Terms of Service

These Terms of Service (the "Terms") govern access to and use of the C-MORE’s Due Diligence & Risk Intelligence Supply Chain Platform (the "Platform") by:

C-MORE SUSTAINABILITY, LDA., a private limited company (sociedade por quotas) incorporated under the laws of Portugal, with registered office at Estrada EN 356, Rua Cidade de Ourém, Quinta da Abadia, 2435-057 Caxarias, Ourém, Portugal, registered with the Portuguese Commercial Registry under the single registration and tax number 516143107, with a share capital of EUR 50,000.00 ("C-MORE", "we", "us").

The Platform connects two types of business customers: Suppliers, who upload information and documents about their organisation and their workforce to be qualified, and Clients, who use the Platform to assess Suppliers they work with or intend to work with. Suppliers and Clients are each an "Account Holder".

Structure of these Terms

These Terms consist of:

• Part A — General Terms, which apply to every Account Holder and every User;
• Part B — Supplier Terms, which apply in addition to Part A when you subscribe as a Supplier;
• Part C — Client Terms, which apply in addition to Part A when you subscribe as a Client;
• Annex I — Glossary;
• Annex II — Data Processing Agreement (Article 28 GDPR), with its Appendices;
• Annex III — Data Sharing Agreement between Suppliers and Clients;
• Annex IV — Qualification Methodology and Contestation Procedure.

The Annexes form an integral part of these Terms. In case of conflict: (i) Annex II prevails on the processing of Personal Data on behalf of an Account Holder; (ii) Annex III prevails on the relationship between a Supplier and a Client regarding Shared Data; (iii) Part B or Part C prevails over Part A for the matters they specifically regulate; and (iv) an Order Form signed by C-MORE prevails over these Terms only where it expressly identifies the clause it departs from.

Part A — General Terms

1. Acceptance and contract formation

1.1 The Platform is intended exclusively for businesses, public bodies and other professional organizations acting for purposes relating to their trade, business, craft or profession. It is not offered to consumers. By accepting these Terms, the Account Holder declares that it is not acting as a consumer.

1.2 The person who accepts these Terms on behalf of an Account Holder declares and warrants that he or she has the authority to bind that Account Holder. If that person does not have such authority, he or she shall be personally liable for the obligations assumed.

1.3 The contract between C-MORE and the Account Holder (the "Agreement") is concluded when the Account Holder (i) electronically accepts these Terms during the registration process, (ii) completes the creation of its Account and (iii) selects a Subscription Plan, or, where applicable, when an Order Form is signed by both parties. The Agreement comprises these Terms, the selected Subscription Plan or Order Form and the documents expressly incorporated herein.

1.4 C-MORE's Privacy Policy and Cookie Policy are information documents provided under Articles 13 and 14 of the GDPR. They are not part of the contractual terms and their acknowledgement does not constitute consent to any processing of Personal Data.

1.5 Before concluding the Agreement, the Account Holder had the opportunity to read, store and print these Terms. C-MORE will keep an electronic record of the version accepted, the date and time of acceptance and the User who accepted it.

2. Definitions and interpretation

2.1 Capitalized terms have the meaning given to them in these Terms and in Annex I (Glossary).

2.2 Headings are for convenience only. The words "including" and "in particular" are illustrative and do not limit the generality of the preceding words. References to a law include that law as amended or replaced from time to time.

3. The Service

3.1 Subject to these Terms and to payment of the applicable Fees, C-MORE makes the Platform available to the Account Holder during the Subscription Period, on a software-as-a-service basis, for the Account Holder's internal business purposes, with the functionalities of the selected Subscription Plan (the "Service").

3.2 The Service includes, depending on the type of account:

1. (a) for Suppliers: the storage of documents and information, the automated extraction of data from documents by an AI System, the review of extracted data, the Qualification of the Supplier according to the Qualification Methodology, and the sharing of information with the Clients chosen by the Supplier;
2. (b) for Clients: access to the Qualification of Suppliers and to the information that each Supplier has decided to share with that Client, the download of such information, and the tools made available to manage the Client's supplier base.

3.3 The Service does not include professional services, such as consulting, training, configuration, customisation or integration services ("Professional Services"). Professional Services may be agreed separately by means of a proposal issued by C-MORE and accepted by the Account Holder, which will be governed by these Terms unless the proposal provides otherwise.

3.4 The Service is provided from cloud infrastructure located in the European Union. C-MORE may, at its discretion, choose and change the technical means used to provide the Service, including the cloud provider, the AI model and the software components, provided that (i) the level of security of the Service is not materially reduced and (ii) the provisions of Annex II on Sub-processors are complied with.

4. Nature of the Qualification — important notice

4.1 The Qualification is not a certification. The Qualification is the result of the application, by C-MORE, of the pre-defined and documented rules of the Qualification Methodology to the information and documents provided by the Supplier. It is not a certification, accreditation, audit, inspection, legal opinion or guarantee of any kind, and C-MORE is not an accredited certification body. Neither party shall describe the Qualification as a "certification" or "certificate", or use equivalent expressions, in any language.

4.2 The Qualification supports, but does not replace, the Client's decision. Each Client remains solely responsible for its own decisions regarding the selection, contracting, monitoring and management of its Suppliers, including the decision to allow any worker of a Supplier to access its premises or to perform any work, and for complying with the legal obligations that apply to it (including occupational health and safety, labour, tax, social security and supply chain due diligence obligations).

4.3 Role of artificial intelligence. The AI System is used only to extract and classify information from documents, for review and confirmation by the Supplier. The Qualification itself is determined by rules defined and approved by people, and every result may be validated by a person, as described in Annex IV. No Qualification is the result of a decision based solely on automated processing.

4.5 The Account Holder shall inform its Users, and any third party to whom it discloses a Qualification, of the contents of this Clause 4.

5. Accounts and Users

5.1 The Account Holder shall designate the Users who may access the Platform on its behalf, including at least one administrator User ("Admin User"). Each User must register individually with personal credentials. Credentials are personal and non-transferable and may not be shared.

5.2 Multi-factor authentication is mandatory for all Users, unless the Account Holder uses single sign-on (SSO) made available by C-MORE, in which case the Account Holder is responsible for the security of its identity provider.

5.3 The Account Holder is responsible for (i) keeping the list of its Users up to date and promptly removing access for persons who leave its organisation or no longer need access; (ii) ensuring that its Users comply with these Terms; and (iii) all acts and omissions of its Users and of any person using its Users' credentials, which shall be deemed acts and omissions of the Account Holder.

5.4 The Account Holder shall notify C-MORE immediately at legal@thecmorecompany.com if it becomes aware or suspects any unauthorised use of its Account or any credential.

