Terms of Service

These terms (Terms) govern access to and use of the pre-release (beta) version of the Forge platform, and are incorporated into the Order Form signed by the Licensee.

In these Terms, Licensor means Purdy & Figg Ltd, a company incorporated in England and Wales under number 12477148 whose registered office is at 9 Heron Business Park, Eastman Way, Hemel Hempstead Industrial Estate, Hemel Hempstead, England, HP2 7FW, and Licensee means the company named as the customer in the Order Form. Each of the Licensor and the Licensee is a party, and together they are the parties.

1.1 In this Licence:

Authorised User

means an employee or contractor of the Licensee who is authorised by the Licensee to access and use the Licensed Products in accordance with clause 4.5.2;

Business Day

means a day other than a Saturday, Sunday or public holiday;

Confidential Information

means all information of a confidential nature (in any form) including know-how, trade secrets, financial, commercial, technical, tactical, strategic, marketing or customer information, employee information, any information agreed to be or marked as confidential;

Effective Date

means the start date stated in the Order Form or, if no start date is stated, the date on which the Order Form has been signed by the Licensee and countersigned by the Licensor;

End User

means any person, other than an Authorised User, who accesses or uses a Licensee Application;

Export Period

has the meaning given in clause 11.5;

Feedback

means any suggestions, comments, ideas, enhancement requests, bug reports, test results or other feedback relating to the Licensed Products provided by or on behalf of the Licensee or its Authorised Users, but excluding Licensee Materials;

Intellectual Property Rights

means copyright, rights related to copyright such as moral rights and performers rights, patents, rights in inventions, rights in confidential information, know-how, trade secrets, trade marks, geographical indications, service marks, trade names, design rights, rights in get-up, database rights, databases, business names, rights in computer software, unfair competition and passing off, and all similar rights of whatever nature wherever in the world arising and, in each case: (a) whether registered or not; (b) including any applications to protect or register such rights; (c) including all renewals and extensions of such rights or applications; (d) whether vested, contingent or future; and (e) wherever existing;

Licence

means the agreement between the Licensor and the Licensee comprising the Order Form and these Terms, including their schedules and appendices;

Licensed Intellectual Property Rights

means the Intellectual Property Rights detailed in Schedule 1;

Licence Term

has the meaning given in clause 11.1;

Licensed Products

as defined in Schedule 1;

Licensee Application

means any web-based application built, deployed or hosted by or on behalf of the Licensee using the Licensed Products, excluding any part of the Licensed Products incorporated in it;

Licensee Materials

means all data, content, code, software, applications (including Licensee Applications) and other materials created, uploaded, hosted, stored or processed using the Licensed Products by or on behalf of the Licensee, its Authorised Users or End Users, excluding the Licensed Products and any Feedback;

Permitted Purpose

has the meaning given in clause 2.1;

Order Form

means the order form issued by the Licensor which incorporates these Terms and is signed by or on behalf of the Licensee and countersigned by the Licensor;

1.2 In this Licence:

• a reference to this Licence includes its schedules, appendices and annexes (if any);
• a reference to a ‘party’ includes that party’s personal representatives, successors and permitted assigns;
• a reference to a ‘person’ includes a natural person, corporate or unincorporated body (in each case whether or not having separate legal personality) and that person’s personal representatives, successors and permitted assigns;
• a reference to any legislation or legislative provision is a reference to it as amended, extended, re-enacted or consolidated from time to time.

1.3 If there is any conflict between the Order Form and these Terms, the Order Form shall prevail, except that clause 3 (Beta Licence), clause 10 (Indemnities), clause 12 (Limitation of liability) and Schedule 2 (Data Processing Addendum) shall prevail over the Order Form unless the Order Form expressly states which provision of these Terms it amends.

2.1 Subject to the terms and conditions of this Licence, the Licensor hereby grants to the Licensee during the Licence Term a non-exclusive, non-transferable, non-sub-licensable licence to access and use the Licensed Products, through its Authorised Users, for the purpose of evaluating and testing them, including building, testing and deploying Licensee Applications and, where the Order Form states that End Users are permitted, making Licensee Applications available to End Users in accordance with clause 2.2 (the Permitted Purpose).

