Terms of Use

Who provides Risk Atlas

NU WELLBEING LIMITED, trading as Risk Atlas
Company number 10447118 · Registered in England and Wales
Registered office: 483 Green Lanes, London, Surrey, England, N13 4BS
Email: info@risk-atlas.io

These Terms of Use cover the Risk Atlas website and platform. “We”, “us” and “our” mean NU WELLBEING LIMITED. “You” means the person using the service and, where that person has authority, the organisation they represent.

Risk Atlas is a business risk and assurance tool. Read these terms before using it. You must have permission to act for an organisation or enter its information. An employee’s sign-in does not, on its own, place an order or commit the employer to a paid subscription.

A separately accepted customer agreement sets the purchased scope and commercial obligations. If it expressly varies these terms, that agreement takes priority for the customer. An agreed data processing agreement takes priority on processing customer personal data. The Privacy Statement explains our data practices; it is not a request for blanket consent.

Accounts and permissions

• Use your own authorised account and a work email you can keep secure. Do not share verification codes or let someone use your identity.
• Keep your details accurate, sign out on shared devices and report suspected unauthorised access promptly.
• Only view, change, approve, export or connect information within your assigned authority.
• Administrators are responsible for checking membership, roles, company scope and Board access, and promptly updating or removing access when responsibilities change.

Adding a parent, subsidiary, branch or connected company does not authorise unrestricted sharing across the group. Check the relevant permissions and legal basis. Employees and contractors should only have access needed for their work. Contractor access does not expire automatically on a leaving date; an administrator must manage suspension or removal.

Permission to perform a function does not replace your organisation’s governance rules or the need for independent review and approval.

What the platform does

Risk Atlas helps organise risks, incidents, controls, frameworks, evidence, audits, actions, reports and connected information. The features available depend on configuration, your role and your customer agreement.

Scores and heat maps depend on the assessments and settings entered. Automated checks cover the checks configured in the system; they do not establish that every risk, control gap or regulatory requirement has been found. Example dashboards, scenarios and sample data illustrate the service and are not evidence about your organisation.

Framework libraries and control mappings are working aids. Your organisation must determine applicability, check current authoritative sources and obtain any required standards licences. They do not reproduce every requirement or replace the official text.

References to ISO standards, GDPR, the EU AI Act, DORA or other frameworks do not mean Risk Atlas is certified, approved by a regulator or a guarantee of your compliance. The service does not provide a statutory audit opinion or replace qualified legal, regulatory, investment or other professional advice.

AI and human oversight

AI features require an approved connection and administrator enablement. Before enabling them, confirm that the selected data, provider, processing locations and contractual terms are suitable for your organisation.

AI can produce inaccurate, incomplete, outdated or misleading content. A suitably qualified person must check the sources, assumptions, calculations and conclusions before acting on an output or using it in a Board, audit or regulatory report.

The AI analyst does not itself approve risks, issue an audit opinion or take responsibility for management decisions. Do not use it as the sole basis for decisions that materially affect a person’s rights, employment, access to services or safety.

Your organisation remains responsible for risk appetite, treatment, control effectiveness, approvals, reporting and any regulated decisions it makes.

Use the service responsibly

You must not use Risk Atlas to:

• Access another customer’s records, bypass permissions, misuse someone’s account or extract information you are not authorised to receive.
• Upload unlawful content, malicious files, credentials or information you do not have the right to process.
• Falsify evidence, impersonate another person, conceal the origin of a decision or misrepresent an AI draft as independently verified assurance.
• Interfere with the service, overload its interfaces or test security without prior authorisation.
• Infringe intellectual property, confidentiality, privacy or other legal rights, or breach applicable sanctions and export restrictions.

Only upload necessary information and follow your organisation’s retention and classification rules. Evidence uploads are not a substitute for your own malware checks. Report vulnerabilities or suspected misuse privately to info@risk-atlas.io.

