PAVE Insight Ltd Subscription Conditions

Version: 4 October 2026
Supplier: PAVE Insight Ltd, incorporated and registered in England and Wales with company number 15183946, whose registered office is at 167-169 Great Portland Street, 5th Floor, London W1W 5PF, United Kingdom.

These Conditions are incorporated into, and form part of, each Order Form entered into between PAVE Insight Ltd and the Customer for the Services and/or any Additional Services. Commercial details are set out in the applicable Order Form, online proposal, quote or statement of work. Each Order Form, together with these Conditions and any document expressly incorporated by reference, forms the Agreement between the parties.

Interpretation
Basis of contract and online Order Forms
User accounts and access rights
Additional accounts, upgrades and consulting services
Services, availability and support
Third-party services, data and dependencies
Supplier's obligations and service changes
Customer's obligations
Charges, discounts and payment
Referral rebate scheme
Proprietary rights, Customer Data, outputs and Deliverables
Confidentiality and publicity
Indemnities
Limitation of liability
Term, renewal and termination
Suspension
Effects of termination and exit
Force majeure
Data protection
Security, assurance and audit
Conflict and order of precedence
Variation and updates
Waiver
Rights and remedies
Severance
Entire agreement
Assignment and subcontracting
No partnership or agency
Third-party rights
Electronic signature and counterparts
Notices
Governing law
Jurisdiction

Schedules
Schedule 1 - Data Protection Addendum
Schedule 2 - Particulars of Processing
Schedule 3 - Technical and Organisational Measures

Conditions

1. Interpretation

1.1 The definitions and rules of interpretation in this clause apply in this Agreement.

Acceptance: the Customer's acceptance of an Order Form by signature, electronic signature, online approval, clicking to accept, making payment, or allowing any Authorised User to access or use the Services, whichever occurs first.

Additional Services: any services outside standard subscription access to the Services, including analyst time, data support, data cleansing, onboarding, configuration, training, workshops, bespoke reporting, custom analysis, integration work, implementation support, Consulting Services and other professional services.

Agreement: the contract between the Customer and the Supplier for the supply of the Services and any Additional Services, comprising the Order Form, these Conditions, the Schedules and any document expressly incorporated by reference in the Order Form.

Aggregated Data: data, statistics, metrics, insights or analysis created or derived by or on behalf of the Supplier from Customer Data, Customer Outputs, Deliverables or use of the Services or Additional Services, provided that no individual person, Customer or Customer dataset can reasonably be identified or reconstructed from it.

Applicable Data Protection Laws: all applicable laws relating to the protection of personal data, privacy, direct marketing or electronic communications, including the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 and, to the extent applicable, the EU GDPR.

Authorised User: a named individual employee, officer, consultant, contractor or agent of the Customer who is authorised by the Customer to access and use the Services through an Authorised User Account solely for the Customer's internal business operations.

Authorised User Account: an individual login account provisioned for an Authorised User. An Authorised User Account is not a concurrent-use licence and must not be shared.

Base Subscription Fees: the Supplier's standard undiscounted fees for the relevant Package, modules, account allowance and Subscription Term before applying any Discount, as set out in the applicable Order Form or, if not set out there, the Supplier's then-current list price or quoted base price.

Business Day: a day other than a Saturday, Sunday or public holiday in England when banks in London are open for business.

Confidential Information: has the meaning given in clause 12.1.

Consulting Services: Additional Services comprising consulting, advisory, analyst, data, implementation, configuration, training, research, bespoke reporting, workshop, strategic support or similar professional services provided by or on behalf of the Supplier.

Contract Year: a 12-month period commencing on the Effective Date or any anniversary of the Effective Date.

CPI: the Consumer Prices Index published by the UK Office for National Statistics, or any replacement or successor index selected by the Supplier acting reasonably.

Customer: the customer specified in the Order Form.

Customer Data: data, content, materials, files, records or information inputted into the Services by the Customer or Authorised Users, or supplied to the Supplier by or on behalf of the Customer, for the purpose of using the Services, facilitating the Customer's use of the Services or receiving Additional Services. Customer Data excludes Supplier Materials, Proprietary Data, Aggregated Data, Usage Data, system logs, Customer Outputs and Deliverables except to the extent a Customer Output or Deliverable contains the Customer Data itself.

Customer Output: any dashboard view, report, forecast, visualisation, export or other output generated for the Customer through use of the Services, excluding Supplier Materials and Proprietary Data embedded in or underlying that output.

Deliverables: any report, analysis, dashboard configuration, training material, model, template, integration, data file, document or other output prepared or supplied by or on behalf of the Supplier through Additional Services, excluding the Services and Customer Outputs generated solely through ordinary use of the Services.

Discount: any discount, promotional price, introductory price, credit, rebate, trial credit, price concession or other reduction from the Base Subscription Fees.

Documentation: the online or written user documentation, service descriptions, help materials and other materials made available by the Supplier for the Services from time to time.

Effective Date: the effective date stated in the Order Form or, if no date is stated, the date of Acceptance.

EU GDPR: Regulation (EU) 2016/679, as amended or replaced from time to time.

Fees: the Subscription Fees, fees for Additional Services, usage fees, set-up fees and any other fees or charges payable under or in connection with the Agreement.

Initial Subscription Term: the initial term stated in the Order Form. If no term is stated, the Initial Subscription Term shall be 12 months from the Effective Date.

Net Subscription Fees: the Subscription Fees payable after applying any Discount.

Normal Business Hours: 8.00 am to 6.00 pm UK time on Business Days.

Order Form: the online proposal, subscription details page, quote, statement of work or other ordering document issued or approved by the Supplier and accepted by the Customer, including through an electronic signature or online acceptance workflow, which identifies the commercial terms of the Customer's subscription and/or any Additional Services.

Package: the subscription package, tier or bundle selected by the Customer in the Order Form.

Planned Maintenance: scheduled maintenance, updates, upgrades, releases, infrastructure work or other planned work affecting the Services.

Proprietary Data: all datasets, market data, reference data, forecasts, analytics, models, algorithms, calculations, methodologies, benchmarks, templates and other data or information generated, compiled, obtained, licensed or owned by the Supplier or its licensors and made available through or in connection with the Services or Additional Services.

Renewal Period: each successive 12-month renewal period commencing after the Initial Subscription Term, unless a different renewal period is stated in the Order Form.

Services: the PAVE Insight cloud-hosted data, analytics, dashboarding and forecasting services made available by the Supplier to the Customer under the Agreement, including the Software and related Documentation, support and online interfaces.

Software: the PAVE Insight cloud-hosted data analytics and forecasting environment, including its software components, databases, dashboards, reports, interfaces, models and related infrastructure.

Subscription Fees: the recurring subscription fees payable by the Customer for the selected Package, modules and agreed Authorised User Account allowance, as set out in the Order Form. Subscription Fees are package-based and are not calculated on a per-seat basis unless the Order Form expressly states otherwise.

Subscription Term: the Initial Subscription Term together with any Renewal Periods.

Supplier: PAVE Insight Ltd, incorporated and registered in England and Wales with company number 15183946, whose registered office is at 167-169 Great Portland Street, 5th Floor, London W1W 5PF, United Kingdom.

