Acceptable Use Policy

This Acceptable Use Policy (the “AUP”) sets out the rules that govern your use of RiskOS — Risk Management, a risk register for macOS published by MAHTCA GLOBAL and sold only through Apple’s Mac App Store.

1. Status and incorporation

This AUP forms part of the RiskOS Terms of Use and End User Licence (the “Terms”). A breach of this AUP is a material breach of the Terms: it activates the indemnity obligations there and is subject to the limitation of liability, governing law and severability rules set out in the Terms. Where the two appear to conflict, the Terms control.

2. Acceptance

You accept this AUP by downloading, installing, opening, purchasing or using RiskOS, including any profile capacity unlocked by an in-app purchase. If you do not accept it, do not use RiskOS. Continued use after an update is acceptance of it as updated.

3. Definitions

In this AUP: (a) “User”, “you” and “your” mean any person who uses RiskOS. (b) “Register” means everything you record in RiskOS — risks and their assessment history, controls, actions, assets, vendors, frameworks, indicators, events, settings and profiles — and anything you export, print or back up from it. (c) “Personal Data” has the meaning given in Article 4(1) of the EU GDPR and any equivalent term under other applicable law. (d) “Misuse” means any use of RiskOS that breaches this AUP, the Terms, Apple’s platform rules or the law. (e) “Credible Report” means a good-faith report of suspected Misuse with enough detail for us to evaluate it. (f) “Authority” means a competent law-enforcement body, court, regulator or other public body with lawful jurisdiction. (g) “we”, “us” and “our” mean MAHTCA GLOBAL.

4. Intended uses

RiskOS is intended for lawful, good-faith risk management: recording the risks an organisation faces, scoring them, linking the controls that reduce them, tracking treatment actions, assets, vendors, framework coverage, indicators and events, reviewing the register on a cadence you set, and reporting to those who need it.

Consultants, advisers and internal audit functions may keep a separate register for each client they are engaged by, within the profile capacity they own. If you hold a register on a client’s behalf, you are responsible for having their authority to hold what it contains and for honouring the confidentiality you owe them. A use is permitted unless section 5 catches it, or it breaches the Terms, the law or a third party’s rights.

5. Prohibited conduct

You must not use RiskOS, or let anyone use it on your behalf, in the following ways. The list is illustrative, not exhaustive.

• Unlawful content or purposes. Recording, storing or exporting material that is unlawful where you are, or using RiskOS in service of an activity that breaches a law, court order, sanctions regime or platform rule that applies to you or to us.
• Planning or concealing harm. Using a register to plan, coordinate or facilitate harm to a person or an organisation, or using the assessment history, the review pass or a report to conceal, fabricate, backdate or misrepresent what was known, decided or accepted in a legal, regulatory, insurance, employment or audit proceeding, or in anticipation of one.
• Personal Data without a lawful basis. Recording Personal Data about an identifiable person — in a risk, an owner record, a vendor contact or an event — without a lawful basis under applicable law and without meeting the transparency, minimisation and retention duties that come with it. Where a risk can be recorded by role rather than by name, record it by role.
• Infringing or unlicensed catalogues. Importing, reproducing, adapting or exporting a risk catalogue, control catalogue, framework text, methodology or client register you have no licence or authority to use. That licence is yours to hold.
• Defeating the purchase model or the profile cap. Bypassing, tampering with or helping others bypass a purchase check, entitlement or profile limit, or obtaining profile capacity other than through the Mac App Store on Apple’s terms.
• Misrepresenting an export. Presenting a RiskOS report, export or print as an audit, certification, attestation or endorsement by MAHTCA GLOBAL, or as proof that a standard has been complied with. RiskOS presents what you enter; the judgement is yours, and so is responsibility for it.
• Reverse engineering or redistribution of RiskOS, as prohibited by the Terms.

The absence of a category here does not make it permitted. Conduct that is unlawful, harmful, deceptive or that breaches another person’s rights is prohibited whether or not it is listed.

6. What we can and cannot do

RiskOS runs entirely on your Mac. There is no account and no server we operate; we never receive your Register and hold no record of your use of it. The one point at which a network is involved at all is Apple’s own App Store, which sells the app and the profile tiers and restores purchases you already own; your Register is never part of that, and nothing about it reaches Apple either. That limits what enforcement can be, and we would rather say so plainly than imply a power we do not have.