5.5 The Admin Users are the Account Holder's contact persons for all communications and notices relating to the Agreement, unless the Account Holder indicates otherwise in the Platform.

6. Acceptable use

6.1 The Account Holder shall use, and shall ensure that its Users use, the Platform responsibly, in accordance with these Terms, applicable law and C-MORE's reasonable instructions.

6.2 The Account Holder shall not, and shall ensure that its Users do not, directly or indirectly:

1. (a) upload, store or transmit any content that is unlawful, infringing, defamatory, discriminatory, false or misleading, or that the Account Holder does not have the right to upload or share;
2. (b) upload documents or data outside the categories made available in the Platform, or upload identity document copies, health data, criminal record data or photographs in breach of Clause 28;
3. (c) upload forged, altered or manipulated documents, or documents that the Account Holder knows or should know to be invalid or expired, unless identified as such;
4. (d) upload files containing viruses, malware, malicious code or hidden instructions intended to manipulate the AI System or the Platform (including "prompt injection" content);
5. (e) attempt to access data of other Account Holders, circumvent access controls, tenant isolation, download limits or any other security measure, or test the vulnerability of the Platform without C-MORE's prior written authorisation;
6. (f) carry out systematic or automated extraction of data from the Platform (scraping, crawling, bulk download), or use bots or other automated means, other than the interfaces and exports expressly made available by C-MORE;
7. (g) copy, modify, translate, create derivative works of, reverse engineer, decompile or disassemble the Platform, except to the extent expressly permitted by mandatory law;
8. (h) resell, sublicense, rent, lend, time-share or otherwise make the Platform available to third parties, or use it on behalf of third parties, other than as expressly provided in these Terms;
9. (i) use the Platform, the Qualification Methodology or any output of the Service to develop, train or benchmark a competing product or service;
10. (j) use the Platform to profile, score or rank individual workers, or to make decisions about individual workers based solely on information obtained from the Platform;
11. (k) remove or alter any proprietary notice, watermark or reference to C-MORE in the Platform or its outputs; or
12. (l) use the Platform in breach of applicable sanctions or export control laws.

6.3 C-MORE may apply technical limits to the use of the Platform, including file size and format limits, malware scanning, download limits and rate limits, to protect the security and availability of the Service.

7. Service levels, support and maintenance

7.1 C-MORE will use commercially reasonable efforts to make the Platform available in accordance with the service levels set out at the applicable SLA Policy and to provide technical support through the channels and during the hours indicated therein.

7.2 C-MORE may carry out maintenance of the Platform whenever necessary. C-MORE will endeavour to schedule planned maintenance outside business hours in Portugal and to give prior notice in the Platform, but does not guarantee it. Emergency maintenance may be carried out without notice.

7.3 Unavailability caused by planned or emergency maintenance, by the Account Holder or its Users, by third-party networks or services outside C-MORE's reasonable control, by Force Majeure, or by suspension in accordance with these Terms, shall not count towards the service levels and shall not entitle the Account Holder to any compensation or reduction of Fees.

8. Changes to the Service and to these Terms

8.1 C-MORE may evolve and modify the Platform, its functionalities and its technical infrastructure, provided that such changes do not materially reduce the core functionalities of the Subscription Plan subscribed during the current Subscription Period.

8.2 C-MORE may amend these Terms at any time. Amendments take effect immediately upon notification to the Account Holder, or on any later date indicated in the notification. C-MORE will notify amendments by any of the following means: (i) by requiring the Users to accept the amended Terms when they next access the Platform; (ii) by email to the Admin Users; or (iii) by notice in the Platform.

8.3. C-MORE may make the continued access to and use of the Platform conditional on the express acceptance of the amended Terms by an Admin User. Until such acceptance is given, C-MORE may restrict access to the Platform to the functionalities necessary to review the amended Terms and to export Customer Data. The express acceptance of the amended Terms, or the continued use of the Platform after notification, constitutes acceptance of the amended Terms by the Account Holder.

9. Subscription Period, renewal and cancellation

9.1 The Agreement begins on the date of its conclusion and the initial Subscription Period has a duration of twelve (12) months from the date on which the Account is activated, unless otherwise stated in the Order Form.

9.2 Automatic renewal. At the end of each Subscription Period, the Subscription is automatically renewed for successive periods of twelve (12) months, unless the Account Holder or C-MORE cancels the renewal by notice given at least thirty (30) days before the end of the current Subscription Period.

9.3 The Account Holder may cancel the renewal at any time, until the deadline in Clause 9.2, through the account settings in the Platform. C-MORE will confirm the cancellation in writing.

9.4 Cancellation of the renewal takes effect at the end of the current Subscription Period. Except as expressly provided in these Terms, the Account Holder may not terminate the Agreement before the end of the current Subscription Period, and the Fees for the current Subscription Period remain due in full and are not refundable.

10. Fees, invoicing and payment

10.1 The Fees are those of the Subscription Plan selected by the Account Holder, as displayed in the Platform at the time of subscription or as set out in the Order Form. Unless stated otherwise, Fees are expressed in euros and exclude VAT and any other applicable taxes, which shall be borne by the Account Holder.

10.2 Fees are payable annually in advance: (i) for the initial Subscription Period, on subscription; and (ii) for each renewal, on the first day of the renewed Subscription Period. C-MORE may charge the payment method associated with the Account on those dates. Where invoicing is agreed, invoices are payable within thirty (30) days of their date.

10.3 Payment by card or other electronic means is processed by a third-party payment service provider, Stripe, which acts under its own terms and as an independent controller of the payment data it collects. C-MORE does not store full card data.

10.4 Price changes. C-MORE may change the Fees for any renewal period by notifying the Admin Users at least ten (10) days before the end of the current Subscription Period, so that the Account Holder may cancel the renewal within the deadline set out in Clause 9.2. In the absence of such notice, the Fees for the renewal period may be updated in accordance with the euro area Harmonised Index of Consumer Prices (HICP) published by Eurostat for the preceding calendar year.

10.5 No refunds. Fees are non-refundable, including where the Account Holder does not use the Platform or does not use all the functionalities or Users included in its Subscription Plan, except where these Terms expressly provide for a refund.

10.6 Late payment. If any amount is not paid when due, C-MORE may (i) charge late payment interest at the rate applicable to commercial transactions under Portuguese law (Decree-Law 62/2013), from the due date until full payment; and (ii) after giving the Account Holder at least ten (10) days' notice, suspend access to the Platform until full payment, without the suspension affecting the obligation to pay the Fees.

11. Data protection

11.1 Each party shall comply with the data protection laws applicable to it, including Regulation (EU) 2016/679 (the "GDPR"), Law No. 58/2019 of 8 August and Law No. 41/2004 of 18 August.

