Skip to content

General Terms and Conditions

Last updated: September 2026

1. Parties and Status

These Specific Terms and Conditions (the Terms) are issued by Belfort Advisory BV (registered office at Steinen 32, 9850 Deinze; Belgian Crossroads Bank for Enterprises no. 1026.995.022; hereinafter "Belfort Advisory", "we", “us”).

Belfort Advisory offers Neo Whistle, a secure internal reporting channel with case management, as a hosted software service (software-as-a-service).

The software and its hosting are operated on behalf of Belfort Advisory by whistlebox BV, registered at the Belgian Crossroads Bank for Enterprises no. 0754.832.521 (the Platform Operator). Belfort Advisory remains the Customer's sole contracting party for the Service.

Belfort Advisory is a separate, non-law firm entity. The Service does not include legal advice. Legal advice on whistleblowing matters is only provided by Belfort Law under a separate engagement.

2. Definitions

In these Terms, capitalised words have the following meaning:

  • Agreement: the Order and these Terms, including any document expressly incorporated by them.
  • Case Handler: a person appointed by the Customer to receive, follow up and manage Reports in the back office, including an external consultant given access to one or more cases.
  • Channel: a reporting channel configured for the Customer within the Service.
  • Customer: the legal entity that orders the Service, including any affiliated entities listed in the Order.
  • Customer Data: all data entered into the Service by or for the Customer, Case Handlers or Reporters, including Reports, messages and attachments.
  • GDPR: Regulation (EU) 2016/679 (General Data Protection Regulation).
  • Order: the signed quote, order form or other written order confirmation for the Service.
  • Report: a report of a concern submitted through a Channel, including all related messages and attachments.
  • Reporter: a person who submits a Report, anonymously or with their identity.
  • Service: the Neo Whistle reporting channel and case management back office, provided as hosted software, together with the related set-up, support and maintenance.
  • Whistleblowing Legislation: Directive (EU) 2019/1937 and the national laws transposing it that apply to the Customer, including, for Belgium, the Act of 28 November 2022 (private sector) and the Act of 8 December 2022 (federal public sector).

3. Scope and Acceptance

These Terms govern the provision and use of the Service and all legal relationships arising from or connected to it.

The Service is offered only to businesses, public bodies and other organisations acting for professional purposes. It is not offered to consumers. This does not prevent individuals from submitting Reports through a Channel; Reporters are not a party to the Agreement.

Signing an Order, or using the Service, implies acceptance of these Terms. Any general or purchasing conditions of the Customer do not apply, even if they are referred to in an order or other document of the Customer.

Services of Belfort Advisory other than the Service (such as advisory, training, or support with the handling of Reports) are governed by the General Terms and Conditions of Belfort Law BV and Belfort Advisory BV, unless agreed otherwise in writing.

4. Order of Precedence

If the documents forming the Agreement conflict, the following order applies:

  1. the Order, but only for the specific subject it expressly deviates on;
  2. these Terms;
  3. the General Terms and Conditions of Belfort Law BV and Belfort Advisory BV, for matters not addressed above.

Marketing materials, the spec sheet, the security and privacy white paper and other descriptive documents are for information only. They do not create commitments unless incorporated in the Order.

5. Formation of the Agreement

Quotes of Belfort Advisory are valid for 30 days unless stated otherwise. The Agreement is formed when the Customer signs the Order, or when Belfort Advisory confirms an order in writing.

The Order states at least the number of Channels, the subscription fee, the start date and, where applicable, the affiliated entities covered.

The Service is not offered on a free trial basis.

Belfort Advisory may refuse an order, or make it subject to conditions, for example following an internal ethical or know-your-customer screening, without having to state a reason.

6. The Service

Right of use. For the term of the Agreement, Belfort Advisory grants the Customer a non-exclusive, non-transferable right to use the Service for its own internal reporting channel. The Customer may not resell, sublicense or otherwise make the Service available to third parties, other than to Case Handlers and Reporters.

Set-up. Each Channel is set up automatically. Activation emails are sent to the Case Handlers designated by the Customer. The Customer configures its Channel itself, within the configuration options of the Service. Colours, favicon, email templates and the domain are set centrally and are the same for all Channels.