Statement of Work: any Order Form, statement of work, quote, proposal, work order, online approval or other written or electronic confirmation issued or approved by the Supplier that describes Additional Services.

Supplier Materials: the Services, Software, Documentation, Proprietary Data, Aggregated Data, Usage Data, Deliverables, Supplier tools, know-how, methodologies, templates, workflows, processes, configurations, working papers and any intellectual property or materials owned, licensed, developed or created by or on behalf of the Supplier, whether before, during or after the Subscription Term, excluding Customer Data to the extent embedded in a Deliverable or Customer Output.

Support Services Policy: the Supplier's policy for providing standard support for the Services, as made available online or otherwise notified by the Supplier from time to time.

Terms URL: the URL or web page specified in the Order Form from which these Conditions may be accessed.

UK GDPR: has the meaning given in section 3(10), supplemented by section 205(4), of the Data Protection Act 2018.

Usage Data: telemetry, logs, metadata, diagnostic data, performance data, security data and other data relating to configuration, access, availability, performance, usage and operation of the Services.

Virus: any thing or device, including any software, code, file or programme, which may prevent, impair or otherwise adversely affect the operation, security, availability, integrity or user experience of any software, hardware, network, service, device, programme or data, including worms, trojan horses, ransomware, malware and other similar things or devices.

1.2 Clause, schedule and paragraph headings shall not affect interpretation of the Agreement.

1.3 Unless the context otherwise requires, words in the singular include the plural and words in the plural include the singular.

1.4 References to a person include an individual, company, corporation, partnership, unincorporated body, government entity and that person's successors and permitted assigns.

1.5 References to a company include any company, corporation or other body corporate, wherever and however incorporated or established.

1.6 References to a statute or statutory provision are to that statute or statutory provision as amended, extended, re-enacted or replaced from time to time, and include all subordinate legislation made under it.

1.7 References to writing or written include email and electronic signature or acceptance workflows, but exclude fax.

1.8 References to clauses and schedules are to the clauses and schedules of these Conditions unless the context otherwise requires.

1.9 The words including, include, in particular and similar expressions are illustrative and shall not limit the sense of the words preceding them.

1.10 A reference to the Customer includes Authorised Users where the context requires. The Customer is responsible for the acts and omissions of its Authorised Users as if they were the acts and omissions of the Customer.

2. Basis of contract and online Order Forms

2.1 Each Order Form incorporates these Conditions by reference. The Agreement is formed on Acceptance, unless the Order Form states that acceptance is subject to the Supplier's countersignature or written confirmation.

2.2 An Order Form may be accepted by electronic signature or through an online proposal, ordering or e-signature platform. The parties agree that electronic signatures, electronic approvals and records generated by such platforms are valid and binding for the purposes of the Agreement.

2.3 The Supplier may withdraw or amend any proposal or Order Form before Acceptance. Unless the Order Form states otherwise, any proposal or quote expires 30 days after issue if not accepted by the Customer.

2.4 The version of these Conditions incorporated into an Order Form is the version identified in the Order Form or, if no version is identified, the version made available at the Terms URL on the Effective Date. The Supplier may make updated versions available from time to time in accordance with clause 22.

2.5 The Customer acknowledges that the Services are supplied for business purposes only. The Customer warrants that it is not acting as a consumer.

2.6 Any terms or conditions supplied by the Customer, including on or with any purchase order, supplier portal, vendor onboarding system, payment process or other document, are rejected and shall not apply unless expressly agreed by the Supplier in writing and signed by a director of the Supplier.

2.7 The Customer is responsible for ensuring that the Order Form accurately records the Package, modules, Base Subscription Fees, any Discount, Net Subscription Fees, Subscription Term, billing frequency, account allowance and any special terms required by the Customer before Acceptance.

3. User accounts and access rights

3.1 Subject to the Customer paying the Fees and complying with the Agreement, the Supplier grants the Customer a non-exclusive, non-transferable, non-sublicensable right during the Subscription Term to permit Authorised Users to access and use the Services and Documentation solely for the Customer's internal business operations.

3.2 Unless the Order Form states otherwise, the Customer's Package includes up to 10 Authorised User Accounts. The Subscription Fees are package-based and are not reduced if the Customer uses fewer than 10 Authorised User Accounts.

3.3 In relation to Authorised Users and Authorised User Accounts, the Customer undertakes that:

(a) the maximum number of Authorised User Accounts shall not exceed the allowance stated in the Order Form or, if no allowance is stated, 10;

(b) each Authorised User Account shall be allocated to one named individual only and shall not be shared by multiple individuals;

(c) an Authorised User Account may be reassigned to another named individual if the previous Authorised User no longer requires access, provided that the Customer does not use reassignment to avoid account limits or permit account sharing;

(d) each Authorised User shall keep authentication credentials confidential and secure;

(e) the Customer shall maintain accurate and current records of Authorised Users and promptly remove access for any person who no longer requires it;

(f) the Customer shall be responsible for all activity conducted through its Authorised User Accounts, whether authorised or unauthorised, except to the extent caused by the Supplier's breach of the Agreement; and

(g) the Customer shall promptly notify the Supplier of any actual or suspected unauthorised access to or use of the Services.

3.4 The Supplier may monitor use of the Services and audit account usage, access logs and other relevant records to verify compliance with the Agreement. The Supplier shall not be entitled to require disclosure of Authorised User passwords. The Customer shall provide reasonable co-operation with such audit or verification.

3.5 If any audit or monitoring indicates that the Customer has exceeded its account allowance, permitted unauthorised access, breached licence restrictions or underpaid Fees, then, without prejudice to the Supplier's other rights and remedies, the Supplier may require the Customer to:

(a) reduce usage to the permitted allowance;

(b) purchase an upgraded Package or additional account allowance;

(d) reimburse the Supplier's reasonable audit costs where the audit identifies material non-compliance.

3.6 The Customer shall not access, store, distribute or transmit any Virus or any material during use of the Services that:

(a) is unlawful, harmful, threatening, defamatory, obscene, infringing, harassing, discriminatory, offensive or otherwise objectionable;

(b) facilitates illegal activity;

(d) promotes unlawful violence;

(e) is discriminatory based on race, sex, gender reassignment, colour, religious belief, sexual orientation, disability or any other protected characteristic;

(f) infringes any third-party rights;

(g) causes damage or injury to any person, property, system, network, software or data; or

(h) would reasonably be expected to damage the reputation of the Supplier or the Services.

3.7 The Supplier may, without liability and without prejudice to its other rights, remove or disable access to any material or account that the Supplier reasonably considers to breach clause 3.6 or otherwise create legal, security, operational or reputational risk.

