Lumorus CoSec Hub Platform Terms of Use
Effective date: 16 June 2026 Last Updated: 16 June 2026
Effective date: 16 June 2026
Last Updated: 16 June 2026
- Introduction
These Platform Terms of Use govern access to and use of the Lumorus CoSec Hub.
The CoSec Hub is Lumorus’ digital platform, portal and technology environment used to support the delivery, administration and management of company secretary services, governance workflows, client communications, records, tasks, filings, calendars, documents, reporting and related services.
These Platform Terms apply to all clients, authorised users and other persons who access or use the CoSec Hub.
By ticking the relevant acceptance box, clicking “I agree”, creating an account, logging into the CoSec Hub, accessing the platform, or otherwise using the CoSec Hub, you agree to these Platform Terms.
If you access the CoSec Hub on behalf of a company, organisation, fund, charity, trust, partnership or other legal entity, you confirm that you have authority to bind that organisation and its authorised users to these Platform Terms.
- Parties
These Platform Terms are between:
Lumorus Group Ltd, a company incorporated in England and Wales with company number 12750296 and registered office at City Pavilion, 27 Bush Lane, Cannon Green, United Kingdom, EC4R 0AA, referred to as “Lumorus”, “we”, “us” or “our”; and
the Client and each Authorised User, referred to as “you” or “your”.
- Relationship with other documents
These Platform Terms should be read together with:
- the CoSec Retainer Terms and Conditions;
- any order form, proposal, statement of work or service schedule;
- the Data Processing Agreement;
- the Privacy Policy;
- the Consumer Protection and Fair Use Policy;
- any applicable jurisdiction-specific addendum;
- any platform guidance, user rules or onboarding instructions issued by Lumorus.
If there is a conflict between these Platform Terms and a signed client agreement, the signed client agreement will take priority, unless these Platform Terms provide more specific rules for platform access, security, acceptable use, misuse or suspension.
If there is a conflict between these Platform Terms and the Data Processing Agreement in relation to processing Client Personal Data, the Data Processing Agreement will take priority.
- Global application
Lumorus is based in the United Kingdom, but the CoSec Hub may be accessed by clients and users in different jurisdictions.
You are responsible for ensuring that your access to and use of the CoSec Hub is lawful in the country or territory from which you access it and, in any country, or territory in which your organisation operates.
Lumorus may restrict or modify access to the CoSec Hub in certain jurisdictions where required for legal, regulatory, security, sanctions, technical or operational reasons.
Nothing in these Platform Terms excludes any rights or protections that cannot lawfully be excluded under applicable law.
- Definitions
In these Platform Terms:
Account means an account created for a Client or Authorised User to access the CoSec Hub.
Authorised User means an individual approved by the Client or Lumorus to access the CoSec Hub.
Client means the person, organisation or legal entity that has entered into an agreement with Lumorus for the CoSec Retainer, CoSec Hub or related services.
Client Content means data, documents, information, records, instructions, comments, files, materials or other content uploaded, submitted, stored, transmitted or made available by or on behalf of the Client or Authorised Users through the CoSec Hub.
CoSec Hub means Lumorus’ digital platform, portal, application or technology environment used to support company secretary, governance, compliance, workflow, document, communication and related services.
Lumorus Content means any content, templates, designs, workflows, systems, interfaces, dashboards, documents, methods, know-how, materials, reports, tools, technology, software, graphics, branding, guidance or other materials made available by Lumorus through the CoSec Hub.
Services means the CoSec Hub, CoSec Retainer, Governance Knowledge Centres and related company secretary, governance, compliance, support, administrative and professional services provided by Lumorus.
- Purpose of the CoSecHub
The CoSec Hub is provided to support the delivery and management of Lumorus services.
It may be used for:
- client onboarding;
- entity information management;
- statutory records support;
- director, officer, shareholder and beneficial ownership records;
- meeting administration;
- compliance calendars;
- task and workflow tracking;
- document exchange;
- service requests;
- governance reporting;
- filing and compliance support;
- user communications;
- audit trails;
- client service coordination.
The CoSec Hub is not a substitute for the Client’s own board, management, legal, regulatory, tax, accounting, compliance or professional responsibilities.