2.2 Where the Order Form states that End Users are permitted, the Licensee may make Licensee Applications available to End Users during the Licence Term, provided that:

• 2.2.1 End Users are given access only to Licensee Applications, and not to the build, development or administration environment of the Licensed Products;
• 2.2.2 the Licensee is solely responsible for each Licensee Application and for its relationship with, and any obligations to, its End Users;
• 2.2.3 the Licensee does not make any representation, or give any warranty or commitment, to any End User on behalf of the Licensor; and
• 2.2.4 the Licensee ensures that End Users’ use of Licensee Applications complies with clauses 4.4.9 and 4.4.10.

2.3 To the extent that any Licensee Application incorporates or depends on any part of the Licensed Products, the Licensee’s right to use that part ends on expiry or termination of this Licence, and the Licensor shall have no obligation to keep any Licensee Application available after that time.

3.1 The Licensee acknowledges that the Licensed Products are a pre-release (beta) version made available free of charge for evaluation and testing, and may contain errors, defects and incomplete features. The Licensed Products are provided “as is” and “as available”. The Licensor gives no commitment as to availability, performance, support, maintenance or the continued provision of any feature, and may modify, suspend or withdraw any part of the Licensed Products at any time.

3.2 Except as expressly set out in clause 9, all warranties, conditions and other terms implied by statute or common law are, to the fullest extent permitted by law, excluded from this Licence.

4.1 The Licensee shall not, and shall not cause any third party to, register or make any application to register any Intellectual Property Rights which conflict with the Licensed Intellectual Property Rights.

4.2 This Licence shall not entitle the Licensee to use any of the Licensed Intellectual Property Rights for any purpose other than in the exercise of its rights expressly granted under this Licence and in performing its obligations in connection with this Licence.

4.3 The Licensee shall supply to the Licensor such information in relation to its use of the Licensed Intellectual Property Rights or otherwise relating to this Licence as the Licensor may reasonably require.

4.4 Except as expressly permitted by this Licence, or to the extent that applicable law does not allow such a restriction, the Licensee shall not, and shall not permit or assist any third party to:

• 4.4.1 copy, modify, translate, adapt or create derivative works of the Licensed Products or any part of them;
• 4.4.2 reverse engineer, decompile, disassemble or otherwise attempt to derive the source code, underlying structure, algorithms or ideas of the Licensed Products;
• 4.4.3 sell, rent, lease, lend, distribute, sub-license, assign, pledge or otherwise transfer or encumber any rights in the Licensed Products, or make them available to any third party, including on a timesharing, service bureau or managed service basis, provided that making Licensee Applications available to End Users in accordance with clause 2.2 shall not of itself breach this clause 4.4.3;
• 4.4.4 use the Licensed Products for any purpose other than the Permitted Purpose, or operate the Licensed Products (as distinct from Licensee Applications) for the benefit of any third party;
• 4.4.5 use the Licensed Products, or any information obtained from them, to build, train, benchmark or improve any product or service that competes with the Licensed Products or with any other product or service of the Licensor;
• 4.4.6 use any automated means, including any artificial intelligence or machine learning tool, bot, crawler, scraper or spider, to access, extract, copy or index any part of the Licensed Products or their content, except through interfaces and tools the Licensor provides or approves in writing for that purpose;
• 4.4.7 circumvent, disable or interfere with any security, authentication, access control or usage-limiting feature of the Licensed Products, or access any part of them, or any account, system or network connected to them, that the Licensee is not authorised to access;
• 4.4.8 carry out any penetration testing, vulnerability scanning or load testing of the Licensed Products without the Licensor’s prior written consent;
• 4.4.9 introduce into the Licensed Products any virus, malware, malicious code or other harmful component, or do anything that interferes with or impairs the integrity, performance or availability of the Licensed Products or their use by others; or
• 4.4.10 upload, host or process on the Licensed Products any material that is unlawful, defamatory, obscene, harassing or deceptive, or that infringes the Intellectual Property Rights or other rights of any third party.

