shall ensure that:

(a) a valid lawful basis under Article 6 GDPR exists for each processing activity;

(b) where communications constitute direct marketing, valid opt-in consent (meeting the GDPR standard of freely given, specific, informed, and unambiguous) has been obtained from each Customer prior to providing their data to Regzact;

(c) where communications are purely regulatory or transactional, the Client has identified and documented the appropriate lawful basis (which may be legal obligation or legitimate interests);

(d) the Client’s privacy notice informs Customers that their data may be processed by Regzact as a Data Processor acting on the Client’s behalf.

9.3 Accuracy of Data and Opt-Out Management. The Client is solely responsible for maintaining accurate, up-to-date recipient lists and data within the Platform. The Client shall not provide to Regzact the personal data of any individual who has opted out, withdrawn consent, or otherwise objected to receiving communications. It is the Client’s sole responsibility to manage all opt-out, unsubscribe, and suppression processes and to ensure that all data provided to Regzact reflects the current consent status of each Customer.

9.4 Content Responsibility. The Client is solely responsible for ensuring that all content (including message text, documents, questionnaire content, and register entries) is accurate, compliant with applicable law, and does not contain misleading or prohibited material.

9.5 Acceptable Use. The Client shall not use the Platform for any unlawful purpose, or in any manner that could damage, disable, overburden, or impair the Platform. The Client shall not attempt to gain unauthorised access to any part of the Platform, or to any systems or networks connected to the Platform.

Data Classification and Restrictions

10.1 The Client shall not upload, store, or process on the Platform any:

(a) special category data as defined in Article 9 GDPR (including data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data, health data, or data concerning sex life or sexual orientation);

(b) criminal offence data as defined in Article 10 GDPR;

unless expressly agreed in writing between the Client and Regzact, with appropriate additional safeguards documented.

10.2 Where the Client uploads any such data in breach of this Section, the Client assumes full responsibility and shall indemnify Regzact against any claims, losses, or regulatory action arising from such upload.

Multi-Party Data Processing

11.1 Where the Platform enables data exchange or communication between multiple parties (for example, between a broker and an insurer, or between a client and a third-party service provider):

(a) each party acts as an independent Data Controller in respect of the personal data it provides or receives;

(b) Regzact acts solely as a Data Processor on behalf of the instructing Client;

(c) Regzact is not responsible for determining the lawfulness of any data shared between parties, nor for any use made of such data by a receiving party.

11.2 The Client is responsible for ensuring that any data sharing facilitated through the Platform complies with Data Protection Laws, including (where applicable) the requirement to have a data sharing agreement or joint controller arrangement in place with the relevant third party.

Regzact Obligations

12.1 Regzact shall act solely as Data Processor and shall process Customer Personal Data only on the documented instructions of the Client, as further set out in Schedule 1 (Data Processing Agreement).

12.2 Where the Client uses the SMS functionality, Regzact shall register the Client’s Sender ID with its designated OPA and Irish MNOs, and shall maintain the Sender ID within the Client’s dedicated Messaging Service.

12.3 Regzact shall maintain send logs and delivery audit trails for SMS and email communications for a minimum period of 6 years (or such longer period as required by applicable regulation).

12.4 Regzact shall enforce sending-hours restrictions (08:00–21:00 Irish time) for SMS communications at platform level.

12.5 Regzact shall implement appropriate technical and organisational security measures as set out in Schedule 1, Annex B.

12.6 Regzact shall use commercially reasonable efforts to ensure the availability and performance of the Platform, but does not guarantee uninterrupted or error-free operation.

ComReg & Telecommunications Compliance

13.1 Regzact is registered with ComReg as a third-party provider and as a Participating Aggregator in the SMS Sender ID Registry.

13.2 Each Client Sender ID must be registered by the Client (or by Regzact on the Client’s behalf) with ComReg’s SMS Sender ID Registry prior to any messages being sent. The Client must designate Regzact’s current OPA (as identified in Annex C to Schedule 1) as the OPA and Regzact as a Third Party in the ComReg registry.

