User terms (company)

15 October 2026

Introduction
1. These conditions (‘User Conditions’) refer to the use of Mitigater. Through creating an account and using the service you approve the User Conditions stipulated below.
2. The person creating an account on behalf of a company confirms that he or she is authorised to accept these User Conditions on behalf of that company. The company is bound by these User Conditions. The person creating the account is registered as the company's account owner and may transfer that role to another user of the company.
3. If the company has entered into a separate written agreement with Mitigater AB, that agreement shall prevail over these User Conditions in the event of conflict.
4. Each individual user's use of Mitigater on behalf of the company is also governed by Mitigater's User terms (individual). In the event of conflict, these User Conditions prevail over the User terms (individual).
Use of Mitigater
1. Mitigater is a platform for mapping and documenting supply chains at product level. A registered company may use Mitigater to (a) register its company and location details, (b) confirm which of its products it supplies to clients that have invited it, (c) optionally share certificates and compliance documentation with those clients, (d) optionally invite its own suppliers, and (e) view risk levels and reports relating to its supply chain. The purpose is to enable companies to trace the origin of the products they purchase and to assess risks in their supply chains, including for compliance with EU legislation such as CSDDD, CSRD and EUDR (the “Purpose”).
2. You may not register a user account with a false company name.
3. Offensive messages or material may not be published via Mitigater.
Connections and sharing of data
1. Mitigater allows companies to connect with their clients and suppliers. Data is shared with another company only when the company sends or accepts an invitation or a connection in Mitigater, and only to the extent described in Mitigater. By sending or accepting an invitation or a connection, the company authorises Mitigater AB to make such data available to the other company. The sharing constitutes a disclosure from the sharing company to the receiving company, and each company is the data controller for personal data it shares and for personal data it receives through Mitigater.
2. Any registered company may invite its clients and suppliers to connect in Mitigater. An invited company decides itself whether to accept an invitation, and no data registered by the invited company is shared with the inviting company unless the invitation is accepted.
3. Companies further up the supply chain can see the country and risk level of connected suppliers' products, but not the identity of those suppliers. Mitigater AB shall not disclose the identity of a supplier to companies further up the supply chain without that supplier's acceptance.
4. The company is responsible for the accuracy of the information and documents it uploads or shares in Mitigater, and for having the right to share them. The company shall ensure that it has a legal basis under applicable data protection legislation for any personal data it shares with other companies through Mitigater, including contact persons' details when registering or inviting another company. Mitigater AB does not verify, and is not responsible for, the accuracy of information or documents uploaded or shared by other companies.
5. A company that receives data from another company through a connection may use such data only for the Purpose, shall keep it confidential and shall not disclose it to any third party, except through Mitigater in accordance with this section, to its auditors and advisers under a duty of confidentiality, or where required by law. The receiving company is the data controller for personal data it receives and is responsible for complying with applicable data protection legislation in respect of such data, including providing information to the data subjects concerned.
6. The company may end a connection at any time, whereupon data is no longer shared through that connection. Data shared through the connection before it was ended remains available to the receiving company as a record of the information as it stood at that time, but is not updated.
Right of use, Intellectual property rights
1. All intellectual and other rights to or in respect of Mitigater belong to Mitigater AB, or Mitigater AB’s licensor. This includes the risk engine, methodology, algorithms, models and scoring used in Mitigater, and any further development thereof, but not Company Data (see section 5).
2. Through the acceptance of these Conditions and registration of an account you obtain the right to use Mitigater only for the Purpose. All other use is prohibited and you may, for instance, not decompile or in any other way endeavour to reveal the function of Mitigater, ‘hack’ Mitigater, use scraping, automated access or mass extraction of data from Mitigater, use Mitigater or data from Mitigater to develop a competing service, introduce viruses, Trojan horses or other harmful or unwanted codes or in any other way destroy or impair the function of Mitigater or use Mitigater in such a way as may constitute a crime according to law or for any other purpose for which it is not intended to be used.
3. If the company provides suggestions or feedback regarding Mitigater, Mitigater AB may use them freely without any obligation to the company. Such use shall not involve any disclosure of Company Data.
Company data and confidentiality
1. All data uploaded to Mitigater by the company (“Company Data”) belongs to the company. Mitigater AB may only use Company Data to provide Mitigater for the Purpose, except as set out in this section. Data that the company uploads about another company, for example a supplier, is the uploading company's Company Data. Mitigater AB does not sell Company Data and does not use it for advertising.
2. Mitigater AB shall keep Company Data, including supplier lists, sourcing relationships, factory and location information, certificates and audit documents, confidential and shall not disclose it to any third party, except (a) to other companies in accordance with the company's instructions in Mitigater, (b) to service providers engaged by Mitigater AB to provide Mitigater, who are bound by corresponding confidentiality obligations, (c) where the information is or becomes publicly available other than through a breach of these User Conditions, or (d) where disclosure is required by law or by a decision of a public authority.
3. Mitigater AB shall protect Company Data with at least the same degree of care as it uses for its own confidential information, and no less than reasonable care, and shall ensure that its personnel with access to Company Data are bound by a duty of confidentiality.
4. Mitigater uses third-party AI services, currently OpenAI, to search public sources for certificates. Only the name, registration number, VAT number and country of the company searched for are sent, never the identity of the company that initiated the search or any other Company Data. Mitigater AB shall not use Company Data to train AI models, and shall not permit its service providers to do so.