11.2 C-MORE as processor. C-MORE processes the Personal Data contained in Customer Data on behalf of the Account Holder, as processor, in order to provide the Service, under the terms of the Data Processing Agreement in Annex II. This includes the hosting of documents, their processing by the AI System, the review of extracted data and the sharing of information with the Clients chosen by the Supplier.

11.3 C-MORE as controller. C-MORE processes Personal Data as controller, under its Privacy Policy, for: (i) the management of Accounts, Users, billing and the contractual relationship; (ii) the security of the Platform, audit trails and fraud prevention; (iii) the Qualification, as described in Annex IV and in the Qualification Privacy Notice; (iv) the handling of contestations and the defence of legal claims; and (v) the marketing activities described in the Privacy Policy, where applicable.

11.4 Clients as independent controllers. Each Client is an independent controller of the Shared Data it accesses or downloads, from the moment of access, in accordance with Annex III.

11.5 The contact details of the Users are processed by each party as independent controllers for the purposes of entering into and managing the Agreement. Each party shall inform its own representatives and Users of such processing.

12. Artificial intelligence and use of data to improve the Service

12.1 AI System. The Platform uses an AI System, developed and made available by C-MORE using a general-purpose AI model provided by a third party, to extract and classify information from documents. The Account Holder acknowledges that AI-generated output may be inaccurate or incomplete. For this reason, extracted data are presented to the Supplier for review and confirmation.

12.2 No training of third-party models. C-MORE shall ensure, by contract, that the provider of the AI model (i) processes Customer Data only to provide the requested output, (ii) does not use Customer Data to train or improve its own models and (iii) does not retain Customer Data beyond what is strictly necessary for the technical processing of each request, and processes it within the European Union.

12.3 Anonymised Data. The Account Holder instructs and authorises C-MORE to create, from Customer Data and from the use of the Service, data that has been anonymised in such a way that it no longer relates to an identified natural person nor identifies the Account Holder ("Anonymised Data. C-MORE may use Anonymised Data, during and after the term of the Agreement, to operate, maintain, secure, evaluate, develop and improve the Platform, the AI System and the Qualification Methodology, and to produce statistics and benchmarks. Anonymised Data is the exclusive property of C-MORE.

12.4 Undertakings. In any event, C-MORE: (i) shall not sell, rent or license Customer Data to third parties; (ii) shall not identify any Account Holder in any benchmark or statistic made available to third parties without its prior written consent; and (iii) shall, upon reasonable written request, provide the Account Holder with a description of the AI functionalities of the Platform and of the safeguards described in this Clause.

12.5 Where the Platform makes available a conversational assistant or other functionality through which Users interact directly with an AI System, the Platform will inform Users that they are interacting with an AI System.

13. Intellectual property

13.1 C-MORE and its licensors own all intellectual property rights in the Platform, the AI System, the Qualification Methodology, the Qualifications, the reports and other outputs generated by the Platform (excluding the Customer Data they contain), the documentation and Anonymised Data, including all improvements and derivative works. Except for the rights expressly granted in these Terms, no right or licence is granted to the Account Holder.

13.2 The Account Holder retains all rights in the Customer Data. The Account Holder grants C-MORE a non-exclusive, worldwide, royalty-free license, for the term of the Agreement and for the retention periods set out in these Terms, to host, copy, process, transmit and display Customer Data to the extent necessary to provide the Service, to comply with law and to exercise its rights under these Terms, including Clause 12.3.

13.3 C-MORE grants the Account Holder a limited, non-exclusive, non-transferable, non-sublicensable licence, for the Subscription Period, to access and use the Platform and its outputs for its internal business purposes, in accordance with these Terms. Clients may disclose a Qualification to their own auditors, advisers and competent authorities, provided that they do so in its entirety, without alteration and together with the notice in Clause 4.

13.4 If the Account Holder or its Users provide suggestions or feedback about the Service, C-MORE may use them freely, without any obligation to the Account Holder.

14. Confidentiality

14.1 Each party shall keep confidential the Confidential Information of the other party, use it only for the purposes of the Agreement and disclose it only to its employees, Affiliates, Sub-processors and advisers who need to know it and are bound by equivalent confidentiality obligations.

14.2 The obligations in Clause 14.1 do not apply to information that (i) is or becomes public without breach of the Agreement; (ii) was lawfully in the possession of the receiving party before disclosure; (iii) is independently developed by the receiving party; or (iv) must be disclosed by law or by order of a competent authority, in which case the receiving party shall, where legally permitted, notify the other party in advance.

14.3 These confidentiality obligations survive for five (5) years after the end of the Agreement, and indefinitely in respect of trade secrets and Personal Data.

15. Warranties and disclaimers

15.1 C-MORE warrants that the Platform, as provided by C-MORE, will perform substantially in accordance with its description during the Subscription Period.

15.2 The Account Holder warrants that (i) it has all the rights, authorisations and legal grounds necessary to upload, process and, where applicable, share the Customer Data through the Platform; (ii) the Customer Data is accurate, complete and up to date, and does not infringe the rights of any third party; and (iii) it will comply with applicable law in the use of the Platform.

15.3 To the maximum extent permitted by law, C-MORE does not warrant that: (i) the Platform will be uninterrupted or error-free; (ii) the output of the AI System will be accurate or complete; (iii) any Supplier qualified through the Platform will perform its obligations, comply with the law or be suitable for any particular purpose; or (iv) the use of the Platform will ensure the Account Holder's compliance with any legal obligation. All other warranties, express or implied, including of merchantability, satisfactory quality and fitness for a particular purpose, are excluded.

16. Limitation of liability

16.1 Nothing in these Terms excludes or limits either party's liability for (i) wilful misconduct or gross negligence; (ii) death or personal injury caused by its acts or omissions; or (iii) any other liability that cannot be excluded or limited under applicable law.

16.2 Subject to Clause 16.1, C-MORE shall not be liable for: (i) loss of profits, revenue, business, contracts, goodwill or reputation; (ii) indirect, consequential or special damages; (iii) loss or corruption of data, beyond the obligation to restore it from the latest available backup; (iv) damages resulting from decisions taken by a Client regarding a Supplier or its workers, or from the use of Shared Data by a Client; (v) damages resulting from the inaccuracy, falsity or expiry of information provided by a Supplier; or (vi) damages caused by the acts or omissions of third parties not acting on behalf of C-MORE.

16.3 Subject to Clause 16.1, C-MORE's total aggregate liability arising out of or in connection with the Agreement, whether in contract, tort or otherwise, shall not exceed, in each period of twelve (12) months, the total amount of Fees paid by the Account Holder under the Agreement in the twelve (12) months preceding the event giving rise to the liability.