13.3 Regzact shall register each Client’s Sender ID within its OPA’s platform as a registered Alphanumeric Sender ID for Ireland and add it to the Client’s Messaging Service sender pool.

13.4 The Client acknowledges that unregistered or improperly configured Sender IDs may be tagged as “Likely Scam” or blocked by Irish MNOs pursuant to ComReg Decision D14/24.

Data Protection

14.1 The Data Processing Agreement at Schedule 1 forms an integral part of these Terms and sets out the detailed obligations of each party under Article 28 GDPR.

14.2 Regzact is registered with the Data Protection Commission as a Data Processor.

14.3 The Client acknowledges that Regzact engages third-party Sub-processors in connection with the Services, including for SMS transmission. The current list of approved Sub-processors, together with their purposes and applicable safeguards, is set out in Annex C to Schedule 1 and is also maintained on the Platform. Regzact shall notify the Client of any change of Sub-processor in accordance with Schedule 1.

Fees and Payment

15.1 The Services are provided under the Client’s active subscription plan on the Platform. Fees and usage charges are as displayed on the Platform at the time of Registration, or as subsequently agreed between the parties. Details of the Client’s current plan and applicable pricing are available within the Platform at all times.

15.2 Regzact reserves the right to amend fees or introduce new charges on not less than 30 days’ written notice. Continued use of the Services after the effective date of any fee change constitutes acceptance of the revised fees.

15.3 All fees are exclusive of VAT, which shall be charged at the applicable rate where required by law.

Liability and Indemnity

16.1 The Client shall indemnify and hold harmless Regzact against any claims, losses, damages, or expenses arising from:

(a) the Client’s failure to obtain valid consent or lawful basis for communications or other processing;

(b) inaccurate or non-compliant content (including message text, documents, or register entries);

(c) the Client’s failure to ensure that data provided to Regzact is accurate and reflects current consent and opt-out status;

(d) the Client’s failure to properly register its Sender ID with ComReg;

(e) the Client’s reliance on AI Outputs without independent verification;

(f) the Client’s upload of special category or criminal offence data in breach of Section 10;

(g) any breach by the Client of Data Protection Laws in connection with its use of the Platform.

16.2 Regzact’s total aggregate liability under these Terms shall not exceed the fees paid by the Client in the 12 months preceding the event giving rise to liability.

16.3 Regzact shall not be liable for any indirect, incidental, special, consequential, or punitive damages, including loss of profits, revenue, data, or business opportunity, howsoever caused.

16.4 Neither party excludes or limits liability for death, personal injury caused by negligence, fraud, or any liability which cannot be excluded or limited by applicable law.

Term and Termination

17.1 These Terms shall commence on the date of the Client’s Registration on the Platform and shall continue until terminated by either party giving not less than 30 days’ written notice.

17.2 Either party may terminate immediately by written notice if the other party commits a material breach which is not remedied within 14 days of written notice specifying the breach.

17.3 Upon termination, the provisions of Schedule 1 relating to data return or deletion shall apply. Regzact shall, at the Client’s election, return or securely delete all Customer Personal Data within 30 days, subject to any legal retention obligations.

17.4 Termination shall not affect any rights, remedies, obligations, or liabilities of the parties that have accrued up to the date of termination.

General Provisions

18.1 Governing Law. These Terms shall be governed by and construed in accordance with the laws of Ireland.

18.2 Jurisdiction. The courts of Ireland shall have exclusive jurisdiction in relation to any dispute arising out of or in connection with these Terms.

18.3 Entire Agreement. These Terms (including Schedule 1), as accepted by the Client upon Registration, constitute the entire agreement between the parties in relation to their subject matter and supersede all prior agreements, understandings, and representations.

18.4 Amendments. Regzact may update these Terms from time to time. Material changes shall be notified to the Client at least 30 days in advance. Continued use of the Services after the effective date of any change constitutes acceptance.

18.5 Severability. If any provision of these Terms is found to be invalid or unenforceable, the remaining provisions shall remain in full force and effect.

18.6 Notices. All notices shall be in writing and sent to the contact details provided during Registration or as subsequently notified by either party.