4.5 The Licensee shall:

• 4.5.1 use the Licensed Products only in accordance with this Licence, all applicable laws and any reasonable usage limits or acceptable use requirements the Licensor notifies to it in writing from time to time;
• 4.5.2 ensure that access to the Licensed Products (other than access by End Users to Licensee Applications in accordance with clause 2.2) is restricted to Authorised Users;
• 4.5.3 keep all login credentials secure and confidential, and not allow any login credential to be shared or used by more than one individual;
• 4.5.4 be responsible for all acts and omissions of its Authorised Users and End Users, and of any other person who accesses the Licensed Products using the Licensee’s credentials, whether or not authorised by the Licensee; and
• 4.5.5 notify the Licensor promptly on becoming aware of any unauthorised access to or use of the Licensed Products or any breach of this clause 4.

4.6 Without prejudice to any other right or remedy, if the Licensor reasonably believes that the Licensee or any Authorised User has breached clause 4, the Licensor may suspend the access of the Licensee or that Authorised User to the Licensed Products, in whole or in part, until the breach has been remedied to the Licensor’s reasonable satisfaction. Any breach of clause 4 shall be a material breach of this Licence.

5.1 The Licensee expressly acknowledges that the Licensor is the absolute owner of the Licensed Intellectual Property Rights.

5.2 Except as expressly set out in this Licence or otherwise expressly agreed in writing by the parties, no Intellectual Property Rights of either party or otherwise are assigned or transferred.

5.3 As between the parties, the Licensee owns all Intellectual Property Rights in the Licensee Materials. Nothing in this Licence transfers to the Licensee any right, title or interest in the Licensed Intellectual Property Rights or the Licensed Products, including any part of the Licensed Products incorporated in a Licensee Application.

5.4 The Licensee grants to the Licensor a non-exclusive, royalty-free, worldwide licence, for the Licence Term and the Export Period, to host, store, copy, transmit, display, back up and otherwise process the Licensee Materials to the extent necessary to provide, maintain, secure and support the Licensed Products and to exercise its rights and perform its obligations under this Licence.

5.5 The Licensee grants to the Licensor a perpetual, irrevocable, worldwide, royalty-free, transferable and sub-licensable licence to use, copy, modify, incorporate and otherwise exploit the Feedback for any purpose, without any obligation or payment to the Licensee. The Licensor shall not publicly identify the Licensee as the source of any Feedback without the Licensee’s prior written consent.

5.6 The Licensee shall not make any representations or undertake any acts which indicate that the Licensee has any right, title or interest in or to the Licensed Intellectual Property Rights other than under the terms of this Licence.

5.7 The Licensee shall not do, nor cause or authorise to be done:

• anything which shall or may impair, damage or be detrimental to the reputation or goodwill associated with the Licensor or the Licensed Intellectual Property Rights; or
• anything which may adversely affect the value of the Licensed Intellectual Property Rights.

In consideration for the rights granted by the Licensor to the Licensee under this Licence, the following shall apply:

6.1 No fees or other sums shall be payable by the Licensee for access to or use of the Licensed Products during the Licence Term. Any extension or renewal of this Licence beyond the Licence Term may be subject to fees, which shall be agreed in writing between the parties before the extension or renewal takes effect.

6.2 The Licensee shall provide valid payment card details on sign up as a condition of access to the Licensed Products, and shall keep those details up to date throughout the Licence Term. The Licensee authorises the Licensor, through its payment service provider, to charge that payment card for any charges arising from excessive use of the Licensed Products beyond the usage allowance stated in the Order Form or otherwise notified to the Licensee in writing.

6.3 All payments referred to in this Licence are exclusive of VAT and any other sales or similar taxes, customs duties or similar charges which shall also be payable by the Licensee to the Licensor on the due date for payment.

7.1 The Licensee shall immediately inform the Licensor if it becomes aware of any infringement or potential infringement of any of the Licensed Intellectual Property Rights (including any activity or proceedings commenced in which the ownership, validity or registration of the Licensed Intellectual Property Rights is called into question).

8.1 If any notice of infringement or other notification is received by the Licensee, or any action or claim is brought against the Licensee, alleging infringement of third-party rights in connection with any Licensed Product, the Licensee shall provide the Licensor with all information and assistance as reasonably requested by the Licensor.

8.2 The Licensor shall have no obligation or liability where the infringement or alleged infringement:

• arises out of the use or dealing with the Licensed Intellectual Property Rights by the Licensee in a manner outside the scope of the terms of this Licence;
• arises out of materials provided by the Licensee to the Licensor; or
• arises as a result of any other breach of this Licence.