16.4 The Account Holder's liability is not limited in respect of (i) payment of the Fees; (ii) breach of Clauses 6 (Acceptable use), 13 (Intellectual property) or 24 (Compliance); (iii) the indemnity in Clause 17; or (iv) the warranties in Clause 15.2.

16.5 The parties acknowledge that the limitations in this Clause 16 are reasonable, reflect the allocation of risk agreed between them and were taken into account in determining the Fees.

17. Indemnity

17.1 The Account Holder shall indemnify and hold harmless C-MORE, its Affiliates, officers and employees from and against all claims, losses, damages, fines, costs and expenses (including reasonable legal fees) arising out of or in connection with: (i) the Customer Data, including any claim that the Customer Data infringes the rights of a third party or was uploaded or shared without a valid legal basis or without the information required by law having been provided to the Data Subjects; (ii) breach by the Account Holder or its Users of Clauses 6, 15.2, Part B or Part C, as applicable, or Annex III; and (iii) any decision taken by a Client regarding a Supplier or its workers.

17.2 C-MORE shall notify the Account Holder promptly of any claim covered by Clause 17.1, allow it to participate in the defence and not settle the claim without consulting it, without prejudice to C-MORE's right to take any urgent measures necessary to protect its interests.

18. Suspension

18.1 C-MORE may suspend, in whole or in part, the access of the Account Holder or of any User to the Platform, with immediate effect and, where reasonably possible, with prior notice, if: (i) it has reasonable grounds to believe that the Account Holder or a User has breached Clause 6, Clause 24 or Annex III; (ii) the access poses a security risk to the Platform or to other Account Holders; (iii) suspension is required by law or by a competent authority; or (iv) the conditions in Clause 10.6 are met.

18.2 C-MORE will restore access as soon as the reason for the suspension has ceased. Suspension does not entitle the Account Holder to any compensation or reduction of Fees, and does not affect the Account Holder's obligation to pay the Fees.

19. Termination

19.1 Either party may terminate the Agreement by written notice if the other party commits a material breach of the Agreement and fails to remedy it within thirty (30) days of receiving notice requiring the remedy, or immediately if the breach cannot be remedied.

19.2 Either party may terminate the Agreement with immediate effect if the other party is declared insolvent, enters into liquidation or any arrangement with its creditors, or ceases its activity.

19.3 C-MORE may terminate the Agreement with immediate effect by written notice in the cases set out in Clause 24 (Compliance) and where the Account Holder or a User uploads forged documents, attempts to gain unauthorised access to data of other Account Holders, or carries out bulk extraction of data from the Platform.

19.4 If C-MORE terminates the Agreement under Clauses 19.1 to 19.3, all Fees for the current Subscription Period become immediately due. If the Account Holder terminates the Agreement under Clause 19.1, C-MORE will refund the prepaid Fees corresponding to the unused part of the current Subscription Period.

19.5 Switching and data export. The Account Holder may at any time export its Customer Data in a structured, commonly used and machine-readable format, using the export functionalities of the Platform.

19.6 Effects of termination. Upon termination or expiry of the Agreement: (i) access to the Platform ends; (ii) the Account Holder may export its Customer Data during the thirty (30) days following termination; (iii) after that period, C-MORE will delete the Customer Data in accordance with Annex II, except for data that C-MORE must retain by law or for the purposes set out in Clause 11.3, as described in the Privacy Policy; and (iv) the clauses that by their nature should survive termination shall remain in force, including Clauses 4, 12.3, 13, 14, 16, 17, 21 and 25, and Annexes II and III.

20. Force majeure

20.1 Neither party shall be liable for failure to perform its obligations (other than payment obligations) caused by Force Majeure, provided that it notifies the other party promptly and makes reasonable efforts to mitigate its effects. C-MORE may give such notice through the Platform.

20.2 If Force Majeure prevents the performance of the Agreement for more than ninety (90) consecutive days, either party may terminate the Agreement by written notice, and C-MORE will refund the prepaid Fees corresponding to the period during which the Service could not be provided.

21. References and publicity

21.1 C-MORE may identify the Account Holder by name and logo as a user of the Platform in its commercial materials, unless the Account Holder objects by notice to legal@thecmorecompany.com

21.2 C-MORE may display its trademarks and the words "Powered by C-MORE" in the Platform and in its outputs. The Account Holder shall not remove them.

22. Communications and notices

22.1 The Account Holder agrees to receive communications and notices relating to the Agreement electronically, by email to the Admin Users or by notice in the Platform. Notices to C-MORE shall be sent to legal@thecmorecompany.com without prejudice to the use of registered letter to C-MORE's registered office.

22.2 Service-related communications (including security notices, changes to these Terms, renewal reminders and invoices) are part of the Service and are not marketing communications. Marketing communications are governed by the Privacy Policy and require the recipient's consent where required by law.

22.3 C-MORE's electronic records and logs of the Platform constitute evidence of the acts performed in the Platform, including the acceptance of these Terms, the sharing of information and downloads, without prejudice to proof to the contrary.

23. Assignment and subcontracting

23.1 The Account Holder may not assign or transfer the Agreement without C-MORE's prior written consent. C-MORE may assign the Agreement to an Affiliate or to a successor in the business relating to the Platform, by notice to the Account Holder.

23.2 C-MORE may subcontract the performance of its obligations, remaining responsible for the acts of its subcontractors. The engagement of Sub-processors is governed by Annex II.

24. Compliance: anti-corruption, sanctions and ethics

24.1 Each party shall comply with applicable anti-corruption, anti-money laundering, counter-terrorist financing, sanctions and export control laws, including those of the European Union, Portugal and the United Nations.

24.2 Each party declares that neither it nor its directors, nor, to its knowledge, its beneficial owners, are subject to sanctions imposed by the United Nations, the European Union, Portugal or other applicable jurisdictions.

24.3 Either party may suspend the performance of the Agreement or terminate it with immediate effect if the other party breaches this Clause 24.

24.4 C-MORE conducts its activities in accordance with its Code of Ethics and Conduct

25. Governing law and jurisdiction

25.1 The Agreement is governed by the laws of Portugal. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

25.2 The parties shall endeavour to resolve amicably any dispute arising out of or in connection with the Agreement. If the dispute is not resolved within thirty (30) days, it shall be submitted to the exclusive jurisdiction of the courts of the judicial district of Lisbon (Comarca de Lisboa), without prejudice to C-MORE's right to bring proceedings in the courts of the Account Holder's domicile or to seek urgent interim measures in any competent court.

26. General provisions

26.1 These Terms, together with the Subscription Plan or Order Form, constitute the entire agreement between the parties on their subject matter and supersede any prior agreements. Any general terms and conditions of the Account Holder, including purchase terms, shall not apply, even if referred to in a purchase order.