3.8 The Customer shall not, and shall not permit any Authorised User or third party to:

(a) copy, modify, duplicate, create derivative works from, frame, mirror, republish, download, scrape, crawl, display, transmit or distribute all or any portion of the Services, Software, Proprietary Data or Documentation except to the extent expressly permitted by the Agreement;

(b) decompile, reverse compile, disassemble, reverse engineer or otherwise reduce to human-perceivable form all or any part of the Services or Software, except to the extent such restriction is prohibited by law;

(c) access all or any part of the Services, Software, Proprietary Data or Documentation in order to build, improve, benchmark, train or support a product, model, dataset or service that competes with the Services or the Supplier;

(d) use the Services, Software, Proprietary Data, Documentation, Additional Services, Customer Outputs or Deliverables to provide services to third parties or for any bureau, managed service, resale, outsourcing or service-provider purpose;

(e) license, sell, rent, lease, transfer, assign, distribute, disclose or otherwise commercially exploit or make available the Services, Software, Proprietary Data, Documentation, Additional Services, Customer Outputs or Deliverables to any third party except as expressly permitted by the Agreement;

(f) attempt to gain unauthorised access to the Services, Software, any related system or network, or any data of the Supplier or any other customer;

(g) conduct penetration testing, vulnerability scanning, load testing, automated scraping, stress testing or security testing of the Services without the Supplier's prior written consent;

(h) use the Services in any way that breaches applicable law or regulation;

(i) introduce or permit the introduction of any Virus into the Services or the Supplier's network or information systems;

(j) remove, obscure or alter any copyright, trade mark, proprietary notice or restriction displayed in or made available through the Services;

(k) use the Services, Additional Services, Customer Outputs or Deliverables for high-risk, safety-critical, medical, emergency, life-support, legal, financial investment or regulated decision-making purposes, unless expressly agreed in the Order Form; or

(l) use any output, Deliverable or recommendation from the Services or Additional Services as a substitute for professional advice or independent judgement.

3.9 The rights granted under this clause 3 are granted to the Customer only and shall not be treated as granted to any subsidiary, holding company, affiliate or other group company of the Customer unless expressly stated in the Order Form.

3.10 The Customer may permit its contractors or advisers to be Authorised Users only where they access and use the Services solely for the Customer's internal business operations, are bound by confidentiality and use restrictions no less protective than those in the Agreement, and are not competitors of the Supplier. The Customer remains fully responsible for them.

4. Additional accounts, upgrades and consulting services

4.1 The Customer may request additional Authorised User Accounts, additional modules, a Package upgrade or other expanded usage. The Supplier may approve or reject any such request at its discretion.

4.2 Unless the Order Form expressly states otherwise, there is no fixed per-seat price for additional Authorised User Accounts. Any additional accounts, expanded account allowance, Package upgrade or module addition shall be subject to commercial discussion and any fees, conditions and activation timing agreed by the Supplier.

4.3 If the Supplier approves additional Authorised User Accounts, additional modules or a Package upgrade, the Supplier may require the Customer to accept a further Order Form, quote or written variation. Any additional Fees shall be payable in accordance with the applicable invoice and may be pro-rated for the remainder of the then-current Subscription Term.

4.4 Clauses 4.4 to 4.18 apply to Additional Services, including Consulting Services. Additional Services are separate from standard subscription access to the Services and standard technical support under clause 5.

4.5 The Supplier is not obliged to provide Additional Services unless the Supplier agrees to do so in an Order Form, Statement of Work, quote or other written or electronic confirmation issued or approved by the Supplier. No Customer request, brief, purchase order, specification or statement of requirements forms part of the Agreement unless expressly incorporated by the Supplier.

4.6 A Statement of Work may describe the scope, Deliverables, assumptions, dependencies, timetable, Fees, expenses, acceptance criteria and any special terms for Additional Services. If scope or Fees are not agreed, the Supplier is not required to provide the relevant Additional Services. Any request outside the agreed scope is a change request which the Supplier may accept, reject, defer or price separately.

4.7 The Supplier shall perform Additional Services with reasonable skill and care. The Supplier does not warrant that any Additional Services or Deliverables will achieve any particular commercial outcome, revenue, saving, forecast, market result, operational improvement, regulatory outcome, implementation result, adoption level or other Customer objective.

4.8 The Customer remains responsible for: providing accurate, complete and lawful Customer Data, information, instructions, access, personnel, decisions and approvals; performing Customer dependencies; reviewing and validating Deliverables; implementing any recommendations; and determining whether Additional Services and Deliverables are suitable for the Customer's purposes. The Supplier shall not be liable for any failure, delay, defect, loss or additional cost to the extent caused by Customer Data, Customer instructions, Customer systems, third-party systems, Customer delay or Customer failure to perform its dependencies.

4.9 Unless expressly stated to be binding in a Statement of Work, all dates, timetables, milestones and delivery estimates for Additional Services are indicative only. The Supplier may adjust any timetable, milestone, delivery date or Fees where reasonably necessary because of Customer delay, inaccurate or incomplete information, scope change, third-party dependency, Force Majeure event or other matter outside the Supplier's reasonable control.

4.10 Additional Services may be charged on a time-and-materials, fixed-fee, retainer, package, milestone or other basis stated in the applicable Statement of Work. Where the Supplier agrees to provide Additional Services but the applicable rates are not expressly stated, the Supplier may charge at its then-current standard rates. Unless agreed otherwise, the Supplier may invoice time-and-materials Additional Services monthly in arrears and may invoice fixed-fee, retainer, package or milestone Additional Services in advance or on the relevant milestone.

4.11 The Supplier may require prepayment, a deposit, payment on account, a minimum commitment or settlement of overdue Fees before commencing or continuing Additional Services.

4.12 Unless the applicable Statement of Work states that expenses are included, the Customer shall reimburse reasonable travel, accommodation, subsistence, third-party charges and other out-of-pocket expenses incurred by the Supplier in connection with Additional Services requested by the Customer, together with VAT or other applicable taxes.

4.13 Fees for Additional Services are non-cancellable and non-refundable once work has commenced or time has been reserved. If the Customer cancels, postpones or reschedules booked Additional Services less than five Business Days before the scheduled start time, the Supplier may charge the Fees that would have been payable for the reserved time and any non-cancellable expenses or third-party costs.

4.14 The Customer shall review Deliverables promptly. Unless the applicable Statement of Work specifies a different process, Deliverables shall be deemed accepted on delivery unless the Customer gives written notice of a material non-conformance with the agreed scope within five Business Days after delivery, with reasonable details. The Customer's sole and exclusive remedy for non-conforming Additional Services or Deliverables is, at the Supplier's option, correction, re-performance or a credit or refund of the affected Additional Services Fees paid for the non-conforming element.

4.15 Subject to payment in full of all Fees for the relevant Additional Services and any restrictions in the Agreement or applicable Statement of Work, the Supplier grants the Customer a non-exclusive, non-transferable, non-sublicensable licence to use final Deliverables internally for the Customer's internal business operations or the specific purpose stated in the applicable Statement of Work. Drafts, working papers, underlying data, methodologies, models, code, templates, tools, calculations and know-how are not licensed unless expressly stated by the Supplier in writing.

4.16 Deliverables and Additional Services are not legal, financial, investment, accounting, tax, regulatory, compliance, technical assurance, safety or other professional advice unless the Supplier expressly agrees in writing to provide that regulated or specialist advice. The Customer remains responsible for obtaining independent advice where appropriate.

4.17 Additional Services do not include ongoing managed services, outsourced business processes, customer system operation, data stewardship, regulatory sign-off, audit certification or third-party implementation responsibility unless expressly stated in the applicable Statement of Work.

4.18 The Supplier may use employees, contractors, subcontractors and consultants to provide Additional Services, provided that the Supplier remains responsible for them to the extent required by the Agreement.