18.7 Force Majeure. Neither party shall be liable for any failure or delay in performing its obligations where such failure or delay results from circumstances beyond the reasonable control of that party.

ACCEPTANCE BY REGISTRATION

By completing the Client registration process on the Regzact platform, the Client:

(a) Confirms that the person completing registration is a Director, authorised officer, or duly authorised representative of the Client organisation, with the authority to bind the Client to these Terms;

(b) Agrees to be bound by these Terms & Conditions in their entirety, including the Data Processing Agreement at Schedule 1 and its Annexes;

(c) Acknowledges that Registration constitutes a binding acceptance equivalent to a written signature for the purposes of Article 28(9) GDPR, which permits the Data Processing Agreement to be in electronic form;

(d) Acknowledges that these Terms remain in force from the date of Registration until terminated in accordance with Section 17; and

(e) Acknowledges that Regzact will record the date, time, IP address, and identity of the registering user as evidence of acceptance.

A copy of these Terms & Conditions (including Schedule 1) as in force at the date of Registration will be made available to the Client via the Platform and by email. The Client may request a copy at any time by contacting Regzact.

SCHEDULE 1

Data Processing Agreement

Pursuant to Article 28 of the General Data Protection Regulation (EU) 2016/679

Scope and Purpose

1.1 This Data Processing Agreement (“DPA”) forms part of the Client Terms & Conditions (“Agreement”) and sets out the terms on which Regzact (the “Processor”) will process Personal Data on behalf of the Client (the “Controller”).

1.2 The subject matter, duration, nature, and purpose of processing, the types of Personal Data, and categories of Data Subjects are described in Annex A to this Schedule.

Processor Obligations

2.1 Regzact shall process Personal Data only on the documented instructions of the Client, including with regard to transfers of Personal Data to a third country, unless required to do so by EU or Irish law, in which case Regzact shall inform the Client of that legal requirement before processing (unless prohibited from doing so).

2.2 Regzact shall ensure that persons authorised to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

2.3 Regzact shall implement the technical and organisational security measures set out in Annex B, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk to the rights and freedoms of Data Subjects.

2.4 Regzact shall not engage another processor (Sub-processor) without prior general written authorisation of the Client. Regzact shall inform the Client of any intended changes concerning the addition or replacement of Sub-processors, giving the Client the opportunity to object to such changes within 14 days. The current list of Sub-processors is set out in Annex C.

2.5 Where Regzact engages a Sub-processor, it shall impose on that Sub-processor, by way of a contract, the same data protection obligations as are set out in this DPA.

2.6 Regzact shall, taking into account the nature of the processing, assist the Client by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Client’s obligation to respond to requests for exercising Data Subject rights under Chapter III of the GDPR.

2.7 Regzact shall assist the Client in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR, taking into account the nature of processing and the information available to Regzact.

2.8 At the choice of the Client, Regzact shall delete or return all Personal Data to the Client after the end of the provision of Services, and delete existing copies unless EU or Irish law requires storage of the Personal Data.

2.9 Regzact shall make available to the Client all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR and this DPA, and allow for and contribute to audits, including inspections, conducted by the Client or another auditor mandated by the Client. Regzact may satisfy audit requirements by providing relevant third-party certifications, SOC 2 reports, or equivalent documentation.

Personal Data Breach Notification

3.1 Regzact shall notify the Client without undue delay (and in any event within 48 hours) after becoming aware of a Personal Data Breach affecting the Client’s Customer Personal Data.

3.2 Such notification shall include, to the extent available:

(a) a description of the nature of the Personal Data Breach, including the categories and approximate number of Data Subjects and records concerned;

(b) the name and contact details of the Regzact data protection point of contact;

(d) a description of the measures taken or proposed to be taken to address the breach and mitigate its effects.

3.3 Regzact shall cooperate with the Client and take reasonable commercial steps to assist in the investigation, mitigation, and remediation of each Personal Data Breach.

International Data Transfers

4.1 Regzact shall not transfer Personal Data outside the European Economic Area (EEA) unless: (a) the transfer is to a country recognised by the European Commission as providing an adequate level of protection; or (b) appropriate safeguards are in place, including the EU Standard Contractual Clauses approved by the European Commission.