26.2 If any provision of these Terms is found invalid or unenforceable, the remaining provisions shall remain in force, and the invalid provision shall be replaced by a valid provision that comes as close as possible to the intention of the parties.

26.3 The failure or delay of a party in exercising a right does not constitute a waiver of that right.

26.4 Nothing in the Agreement creates a partnership, joint venture, agency or employment relationship between the parties. Except as provided in Annex III, the Agreement does not confer rights on third parties.

26.5 These Terms are drawn up in English. If C-MORE makes available a translation, the English version prevails in case of discrepancy, unless C-MORE expressly states otherwise.

Part B — Supplier Terms

27. Scope

27.1 This Part B applies to Account Holders who subscribe to the Platform as Suppliers.

28. Supplier obligations regarding Customer Data

28.1 The Supplier is the controller of the Personal Data of its workers, subcontractors and other persons that it uploads to the Platform, and is solely responsible for determining the legal basis for such processing and for its sharing with Clients.

28.2 The Supplier shall upload only the documents and information that are necessary for the purposes of the Platform and that correspond to the document categories made available in the Platform. Within those categories, the Supplier may upload, under its sole responsibility:

1. (a) copies of identity documents, including the Portuguese Citizen Card (Cartão de Cidadão), provided that the Supplier has obtained the holder's consent where required by Law 7/2007 of 5 February, or has another lawful ground for the copy;
2. (b) health information, including occupational fitness certificates issued under Law 102/2009 and other medical documents, provided that the processing is permitted under Article 9(2) of the GDPR and does not breach Article 17 of the Portuguese Labour Code or other applicable law;
3. (c) criminal record certificates, provided that the processing is authorised under Article 10 of the GDPR and by applicable law for the function concerned; and
4. (d) photographs of workers, provided that the Supplier has a lawful ground for doing so. The Supplier shall not request or allow any biometric processing of such photographs, and the Platform does not carry out any such processing.

28.3 The Supplier declares and warrants that, before uploading any of the documents referred to in Clause 28.2, it has verified and holds a valid legal basis and, where applicable, the conditions required by Articles 9 and 10 of the GDPR, has informed the Data Subjects, and limits the documents uploaded to what is strictly necessary. C-MORE does not verify, and is not responsible for, the existence of such legal basis or conditions. The Supplier shall indemnify C-MORE in accordance with Clause 17 for any claim, fine or loss arising from the upload or sharing of such documents.

28.5 The Supplier shall review the data extracted by the AI System before confirming it, and is responsible for the accuracy of the data it confirms. The Supplier shall keep its documents up to date and shall remove or replace documents that have expired, have been revoked or are no longer accurate.

29. Information to workers — Supplier Declaration

29.1 The Supplier shall, before uploading any Personal Data of a worker or other natural person, provide that person with the information required by Article 13 of the GDPR, which shall include at least: (i) the use of the Platform, operated by C-MORE as processor; (ii) the processing of documents by an AI System for data extraction; (iii) the categories of Clients with whom the information may be shared; and (iv) a reference to C-MORE's Qualification Privacy Notice, which the Supplier shall make available to such persons.

29.2 When uploading Personal Data of workers, the Supplier's User shall confirm, in the Platform, a declaration that the Supplier has provided the information referred to in Clause 29.1 (the "Supplier Declaration"). The Supplier acknowledges that the Supplier Declaration is a declaration of compliance with the Supplier's information obligations, and not a consent of the Data Subjects, and that the processing of workers' documents through the Platform should not be based on the consent of the workers.

29.3 Where the Supplier wishes to include in a worker's profile optional information that is not required for the purposes of the Platform, the Supplier is responsible for obtaining and recording the worker's consent, where required, and for respecting its withdrawal.

30. Sharing with Clients

30.1 The Supplier decides, through the Platform, which Clients may access its Qualification and which sets of information are shared with each Client. Sharing is always an act of the Supplier.

30.2 By sharing information with a Client, the Supplier accepts, in its relationship with that Client, the Data Sharing Agreement in Annex III. The Supplier acknowledges that, from the moment the Client accesses or downloads Shared Data, the Client is an independent controller of such data, and that C-MORE has no control over the use that the Client makes of downloaded data.

30.3 The Supplier may revoke the sharing with a Client at any time through the Platform. Revocation prevents future access by the Client but does not affect copies already downloaded, which remain subject to Annex III.

30.4 Where the Supplier shares information with a Client established outside the European Economic Area in a country not covered by an adequacy decision, the Data Sharing Agreement incorporates the Standard Contractual Clauses (controller to controller), as set out in Annex III.

31. Qualification

31.1 The Supplier acknowledges that C-MORE issues the Qualification as controller, in accordance with the Qualification Methodology in Annex IV, which is the same for all Clients.

31.2 The Supplier may contest a Qualification result in accordance with the procedure in Annex IV. The contestation procedure is without prejudice to the rights of Data Subjects under the GDPR.

31.3 The Supplier acknowledges that a Qualification result, including a negative result validated in accordance with Annex IV, will be visible to the Clients with whom the Supplier has shared its Qualification, and that C-MORE shall not be liable for the consequences of an accurate application of the Qualification Methodology to the information provided by the Supplier.

32. End of the Supplier's subscription

32.1 Upon the end of the Supplier's subscription, Clients will no longer have access to the Supplier's Qualification or Shared Data through the Platform, and the Supplier's Customer Data will be returned and deleted in accordance with Clause 19.6 and Annex II. The Qualification history is retained by C-MORE in accordance with Annex IV.

Part C — Client Terms

33. Scope

33.1 This Part C applies to Account Holders who subscribe to the Platform as Clients.

34. Permitted use

34.1 The Client may access the Qualification of a Supplier and the Shared Data only if, and to the extent that, the Supplier has shared it with the Client, and only for the purpose of assessing, selecting, contracting, monitoring and managing that Supplier and controlling the access of the Supplier's workers to the Client's premises or projects (the "Permitted Purpose").

34.2 The Client shall not: (i) use the Qualification or the Shared Data for any purpose other than the Permitted Purpose; (ii) disclose Shared Data to third parties, other than its auditors, advisers, insurers and competent authorities who need to know it for the Permitted Purpose, or its contractors acting on its behalf as processors; (iii) combine Shared Data with other data to profile individual workers; (iv) use Shared Data to make decisions about individual workers based solely on automated processing; or (v) attempt to obtain from the Platform information that a Supplier has not shared with it.

34.3 The Client shall not base a decision regarding a Supplier exclusively on the Qualification and shall carry out its own assessment, as provided in Clause 4.