We do not warrant that we will detect, prevent or remedy any Misuse. The absence of detection or action endorses no conduct and waives no provision of this AUP.

7. Cooperation with Authorities and with Apple

Subject to applicable law, we will cooperate in good faith with an Authority acting on valid legal process directed to us, with a Credible Report indicating an imminent risk of serious harm, and with Apple in connection with the App Store or an Apple enforcement action. Because we hold nothing about your use of RiskOS, that cooperation is limited to confirming that no record of it reaches us, providing documentation or a sworn statement where legally compelled, and changing or withdrawing RiskOS at Apple’s request or an Authority’s lawful direction.

8. Notice and action procedure

Reports of suspected Misuse should be sent to riskos@mahtca.com. To qualify as a Credible Report, a notice should include, where possible: identification of the person, conduct or material involved; a description of the alleged Misuse in enough detail to be evaluated; contact details where the reporter can be reached; and a good-faith declaration that the report is accurate. We will acknowledge Credible Reports within a reasonable time, evaluate them in good faith and take whatever action we consider appropriate and lawful, without promising an outcome or a timeline. We may decline to act on, close or refer to an Authority a report that is frivolous, manifestly unfounded, repetitive or made in bad faith. The procedure follows the spirit of Article 16 of EU Regulation 2022/2065 as voluntary good practice.

9. Reporter safe harbour

So far as the law permits, we will treat a good-faith reporter’s identity as confidential; we will not retaliate for a good-faith report; and we will not be liable to a reported User for a claim arising from one. Knowingly false reports, and reports sent to harass another User, are not protected, may themselves be Misuse and may be referred to an Authority.

10. Consequences of breach

A breach of this AUP is a material breach of the Terms; activates your indemnity obligations; is subject to the limitation of liability in the Terms; permits termination of your licence; and may be reported to Apple, to an Authority or to a person at risk of harm. Our remedies are cumulative. Termination of a licence removes nothing from your Mac and entitles you to no refund from us, which only Apple can issue.

11. Reservation of rights

We reserve all rights not expressly granted to you in the Terms, the Privacy Policy or this AUP, including the right to update or withdraw this AUP under section 16, to cooperate with Apple and with Authorities, and to refuse support or future offerings to a User credibly reported to be in breach. No delay in exercising a right waives it.

12. No third-party beneficiary rights (except Apple)

Apple Inc. and its subsidiaries are intended third-party beneficiaries of the Terms and of this AUP and may enforce it against you. No one else may enforce it against us: a third party harmed by your Misuse must pursue you, not MAHTCA GLOBAL. Nothing here limits an Authority’s right to act against us where we bear independent responsibility.

13. Survival

Your obligations under this AUP, and any indemnity or consequence-of-breach obligation arising while it was in force, survive your removal of the app, any reversal of an in-app purchase and any termination of the Terms. They apply to everything you recorded or exported while this AUP or a prior version was in force.

14. Severability

If any provision of this AUP is found to be invalid or unenforceable, it will be enforced to the maximum extent the law permits, or modified to the closest lawful effect, and the remaining provisions will stand.

15. Governing law and forum

This AUP, and any dispute arising out of or in connection with it, are governed by the laws of Romania, excluding its conflict-of-law rules and excluding the United Nations Convention on Contracts for the International Sale of Goods (Vienna, 11 April 1980), and are subject to the jurisdiction of the courts competent for the registered office of MAHTCA GLOBAL in Romania. Nothing here removes the protection of mandatory consumer rules where you reside, and if you are a consumer you may bring proceedings in the courts of the country where you live so far as the law allows.

16. Changes

We may update this AUP to reflect changes in RiskOS, the law, Apple’s requirements or our practices. The version and effective date above will change. Where a change materially affects your rights, we will make reasonable efforts to tell you first. If you do not accept an update, stop using RiskOS and remove it.

17. Contact

For any question about this AUP, or to submit a Credible Report under section 8, write to riskos@mahtca.com or start from the support page. MAHTCA GLOBAL, Bechetului Nr. 26, Malu Mare, Dolj, Romania. Romanian Trade Register J16/663/2018. CUI 39070729.