Availability and support. Belfort Advisory makes reasonable efforts to keep the Service available and performing as described. Support is provided by email on Belgian business days, during office hours, within a reasonable time. Unless agreed otherwise in the Order, Belfort Advisory does not guarantee specific availability levels or response times, nor uninterrupted or error-free operation.

Maintenance. Planned maintenance is announced in advance where reasonably possible. Urgent maintenance, for example to fix a security vulnerability, may be carried out without prior notice.

Changes to the Service. Belfort Advisory may develop and change the Service, provided this does not materially reduce its core functionality or its level of security. Material changes are announced at least 30 days in advance. If a change materially affects the Customer, the Customer may terminate the Agreement before the change takes effect, with a pro rata refund of prepaid fees.

Subcontracting. Belfort Advisory may use subcontractors to provide the Service, including the Platform Operator and its hosting, email and captcha providers. Belfort Advisory remains responsible towards the Customer for their performance. Sub-processors of personal data are governed by section 9.

No case handling. Belfort Advisory provides the technical tool only. It does not receive, assess, investigate or follow up Reports, unless separately engaged to do so in writing.

7. Customer Responsibilities

Compliance with Whistleblowing Legislation. The Service supports the Customer in meeting its obligations, but use of the Service does not by itself make the Customer compliant. The Customer remains solely responsible for:

  • appointing impartial and competent Case Handlers;
  • acknowledging, following up and giving feedback on Reports within the legal time limits;
  • protecting Reporters and other persons concerned against retaliation;
  • informing its staff and other eligible persons about the Channel and the external reporting options;
  • determining retention periods and archiving or deleting Reports in time;
  • all decisions taken on the basis of Reports.

Configuration and content. The Customer is responsible for the texts, privacy notice, categories, input fields and other settings it configures in its Channel, and for their accuracy and lawfulness.

Accounts and access. The Customer ensures that:

  • Case Handlers keep their login details, passphrase and two-factor authentication device secure and personal;
  • access to cases is granted only on a need-to-know basis, and removed without delay when a Case Handler leaves or is no longer competent;
  • at least two active Case Handlers with administrator rights are maintained at all times;
  • Belfort Advisory is informed immediately of any suspected unauthorised access.

Encryption and loss of access. Reports, messages and attachments are end-to-end encrypted. Only the Reporter and the Case Handlers on a case hold the keys. Neither Belfort Advisory nor its subcontractors can read, recover or restore this content. If all Case Handlers on a case lose their passphrase or access, the content of that case may become permanently inaccessible. Belfort Advisory is not liable for such loss.

8. Acceptable Use

The Customer will not, and will ensure that its users do not:

  • use the Service for any unlawful purpose, or to identify or retaliate against anonymous Reporters;
  • use the Channel for purposes other than receiving and handling reports of concerns;
  • attempt to access data of other customers, or to circumvent security or access controls;
  • probe, scan or test the Service for vulnerabilities, other than through responsible disclosure to neo@belfort-advisory.com;
  • copy, modify, reverse engineer or decompile the Service, except where the law expressly allows it;
  • upload malicious code or overload the Service.

9. Data Protection

For personal data in Customer Data, the Customer is the controller and Belfort Advisory is the processor within the meaning of the GDPR. This section forms the processing agreement required by Article 28 of the GDPR.

The processing concerns Reporters, Case Handlers, persons named in Reports and other persons concerned. It may include special categories of personal data and data relating to criminal offences. It lasts for the term of the Agreement and serves only to provide the Service.

Belfort Advisory:

  • processes personal data only on the documented instructions of the Customer, which consist of these Terms and the Customer's configuration and use of the Service, unless EU or Member State law requires otherwise;
  • ensures that all persons authorised to process personal data are bound by confidentiality;
  • implements the security measures described in section 10;
  • assists the Customer, taking into account the nature of the processing, with data subject requests and with its obligations on security, breach notification, data protection impact assessments and prior consultation;
  • notifies the Customer of a personal data breach without undue delay, and in any case within [48] hours of becoming aware of it;
  • deletes all personal data at the end of the Agreement, as set out in section 18;
  • makes available the information needed to demonstrate compliance with this section, and allows audits by the Customer or an auditor it mandates, at most once a year, with 30 days' notice and at the Customer's expense.