35. Downloads

35.1 Downloads are subject to the limits and security measures of the Platform, including watermarks and download logs. Each download is recorded and visible to the Supplier concerned.

35.2 The Client shall retain downloaded Shared Data only for as long as necessary for the Permitted Purpose and, in any event, for no longer than the period set out in Annex III, and shall then delete it securely, unless a longer retention period is required by law.

35.3 The Client is responsible for the security of the Shared Data it downloads and for any processing it carries out after download, including any transfer outside the European Economic Area.

36. Client as independent controller

36.1 The Client is an independent controller of the Shared Data from the moment it accesses or downloads it, and accepts Annex III in its relationship with each Supplier that shares data with it.

36.2 Where the Client records in the Platform its own information about Suppliers (for example, internal assessments, notes or incident records), C-MORE processes any Personal Data contained therein as the Client's processor under Annex II.

36.3 The Client shall ensure that criminal record certificates are requested from Suppliers only for functions for which the law expressly requires them, and shall record in the Platform the legal basis for each request, as provided in Annex IV.

37. End of the Client's subscription

37.1 Upon the end of the Client's subscription, its access to the Platform ends immediately. The Suppliers' data remain in the Platform under the control of the Suppliers. Data previously downloaded by the Client remain subject to Annex III and to Clause 35.2.

Annex I — Glossary

Account: the account created in the Platform for an Account Holder.

Account Holder: a Supplier or a Client that has entered into the Agreement with C-MORE.

Affiliate: any entity that controls, is controlled by or is under common control with a party, where control means holding, directly or indirectly, more than 50% of the share capital or voting rights, or the power to direct its management.

AI System: the artificial intelligence system integrated in the Platform, developed by C-MORE, that extracts and classifies information from documents uploaded by Suppliers.

Anonymised Data: has the meaning given in Clause 12.3.

Client: an Account Holder that uses the Platform to assess Suppliers.

Confidential Information: all non-public information disclosed by one party to the other in connection with the Agreement, including Customer Data, the Qualification Methodology rules, information on the Platform's security and the commercial terms of the Agreement.

Customer Data: all data, documents and information uploaded to the Platform by or on behalf of an Account Holder, including data extracted from such documents and confirmed by the Supplier.

Data Subject: an identified or identifiable natural person to whom Personal Data relates.

Fees: the amounts payable by the Account Holder for the Subscription.

Force Majeure: any event beyond the reasonable control of the affected party that could not reasonably have been foreseen or avoided, including natural disasters, epidemics, war, terrorism, riots, general strikes, prolonged failure of public telecommunications networks or energy supply, and large-scale cyberattacks on third-party infrastructure that could not have been prevented by appropriate security measures.

Order Form: a document signed by C-MORE and the Account Holder setting out specific commercial terms.

Personal Data: any information relating to a Data Subject, as defined in Article 4(1) of the GDPR.

Qualification: the result, issued by C-MORE, of the application of the Qualification Methodology to the information provided by a Supplier.

Qualification Methodology: the rules, criteria and procedures for the Qualification, described in Annex IV.

Shared Data: the Customer Data that a Supplier decides to share with a Client through the Platform.

Sub-processor: any processor engaged by C-MORE to process Personal Data on behalf of an Account Holder.

Subscription Period: the initial subscription period and each renewal period.

Subscription Plan: the commercial plan selected by the Account Holder, with the functionalities, limits and Fees described in the Platform.

Supplier: an Account Holder that uses the Platform to upload information about its organisation and workforce and to be qualified.

User: a natural person authorised by an Account Holder to access the Platform on its behalf.

Annex II — Data Processing Agreement

This Data Processing Agreement ("DPA") is entered into under Article 28(3) of the GDPR between the Account Holder, as controller (the "Controller"), and C-MORE, as processor (the "Processor"), and applies whenever C-MORE processes Personal Data on behalf of the Account Holder in the context of the Service.

1. Subject matter, duration and instructions

1.1 The subject matter, nature, purpose and duration of the processing, the types of Personal Data and the categories of Data Subjects are described in Appendix 1.

1.2 The Processor shall process Personal Data only on documented instructions from the Controller, including with regard to transfers to third countries, unless required to do so by Union or Member State law, in which case it shall inform the Controller of that legal requirement before processing, unless the law prohibits such information.

1.3 The Controller's documented instructions are: (i) these Terms, including this DPA; (ii) the configurations and actions carried out by the Controller's Users in the Platform, including uploading documents, confirming extracted data, sharing information with Clients and deleting data; and (iii) any other written instructions agreed between the parties. The Controller instructs the Processor, in particular, to: (a) process documents through the AI System to extract and classify data; (b) make Shared Data available to the Clients chosen by the Supplier; and (c) create Anonymised Data in accordance with Clause 12.3 of the Terms.

1.4 The Processor shall immediately inform the Controller if, in its opinion, an instruction infringes the GDPR or other data protection law.

1.5 No processing for the Processor's own purposes. The Processor shall not process Personal Data contained in Customer Data for its own purposes, including for training, fine-tuning or evaluating the AI System or any other model, for building databases of suppliers or workers for use outside the sharing decided by the Supplier, or for marketing purposes. This is without prejudice to the processing carried out by C-MORE as controller for the Qualification and for the other purposes listed in Clause 11.3 of the Terms.

2. Confidentiality

2.1 The Processor shall ensure that persons authorised to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that they have received appropriate training in data protection, information security and, where relevant, AI literacy.

3. Security

3.1 The Processor shall implement the technical and organisational measures described in Appendix 2, in accordance with Article 32 of the GDPR. The Processor may update such measures provided that the overall level of security is not reduced.

4. Sub-processors

4.1 The Controller grants the Processor a general authorisation to engage Sub-processors. The Sub-processors engaged at the date of these Terms are listed in Appendix 3.

4.2 The Processor shall inform the Controller of any intended addition or replacement of Sub-processors at least thirty (30) days in advance, by email to the Admin Users and by notice in the Platform. The Controller may object on reasonable grounds related to data protection within that period. If the parties cannot resolve the objection in good faith, the Controller may terminate the affected part of the Service by written notice given before the change takes effect and, in that case, the Processor will refund the prepaid Fees corresponding to the unused part of the Subscription Period. In the absence of objection, the change is deemed accepted.

4.3 The Processor shall impose on each Sub-processor, by written contract, data protection obligations that offer at least the same level of protection as this DPA, including, for the provider of the AI model, the prohibition of using Customer Data, prompts and outputs to train or improve its models, zero or minimal data retention and processing within the European Union. The Processor remains liable to the Controller for the performance of its Sub-processors' obligations.