5. Services, availability and support

5.1 The Supplier shall, during the Subscription Term, provide the Services and make available the Documentation to the Customer on and subject to the Agreement.

5.2 The Supplier shall use reasonable endeavours to make the Services available with a target uptime of 99.5% per calendar month, measured from the Supplier's monitoring point and excluding:

(a) Planned Maintenance;

(b) emergency or unscheduled maintenance;

(d) outages, delays, interruptions or errors caused by the Customer, Authorised Users, Customer Data, Customer systems, Customer networks or Customer instructions;

(e) third-party services, networks, hosting providers, data providers, internet services or other dependencies outside the Supplier's reasonable control;

(f) suspension under the Agreement;

(g) beta, pilot, trial, evaluation or non-production services or features;

(h) security incidents or remedial action reasonably taken by the Supplier to protect the Services, customers or data; and

(i) unavailability resulting from the Customer's failure to use the Services in accordance with the Documentation or the Supplier's reasonable instructions.

5.3 The uptime target in clause 5.2 is a service target and not a warranty that the Services will be uninterrupted or error-free.

5.4 If the Supplier fails to meet the uptime target in a calendar month, the Customer's sole and exclusive remedy is a service credit equal to 5% of that month's Subscription Fees for each full percentage point below 99.5%, capped in aggregate at 10% of that month's Subscription Fees.

5.5 A service credit is available only if:

(a) the Customer submits a written claim with reasonable supporting details within 30 days after the end of the relevant month;

(b) the Customer is not in breach of the Agreement and has no overdue Fees at the time of the claim or when the credit is to be applied; and

5.6 Service credits are not refunds, have no cash value, may not be set off by the Customer and shall be applied to a future invoice for the same Services. If no future invoice is due because the Agreement has lawfully expired without renewal, the credit shall lapse unless the Supplier agrees otherwise.

5.7 Planned Maintenance may be carried out during the maintenance window of 6.00 am to 10.00 am UK time or at such other times as the Supplier reasonably determines. The Supplier shall use reasonable endeavours to give advance notice of material Planned Maintenance where reasonably practicable.

5.8 The Supplier may perform emergency or unscheduled maintenance at any time where the Supplier considers it necessary for security, legal, operational, performance or availability reasons. The Supplier shall use reasonable endeavours to give notice where reasonably practicable.

5.9 The Supplier will, as part of the Services and at no additional cost, provide standard technical support for the Services during Normal Business Hours in accordance with the Support Services Policy.

5.10 Standard support does not include Additional Services, Consulting Services, training, workshops, custom analysis, data cleansing, bespoke reporting, customer-specific configuration, implementation support, third-party systems support, support for unsupported browsers or devices, or issues caused by the Customer, Authorised Users, Customer Data, Customer systems or third-party services.

6. Third-party services, data and dependencies

6.1 The Customer acknowledges that the Services and Additional Services may incorporate, interoperate with, depend on or enable access to third-party services, websites, data, software, infrastructure, hosting, APIs, content and other materials.

6.2 The Supplier is not responsible for third-party websites, services, content, transactions or contracts entered into by the Customer with third parties. Any such use is at the Customer's own risk and subject to the relevant third party's terms.

6.3 The Supplier may use third-party providers, licensors, sub-processors, data sources, infrastructure providers, contractors and tools in connection with the Services and Additional Services. The Supplier may replace, remove, suspend or modify third-party dependencies where the Supplier reasonably considers it necessary or desirable, including because of changes in availability, quality, pricing, security, legal requirements or third-party terms.

6.4 The Supplier does not warrant that any third-party data, market data, reference data, content or dependency will be error-free, complete, current, continuously available or suitable for the Customer's purposes.

6.5 The Customer is responsible for obtaining and maintaining any third-party licences, consents, permissions or rights required for Customer Data, Customer systems or third-party integrations requested or supplied by the Customer.

7. Supplier's obligations and service changes

7.1 The Supplier shall perform the Services substantially in accordance with the Documentation and shall perform any Additional Services with reasonable skill and care.

7.2 The undertaking in clause 7.1 shall not apply to the extent any non-conformance is caused by:

(a) use of the Services contrary to the Agreement, Documentation or the Supplier's instructions;

(b) modification or alteration of the Services by any party other than the Supplier or the Supplier's authorised contractors;

(d) the Customer's failure to install, configure, use or update any required software, browser, system or integration in accordance with the Supplier's instructions;

(e) beta, pilot, trial, evaluation or non-production features; or

(f) Force Majeure events.

7.3 If the Services do not conform with clause 7.1, the Supplier shall use reasonable commercial endeavours to correct the non-conformance or provide a workaround. If Additional Services or Deliverables materially fail to conform with the agreed scope, the Supplier may correct, re-perform or provide a credit or refund of the affected Additional Services Fees paid for the non-conforming element. The remedies in this clause 7.3 and clause 4.14 are the Customer's sole and exclusive remedies for breach of clause 7.1.

7.4 The Supplier does not warrant that:

(a) the Customer's use of the Services will be uninterrupted, secure, timely or error-free;

(b) the Services, Additional Services, Documentation, Proprietary Data, Customer Outputs, Deliverables or information obtained through the Services or Additional Services will meet the Customer's requirements or expectations;

(c) forecasts, analytics, dashboards, outputs, Deliverables or data made available through the Services or Additional Services will be accurate, complete, current or suitable for any particular purpose;

(d) the Software or Services will be free from Viruses or vulnerabilities; or

(e) defects will be corrected within any particular period unless expressly stated in the Order Form.

7.5 The Customer acknowledges that data analytics, forecasting and Consulting Services involve assumptions, estimates, data quality limitations, market uncertainty, modelling risk and reliance on Customer Data and Customer instructions. Customer Outputs and Deliverables are provided for internal informational and decision-support purposes only. The Customer remains solely responsible for decisions, actions and omissions based on use of the Services, Additional Services, Customer Outputs or Deliverables.

7.6 The Services, Additional Services, Documentation, Proprietary Data, Customer Outputs and Deliverables do not constitute legal, financial, investment, accounting, tax, regulatory, compliance, technical assurance, safety, professional or other advice unless the Supplier expressly agrees otherwise in writing.

7.7 The Agreement does not prevent the Supplier from entering into similar agreements with third parties, or from independently developing, using, selling or licensing services, software, documentation, data, analytics, models, Deliverables, outputs or products which are similar to or compete with those provided under the Agreement.

7.8 The Supplier may update, modify, enhance, replace or discontinue features, functionality, user interfaces, models, algorithms, methodologies, data sources, Documentation, Support Services Policy and other aspects of the Services from time to time, provided that the Supplier shall not materially reduce the core functionality of the subscribed Package during the then-current Subscription Term except where the Supplier reasonably considers the change necessary for legal, regulatory, security, technical, operational, third-party dependency or service-improvement reasons.

7.9 The Supplier may provide beta, preview, pilot or experimental features from time to time. Such features are provided as-is, may be modified or withdrawn at any time, and are excluded from any service levels, warranties, indemnities and support commitments unless the Supplier expressly agrees otherwise in writing.

7.10 The Supplier warrants that it has and will maintain the rights, licences, consents and permissions necessary for the performance of its obligations under the Agreement.