Sub-processors. The Customer gives general authorisation for the following sub-processors: whistlebox (Belgium, platform operator), OVHcloud (France, hosting in Frankfurt, Germany), Rapidmail (Germany, email delivery) and FriendlyCaptcha (Germany, captcha). Belfort Advisory informs the Customer at least 30 days in advance of any new or replacement sub-processor. The Customer may object on reasonable grounds; if no solution is found, the Customer may terminate the Agreement. Belfort Advisory imposes equivalent data protection obligations on its sub-processors.

Encrypted content. Because Reports are end-to-end encrypted, Belfort Advisory cannot access their content. Data subject requests concerning that content are handled by the Customer's Case Handlers, using the correction and removal functions of the Service.

All Customer Data is processed and stored within the European Union, by European providers only.

For the contact, account and billing data of the Customer's representatives, Belfort Advisory acts as controller under its privacy policy.

Belfort Advisory may use anonymised, aggregated data on the use of the Service (such as the number of Channels and users) for invoicing, statistics and improving the Service. This data never includes the content of Reports.

10. Security

Belfort Advisory and the Platform Operator maintain appropriate technical and organisational measures to protect Customer Data, as described in the security and privacy white paper, available on request. These include end-to-end encryption of Reports, a separate encrypted database per customer, mandatory two-factor authentication for Case Handlers, and a yearly penetration test by a specialised third party.

The information security programme is aligned with ISO 27001 controls. Neither Belfort Advisory nor the Platform Operator is ISO 27001 certified, unless stated otherwise in the Order.

Belfort Advisory notifies the Customer of personal data breaches affecting Customer Data as set out in section 9.

11. Confidentiality

Each party keeps confidential all non-public information received from the other party and uses it only for the Agreement. This obligation continues for five years after the end of the Agreement, and indefinitely for Customer Data.

This does not apply to information that is or becomes public without breach, that was already lawfully known to the receiving party, or that must be disclosed by law or by a competent authority.

12. Requests from Authorities

If an authority requests access to Customer Data, Belfort Advisory refers the request to the Customer where legally allowed, and informs the Customer without delay. Belfort Advisory discloses only what it is legally required to disclose. Because of end-to-end encryption, Belfort Advisory cannot disclose the content of Reports.

13. Fees, Indexation and VAT

The fees are set out in the Order. Unless agreed otherwise, the subscription fee is invoiced annually in advance, the first time on the start date.

Fees may be adjusted once per year, on each renewal date, and indexed based on the Belgian consumer price index. Other price increases are announced at least 60 days before the renewal date; the Customer may then terminate the Agreement with effect from that renewal date.

All amounts are exclusive of VAT. Services are subject to Belgian VAT at the applicable rate when deemed supplied in Belgium. If supplied abroad, foreign VAT rules may apply.

14. Invoicing and Payment

Invoices are payable within 30 days of the invoice date.

Late payment consequences:

  • legal interest, automatically from the due date and without prior notice;
  • a fixed indemnity of 10% of the invoiced amount, with a minimum of [€40 / €500] and a maximum of €12,500;
  • without prejudice to recovery of higher proven damages and costs.

Prepaid fees are not refunded, except where these Terms expressly provide otherwise.

15. Term and Renewal

The Agreement runs for an initial term of 12 months from the start date in the Order. It then renews automatically for successive periods of 12 months, unless either party terminates it in writing at least 3 months before the end of the current term.

16. Suspension

Belfort Advisory may suspend access to the Service, in whole or in part:

  • if an invoice remains unpaid 15 days after a written reminder;
  • if the Customer or its users breach section 8 (Acceptable Use);
  • immediately, where needed to prevent or contain a security incident or to comply with the law.

Belfort Advisory limits any suspension to what is necessary and lifts it as soon as the cause is removed. Fees remain due during a suspension caused by the Customer.

17. Termination

Either party may terminate the Agreement with immediate effect by written notice if the other party:

  • commits a material breach that is not remedied within 30 days of a written notice of default;
  • is declared bankrupt, enters into liquidation or ceases its activities.

Non-payment of an invoice for more than 60 days after its due date is a material breach.

Belfort Advisory may also terminate the Agreement, refuse or suspend services following an internal ethical screening, or where required by law. In that case, the Customer receives a pro rata refund of prepaid fees for the remaining term.