5. International transfers

5.1 The Processor shall not transfer Personal Data outside the European Economic Area, nor allow Sub-processors to do so, except (i) on the Controller's instructions, including the sharing of Shared Data with Clients established outside the EEA decided by the Supplier, which is governed by Annex III; or (ii) where the transfer is covered by an adequacy decision or by appropriate safeguards under Chapter V of the GDPR and the Processor has informed the Controller in accordance with Clause 4.2.

6. Assistance

6.1 Taking into account the nature of the processing, the Processor shall assist the Controller by appropriate technical and organisational measures in responding to requests from Data Subjects exercising their rights. If the Processor receives such a request directly, it shall forward it to the Controller without undue delay and, in any event, within five (5) business days, and shall not respond to it except on the Controller's instructions, without prejudice to requests concerning processing for which C-MORE is controller.

6.2 The Processor shall assist the Controller in ensuring compliance with Articles 32 to 36 of the GDPR, taking into account the nature of the processing and the information available to the Processor, including by making available a summary of the data protection impact assessment of the Platform.

7. Personal data breaches

7.1 The Processor shall notify the Controller without undue delay, and in any event within twenty-four (24) hours after becoming aware of it, of any personal data breach affecting Customer Data, providing the information required by Article 33(3) of the GDPR available at the time, and supplementing it as soon as further information becomes available.

7.2 The Processor shall take the measures necessary to contain the breach and mitigate its effects, and shall cooperate with the Controller. The Processor shall not notify the supervisory authority or the Data Subjects of breaches affecting Customer Data on behalf of the Controller, unless instructed by the Controller or required by law.

8. Deletion and return

8.1 Personal Data is retained in accordance with the retention settings configured by the Controller in the Platform or, in their absence, with the default periods set out in Appendix 1.

8.2 Upon termination of the Agreement, the Controller may export its Customer Data during the period set out in Clause 19.6 of the Terms. After that period, the Processor shall delete all Personal Data processed on behalf of the Controller within thirty (30) days, and shall issue a deletion certificate upon request, unless Union or Member State law requires the retention of the Personal Data. Deletion from backups shall occur in accordance with the backup retention cycle, during which the data remains protected and is not actively processed.

9. Audits

9.1 The Processor shall make available to the Controller all information necessary to demonstrate compliance with Article 28 of the GDPR, summaries of third-party audit reports and penetration test results, and the answers to reasonable security questionnaires.

9.2 Where the information made available under Clause 9.1 is not sufficient to demonstrate compliance, the Controller may carry out an audit, at its own cost, by itself or through an independent auditor bound by confidentiality, no more than once every twelve (12) months (except following a personal data breach or at the request of a supervisory authority), with at least thirty (30) days' notice, during business hours and without unreasonably disrupting the Processor's activities or compromising the security and confidentiality of other customers' data. Technical security tests of the Platform, including penetration tests, require the Processor's prior written agreement on scope and timing.

10. Liability

10.1 The liability of each party under this DPA is subject to the limitations set out in Clause 16 of the Terms, without prejudice to the rights of Data Subjects under Article 82 of the GDPR.

Appendix 1 — Description of processing

Item	Description
Subject matter	Provision of the Service under the Terms
Nature of processing	Collection by upload, storage, organisation, automated extraction and classification by the AI System, consultation, review and correction by the Controller, making available to Clients chosen by the Supplier, download logging, anonymisation, export, deletion
Purpose	Allowing the Supplier to manage and share documentation about its organisation and workforce with its Clients, and allowing Clients to record their own information about Suppliers
Categories of Data Subjects	Workers, subcontractors and other persons engaged by the Supplier; legal representatives and contact persons of the Supplier; sole traders acting as Suppliers; persons mentioned in the Client's own records
Categories of Personal Data	Identification data (name, function, identity document number and expiry date, and copies of identity documents where uploaded by the Supplier under Clause 28.2(a)); professional data (training, qualifications, licences, professional credentials and their validity); employment and insurance data (social security registration, workplace accident insurance coverage and validity); photographs (no biometric processing); data contained in company documents (e.g., names of directors in commercial registry certificates)
Special categories and criminal data	Health data, including occupational fitness certificates under Law 102/2009 and other medical documents, and criminal record certificates, uploaded by the Supplier under its sole responsibility in accordance with Clause 28 of the Terms. Visible only to the Clients designated by the Supplier. These data are not used in the Qualification
Duration	Term of the Agreement plus the export and deletion periods in Clause 8
Default retention (unless configured otherwise by the Controller)	Expired document: 90 days after the expiry date. Worker removed by the Supplier: 30 days after removal. End of subscription: 30 days after termination. Prompts and outputs of the AI model: not retained beyond the minimum technical log

Appendix 2 — Technical and organisational measures

The Processor implements and maintains the following categories of technical and organisational measures, appropriate to the risk and taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, in accordance with Article 32 of the GDPR. The specific measures are documented in the Processor’s information security management system and may be updated from time to time in accordance with Clause 3.1 of this DPA. Further information on the measures is available to the Controller upon reasonable request, subject to confidentiality and provided that its disclosure does not compromise the security of the Platform or of other customers.

• Information security governance: an information security management system aligned with ISO/IEC 27001, with defined security roles and responsibilities, security policies and periodic review.
• Access control: authentication of Users, including multi-factor authentication, role-based access, the principle of least privilege and periodic review of access rights.
• Encryption: encryption of Personal Data in transit and at rest, in accordance with recognised industry standards.
• Segregation: logical separation of the data of each Account Holder.
• Reinforced protection of sensitive data: additional access restrictions and protection for identity document copies, health data and criminal record data.
• Security of uploaded files and of the AI System: measures to detect malicious files and to mitigate attempts to manipulate the AI System through the content of documents.
• Logging and monitoring: recording of relevant events in the Platform, including access, sharing and downloads, and monitoring for security incidents.
• Availability and resilience: backup and recovery procedures appropriate to the Service.
• Secure development: secure development practices, security testing proportionate to the risk, and avoidance of real Personal Data in development and test environments.
• Retention and deletion: deletion of Personal Data in accordance with Appendix 1 and Clause 8 of this DPA.
• Incident management: procedures to detect, respond to and notify personal data breaches.
• Personnel: confidentiality obligations and security, data protection and AI literacy training appropriate to each role.
• Sub-processors: selection and contractual oversight of Sub-processors in accordance with Clause 4 of this DPA.

Appendix 3 — Sub-processors

Sub-processor	Service	Location of processing
Amazon Web Services EMEA SARL	Cloud hosting and infrastructure	EU — Spain (eu-south-2)

Annex III — Data Sharing Agreement

This Data Sharing Agreement ("DSA") applies between each Supplier and each Client with whom the Supplier shares information through the Platform. It is accepted by the Supplier when it shares information with a Client and by the Client when it first accesses information shared by that Supplier. C-MORE is not a party to this DSA, but may enforce it as a third-party beneficiary in respect of the Platform.

