LAMINATE

Laminate Customer Terms

Version 0.1

Last updated:

These terms are the agreement between Laminate Systems ("Laminate", "we") and the organization that signs up to use Laminate (the "Customer", "you"). By accepting an order, or by using Laminate, the Customer accepts these terms. The person who accepts them confirms they have authority to bind the Customer.

1. The service

Laminate is software for access control and credentialing at the doors and desks of the Customer's own projects: events, sites and other places where people come and go for a set period. It includes the console used by the Customer's staff, the Laminate Station app for iPad and iPhone, the sign-up links sent to the people the Customer invites, and the optional assistant connection (together, the "Service").

Laminate is decision support. A device compares a face or a wristband with the people it expects and shows a result, and the Customer's staff decide what happens next. Laminate does not open or lock doors, and the Customer does not rely on it as the only means of controlling access to anywhere that could endanger a person's life or safety.

2. Accounts and the Customer's staff

The Customer chooses who on its staff has access, and with which role. The Customer is responsible for what its staff do in the Service, for keeping their sign-in methods secure, and for telling us promptly if it believes an account has been misused. Console sign-in is by passkey, or through the Customer's own single sign-on where it has set that up.

3. Orders, devices and fees

Fees, what they cover, and how usage is measured are set out in the order form or quote the Customer accepts. Nothing on the Laminate website is an offer or a statement of price. Invoices are due as the order form states. Fees do not include taxes, which the Customer bears.

The Customer supplies the iPads, iPhones, wristbands and compatible readers it uses with the Service. It is responsible for keeping them physically secure, for keeping them up to date, and for the networks they use.

4. The Customer's data and our role

The Customer owns the information it puts into Laminate or collects through it: its people lists, photos, agreements, records and settings (the "Customer Data"). We use Customer Data only to provide and support the Service, to keep it secure, and as the Customer instructs, and for no other purpose. We do not sell it, build advertising profiles from it, combine it with another customer's, or use it to train any model.

For Customer Data that identifies people, the Customer decides why and how it is collected and used, and Laminate acts on the Customer's behalf as its processor or service provider. Section 5 sets out what that means in practice. Our Privacy Policy describes what Laminate holds and for how long, and the Customer is responsible for giving the people it invites whatever further notice the law requires.

5. Processing terms

These terms form the contract that applicable law requires between a controller and a processor.

  • Instructions and purpose. We process Customer Data to provide the Service, as these terms, the Customer's settings and its staff's use of the console instruct. The nature and purpose of processing is access control and credentialing at the Customer's projects. The types of data and the people they concern are those described in the Privacy Policy under "What we hold".
  • Duration and deletion. We process Customer Data for the life of each project and delete it on the schedule in the Privacy Policy: by default seven days after a person's last scheduled day for face data, ID details and contact details, and when the project closes, 90 days after its last day by default, for the rest. The Customer can change those periods. Deleted information can remain in backups for up to seven days. On the Customer's written request before the agreement ends we export the Customer Data we hold for it, and we delete whatever remains within 30 days after the agreement ends.
  • Confidentiality. Everyone at Laminate who can access Customer Data is bound by a duty of confidentiality. Laminate staff can open the Customer's console only through support access: read-only, ending after 60 minutes, recorded and visible to the Customer. Support access is on by default and the Customer's administrators can switch it off at any time.
  • Subprocessors. The Customer authorizes the companies named in the Privacy Policy under "Where it is stored and who processes it" to process Customer Data for us. We bind them to terms no less protective than these, we are responsible for them, and we will tell the Customer before adding or replacing one that handles Customer Data. Services the Customer connects itself (a Google account, an ID check from Didit or Stripe Identity, an AI assistant) are provided to the Customer under its own agreement with that company.
  • Security. We protect Customer Data with the measures described on the Security page of our website and keep them in place for as long as we hold it. We do not warrant that they prevent every incident.
  • Assistance and audits. We help the Customer respond to requests from the people it invited, by passing a request on or by providing the information we hold, and we make available the information reasonably needed to show we have met this section. The Customer or its auditor may carry out a reasonable audit or assessment once a year on 30 days' written notice, during business hours and at the Customer's cost, with no access to another customer's data.
  • Incidents. We tell the Customer without undue delay, and within 72 hours, after we become aware of a confirmed incident affecting its Customer Data, and give it what it reasonably needs to meet its own obligations.

6. Face recognition and the Customer's responsibilities

Face recognition in Laminate is optional and is switched on by the Customer, for a project or for particular days. A project, or days within it, can be set to wristbands only, and then no face data is learned and faces are not matched at the doors.