7.11 In the event of loss or damage to Customer Data, the Customer's sole remedy against the Supplier shall be for the Supplier to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest backup maintained by or for the Supplier. The Supplier shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data caused by any third party except those sub-contracted by the Supplier to perform Customer Data maintenance or backup services.

8. Customer's obligations

8.1 The Customer shall:

(a) provide all necessary co-operation, information, access, decisions, materials, Customer Data, approvals and assistance reasonably required by the Supplier to provide the Services and any Additional Services;

(b) ensure that all information and Customer Data supplied to the Supplier is accurate, complete, lawful, up to date and provided in a timely manner;

(c) comply with all applicable laws and regulations in connection with the Customer's activities, Customer Data and use of the Services, Additional Services, Customer Outputs and Deliverables;

(d) carry out its responsibilities under the Agreement in a timely and efficient manner;

(e) ensure that Authorised Users use the Services and Documentation in accordance with the Agreement and be responsible for each Authorised User's breach;

(f) obtain and maintain all licences, consents, notices, permissions, rights and approvals required for the Supplier to provide the Services and any Additional Services, including in relation to Customer Data and any third-party systems or data provided or requested by the Customer;

(g) ensure that its systems, networks, browsers, devices and integrations comply with specifications and instructions provided by the Supplier from time to time;

(h) be responsible for procuring, maintaining and securing its network connections, telecommunications links, systems, hardware, software, browsers, devices and integrations;

(i) maintain its own copies and backups of Customer Data where required for its business continuity, regulatory compliance or record-keeping purposes;

(j) implement and maintain appropriate security measures for its systems, devices, accounts, passwords and Authorised Users;

(k) promptly notify the Supplier of any actual or suspected breach of security, unauthorised access, misuse or vulnerability affecting the Services, Additional Services, Supplier systems or any Authorised User Account;

(l) not submit special category personal data, criminal offence data, children's data, consumer personal data, payment card data, health data or other high-risk personal data to the Services or provide it in connection with Additional Services unless expressly agreed by the Supplier in writing; and

(m) comply with all reasonable instructions and policies notified by the Supplier in connection with security, access, support, acceptable use and operation of the Services and any Additional Services.

8.2 The Supplier shall not be liable for any failure, delay, defect, non-conformance, loss or damage to the extent caused by the Customer's failure to comply with clause 8.1. The Supplier may adjust any timetable, delivery schedule, support response, milestone, service commitment, Additional Services scope, Deliverable or Fees to the extent reasonably necessary because of Customer delay or failure.

8.3 As between the parties, the Customer owns all right, title and interest in and to Customer Data and has sole responsibility for the legality, reliability, integrity, accuracy, completeness and quality of Customer Data.

8.4 The Customer warrants that:

(a) it has the right to provide Customer Data to the Supplier and permit the Supplier to process Customer Data in accordance with the Agreement;

(b) Customer Data and the Supplier's use of Customer Data in accordance with the Agreement will not infringe any third-party rights or breach applicable law;

(c) the Customer has provided all notices and obtained all consents, authorisations and lawful bases required for the Supplier to process personal data in accordance with the Agreement;

(d) Customer Data will not contain anything that breaches clause 3.6 or clause 8.1(l); and

(e) the Customer's use of the Services, Additional Services, Customer Outputs and Deliverables will comply with all applicable laws and regulations.

9. Charges, discounts and payment

9.1 The Customer shall pay the Fees in accordance with the Agreement and the applicable Order Form.

9.2 The Customer shall provide valid, up-to-date and complete billing details, payment card details, approved purchase order information or other payment information reasonably required by the Supplier.

9.3 If the Customer provides payment card details, the Customer authorises the Supplier or its payment processor to charge the card for all Fees payable under the Agreement, including on the Effective Date for the Initial Subscription Term and on each renewal date for the relevant Renewal Period.

9.4 If the Supplier invoices the Customer, the Customer shall pay each invoice within 30 days after the invoice date, unless the Order Form states a shorter payment period. The Supplier may invoice Additional Services in advance, monthly in arrears, on completion, on milestones, on reservation of time, or otherwise as stated in the applicable Statement of Work or as reasonably determined by the Supplier where not expressly stated.

9.5 The Customer shall not withhold, reduce, set off or delay payment because of any purchase order, procurement process, supplier portal, invoice formatting issue or other administrative requirement not expressly agreed by the Supplier in the Order Form.

9.6 All Fees are:

(a) payable in pounds sterling unless the Order Form states otherwise;

(b) non-cancellable and non-refundable except as expressly stated in the Agreement;

(c) exclusive of VAT and any other taxes, duties, levies or similar charges, which shall be added to the Supplier's invoice at the applicable rate; and

(d) payable without deduction, withholding, counterclaim or set-off except as required by law.

9.7 If the Supplier has not received payment by the due date, then, without prejudice to the Supplier's other rights and remedies:

(a) the Supplier may charge interest on the overdue amount on a daily basis at an annual rate equal to 4% above the Bank of England base rate from time to time, from the due date until payment in full, whether before or after judgment;

(b) the Supplier may recover its reasonable costs and expenses of collecting overdue amounts, including legal and debt collection costs;

(c) the Supplier may suspend access to all or part of the Services or suspend performance of Additional Services in accordance with clause 16; and

(d) any Discounts, credits or concessions not yet applied may be withdrawn by the Supplier.

9.8 The Customer shall pay all Fees for the full Subscription Term and all Fees for Additional Services which have commenced, been delivered, been reserved, or become payable under the applicable Statement of Work. Except where the Agreement expressly states otherwise, early termination, non-use, partial use, a reduction in Authorised Users, failure to access the Services, cancellation or rescheduling of Additional Services, non-use of Deliverables or expiry of a Discount shall not entitle the Customer to any refund or credit.

9.9 Where an Order Form identifies Base Subscription Fees, any Discount and Net Subscription Fees, those amounts shall apply for the relevant Subscription Term. If the Order Form shows only the Net Subscription Fees, the Supplier's then-current list price or quoted undiscounted price for the relevant Package and modules shall be treated as the Base Subscription Fees.

9.10 Any Discount applies only to the period, Package, modules and Fees expressly stated in the Order Form. Unless the Order Form expressly states that a Discount is recurring, the Discount applies only to the Initial Subscription Term and shall not apply to any Renewal Period, upgrade, additional account allowance, additional module, Additional Services, taxes or other charges.

9.11 A Discount does not amend, reduce or waive the Base Subscription Fees, and the expiry, reduction or withdrawal of a Discount is not a price increase.

9.12 Unless the Order Form states otherwise, any percentage cap or limit on renewal increases shall be calculated by reference to the Base Subscription Fees that would have applied without any Discount, not by reference to the Net Subscription Fees actually paid after applying a Discount.

9.13 Subject to clause 9.14 and unless the Order Form states otherwise, the Supplier may increase the Base Subscription Fees at the start of each Renewal Period by giving at least 60 days' notice before the start of that Renewal Period. For the same Package, modules and account allowance, the increase to the Base Subscription Fees shall not exceed the lower of:

(a) CPI plus 3%; and

(b) 7%,

in each case calculated against the Base Subscription Fees for the immediately preceding Subscription Term.