Unless expressly agreed in writing, Lumorus does not provide regulated legal, tax, audit, investment, financial, immigration or other regulated professional advice through the CoSec Hub.
- Access to the CoSecHub
Access to the CoSec Hub is subject to the limits of the service package subscribed to by the Client. Package limits may include limits on users, entities, jurisdictions, storage, workflows, service requests, support requests, document uploads, document reviews, meetings, filings, reporting features and other usage measures.
Lumorus may grant access to the CoSec Hub to the Client and its Authorised Users in accordance with the applicable client agreement.
Access may be subject to:
- successful onboarding;
- account approval;
- identity or authority checks;
- payment status;
- subscription status;
- jurisdictional restrictions;
- security requirements;
- role-based permissions;
- fair usage limits;
- compliance with these Platform Terms.
Lumorus may refuse, limit, suspend or withdraw access where reasonably necessary for security, legal, regulatory, contractual, operational or risk management reasons.
- Authorised Users
The Client may only give CoSec Hub access to Authorised Users approved by Lumorus.
The Client must request Lumorus approval before adding any additional user. Additional users may be subject to additional fees, package limits, onboarding checks, identity checks, authority checks, role-based access controls and other conditions notified by Lumorus.
The Client must ensure that each Authorised User:
- is authorised to act on behalf of the Client;
- uses the CoSec Hub only for the Client’s legitimate business purposes;
- complies with these Platform Terms;
- complies with all applicable laws;
- keeps login details secure;
- accesses only the information they are authorised to view;
- does not misuse the CoSec Hub or Lumorus systems.
The Client is responsible for all activity carried out through its Accounts and by its Authorised Users, except to the extent caused by Lumorus’ breach of these Platform Terms.
The Client must promptly notify Lumorus if an Authorised User should be removed, including where the user leaves the Client’s organisation, changes role, loses authority, or no longer requires access.
- Account security
You must:
- keep usernames, passwords, authentication codes and login credentials confidential;
- use strong and unique passwords;
- not share login credentials with anyone else;
- not allow unauthorised persons to access the CoSec Hub;
- notify Lumorus immediately if you suspect unauthorised access, credential compromise, misuse or a security incident;
- follow any reasonable security instructions issued by Lumorus;
- ensure that devices used to access the CoSec Hub are appropriately secured.
Lumorus may require Multi-Factor Authentication, also known as MFA, password resets, access reviews or other security controls. MFA means an additional identity verification step beyond a password, such as an authenticator code, email code, SMS code, device prompt or other approved verification method.
Lumorus may suspend or restrict access where it reasonably suspects unauthorised access, compromised credentials, misuse, security risk or breach of these Platform Terms.
- User access management
The Client does not have an automatic right to add additional users to the CoSec Hub.
All additional user access must be requested from and approved by Lumorus. Lumorus may approve, refuse, limit, suspend or condition additional user access based on the applicable service package, user limits, security requirements, onboarding checks, payment status, authority checks, role requirements and applicable law.
Where additional users exceed the number included in the Client’s package, additional fees may apply.
The Client must provide accurate information about each proposed user, including their name, role, email address, organisation, authority and required access level.
The Client must promptly request removal of access for any user who no longer requires access, including former employees, advisers, directors, officers, contractors or other representatives.
Lumorus may review user access from time to time and may require the Client to confirm whether listed users remain authorised.
User access should follow the principle of least privilege, meaning users should only be given the level of access reasonably required for their role.
Where the Client has administrator rights or user management permissions, the Client is responsible for:
- granting access only to appropriate users;
- assigning suitable permission levels;
- reviewing access regularly;
- removing users who no longer require access;
- ensuring that users have appropriate authority;
- maintaining accurate user records;
- ensuring that access rights reflect internal governance and confidentiality requirements.
The Client should apply the principle of least privilege, meaning users should only be given the level of access reasonably required for their role.
- Acceptable use
You may use the CoSec Hub only for lawful purposes and in accordance with these Platform Terms.