9.1 Each of the parties warrants that it has the full power and authority to carry out the actions contemplated under this Licence and that its entry into and performance under this Licence shall not cause it to be in breach of any obligations to a third party.

9.2 The Licensor warrants and represents that as at the date of this Licence:

• it is the sole legal and beneficial owner of the Licensed Intellectual Property Rights; and
• it is entitled to grant to the Licensee the licences contained within this Licence.

10.1 The Licensee shall indemnify and keep indemnified the Licensor from and against all losses, damages, liability, costs (including reasonable legal fees) and expenses incurred by the Licensor as a result of or in connection with any action, demand or claim arising out of or in connection with:

• any breach of this Licence by the Licensee;
• any use of the Licensed Intellectual Property Rights or Licensed Products by the Licensee, its Authorised Users or End Users, or by any person accessing the Licensed Products through or on behalf of the Licensee, other than in accordance with this Licence;
• any data, content, software, application or other material that the Licensee, or any person acting on its behalf, creates on, uploads to, hosts on or processes using the Licensed Products, including any claim that the Licensee Materials infringe the Intellectual Property Rights of a third party;
• any breach by the Licensee of clause 13 (Confidentiality); or
• any claim by an End User arising out of or in connection with a Licensee Application or that End User’s use of it.

11.1 This Licence shall commence on the Effective Date and, unless terminated earlier in accordance with this clause 11, shall continue for the period stated in the Order Form or, if no period is stated, for three (3) months (the Licence Term). This Licence may be terminated at any time by the Licensor giving a minimum of 1 week notice in writing to the Licensee.

11.2 Without affecting any other right or remedy available to it, either party may terminate this Licence with immediate effect by giving written notice to the other party if:

• 11.2.1 the other party commits a material breach of this Licence which is irremediable or, if remediable, is not remedied within 30 days of receiving written notice of the breach;
• 11.2.2 the other party suspends, or threatens to suspend, payment of its debts, or is unable to pay its debts as they fall due or admits inability to pay its debts within the meaning of section 123 of the Insolvency Act 1986;
• 11.2.3 the other party enters into any compromise or arrangement with its creditors, has an administrator, administrative receiver or liquidator appointed, has a winding-up petition presented or order made against it (other than for a solvent amalgamation or reconstruction), or is subject to any analogous event in any jurisdiction; or
• 11.2.4 the other party suspends or ceases, or threatens to suspend or cease, carrying on all or substantially all of its business.

11.3 Termination or expiry of this Licence shall not affect any accrued rights and liabilities of either party at any time up to the date of termination.

11.4 In the event of termination of this Licence for any reason, or on the expiry of the Licence Term:

• each party shall within 7 days return or destroy (at the other party’s option) all the other party’s Confidential Information in its possession or under its control and all copies of such information (excluding Licensee Materials, which shall be dealt with in accordance with clause 11.5);
• the Licensee shall immediately cease using the Licensed Intellectual Property Rights; and
• the Licensee shall promptly return to the Licensor at the Licensee’s expense all records and copies of materials provided to the Licensee by the Licensor as a result of this Licence.

11.5 For 30 days following expiry or termination of this Licence (the Export Period), the Licensor shall, on the Licensee’s written request, make the Licensee Materials available for export in the formats available through the Licensed Products. After the Export Period, the Licensor shall delete the Licensee Materials, unless and to the extent that applicable law requires it to retain them or the parties have entered into a further agreement for the Licensee’s continued use of the Licensed Products. Copies held in backups shall be deleted in accordance with the Licensor’s standard backup cycle, and in any event within 30 days after the end of the Export Period.

11.6 The Licensed Products are a pre-release version, and the Licensee is responsible for maintaining its own copies of any Licensee Materials it wishes to retain.

12.1 The extent of the parties’ liability under or in connection with this Licence (regardless of whether such liability arises in tort, contract, indemnity or in any other way and whether or not caused by negligence or misrepresentation) shall be as set out in this clause.

12.2 The Licensor shall not be liable to the Licensee for any consequential, indirect or special loss.

12.3 Subject to clause 12.5, the Licensor shall not be liable to the Licensee in contract, tort (including negligence), misrepresentation (whether innocent or negligent), breach of statutory duty or otherwise arising out of or in connection with this Licence for any of the following (whether direct or indirect):

• loss of profit;
• loss of anticipated profit;
• loss of revenue;
• loss or corruption of data;
• loss or corruption of software or systems;
• loss or damage to equipment;
• loss of use;
• loss of production;
• loss of contract;
• loss of business;
• loss of commercial opportunity;
• loss of savings, discount or rebate (whether actual or anticipated);
• harm to reputation or loss of goodwill; or
• wasted expenditure.