9.14 The cap in clause 9.13 does not apply to:

(a) the expiry, reduction or withdrawal of a Discount;

(b) changes to the Package, modules, account allowance, usage limits, scope or Subscription Term requested by or agreed with the Customer;

(d) pass-through taxes, duties, levies, payment processing charges or similar charges;

(e) material increases in third-party provider, hosting, infrastructure, data licensing or other third-party costs; or

(f) any increase expressly agreed in an Order Form or written variation.

9.15 If the Customer disputes an invoice in good faith, it must notify the Supplier in writing within 10 Business Days after the invoice date, giving reasonable details of the dispute. The Customer shall pay all undisputed amounts by the due date. The parties shall work in good faith to resolve the disputed amount. If the Customer does not dispute an invoice within that period, the invoice shall be deemed accepted.

10. Referral rebate scheme

10.1 The Supplier may, at its sole discretion, offer a referral rebate to a Customer when the Customer introduces prospective customers that subsequently enter into a paid subscription for the Services.

10.2 No referral rebate applies unless the Supplier has confirmed eligibility, amount and qualifying criteria in writing in the Order Form or in a separate written agreement. No referral rebate applies by default.

10.3 No entitlement to a referral rebate arises unless and until the referred party has entered into a binding subscription agreement with the Supplier for a minimum 12-month Subscription Term and paid the applicable fees in full.

10.4 The amount, form and timing of any referral rebate shall be as confirmed by the Supplier in writing. The Supplier may apply a rebate as a credit against future Fees or, at its discretion, pay it as a standalone rebate.

10.5 Referral rebates are exclusive of VAT and any other taxes. The Customer is responsible for any tax treatment, reporting or approvals relating to referral rebates.

10.6 The Customer shall comply with all applicable anti-bribery, anti-corruption, procurement, conflicts-of-interest and disclosure obligations in connection with any referral. The Supplier may withhold or cancel any referral rebate where it reasonably considers that payment could breach law, policy, procurement rules or reputational standards.

10.7 Referral rebates are personal to the Customer, may not be assigned or transferred, and may not be combined with any other discount or promotional scheme unless agreed by the Supplier in writing.

10.8 The Supplier may amend or withdraw any referral rebate scheme at any time before confirming eligibility in writing.

11. Proprietary rights, Customer Data, outputs and Deliverables

11.1 The Customer acknowledges and agrees that the Supplier and/or its licensors own all intellectual property rights in and to the Supplier Materials. Except as expressly stated in the Agreement, no rights are granted to the Customer in respect of the Supplier Materials.

11.2 The Customer owns Customer Data. The Customer grants the Supplier and its subcontractors a worldwide, royalty-free, non-exclusive licence during the Subscription Term and for any post-termination period reasonably required to provide, secure, support, improve and administer the Services, provide Additional Services, perform the Agreement, process Customer Data, create Customer Outputs and Deliverables, and exercise the Supplier's rights under the Agreement.

11.3 The Customer grants the Supplier a perpetual, irrevocable, worldwide, royalty-free licence to use Customer Data, Customer Outputs, Deliverables and Usage Data to create, use, exploit and disclose Aggregated Data for any purpose, including analytics, benchmarking, model improvement, service improvement, product development, security, reporting and marketing, provided that the Aggregated Data does not identify the Customer, any individual person or any Customer dataset.

11.4 The Customer may use Customer Outputs for its internal business operations during the Subscription Term. After expiry or termination, the Customer may retain and use static copies of Customer Outputs lawfully exported before termination solely for its internal record-keeping and historical reference purposes, provided that:

(a) all Fees due under the Agreement have been paid;

(b) the Customer does not use Customer Outputs to compete with the Supplier;

(c) the Customer does not redistribute, publish, resell, license, commercialise or otherwise make available Customer Outputs or Proprietary Data to any third party except as expressly permitted by the Agreement or the Order Form;

(d) the Customer does not remove proprietary notices or restrictions; and

(e) the Customer complies with confidentiality obligations and any third-party data restrictions notified by the Supplier.

11.5 Subject to payment in full of all Fees for the relevant Additional Services, the Customer may use final Deliverables for its internal business operations or the specific purpose stated in the applicable Statement of Work, subject to clauses 4.15, 11.6 and 11.7. The Customer shall not use any Deliverable to compete with the Supplier, or redistribute, publish, resell, license, commercialise or otherwise make available any Deliverable to any third party unless expressly permitted by the Supplier in writing.

11.6 Nothing in the Agreement transfers ownership of Supplier Materials to the Customer. To the extent any Customer Output or Deliverable contains or depends on Supplier Materials, the Customer receives only the limited rights expressly stated in clause 11.4 or clause 11.5.

11.7 The Supplier retains ownership of all Supplier Materials, including all pre-existing and reusable materials, know-how, methodologies, templates, software, code, configurations, data models, algorithms, calculations, tools, working papers, generic learning and improvements, even if developed, adapted or used in connection with Additional Services. Customer Data embedded in a Deliverable remains Customer Data, but this does not affect the Supplier's ownership of Supplier Materials or its licence rights under the Agreement.

11.8 The Customer shall not use Proprietary Data, Customer Outputs, Deliverables or any part of the Services or Additional Services for external publication, third-party reporting, customer-facing services, public benchmarking, resale, redistribution, model training, competitive analysis or development of competing products unless expressly agreed by the Supplier in writing.

11.9 The Supplier may use any feedback, suggestions, ideas, enhancement requests, recommendations or other information provided by the Customer or Authorised Users relating to the Services, Additional Services or Deliverables without restriction, attribution or payment. The Customer assigns to the Supplier any intellectual property rights in such feedback to the extent required to give effect to this clause.

11.10 The Supplier confirms that it has all rights in relation to the Services, Documentation and final Deliverables necessary to grant the rights it grants under the Agreement.

12. Confidentiality and publicity

12.1 Confidential Information means all confidential information, however recorded or preserved, disclosed by a party or its Representatives to the other party or that party's Representatives in connection with the Agreement, including:

(a) information that would be regarded as confidential by a reasonable business person relating to the business, assets, affairs, customers, clients, suppliers, plans, products, services, finances, operations, processes, know-how, designs, trade secrets, software or technology of the disclosing party or its group;

(b) information developed by the parties in the course of the Agreement;

(d) the Supplier Materials, pricing, Discounts, proposals, roadmaps, security information, benchmarking, performance information and product plans; and

(e) the terms of the Agreement.

12.2 Representatives means, in relation to a party, its employees, officers, contractors, subcontractors, representatives, professional advisers and, in the Supplier's case, actual or prospective investors, acquirers, funders, insurers and group companies.

12.3 The provisions of this clause 12 shall not apply to information that:

(a) is or becomes generally available to the public other than as a result of breach of this clause;

(b) was available to the receiving party on a non-confidential basis before disclosure;

(c) is or becomes available to the receiving party on a non-confidential basis from a person who, to the receiving party's knowledge, is not bound by confidentiality obligations in respect of it;

(d) is independently developed by or for the receiving party without use of or reference to the disclosing party's Confidential Information; or

(e) the parties agree in writing is not confidential or may be disclosed.

12.4 Each party shall keep the other party's Confidential Information secret and confidential and shall not:

(a) use it except for the purpose of exercising or performing its rights and obligations under or in connection with the Agreement; or

(b) disclose it except as expressly permitted by this clause 12.