Termination does not affect fees for the period already elapsed, nor clauses meant to survive termination, such as confidentiality and liability.

18. End of the Service and Customer Data

The Customer is responsible for archiving or recording any Customer Data it needs to keep, before the end of the Agreement. An export of Customer Data, or a transition period at the end of the Agreement, is only available if the Customer requests it before entering into the Agreement and it is agreed in the Order.

At the end of the Agreement, access to the Service ends and all Customer Data is securely deleted within [30] days. Copies in backups are deleted in the normal backup cycle, within [90] days at the latest. Deleted data cannot be recovered.

19. Intellectual Property

All intellectual property rights in the Service, its software, design, documentation and the Neo Whistle name belong to Belfort Advisory, the Platform Operator or their licensors. The Customer only receives the right of use described in section 6.

The Customer retains all rights in Customer Data and in its own logo, images and texts. The Customer grants Belfort Advisory and its subcontractors the right to host and process these solely to provide the Service.

The Customer guarantees that the materials it uploads to configure its Channel do not infringe third-party rights.

If a third party claims that the Service infringes its intellectual property rights, Belfort Advisory may, at its choice, obtain the right for the Customer to continue using the Service, modify the Service so it no longer infringes, or terminate the Agreement with a pro rata refund of prepaid fees.

20. Warranties

Belfort Advisory provides the Service with the care of a diligent professional service provider. Its obligations are obligations of means (middelenverbintenis), unless expressly stated otherwise.

Belfort Advisory does not guarantee that the Service is free of errors or uninterrupted, nor that the Service, templates or default texts by themselves ensure compliance with Whistleblowing Legislation or other laws.

21. Liability

Except in case of fraud or wilful misconduct, Belfort Advisory is not liable for indirect or consequential damage, such as loss of profit, revenue, goodwill or business opportunities, damage resulting from claims of third parties, or loss of data that the Customer could have avoided by following section 7.

Except in case of fraud or wilful misconduct, the total liability of Belfort Advisory under or in connection with the Agreement, including the processing of personal data, is limited per year to the fees paid by the Customer for the Service in the 12 months before the event giving rise to the claim, and in any case to the amount effectively covered and paid out under its professional indemnity insurance.

The Customer must report any claim in writing within 6 months of becoming aware of the damage, failing which the claim lapses.

Nothing in these Terms limits liability that cannot be limited under mandatory law.

22. No Personal Liability and No Third-Party Rights

Except in case of wilful misconduct, no directors, shareholders, affiliates, or current or former personnel of Belfort Advisory, nor the Platform Operator, shall be held personally liable towards the Customer in relation to the Service.

The Agreement does not create rights for third parties, including Reporters. No third party may rely on or enforce it.

23. Force Majeure

Neither party is liable for failure to perform caused by events beyond its reasonable control, such as natural disasters, war, pandemics, large-scale cyberattacks, failures of public networks or hosting infrastructure, or government measures. Payment obligations are not affected. If force majeure lasts more than 60 days, either party may terminate the Agreement in writing, with a pro rata refund of prepaid fees.

24. Changes to these Terms

Belfort Advisory may change these Terms. Changes are notified in writing at least 30 days before they take effect and apply from the next renewal date, unless the Customer accepts them earlier. Changes required by law may apply sooner. If the Customer objects to a material change, it may terminate the Agreement with effect from the date the change applies.

25. Final Provisions

  • Assignment: the Customer may not transfer the Agreement without prior written consent. Belfort Advisory may transfer it to an affiliate or to a successor of its activities, after notifying the Customer.
  • Reference: Belfort Advisory may mention the Customer's name as a client, unless the Customer objects in writing.
  • Notices: notices are given by email to the addresses stated in the Order, or by registered letter.
  • Severability: each clause is severable. An invalid or unenforceable clause is replaced by a valid clause that best reflects the original intent.
  • Entire agreement: the Agreement replaces all prior proposals and arrangements on its subject.
  • Language: these Terms are drawn up in English. Translations are for convenience only; the English version prevails.

26. Governing Law and Jurisdiction

This notice is governed by Belgian law, exclusively applicable to any dispute; the courts of Antwerp have exclusive jurisdiction over disputes concerning its interpretation or performance.

These Terms also inure to the benefit of the directors, shareholders, affiliates and all persons working or having worked for Belfort Advisory.