4.2 Where any Sub-processor processes Personal Data outside the EEA (including in the United States), such transfer shall be governed by that Sub-processor’s data processing agreement with Regzact, which shall incorporate appropriate safeguards such as the EU-U.S. Data Privacy Framework and/or EU Standard Contractual Clauses. Details of each Sub-processor’s location and applicable safeguards are set out in Annex C.

Liability

5.1 Each party’s liability under this DPA shall be subject to the limitations and exclusions of liability set out in the Agreement.

5.2 Neither party shall be responsible for fines issued under Data Protection Laws against the other party by the DPC or any other supervisory authority in connection with the other party’s own violation of Data Protection Laws.

ANNEX A: Details of Processing

Subject Matter	The provision of the Regzact platform services to the Client, including: the transmission of SMS and email communications; document storage and management; onboarding workflows; questionnaire distribution and response collection; compliance register tools; and AI-assisted features.
Duration	For the duration of the Client Terms & Conditions, plus any retention period required by law or regulation.
Nature of Processing	Collection (from Client), storage, retrieval, organisation, transmission (including via third-party SMS service providers for SMS), AI processing (for summarisation and response generation features), logging, and deletion of Customer Personal Data.
Purpose of Processing	To provide the Services described in Section 2 of the Agreement, including: sending regulatory and transactional communications; storing and managing documents; distributing and collecting questionnaires; maintaining compliance registers; and generating AI-assisted outputs — all on behalf of and under the instruction of the Client.
Types of Personal Data	Customer name, mobile telephone number, email address, postal address, policy reference number, document contents, questionnaire responses, compliance register entries, and such other data fields as the Client may upload to or create within the Platform.
Categories of Data Subjects	Customers of the Client; employees or representatives of the Client and its partners (where relevant to onboarding workflows or multi-party features); and any other individuals whose personal data the Client uploads to the Platform.
Special Category Data	None, unless expressly agreed in writing per Section 10 of the Agreement. The Client shall not upload special category data (Article 9 GDPR) or criminal offence data (Article 10 GDPR) without prior written agreement and appropriate additional safeguards.

ANNEX B: Technical and Organisational Security Measures

Regzact implements the following measures to protect Customer Personal Data:

Access Controls

(a) Role-based access controls (RBAC) with principle of least privilege for all platform users and staff.

(b) Multi-factor authentication (MFA) enforced for all Regzact staff and administrative access.

Encryption

(a) Data in transit: TLS 1.2 or higher for all API calls and web interfaces.

(b) Data at rest: AES-256 encryption for stored Personal Data.

Infrastructure Security

(a) Cloud hosting within EEA-region data centres.

(b) Regular vulnerability scanning and patching.

Logging and Monitoring

(a) Comprehensive audit logging of all data access and transmission events.

(b) Automated alerting for anomalous access patterns.

Business Continuity

(a) Regular data backups with tested restoration procedures.

(b) Disaster recovery plan documented and reviewed annually.

Staff

(a) All staff with access to Personal Data are subject to confidentiality obligations.

(b) Annual data protection training for all staff.

ANNEX C: Approved Sub-processors

The following Sub-processors are approved by the Client as at the date of this Agreement. This Annex reflects the current Sub-processor list and may be updated by Regzact from time to time in accordance with Section 2.4 of this Schedule. The most current list is also maintained on the Platform.

Sub-processor	Purpose	Location	Safeguards
Twilio Inc.	SMS transmission (Originating Participating Aggregator)	USA / EEA	EU-U.S. Data Privacy Framework; EU SCCs; Twilio DPA

Regzact shall notify the Client at least 14 days in advance of any proposed addition to or replacement of the above Sub-processors, including where a change of OPA is proposed. If the Client objects to a new Sub-processor on reasonable grounds relating to data protection, the parties shall discuss in good faith. If no resolution is reached, the Client may terminate the Agreement on written notice. Where a change of OPA affects the Client’s ComReg Sender ID registration, Regzact shall provide reasonable assistance to the Client in updating its ComReg registry entry.

--- End of Terms & Conditions ---