12.5 A party may disclose the other party's Confidential Information to its Representatives who need to know it for the purposes of the Agreement, provided that the receiving party remains responsible for its Representatives' compliance with this clause.

12.6 A party may disclose Confidential Information to the extent required by law, a court, regulator, stock exchange, government authority or other competent authority, provided that, to the extent legally permitted, it gives the other party reasonable notice and takes into account the other party's reasonable requests in relation to the disclosure.

12.7 The Supplier may disclose Confidential Information to the extent reasonably required for due diligence, investment, funding, insurance, corporate reorganisation, merger, acquisition, sale of business or professional advice, provided that the recipient is subject to confidentiality obligations or professional duties of confidence.

12.8 Each party reserves all rights in its Confidential Information. No rights or obligations in respect of Confidential Information are granted or implied except as expressly stated in the Agreement.

12.9 On termination or expiry of the Agreement, each party shall, on written request, return or destroy the other party's Confidential Information in its possession or control, subject to the receiving party's right to retain copies required by law, regulation, insurance, accounting, audit, professional standards, backup systems or legitimate internal governance. The confidentiality obligations in this clause continue to apply to retained copies.

12.10 The Supplier may use the Customer's name and logo to identify the Customer as a customer of the Supplier on the Supplier's website, customer lists, pitch decks, investor materials and marketing materials, unless the Customer has expressly opted out in the Order Form or the Supplier has agreed otherwise in writing. The Supplier shall not publish a case study, press release or detailed endorsement attributed to the Customer without the Customer's prior written consent.

12.11 Except as expressly stated in the Agreement, neither party makes any express or implied warranty or representation concerning its Confidential Information.

12.12 This clause 12 shall continue after termination or expiry of the Agreement for five years, except that trade secrets and highly sensitive Confidential Information shall remain protected for so long as they remain confidential.

13. Indemnities

13.1 The Customer shall defend, indemnify and hold harmless the Supplier, its affiliates, officers, directors, employees, contractors, agents and licensors against all claims, actions, proceedings, losses, damages, expenses and costs, including reasonable legal fees, arising out of or in connection with:

(a) Customer Data;

(b) the Customer's or any Authorised User's use of the Services, Additional Services, Documentation, Proprietary Data, Customer Outputs or Deliverables other than in accordance with the Agreement;

(d) any allegation that Customer Data or the Supplier's processing of Customer Data in accordance with the Agreement infringes third-party rights or breaches applicable law;

(e) any decision, act or omission of the Customer or any third party based on Customer Data, Customer Outputs, Deliverables, Additional Services or use of the Services;

(f) any Customer system, third-party system or integration requested or supplied by the Customer; or

(g) any breach of Applicable Data Protection Laws by the Customer or caused by the Customer's instructions, Customer Data or failure to provide lawful notices, consents or instructions.

13.2 The Supplier shall defend the Customer against any claim brought by a third party alleging that the Customer's use of the Services, Documentation or final Deliverables in accordance with the Agreement infringes that third party's patent, copyright, trade mark or database right, and shall indemnify the Customer for amounts finally awarded by a court or agreed in settlement by the Supplier in respect of such claim, provided that:

(a) the Supplier is given prompt written notice of the claim;

(b) the Customer provides reasonable co-operation to the Supplier in the defence and settlement of the claim, at the Supplier's expense; and

13.3 In the defence or settlement of any claim under clause 13.2, the Supplier may:

(a) procure the right for the Customer to continue using the affected Services or final Deliverables;

(b) replace or modify the affected Services or final Deliverables so that they become non-infringing; or

(c) if the remedies in clauses 13.3(a) and 13.3(b) are not reasonably available, terminate the affected Services, affected Additional Services or the Agreement on 2 Business Days' notice without further liability, except to provide any service credit or refund expressly required by the Agreement.

13.4 The Supplier shall have no liability under clause 13.2 to the extent the alleged infringement is based on:

(a) modification of the Services, Documentation, Deliverables or Supplier Materials by anyone other than the Supplier;

(b) use of the Services, Documentation, Deliverables or Supplier Materials contrary to the Agreement, Documentation, Statement of Work or Supplier instructions;

(c) use of the Services, Documentation, Deliverables or Supplier Materials after notice of alleged or actual infringement;

(d) Customer Data, Customer systems, Customer instructions, Customer specifications, third-party services or materials supplied or requested by the Customer;

(e) combination of the Services or Deliverables with any software, hardware, data, materials or services not supplied by the Supplier;

(f) use of beta, pilot, trial, evaluation or free services; or

(g) the Customer's breach of the Agreement.

13.5 Clauses 13.2 to 13.4 state the Customer's sole and exclusive rights and remedies, and the Supplier's entire obligations and liability, for infringement or alleged infringement of third-party intellectual property rights by the Services, Documentation or Deliverables.

13.6 No indemnifying party may settle a claim in a way that admits liability on behalf of the indemnified party, imposes non-monetary obligations on the indemnified party, or restricts the indemnified party's business without the indemnified party's prior written consent, not to be unreasonably withheld or delayed. This clause does not limit the Supplier's rights under clause 13.3.

14. Limitation of liability

14.1 The following definitions apply in this clause 14:

(a) liability means every kind of liability arising under or in connection with the Agreement, including liability in contract, tort (including negligence), misrepresentation, restitution, breach of statutory duty or otherwise; and

(b) default means any act or omission resulting in one party incurring liability to the other.

14.2 Nothing in the Agreement excludes or limits either party's liability for:

(a) death or personal injury caused by negligence;

(b) fraud or fraudulent misrepresentation; or

14.3 Nothing in the Agreement limits or excludes the Customer's liability for:

(a) Fees, interest and other amounts payable under the Agreement;

(b) breach, infringement or misappropriation of the Supplier's intellectual property rights or Supplier Materials;

(d) the indemnities in clause 13.1;

(e) breach of Applicable Data Protection Laws by the Customer or caused by Customer Data, Customer instructions or Authorised Users; or

(f) wilful misconduct.

14.4 Subject to clauses 14.2 and 14.3, the Supplier shall have no liability for any:

(a) loss of profits;

(b) loss of revenue;

(d) loss of agreements or contracts;

(e) loss of anticipated savings;

(f) wasted expenditure;

(g) loss of or damage to goodwill or reputation;

(h) loss, corruption, damage, inaccuracy or restoration of data or information;

(i) loss arising from Customer Data, Customer instructions, Customer systems, Additional Services, Deliverables or third-party services;

(j) special, indirect, consequential or punitive loss, costs, damages, charges or expenses; or

(k) losses which could have been avoided by the Customer following the Supplier's reasonable instructions or maintaining appropriate backups, controls or mitigations.

14.5 Subject to clauses 14.2, 14.3 and 14.4, the Supplier's total aggregate liability to the Customer in respect of all defaults, including the indemnity in clause 13.2 and obligations under clause 19 and Schedule 1, shall not exceed the total Fees paid and payable by the Customer under the affected Order Form or Statement of Work in the 12 months immediately preceding the event giving rise to the claim. If a claim relates only to Additional Services, the cap shall not exceed the Fees paid and payable for the affected Additional Services. Taxes, expenses, pass-through costs and payment-processing charges are excluded when calculating the cap.