12.4 The Licensor’s total aggregate liability to the Licensee arising under or in connection with this Licence, whether in contract, tort (including negligence), breach of statutory duty, misrepresentation, under any indemnity or otherwise, shall be limited to the greater of £5,000 or 100% of the total sums paid or payable by the Licensee under this Licence in the 12 months immediately preceding the event giving rise to the claim. Where two or more claims arise from the same or related events, those claims shall be treated as arising from a single event.

12.5 Notwithstanding any other provision of this Licence, the liability of the parties shall not be limited in any way in respect of the following:

• death or personal injury caused by negligence;
• fraud or fraudulent misrepresentation;
• any other losses which cannot be excluded or limited by applicable law.

13.1 Each party agrees that it may use the other party’s Confidential Information only in the exercise of its rights and performance of its obligations under this Licence. Neither party shall during the term of this Licence and for a period of 5 years following termination of this Licence, disclose the other party’s Confidential Information except as permitted under this clause.

13.2 Each party may disclose the other party’s Confidential Information to those of its employees, officers, advisers, agents or representatives who need to know the other party’s Confidential Information in order to exercise the disclosing party’s rights or perform its obligations under this Licence provided that the disclosing party shall ensure that each of its employees, officers, advisers, agents or representatives to whom the other party’s Confidential Information is disclosed is aware of its confidential nature and complies with this clause as if it were a party.

13.3 Each party agrees to not allow any of the other party’s Confidential Information to be shared with, uploaded to, processed by, disclosed to or used to train any publicly available artificial intelligence or machine learning system, program, model or dataset without that other party’s prior written consent.

13.4 Each party may disclose any Confidential Information of the other party where it is required to do so by law, any court, any governmental, regulatory or supervisory authority (including any regulated investment exchange) or any other authority of competent jurisdiction.

13.5 Feedback shall not be Confidential Information of the Licensee, and nothing in this clause 13 shall restrict the Licensor’s use of Feedback in accordance with clause 5.5.

14.1 If any dispute arises between the parties out of or in connection with this Licence, the matter shall be referred to senior representatives of each party who shall use their reasonable endeavours to resolve it.

15.1 The Licensee shall for the duration of this Licence maintain appropriate insurance cover with a reputable insurance company against all relevant liabilities and indemnities that may arise under this Licence.

16.1 The Licensee shall not be entitled to grant sub licences under this Licence.

17.1 Notices under this Licence shall be in writing and sent, in the case of the Licensor, to its registered office or to charlie@purdyandfigg.com and, in the case of the Licensee, to the registered office or notices email address stated in the Order Form (or such other address as a party notifies to the other in writing). Notices shall be deemed received:

• if sent by first-class post: 2 Business Days after posting;
• if sent by email: at 9.00 am on the next Business Day after transmission; and
• if delivered by hand: on delivery.

18.1 No variation of this Licence shall be valid or effective unless it is in writing, refers to this Licence and is duly signed or executed by, or on behalf of, each party.

19.1 This Licence constitutes the entire agreement between the parties and supersedes and extinguishes all previous agreements, promises, assurances, warranties, representations and understandings between them, whether written or oral, relating to its subject matter. Each party acknowledges that in entering into this Licence it does not rely on, and shall have no remedies in respect of, any statement, representation, assurance or warranty (whether made innocently or negligently) that is not set out in this Licence. Nothing in this clause shall limit or exclude any liability for fraud.

20.1 The Licensee shall not assign, transfer, mortgage, charge, sub-contract, declare a trust over or deal in any other manner with any of its rights and obligations under this Licence without the prior written consent of the Licensor. The Licensor may at any time assign, novate, transfer, sub-contract or deal in any other manner with any or all of its rights and obligations under this Licence, including to any member of its group or to any purchaser of all or part of its business or of the Licensed Products, and the Licensee shall execute any document reasonably required to give effect to any such novation.