Where the Customer uses face recognition, it is responsible for deciding that it is lawful for its project and its location, and for the following:

  1. Using face recognition only where the law allows it, and setting the affected projects or days to wristbands only where it does not or where the Customer has not completed what the law requires.
  2. Giving each person the notice, and obtaining the consent, written release or other authorization, that applicable law requires before their face is learned. Laminate provides a consent notice and a way for each person to agree or decline and to withdraw. The Customer is responsible for deciding whether that notice and process meet the laws that apply to it, and for adding anything further they require. The Customer will not enable face recognition for a person who has declined.
  3. Using watchlists only for a lawful purpose, confirming the lawful basis as the Service requires before matching starts, and not adding anyone to a watchlist unlawfully.
  4. Telling people about its retention periods and honoring their requests to see, correct or erase their information, using the tools Laminate provides.
  5. Not making any decision about a person solely because of a match or a failure to match. A device that does not recognize someone has not refused them, and the Customer's staff decide what happens next.

Laminate does not check whether a face is a live person or a picture, and its own ID check does not prove that a document is genuine. The Customer decides what weight to give a match or a check result.

7. Acceptable use

The Customer will not, and will not let others:

  • use the Service to unlawfully discriminate against a person, or to monitor people covertly;
  • use the Service for any purpose the people it invited were not told about;
  • upload information it has no right to upload, or malicious code;
  • probe, scan or test the Service's security without our written permission, or bypass its limits;
  • resell, sublicense or provide the Service to anyone else except as an order form allows;
  • reverse engineer the Service, except where the law allows it despite this term; or
  • use the Service in a way that threatens its operation for other customers.

We may suspend access to the part of the Service involved, and will tell the Customer why as soon as we can, where use breaks this section or puts the Service or other people at risk. We will restore access once the cause is resolved.

8. Ownership

We own the Service, including its software, designs and documentation, and we grant the Customer a limited, non-exclusive, non-transferable right to use it during the term for its own projects, under these terms. The Customer's feedback may be used by us without obligation. Each party keeps the rights it has in its own materials, and we have no rights in Customer Data beyond those these terms give us.

9. Warranties and what we do not promise

We will provide the Service with reasonable skill and care. Beyond that, and to the extent the law allows, the Service is provided "as is" and "as available", and we disclaim all other warranties, express or implied, including merchantability, fitness for a particular purpose and non-infringement. We do not warrant that the Service will be uninterrupted or error-free, that a match will always be made or correct, or that the Service will meet the requirements of any particular law. We state no service level or uptime commitment.

10. Liability

To the extent the law allows:

  • neither party is liable to the other for indirect, incidental, special, consequential or punitive damages, or for lost profits or revenue, however caused;
  • each party's total liability to the other arising out of these terms in any twelve-month period is limited to the fees the Customer paid in the twelve months before the claim arose; and
  • those limits do not apply to the Customer's obligations to pay fees, or to liability that cannot be limited by law.

11. Indemnities

The Customer will defend and indemnify Laminate against claims brought by a third party arising from the Customer's use of the Service in breach of section 6 or section 7, or from Customer Data the Customer had no right to provide. We will defend and indemnify the Customer against claims that the Service, used as these terms allow, infringes a third party's intellectual property rights, except to the extent the claim arises from Customer Data, from combining the Service with something we did not supply, or from use these terms do not allow.

The party seeking an indemnity must give the other prompt written notice of the claim, let it control the defense and settlement (a settlement that admits fault for the indemnified party needs its consent), and cooperate reasonably at the indemnifying party's expense.

12. Term and ending the agreement

These terms start when the Customer accepts an order or begins to use the Service and continue month to month until either party ends them under this section. Either party may end the agreement on 30 days' written notice, and fees remain payable for the notice period. Either party may also end it for the other's material breach that is not fixed within 30 days of written notice. When it ends, the Customer's access ends, and we delete Customer Data under section 5. Sections that by their nature should survive (including 4, 5 as to deletion, 8, 9, 10, 11 and 13) do.

13. General

  • Governing law and courts. These terms are governed by the laws of the Commonwealth of Virginia, without regard to its conflict of laws rules. The state courts of Fairfax County, Virginia, and the United States District Court for the Eastern District of Virginia, Alexandria Division, have exclusive jurisdiction, and each party consents to them.
  • Changes. We may update these terms for future orders and renewals and will give the Customer 30 days' notice before a change that affects it takes effect. Continued use after that date is acceptance, unless the Customer ends the agreement first.
  • Notices. Legal notices to us go to the address and email below. We may send notices to the contact the Customer gave us.
  • Assignment. Neither party may assign these terms without the other's written consent, except to a successor to substantially all of its business.
  • Force majeure. Neither party is liable for a delay or failure caused by events beyond its reasonable control.
  • Entire agreement and order. These terms, the order form and the documents they refer to are the whole agreement. If they conflict, the order form prevails, then these terms, then the Privacy Policy.
  • Severability and waiver. If part of these terms cannot be enforced, the rest remains in force. A party that does not enforce a right has not given it up.
  • Independent parties. The parties are independent. These terms create no partnership, agency or employment.

Laminate Systems privacy@laminate.systems