You must not use the CoSec Hub to:
- breach any applicable law or regulation;
- infringe any third-party rights;
- upload unlawful, false, misleading, defamatory, discriminatory, offensive, harmful or infringing material;
- upload malware, viruses, spyware, ransomware or malicious code;
- attempt to gain unauthorised access to any system, data, account or network;
- interfere with the security, integrity, performance or availability of the CoSec Hub;
- copy, scrape, harvest, extract or bulk download data or content without permission;
- reverse engineer, decompile, disassemble or attempt to derive source code from the platform;
- test, scan or probe system vulnerabilities without written permission;
- bypass access controls, usage limits or security measures;
- impersonate another person or misrepresent authority;
- use the CoSec Hub for fraudulent, deceptive, abusive or unlawful activity;
- use the CoSec Hub to provide services to third parties unless expressly authorised;
- use Lumorus Content to build, support or improve a competing service;
- overload, disrupt or degrade the platform;
- upload personal data, sensitive data or confidential information without proper authority;
- act in a way that damages Lumorus’ reputation, systems, clients, personnel or service delivery.
You must not exceed, bypass or attempt to bypass the user, entity, storage, workflow, support, meeting, filing, document review or other usage limits that apply to your service package.
- Client Content and uploads
The Client is responsible for Client Content uploaded, submitted, stored, transmitted or made available through the CoSec Hub.
The Client confirms that it has all rights, permissions, notices, consents, approvals and lawful bases required to upload and use Client Content through the CoSec Hub.
Client Content must be accurate, lawful, relevant and not excessive for the intended purpose.
The Client must not upload:
- unlawful content;
- content that infringes third-party rights;
- malicious code;
- content that the Client has no authority to provide;
- personal data that has been collected unlawfully;
- sensitive or special category data unless necessary, lawful and properly safeguarded;
- information subject to restrictions that prohibit processing through the CoSec Hub.
Lumorus may remove, restrict, quarantine or disable access to Client Content where it reasonably believes that the content breaches these Platform Terms, creates legal or security risk, or may harm Lumorus, the Client, other clients, users or third parties.
- Personal data and privacy
The processing of personal data through the CoSec Hub is governed by the Data Processing Agreement and Privacy Policy, as applicable.
The Client is usually the controller of Client Personal Data uploaded, submitted or provided by or on behalf of the Client. Lumorus is usually the processor where it processes that Client Personal Data to provide the Services on the Client’s instructions.
Lumorus may also act as an independent controller for personal data processed for its own purposes, including account administration, billing, CRM, security, legal compliance, service improvement and business records.
The Client must ensure that personal data provided through the CoSec Hub is collected, disclosed and used lawfully.
- Confidentiality
You must keep confidential all non-public information accessed through the CoSec Hub, including:
- Client Content;
- Lumorus Content;
- platform workflows;
- governance records;
- personal data;
- commercial information;
- technical information;
- user information;
- information relating to other users or third parties.
You must not disclose confidential information obtained through the CoSec Hub except as authorised by the Client, Lumorus, the applicable agreement or applicable law.
- Intellectual property
Lumorus and its licensors retain all rights, title and interest in and to the CoSec Hub and Lumorus Content.
Nothing in these Platform Terms transfers ownership of the CoSec Hub, software, systems, workflows, designs, templates, know-how, methodologies, platform configuration, analytics, documentation, branding or Lumorus Content to the Client or any Authorised User.
Subject to these Platform Terms and the applicable client agreement, Lumorus grants the Client and its Authorised Users a limited, revocable, non-exclusive, non-transferable right to access and use the CoSec Hub for the Client’s internal business purposes during the term of the applicable agreement.
The Client retains ownership of Client Content, subject to the rights granted to Lumorus to host, process, store, transmit, use and otherwise handle Client Content as necessary to provide the Services, comply with the agreement and protect Lumorus’ rights.
- Platform availability
Lumorus will use reasonable efforts to make the CoSec Hub available 24 hours a day, 7 days a week, subject to
- planned maintenance;
- emergency maintenance;
- security updates;
- system upgrades;
- third-party service provider issues;
- hosting or infrastructure disruption;
- internet or telecommunications failures;
- force majeure events;
- client-side issues;
- regulatory, legal or security requirements.