1. Roles

1.1 The Supplier and the Client act as independent controllers. The Supplier is responsible for the lawfulness of the disclosure of the Shared Data to the Client. The Client is responsible for the lawfulness of its processing of the Shared Data from the moment of access.

2. Purpose

2.1 The Client shall process the Shared Data only for the Permitted Purpose defined in Clause 34.1 of the Terms.

3. Categories of data

3.1 The categories of Shared Data are those that the Supplier selects in the Platform for each Client, within the categories described in Appendix 1 to Annex II.

4. Client obligations

4.1 The Client shall: (i) not further disclose the Shared Data except as permitted by Clause 34.2 of the Terms; (ii) implement appropriate technical and organisational security measures, at least equivalent to the measures generally accepted for personal data of employees, including restricted access, encryption of storage devices and secure deletion; (iii) retain downloaded Shared Data for no longer than necessary for the Permitted Purpose and, in any event, for no longer than [●twelve (12) months] after the end of its relationship with the Supplier, or the longer period required by law; (iv) not request criminal record certificates except where the law expressly requires them for the function concerned; and (v) not use health information for any purpose other than verifying fitness for the specific function.

5. Information to Data Subjects

5.1 The Supplier shall inform its workers that their information may be shared with Clients, identifying the categories of Clients, in accordance with Clause 29 of the Terms. The Client may rely on such information to comply with Article 14 of the GDPR, without prejudice to its own obligation to inform Data Subjects of any further processing.

6. Data Subject requests and incidents

6.1 Each party shall handle requests from Data Subjects relating to its own processing and shall cooperate with the other party, without undue delay, where a request concerns the processing carried out by the other party.

6.2 Each party shall notify the other without undue delay, and in any event within seventy-two (72) hours, of any personal data breach affecting Shared Data that may affect the other party's obligations.

7. Transfers outside the EEA

7.1 Where the Client is established in a country outside the European Economic Area not covered by an adequacy decision of the European Commission, the Supplier (as data exporter) and the Client (as data importer) hereby enter into the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module One (controller to controller), which are incorporated by reference, with the following options: Clause 7 (docking clause) applies; in Clause 11, the optional language does not apply; in Clause 17, the governing law is the law of Portugal; in Clause 18, the competent courts are the courts of Portugal. Annex I.A of the SCCs is completed with the identification of the Supplier and the Client in their Accounts; Annex I.B with Clauses 2 and 3 of this DSA; Annex I.C designates the Comissão Nacional de Proteção de Dados (CNPD); and Annex II with Clause 4(ii) of this DSA.

7.2 The Client declares that it has assessed the laws and practices of its country of establishment and has no reason to believe that they prevent it from complying with the SCCs. The Client shall carry out, before the first download, the transfer impact assessment required by the SCCs, and shall make it available to the Supplier upon request.

7.3 C-MORE may restrict downloads by Clients established outside the EEA where it has reasonable grounds to believe that the conditions of this Clause 7 are not met.

8. Liability

8.1 Each party is liable to the other for damage caused by its breach of this DSA, in accordance with applicable law. C-MORE is not liable for the performance of this DSA by the Supplier or the Client.

9. Term

9.1 This DSA applies for as long as the Client processes Shared Data, including after the end of the sharing or of either party's subscription.

Annex IV — Qualification Methodology and Contestation Procedure

1. Principles

1.1 The Qualification is issued by C-MORE, as controller, on the basis of its legitimate interest in providing a qualification service that Clients use to comply with their third-party management and occupational health and safety obligations. C-MORE has carried out and documented a legitimate interest assessment.

1.2 The Qualification is determined by rules defined, documented, versioned and approved by people. The AI System does not determine, score or recommend the Qualification.

1.3 The Qualification Methodology is the same for all Clients. Clients cannot change the rules applied to a Supplier.

1.4 The Qualification assesses the Supplier as an organisation. It does not score, rank or qualify individual workers. Information about workers enters the Qualification only as aggregated indicators per Supplier (for example, the percentage of workers with valid training for a given function).

2. Data used

2.1 Only data that (i) belongs to categories marked for Qualification in the Platform and (ii) has been confirmed by the Supplier after review of the AI extraction are used in the Qualification.

2.2 Identity document copies, health data and criminal record data are never used in the Qualification. They are processed by C-MORE solely as processor on behalf of the Supplier and are only made available to the Clients designated by the Supplier.

2.3 Where a Client asks a Supplier for a criminal record certificate, the Client shall record in the Platform the legal provision that requires the certificate for the function concerned, in accordance with Clause 36.3 of the Terms. The Supplier remains responsible, under Clause 28 of the Terms, for the lawfulness of each upload.

3. Criteria

3.1 The criteria in force, their version and their date of approval are published at [●URL of the Qualification Methodology]. They include, among others: [●e.g., valid commercial registry certificate; tax and social security clearance certificates in force; workplace accident insurance in force; minimum percentage of workers with valid mandatory training; validity of required licences and certifications].

3.2 Changes to the criteria are subject to C-MORE's change management procedure and are published at least [●thirty (30)] days before they apply, except where required by law.

4. Results, explanation and validity

4.1 Each Qualification result is explained criterion by criterion, and the explanation is visible to the Supplier and to the Clients with whom the Qualification is shared.

4.2 Human validation. Every negative or partially negative result is validated by a qualified C-MORE staff member before it is published. The validation, the person who carried it out and the rules applied are recorded.

4.3 A Qualification is valid until the earliest of: (i) the expiry of any document on which a criterion depends; (ii) the publication of a new Qualification; or (iii) [●twelve (12)] months from its issue.

5. Contestation

5.1 The Supplier may contest a Qualification result, through the Platform or by email to [●qualification@cmore.pt], within thirty (30) days of its publication, stating the grounds and attaching any supporting documents.

5.2 While the contestation is pending, the result will be marked as "under review" for the Clients with whom it has been shared.

5.3 C-MORE will analyse the contestation by a person other than the one who validated the contested result and will issue a reasoned decision within thirty (30) days of receipt of the complete contestation, which may be extended by a further thirty (30) days in complex cases, with notice to the Supplier. The decision may confirm, amend or revoke the result.

5.4 The contestation procedure does not affect the rights of Data Subjects under the GDPR, including the right to object under Article 21, which may be exercised as described in the Qualification Privacy Notice.

6. Records

6.1 C-MORE keeps an immutable record of each Qualification (rules applied, data used, date and validating person) for five (5) years from its date, for the purposes of handling contestations and defending legal claims.