21.1 Nothing in this Licence constitutes, or shall be deemed to constitute, a partnership between the parties nor make any party the agent of another party.

22.1 If any provision of this Licence (or part of any provision) is or becomes illegal, invalid or unenforceable, the legality, validity and enforceability of any other provision of this Licence shall not be affected.

23.1 Provisions which by their terms or intent are to survive termination of this Licence shall do so.

24.1 No one other than a party to this Licence shall have any right to enforce any of its provisions.

25.1 This Licence and any dispute or claim arising out of, or in connection with, it, its subject matter or formation (including non contractual disputes or claims) shall be governed by, and construed in accordance with, the laws of England and Wales.

The Licensed Intellectual Property Rights

The Licensed Intellectual Property Rights comprise the following: use of the platform known as “Forge”, developed by and owned by Purdy & Figg Ltd, which enables authorised users to build, deploy, host, version and maintain web-based applications.

The Licensed Products

The Licensed Products on and in respect of which the Licensed Intellectual Property Rights may be used include use of the Forge Platform.

This Data Processing Addendum (Addendum) forms part of the Licence between Purdy & Figg Ltd (Licensor) and the Licensee named in the Order Form (Licensee), governing the Licensee’s use of the Licensed Products. Capitalised terms not defined in this Addendum have the meanings given in the Licence or, where not defined there, in the applicable Data Protection Legislation.

1. Definitions

1.1 Controller, Processor, Data Subject, Personal Data, Processing (and Process and Processed) and Supervisory Authority have the meanings given in the applicable Data Protection Legislation.

1.2 Data Protection Legislation means all laws relating to the protection of Personal Data and privacy that apply to the Processing under the Licence, including: (a) the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003; (b) to the extent applicable, the EU GDPR; in each case as amended, extended, re-enacted or replaced from time to time.

1.3 Data Subject Request means a request by a Data Subject to exercise their rights under the Data Protection Legislation in relation to Licensee Personal Data.

1.4 EU GDPR means Regulation (EU) 2016/679.

1.5 Licensee Personal Data means any Personal Data, contained in the Licensee Materials or otherwise, that the Licensor Processes on behalf of the Licensee in connection with the Licence, as described in Appendix 1.

1.6 Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Licensee Personal Data in the Licensor’s possession or control. It does not include unsuccessful attempts or activities that do not compromise the security of Licensee Personal Data, such as unsuccessful log-in attempts, pings, port scans, denial of service attacks or other network attacks on firewalls or networked systems.

1.7 Restricted Transfer means a transfer of Licensee Personal Data that would be prohibited by the Data Protection Legislation without appropriate safeguards being in place, including: (a) a transfer from the United Kingdom to a country not covered by adequacy regulations under section 17A of the Data Protection Act 2018; and (b) a transfer from the European Economic Area to a country not covered by an adequacy decision under Article 45 of the EU GDPR.

1.8 Security Measures means the technical and organisational measures described in Appendix 2.

1.9 Sub-processor means any third party appointed by the Licensor to Process Licensee Personal Data.

1.10 Transfer Mechanism means, as applicable: (a) for transfers subject to the UK GDPR, the International Data Transfer Agreement (IDTA), or the International Data Transfer Addendum to the EU Standard Contractual Clauses (UK Addendum), issued by the Information Commissioner under section 119A of the Data Protection Act 2018; and (b) for transfers subject to the EU GDPR, the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914 (EU SCCs); in each case as amended or replaced from time to time.

1.11 UK GDPR has the meaning given in section 3(10) of the Data Protection Act 2018.

2. Roles and scope

2.1 The parties acknowledge that, in relation to the Licensee Personal Data, the Licensee is the Controller and the Licensor is the Processor.

2.2 Appendix 1 sets out the subject matter, duration, nature and purpose of the Processing, the types of Personal Data and the categories of Data Subjects.

2.3 To the extent the Licensor Processes Personal Data relating to the Licensee’s personnel or Authorised Users for its own purposes, it does so as an independent Controller and not under this Addendum. Those purposes include account administration, authentication, security monitoring, billing and analytics on the use of the Licensed Products. The Licensor shall Process that Personal Data in accordance with the Data Protection Legislation and its privacy notice.