Unless expressly stated in the applicable client agreement or service package, Lumorus does not guarantee a specific uptime percentage or uninterrupted, error-free or continuous access to the CoSec Hub.
Where practical, Lumorus will aim to provide reasonable notice of planned maintenance that materially affects access.
The Client acknowledges that access may be interrupted, delayed, limited or unavailable from time to time for reasons outside Lumorus’ reasonable control.
- Platform changes
Lumorus may update, modify, improve, replace or discontinue features of the CoSec Hub from time to time.
Changes may be made for reasons including:
- security;
- legal or regulatory compliance;
- service improvement;
- technical performance;
- user experience;
- supplier changes;
- platform development;
- operational efficiency.
Where a material change significantly reduces a paid feature or materially affects service delivery, Lumorus will aim to provide reasonable notice where practical.
- Support
Support will be provided in accordance with the applicable client agreement, service package, service schedule or support terms.
The CoSec Hub is available for client access 24 hours a day, 7 days a week, subject to maintenance, security updates, third-party outages, force majeure events and other limitations set out in these Platform Terms.
Live support is also available as part of the Services, subject to the support level, response times, communication channels, fair usage limits and service package subscribed to by the Client.
Support may include:
- account access assistance;
- user guidance;
- technical support;
- issue reporting;
- platform troubleshooting;
- service request support;
- escalation of platform issues;
- guidance on using relevant CoSec Hub features.
- live support from Lumorus personnel or authorised support representatives.
Live support does not mean that every query will be resolved immediately. Response times, escalation routes and availability of specialist personnel may vary depending on the Client’s service package, the nature of the request, urgency, complexity, time zone, applicable jurisdiction and fair usage limits.
Support does not include, unless expressly agreed:
- bespoke legal advice;
- tax advice;
- accounting advice;
- regulated financial advice;
- custom software development;
- unsupported integrations;
- training for unauthorised users;
- correction of issues caused by Client systems, devices, internet connections or misuse;
- work outside the agreed service scope.
Lumorus may set support hours, response targets, escalation routes and fair usage limits.
- Suspension and restriction of access
Lumorus may suspend, restrict or disable access to the CoSec Hub, in whole or in part, where Lumorus reasonably believes that:
- you have breached these Platform Terms;
- there is unauthorised access or suspected credential compromise;
- there is a security risk;
- there is platform misuse;
- Client Content creates legal, regulatory, security or reputational risk;
- continued access may harm Lumorus, the Client, other clients, users or third parties;
- payment is overdue;
- the Client agreement has expired or been terminated;
- access is required to be restricted by law, regulation, court order, sanctions or regulator request;
- the Client or user has provided false or misleading information;
- the Client has failed to comply with onboarding, verification, KYC or authority checks.
Where reasonable and lawful, Lumorus will aim to notify the Client of suspension and explain the reason. Lumorus may suspend access without prior notice where urgent action is needed for security, legal, regulatory or risk management reasons.
- Consequences of misuse
Where there is misuse of the CoSec Hub, Lumorus may:
- issue a warning;
- require corrective action;
- remove or restrict Client Content;
- suspend or terminate user access;
- suspend or terminate the Client’s access;
- charge for additional work caused by misuse;
- preserve evidence;
- notify affected parties where required;
- report unlawful activity to relevant authorities;
- take legal action where appropriate.
The Client is responsible for losses, costs, liabilities, claims or damages arising from misuse by its Authorised Users, except to the extent caused by Lumorus’ breach of these Platform Terms.
- Third-party services and integrations
The CoSec Hub may use, link to or integrate with third-party services, systems, applications, tools, registries, payment providers, communication tools, storage providers, identity verification providers or electronic signature providers.
Third-party services may be subject to their own terms, privacy notices, security practices and availability.
Lumorus is not responsible for third-party services that are not controlled by Lumorus, except to the extent required by applicable law or expressly agreed in the client agreement.
Lumorus may add, replace or remove third-party providers where reasonably necessary for service delivery, security, compliance, technical or operational reasons.