5. Mitigater AB may use Company Data in aggregated and anonymised form, combined with data from a sufficient number of other companies, from which neither the company, its suppliers nor any individual can be identified, to develop and improve Mitigater and to produce statistics.
6. The company may freely use the risk levels, reports and other results generated for it in Mitigater for its own business purposes. However, risk levels relating to other companies may not be published or communicated to third parties as statements about those companies (see section 6).
7. This section shall continue to apply after the termination of these User Conditions (as regards Company Data, for as long as Mitigater AB holds such data) and in the event of an assignment under the section “Assignment”.
Risk levels and information in Mitigater
1. Risk levels in Mitigater are calculated automatically, based on general country data and on whether documentation such as certificates has been registered in Mitigater. Mitigater may use AI to search public sources for certificates, which the company must review and approve before they affect risk levels.
2. Risk levels, AI-generated results and other information in Mitigater are indicative and provided for information purposes only. They do not constitute a statement of fact about, or a verified assessment of, any company, and Mitigater AB does not guarantee that they are accurate or complete.
3. Mitigater is a decision-support tool and does not constitute legal or other advice. The company is solely responsible for its own assessments and decisions and for its compliance with legislation applicable to it, including CSDDD, CSRD and EUDR.
4. The company shall make its own assessment before taking any measure against another company on the basis of a risk level, and shall not publish risk levels relating to other companies or communicate them to third parties as statements about those companies.
5. A company that has been assigned a risk level may at any time register in Mitigater, provide documentation or request correction of information concerning it. Mitigater AB will handle such requests without undue delay.
Accessibility
1. Mitigater AB endeavours to ensure that Mitigater is accessible for use at all times. Mitigater AB, however, does not assume any responsibility for inaccessibility or errors in Mitigater.
2. Mitigater AB reserves the right to develop and modify the functions in Mitigater. Mitigater AB may permanently discontinue Mitigater with at least ninety (90) days' notice, during which the company may export its data in accordance with section 11. Mitigater AB may temporarily suspend access where necessary for security reasons or in the event of a material breach of these User Conditions.
Processing of personal data
1. For further information on the processing of personal data within the scope of Mitigater's role as data controller please read Mitigater's privacy policy: https://mitigater.com/legal/privacy-policy.
2. The processing of personal data that Mitigater AB carries out as data processor on behalf of companies that have entered into a separate agreement with Mitigater AB is regulated by Mitigater's Data Processing Agreement: https://mitigater.com/legal/data-processing-agreement.
3. Mitigater AB does not act as data processor for companies that have not entered into a separate agreement with Mitigater AB. Personal data that companies share with each other through Mitigater is disclosed between those companies as independent data controllers (controller to controller), in accordance with section 3. Notwithstanding this clause, Mitigater AB is the data controller for the processing of personal data relating to user accounts, as described in Mitigater's privacy policy.
Limitation of liability
1. Mitigater AB is not liable for any indirect losses, including but not limited to loss of profit and loss of information or data, that occurs owing to the use or inaccessibility of or errors in Mitigater. Mitigater AB's total liability under these User Conditions shall be limited to EUR 5,000. The limitations of liability in this section shall not apply in cases of intent or gross negligence, or to the extent liability cannot be limited under mandatory law.
2. Any claim against Mitigater AB must be notified in writing within six (6) months after the company became aware, or should have become aware, of the circumstances giving rise to the claim, failing which the right to claim is lost.
Amendments of User Conditions
1. Mitigater AB reserves the right to amend the User Conditions for Mitigater. Material amendments shall be notified by e-mail to the company's registered account owner at least thirty (30) days before they enter into force. Other amendments shall enter into force with the continued use of Mitigater after the information about such amendment has been notified to you by being published in Mitigater. If the company does not accept a material amendment, it may terminate its account before the amendment enters into force. An amendment is material if it materially reduces the company's rights or increases its obligations, including any amendment to section 5. Amendments required by law or by a decision of a public authority may enter into force earlier.
Term of validity
1. Your right to use Mitigater according to these User Conditions applies until your account is terminated in accordance with this section.
2. You can, at any time whatsoever, discontinue your account, whereupon your right to use Mitigater will cease to apply.
3. Mitigater AB is also entitled to terminate your right to use Mitigater with thirty (30) days' notice without any special reason, or with immediate effect in the event of a material breach of these User Conditions.
4. Upon termination, the company may, free of charge, export its Company Data from Mitigater in a structured, commonly used and machine-readable format for at least thirty (30) days, after which Mitigater AB will delete Company Data, unless storage is required by law. Where the company has entered into a separate agreement with Mitigater AB, personal data is returned or deleted in accordance with the Data Processing Agreement. Data shared with other companies through connections before termination is dealt with in accordance with section 3. Where the company terminates in order to switch to another provider, Mitigater AB shall provide the assistance required under Regulation (EU) 2023/2854 (the Data Act).
Assignment
1. Mitigater AB may assign its rights and obligations under these User Conditions to a company within the same group or to an acquirer of all or part of Mitigater AB's business. Mitigater AB shall notify the company of such assignment. The company may not assign its rights or obligations under these User Conditions without Mitigater AB's prior written consent.
Applicable law and disputes
1. Swedish law without its conflict of law principles shall apply to these User Conditions. Any disputes arising out of or in connection with these User Conditions shall be finally settled by Swedish courts with Jönköping District court as first instance.