3. Licensor obligations

3.1 When Processing Licensee Personal Data, the Licensor shall:

• 3.1.1 Process it only on the Licensee’s documented instructions, unless required to do otherwise by applicable law;
• 3.1.2 not use, retain or disclose Licensee Personal Data for any purpose other than providing the Licensed Products and performing its obligations and exercising its rights under the Licence;
• 3.1.3 not sell, rent, disclose or otherwise make available Licensee Personal Data to any third party for money or other valuable consideration, or for cross-context behavioural advertising, and not combine it with Personal Data received from any other source except as permitted by the Data Protection Legislation;
• 3.1.4 inform the Licensee promptly if, in its opinion, an instruction infringes the Data Protection Legislation. The Licensor may suspend the relevant Processing until the instruction is withdrawn or confirmed in writing;
• 3.1.5 taking into account the nature of the Processing, provide reasonable assistance to the Licensee, by appropriate technical and organisational measures, so that the Licensee can respond to Data Subject Requests. If the Licensor receives a Data Subject Request directly, it shall promptly forward the request to the Licensee and shall not respond itself, except to direct the Data Subject to the Licensee or as required by law;
• 3.1.6 taking into account the nature of the Processing and the information available to it, provide reasonable assistance to the Licensee in complying with its obligations under Articles 32 to 36 of the UK GDPR (and, where applicable, the EU GDPR). Those obligations cover security, Personal Data Breach notification, data protection impact assessments and prior consultation with a Supervisory Authority;
• 3.1.7 notify the Licensee promptly, where legally permitted, of any enquiry, complaint or notice from a Supervisory Authority relating to its Processing of Licensee Personal Data;
• 3.1.8 notify the Licensee without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach. The Licensor shall provide the information the Licensee reasonably requires to meet its own notification obligations, as it becomes available, and shall take reasonable steps to contain and remedy the Personal Data Breach. Notifying or responding to a Personal Data Breach is not an acknowledgement of fault or liability by the Licensor;
• 3.1.9 at the Licensee’s choice, delete or return all Licensee Personal Data at the end of the provision of the Licensed Products, in accordance with clause 11.5 of the Licence, and delete existing copies unless applicable law requires their retention; and
• 3.1.10 make available to the Licensee all information reasonably necessary to demonstrate compliance with this Addendum and Article 28 of the UK GDPR (and, where applicable, the EU GDPR), and allow for and contribute to audits, including inspections, conducted by the Licensee or an independent auditor it mandates, on at least 30 days’ prior written notice, no more than once in any 12-month period (except following a Personal Data Breach or where required by a Supervisory Authority), during normal business hours and subject to reasonable confidentiality obligations.

3.2 The Licensor shall comply with its obligations as a Processor under the Data Protection Legislation. It shall notify the Licensee if it determines that it can no longer meet those obligations, in which case the Licensee may take reasonable and appropriate steps to stop and remedy any unauthorised Processing.

4. Licensee obligations

4.1 The Licensee shall:

• 4.1.1 comply with its obligations as a Controller under the Data Protection Legislation;
• 4.1.2 ensure that it has, and maintains throughout the Licence Term, all lawful bases, consents and notices necessary for the Licensor and its Sub-processors to Process the Licensee Personal Data lawfully under the Licence;
• 4.1.3 ensure that its instructions comply with the Data Protection Legislation;
• 4.1.4 not do, or omit to do, anything that causes the Licensor or any Sub-processor to breach the Data Protection Legislation;
• 4.1.5 be solely responsible for the accuracy, quality and legality of the Licensee Personal Data, and for any notification to Supervisory Authorities or Data Subjects that the Data Protection Legislation requires of a Controller;
• 4.1.6 not upload to, or Process using, the Licensed Products any special category Personal Data or Personal Data relating to criminal convictions and offences without the Licensor’s prior written consent; and
• 4.1.7 promptly inform the Licensor of any enquiry, complaint or request it receives that relates to the Licensor’s Processing of Licensee Personal Data.

5. Sub-processors

5.1 The Licensee gives the Licensor general written authorisation to appoint Sub-processors.

5.2 The Licensor shall: 5.2.1 appoint each Sub-processor under a written contract that imposes data protection obligations no less protective of Licensee Personal Data than those in this Addendum; and 5.2.2 remain liable to the Licensee for the acts and omissions of each Sub-processor in relation to Licensee Personal Data as if they were its own.