- Electronic communications and notices
You agree that Lumorus may provide notices, updates, alerts, legal documents, service messages and other communications electronically, including by:
- email;
- platform notice;
- dashboard message;
- account notification;
- website notice;
- support ticket;
- electronic signature tool.
Electronic communications are treated as received in accordance with the applicable client agreement or, where not specified, when sent or made available through the relevant electronic channel.
You are responsible for keeping contact details and account information up to date.
- Records and audit trails
The CoSec Hub may create records and audit trails of user activity, including:
- login activity;
- access events;
- document uploads;
- workflow actions;
- task updates;
- service requests;
- permission changes;
- user comments;
- system events;
- support interactions.
These records may be used for:
- service delivery;
- security;
- troubleshooting;
- compliance;
- audit;
- dispute resolution;
- user accountability;
- legal or regulatory purposes.
- Client systems and devices
The Client and Authorised Users are responsible for the systems, devices, browsers, internet connections, software and networks used to access the CoSec Hub.
You must ensure that devices and systems used to access the CoSec Hub are secure, updated and protected against unauthorised access or malware.
Lumorus is not responsible for access issues, data loss, security incidents or service disruption caused by Client systems, devices, networks, browsers, internet connectivity or third-party tools outside Lumorus’ control.
- Export controls, sanctionsand restricted use
You must not access or use the CoSec Hub in breach of applicable sanctions, export control laws, anti-bribery laws, anti-money laundering laws or other trade restrictions.
Lumorus may restrict or suspend access where it reasonably believes that continued access may breach sanctions, export controls, regulatory restrictions or legal obligations.
- Disclaimers
The CoSec Hub is provided to support the delivery of Lumorus services and governance administration.
The CoSec Hub does not guarantee that:
- the Client will comply with all laws or regulations;
- all filings, deadlines or governance obligations will be identified without accurate Client data;
- all Client Content is accurate or complete;
- all issues will be detected automatically;
- access will be uninterrupted or error-free;
- any specific governance, legal, regulatory, tax, financial or commercial outcome will be achieved.
The Client remains responsible for its own governance, legal, regulatory, tax, filing, board, management and compliance obligations.
- Liability
Liability arising from use of the CoSec Hub is governed by the applicable client agreement.
Nothing in these Platform Terms excludes or limits liability that cannot lawfully be excluded or limited under applicable law.
- Termination
Access to the CoSec Hub will usually end when:
- the applicable client agreement expires or terminates;
- the Client’s subscription ends;
- Lumorus withdraws access in accordance with these Platform Terms;
- an Authorised User is removed;
- the Client ceases to be eligible for access;
- the Client or user breaches these Platform Terms.
Following termination, Lumorus may restrict access to the CoSec Hub and handle Client Content in accordance with the applicable client agreement and Data Processing Agreement.
- Changes to these Platform Terms
Lumorus may update these Platform Terms from time to time to reflect changes in:
- law or regulation;
- platform functionality;
- security requirements;
- service delivery;
- third-party providers;
- business operations;
- risk management;
- client or user needs.
Where Lumorus makes material changes, it will provide notice by email, platform notice, website notice or another reasonable method.
Continued access to or use of the CoSec Hub after the updated Platform Terms take effect will constitute acceptance of the updated terms, unless applicable law requires a different process.
- Governing law andjurisdiction
These Platform Terms are governed by the laws of England and Wales, unless the applicable client agreement states otherwise.
The courts of England and Wales will have jurisdiction, unless the applicable client agreement states otherwise or mandatory applicable law requires a different forum.
Nothing in this clause prevents a consumer, regulator, supervisory authority or other legally protected person from exercising rights that cannot lawfully be excluded under applicable law.
- Electronic acceptance
These Platform Terms may be accepted electronically, including by ticking a box, clicking “I agree”, creating an account, logging into the CoSec Hub, accessing the platform, signing electronically or otherwise accepting the applicable Lumorus terms.
Electronic acceptance has the same effect as signing these Platform Terms by hand, to the fullest extent permitted by applicable law.
The UK Electronic Communications Act 2000 provides a statutory framework for electronic communications and electronic data storage, and section 7 addresses the admissibility of electronic signatures in legal proceedings in England and Wales.
