Terms and Conditions

This document sets out the general terms and conditions (the "Terms") applicable to the access and use of the WhistleBox platform and all associated services. By accessing, browsing or using the Platform, the User confirms that they have read, understood and fully accept these Terms.

If you do not agree with any of the provisions below, please do not access or use the Platform.

These Terms have been drawn up in accordance Directive (EU) 2019/1937, Regulation (EU) 2016/679 (GDPR) and all other applicable legislation from Romania and the European Union.

• Platform — the website whistle-box.eu, including the associated API and all services provided through it.
• Services — all functionalities offered through the Platform: internal reporting channel with end-to-end encryption, management of whistleblowing reports, anonymous communication between the whistleblower and the designated person, organisation configuration, administration dashboard.
• Operator — NUTRA PHARMA CONSULTING S.R.L. (CUI 41299733), the legal entity that administers the Platform.
• User — any natural or legal person who accesses the Platform, regardless of whether they hold an account.
• Client — the organisation (legal entity) that has created an account and uses the Services to operate an internal reporting channel.
• Whistleblower — the natural person who submits a report through a Client's reporting channel, in accordance with Directive (EU) 2019/1937.
• Designated person — the person or department within the Client organisation that manages the whistleblowing reports received.
• Report — the disclosure submitted by a Whistleblower through the Platform, encrypted end-to-end.
• Account — the account created by the Client through registration (email and password or email magic link), providing access to the Platform's functionalities.
• E2E Encryption — end-to-end encryption whereby report contents are encrypted on the whistleblower's device and can only be decrypted by the designated person. The Platform Operator does not have access to the decrypted content.

WhistleBox is a whistleblowing platform compliant with Directive (EU) 2019/1937, which provides the following functionalities:

• Internal reporting channel — a dedicated public page for each organisation through which employees and collaborators may submit whistleblowing reports.
• End-to-end encryption (E2E) — report contents are encrypted on the whistleblower's device using the organisation's public key. The Platform Operator has no access to the report contents.
• Anonymous reporting — the whistleblower may submit reports without disclosing their identity. The Platform does not collect IP addresses, cookies or other identifying data on reporting pages.
• Secure communication — anonymous two-way dialogue between the whistleblower and the designated person, without compromising anonymity.
• Administration dashboard — an interface for the designated persons within the organisation to manage reports received, legal deadlines and communications.
• Legal compliance — adherence to response deadlines (7 days acknowledgement of receipt, 3 months actions taken), report register, audit trail.
• Organisation configuration — customisation of the reporting channel with the organisation's logo and name, designation of responsible persons.

To set up an internal reporting channel, the organisation's representative must create an account by providing a valid email address. Authentication is carried out via email magic link or password.

• The User warrants that they have the authority to represent the organisation for which they are setting up the reporting channel.
• The User is solely responsible for the security of their access credentials and for all actions carried out through their account.
• The Operator may request verification of the User's or the organisation's identity in justified cases.
• The Whistleblower (the person submitting a report) does not need an account and is not required to provide personal data.

The User undertakes to use the Platform only for lawful purposes and in accordance with applicable legislation.

The following is strictly prohibited:

• False reports made in bad faith — the deliberate submission of false or defamatory reports with the intention of causing harm to a person or organisation.
• Reverse engineering — decompiling, disassembling or attempting to extract the source code, encryption algorithms or database structures of the Platform.
• Attempted decryption — any attempt to access encrypted report content without authorisation.
• Automated scraping and crawling — automated access to the Platform through bots, crawlers, scripts or any other tools without the prior written consent of the Operator.
• Harassment and intimidation — use of the Platform for harassment, blackmail or intimidation of whistleblowers or any other persons.
• Retaliation —Directive (EU) 2019/1937.
• Exploitation of vulnerabilities — unauthorised security testing, injection of malicious code, denial-of-service attacks.

The Operator reserves the right to immediately suspend or terminate the account of any User who breaches the acceptable use rules, without prior notice.

All elements of the WhistleBox Platform — including, but not limited to: the graphical interface, source code, encryption algorithms, text, logo, design, database structure and information presentation — are the exclusive property of the Operator and are protected by Law No. 8/1996 on copyright and related rights, as well as applicable European legislation.

The User is granted a personal, limited, non-exclusive, non-transferable and revocable right of access to the Platform's content, solely for their own use.

• The Services are provided "as is" and "as available".
• The Operator shall not be liable for any direct, indirect, incidental, special or consequential damages arising from the use or inability to use the Platform.
• The Operator shall not be liable for the content of reports submitted by whistleblowers, as these are E2E encrypted and inaccessible to the Operator.
• The Operator shall not be liable for the manner in which the Client manages reports received or for the Client's failure to fulfil their legal obligations under Directive (EU) 2019/1937.
• The Operator shall not be liable for the loss of the encryption private key by the Client.
• The Operator's maximum liability is limited to the subscription fee paid by the Client in the 3 (three) months preceding the incident.

• Subscription payments are processed through NETOPIA Payments (MobilPay). Card details are managed entirely by the payment processor and are not stored on the Operator's servers.
• Invoices are issued automatically through SmartBill and sent by email to the address associated with the account.
• Prices displayed on the Platform are in EUR and do not include VAT, unless expressly stated otherwise.
• Subscriptions renew automatically upon expiry, unless cancelled by the Client at least 24 hours before the renewal date.

• The Operator makes reasonable efforts to ensure the continuous operation of the Platform, but does not guarantee uninterrupted 24/7 operation.
• Scheduled maintenance operations may cause temporary unavailability. Where possible, maintenance shall be announced in advance.
• The Operator reserves the right to modify, suspend or discontinue any functionality of the Platform, temporarily or permanently, with or without prior notice.
• The Operator shall not be liable for losses caused by temporary unavailability of the Platform.

The account may be closed in the following ways:

• At the Client's request — by sending a request to contact@whistle-box.eu. The account shall be deactivated within a maximum of 30 days.
• By the Operator — in the event of a breach of the Terms, abusive use, or at the request of a competent authority.
• Inactivity — accounts inactive for more than 24 months may be deleted automatically, with 30 days' prior notice to the Client.

Upon account deletion, personal data shall be removed in accordance with the Privacy Policy. E2E encrypted reports may be deleted or retained in accordance with the Client's legal obligations.

The Operator may update these Terms periodically. Users shall be notified by email and/or through an announcement on the Platform at least 15 days before significant amendments come into effect.

Continued use of the Platform after the expiry of the notice period shall constitute acceptance of the new Terms.

The Operator shall not be liable for the non-performance or defective performance of obligations arising from these Terms in the event of a force majeure occurrence, as defined by the Romanian Civil Code (Art. 1351).

Force majeure events shall include: natural disasters, wars, pandemics, large-scale cyber attacks, legislative or regulatory changes that significantly affect the provision of the Services.

These Terms and Conditions shall be governed by and construed in accordance with the laws of Romania and applicable EU regulations, including EU Directive 2019/1937 on the protection of persons who report breaches of Union law.

Any dispute shall be resolved amicably. Should an amicable resolution not be possible, the dispute shall be submitted to the competent courts of Bucharest, Romania.

In accordance with Regulation (EU) No. 524/2013, consumers may use the European Online Dispute Resolution (ODR) platform:

• European ODR Platform: https://ec.europa.eu/consumers/odr
• Contact email for dispute resolution: contact@whistle-box.eu

Consumers have the right to resort to alternative dispute resolution procedures before addressing the courts.