5.3 The Licensor shall inform the Licensee of any intended addition or replacement of a Sub-processor at least 14 days before the change takes effect, giving the Licensee the opportunity to object on reasonable data protection grounds. If the Licensee objects and the parties cannot resolve the objection in good faith, the Licensee may terminate this Licence by written notice as its sole and exclusive remedy.

6. International transfers

6.1 The Licensor shall not make, and shall ensure that its Sub-processors do not make, any Restricted Transfer of Licensee Personal Data unless the transfer complies with the Data Protection Legislation. This includes having a valid Transfer Mechanism, or another lawful transfer mechanism, in place, together with any transfer risk assessment required.

6.2 Where the Licensee is established in the European Economic Area, transfers of Licensee Personal Data to the Licensor in the United Kingdom are made in reliance on the European Commission’s adequacy decision for the United Kingdom, for as long as it remains in force.

7. Miscellaneous

7.1 If there is any conflict between the Licence and this Addendum in relation to the Processing of Licensee Personal Data, this Addendum shall prevail. In all other respects, the Licence remains in full force and effect.

7.2 Each party’s liability arising under or in connection with this Addendum, however arising, is subject to the limitations and exclusions of liability in clause 12 of the Licence, to the extent permitted by the Data Protection Legislation.

7.3 This Addendum, and any dispute or claim arising out of or in connection with it (including non-contractual disputes or claims), shall be governed by the laws of England and Wales. The courts of England and Wales shall have exclusive jurisdiction, except as otherwise required by a Transfer Mechanism.

Appendix 1: Details of processing

Subject matter

Hosting, storage and Processing of the Licensee Materials in connection with the Licensee’s use of the Licensed Products under the Licence.

Duration

The Licence Term, plus any period after termination or expiry until the Licensee Personal Data is deleted or returned.

Nature and purpose

Collection, storage, hosting, organisation, retrieval, use, transmission, backup and deletion of Licensee Personal Data as necessary to provide, host, maintain, secure and support the Licensed Products, and any applications the Licensee builds on them.

Types of Personal Data

Names, business contact details, job titles, user credentials and identifiers, IP addresses and device data, and any other Personal Data the Licensee chooses to include in the Licensee Materials.

Categories of Data Subjects

Licensee’s employees, contractors and Authorised Users; and the Licensee’s customers, suppliers or other individuals whose Personal Data the Licensee includes in the Licensee Materials.

Special category data

N/A

Frequency of transfer

Continuous, for the duration of the Licence Term.

Appendix 2: Security measures

The Licensor shall maintain the following technical and organisational measures, which are designed to protect Licensee Personal Data to a level appropriate to the risk. The Licensor may update these measures from time to time, provided the overall level of protection is not materially reduced.

1. Governance and policies

1.1 A documented information security policy, approved by senior management and reviewed at least annually. 1.2 A named individual or team responsible for information security and data protection.

2. Access control

2.1 Role-based access controls applying the principle of least privilege, so that personnel can access Licensee Personal Data only where needed for their role. 2.2 Unique user accounts. 2.3 Prompt removal of access when personnel leave or change role, and periodic reviews of access rights. 2.4 Password and credential management standards.

3. Encryption

3.1 Encryption of Licensee Personal Data at rest uses industry-standard encryption (AES-256 or equivalent).

4. Infrastructure and network security

4.1 Firewalls, network segregation and other appropriate controls to protect production environments. 4.2 Logical separation of each licensee’s data and applications within the Licensed Products.

5. Incident management

5.1 A documented incident response procedure covering how security incidents and Personal Data Breaches are detected, escalated, contained, investigated and notified. 5.2 Post-incident review to identify and put in place improvements.

6. Personnel security

6.1 Confidentiality obligations in employment contracts and contractor agreements. 6.2 Data protection and information security training at induction and periodically after that.

7. Sub-processors and third-party tools

7.1 Security and data protection due diligence before appointing any Sub-processor, and written contracts imposing appropriate security obligations. 7.2 Controls on the use of artificial intelligence and other third-party tools.

8. Data retention and deletion

8.1 Retention of Licensee Personal Data only for as long as needed to provide the Licensed Products, or as required by law. 8.2 Secure deletion or return of Licensee Personal Data at the end of the Licence, in accordance with this Addendum.