Your data and our materials

You and your organisation retain your rights in the information and materials you submit. You give us permission to host, process, display and transmit them only as needed to provide, maintain and secure the agreed service, follow lawful instructions and meet legal obligations.

Our software, branding and original platform materials remain ours or our licensors’. Your right to use them is limited to the permitted use of the service and your customer agreement. Third-party data, standards and materials remain subject to their owners’ rights and licence terms.

You may use and export your organisation’s reports and records within your authority. You must protect copies taken outside the platform. AI output may not be unique, and its use must respect third-party rights.

Our handling of personal information is described in the Privacy Statement. Where we process personal data for a customer, the customer and Risk Atlas must put the required processing terms in place. These Terms of Use alone are not a complete data processing agreement.

APIs, external data and alerts

Connections require appropriate authority, credentials and provider arrangements. Protect API keys and restrict their scope. Third-party services may impose charges, limits and their own terms.

Public sources differ in coverage, accuracy and update frequency. Check timestamps and provenance before relying on them. On-demand retrieval and cached information are not a promise of continuous worldwide monitoring.

Email and SMS alerts depend on configured providers, valid recipient details and permission checks. Messages may be delayed, blocked or fail. Keep an alternative escalation process for urgent or critical matters; Risk Atlas is not an emergency notification service.

Buying, fees and renewal

The pricing and setup page gives illustrative prices and explains how to request a quote. The quote form prepares an email for you to review and send; it does not place an order, collect payment or activate a subscription.

Your accepted written quote or customer agreement must confirm the legal customer, included entities and users, features, onboarding, fees, taxes, payment dates, usage limits and any additional charges. It must also state the service term, renewal, cancellation, refunds where applicable and what happens to data at the end.

There is no automatic purchase or renewal created simply by visiting the website, verifying an email or using the quote form. Do not assume that a displayed feature or an accessible account is included in a particular paid plan; the agreed scope controls your commercial entitlement.

Changes to existing customer prices or commercial commitments must follow the customer agreement. Publishing a new price or these terms does not itself change an already agreed fee.

Availability and responsibility

We will use reasonable care and skill in providing the agreed service. Maintenance, technical problems and provider interruptions can affect availability. Specific uptime, support, recovery, backup and service-credit commitments apply only where agreed in writing.

Keep appropriate copies and independent records of critical decisions. Inform us promptly of faults and cooperate in reasonable steps to reduce their impact.

Any agreed allocation or limit of liability for a customer service is set out in the customer agreement and remains subject to applicable law. These website terms do not introduce a separate financial liability cap.

Nothing in these terms excludes or limits liability for fraud, fraudulent misrepresentation, death or personal injury caused by negligence, or anything else that cannot lawfully be excluded or limited. Mandatory consumer and data protection rights remain unaffected.

Suspension and ending access

We may restrict access where reasonably necessary to protect the service or information, comply with law, investigate a serious breach of these terms or apply an agreed customer contract. Where lawful and practical, we will explain the reason and how to resolve it. Urgent security action may need to happen first.

Your administrator may change or withdraw your workspace permissions. Ending a user’s access is different from cancelling the organisation’s subscription, deleting its data or removing a lawful audit record.

Cancellation, export, return and deletion arrangements are governed by the customer agreement, processing terms and applicable law. Contact us before closure to arrange an authorised export and the handling of retained records. Do not assume that signing out deletes your information.

Changes, law and disputes

The effective date and version appear at the top of this page. We will give appropriate notice of material changes to existing customers and follow any change procedure in their agreements. Where acceptance is legally or contractually required, a website update alone does not replace it.

Unless a customer agreement states otherwise, these terms are governed by the law of England and Wales, and its courts have jurisdiction. This does not override mandatory local laws, any right you have to bring a claim in another competent court, or your right to contact a data protection regulator.

If an issue arises, contact info@risk-atlas.io so we can try to resolve it. If a provision cannot lawfully apply, the remaining provisions continue as far as the law allows. Any delay in enforcing a right does not, by itself, waive it.