14.6 If defaults committed in more than one Contract Year give rise to a single claim or a series of connected claims, the Supplier's total aggregate liability for those claims shall not exceed the highest annual cap applicable to any one of those Contract Years.

14.7 Service credits, refunds and other credits paid or applied by the Supplier shall count towards the cap in clause 14.5.

14.8 The limitations and exclusions in this clause 14 apply whether or not a party has been advised of the possibility of the relevant loss and whether or not any remedy fails of its essential purpose.

14.9 The Customer acknowledges that the Fees have been calculated on the basis that the limitations and exclusions in this clause 14 apply. The Customer is responsible for obtaining its own insurance against risks not assumed by the Supplier under the Agreement.

15. Term, renewal and termination

15.1 The Agreement commences on the Effective Date and continues for the Initial Subscription Term. Unless terminated in accordance with the Agreement, it shall automatically renew for successive Renewal Periods unless either party gives written notice of non-renewal at least 60 days before the end of the Initial Subscription Term or then-current Renewal Period.

15.2 Without affecting any other right or remedy, either party may terminate the Agreement with immediate effect by giving written notice to the other party if:

(a) the other party fails to pay any amount due under the Agreement on the due date and remains in default not less than 30 days after being notified in writing to make payment;

(b) the other party commits a material breach of the Agreement and, if the breach is remediable, fails to remedy it within 30 days after being notified in writing to do so;

(c) the other party suspends, or threatens to suspend, payment of its debts, is unable to pay its debts as they fall due, admits inability to pay its debts, or is deemed unable to pay its debts within the meaning of section 123 of the Insolvency Act 1986;

(d) the other party commences negotiations with creditors with a view to rescheduling debts, or makes a proposal for or enters into any compromise or arrangement with creditors other than for the purpose of a solvent amalgamation or solvent reconstruction;

(e) the other party applies for or obtains a moratorium under Part A1 of the Insolvency Act 1986;

(f) a petition is filed, notice is given, resolution is passed or order is made for or in connection with the winding up of the other party, other than for a solvent amalgamation or solvent reconstruction;

(g) an application is made to court, an order is made, notice of intention is given, or an administrator is appointed over the other party;

(h) a person becomes entitled to appoint or appoints a receiver, administrative receiver or similar officer over the other party or its assets;

(i) a creditor or encumbrancer attaches or takes possession of, or a distress, execution, sequestration or other process is levied or enforced against, all or part of the other party's assets and is not discharged within 14 days;

(j) an event occurs or proceeding is taken in any jurisdiction with equivalent or similar effect to the events in clauses 15.2(c) to 15.2(i);

(k) the other party suspends or ceases, or threatens to suspend or cease, carrying on all or a substantial part of its business; or

(l) the other party's financial position deteriorates so far as to reasonably justify the opinion that its ability to perform the Agreement is in jeopardy.

15.3 The Supplier may terminate the Agreement, any affected Services or any affected Additional Services with immediate effect by written notice if:

(a) the Customer or any Authorised User breaches clauses 3.6, 3.8, 8.1(l), 11 or 19;

(b) the Supplier reasonably considers that the Customer, Customer Data, any Authorised User or continued provision of the Services or Additional Services creates legal, regulatory, security, operational or reputational risk;

(d) a third-party service, data source, hosting provider, licence, contractor, tool or other dependency required for the Services or Additional Services is no longer available on commercially reasonable terms; or

(e) the Customer undergoes a change of control to a competitor of the Supplier or to a person the Supplier reasonably considers creates legal, security, confidentiality or conflict risk.

15.4 If the Supplier terminates under clause 15.2 or 15.3, all unpaid Fees for the remainder of the then-current Subscription Term, all unpaid Fees for agreed Additional Services, all Fees for reserved Additional Services time and any non-cancellable costs shall become immediately due and payable, and any unpaid Discounts may be withdrawn.

15.5 Termination or expiry shall not affect any accrued rights, remedies, obligations or liabilities of either party, including the right to claim damages in respect of any breach existing at or before the date of termination or expiry.

16. Suspension

16.1 The Supplier may suspend all or part of the Services or Additional Services, any Authorised User Account, any Customer Data, any Customer Output or any Deliverable without liability if:

(a) any Fees are overdue;

(b) the Customer or any Authorised User breaches the Agreement;

(c) the Supplier reasonably considers suspension necessary to protect the Services, Additional Services, Supplier, Customer, any other customer, any third-party provider, any data or any system;

(d) the Supplier reasonably suspects unauthorised access, credential compromise, misuse, fraud, security vulnerability or unlawful activity;

(e) suspension is required by law, regulator, court order or third-party provider;

(f) the Customer exceeds usage limits, account allowances or technical limits; or

(g) the Customer fails to provide information, consents, assistance or approvals reasonably required for the Services or Additional Services.

16.2 The Supplier shall use reasonable endeavours to give notice of suspension where practicable, but may suspend immediately where the Supplier considers immediate action necessary.

16.3 The Supplier may make suspension targeted or partial where reasonably practicable, but is not required to do so if full suspension is reasonably necessary or more practical.

16.4 The Customer remains liable for all Fees during any suspension. The Supplier shall not be liable for any loss, damage, cost or expense arising from suspension in accordance with the Agreement.

17. Effects of termination and exit

17.1 On termination or expiry of the Agreement for any reason:

(a) all licences and access rights granted to the Customer shall immediately terminate;

(b) the Customer shall immediately cease all use of the Services, Documentation, Supplier Materials and Proprietary Data, except to the extent expressly permitted by clause 11.4;

(d) all outstanding Fees and other amounts payable to the Supplier shall become immediately due and payable;

(e) each party shall return or destroy Confidential Information in accordance with clause 12.9; and

(f) clauses intended to survive termination shall continue in force, including clauses 1, 4, 6, 9, 10.6, 11, 12, 13, 14, 17, 19, 20, 21, 25, 31, 32, 33 and the relevant parts of Schedule 1.

17.2 During the 30-day period following termination or expiry, the Supplier shall, on the Customer's written request, make Customer Data available for export in a structured, commonly used, machine-readable format selected by the Supplier, provided that:

(a) all undisputed Fees due to the Supplier have been paid;

(b) the request is technically feasible using the Supplier's standard export tools or processes;

(d) the Supplier may charge for any bespoke export, migration, transformation, reformatting, support or assistance outside its standard export process.

17.3 After the 30-day period in clause 17.2, the Supplier may delete Customer Data from active systems without further notice. Customer Data may remain in backups, logs or archival systems until overwritten or deleted in the ordinary course of the Supplier's retention and backup cycles, provided that such data remains protected in accordance with the Agreement.

17.4 The Supplier shall not be obliged to retain Customer Data after termination or expiry except as expressly stated in the Agreement or required by law.

18. Force majeure

18.1 Neither party shall be in breach of the Agreement or otherwise liable for any delay or failure in performing its obligations for so long as and to the extent that the delay or failure results from events, circumstances or causes beyond its reasonable control.

18.2 Force Majeure events include acts of God, flood, drought, earthquake, storm, fire, epidemic, pandemic, war, armed conflict, terrorist attack, civil commotion, riot, industrial dispute, failure of utilities, telecommunications or internet services, failure or delay of third-party providers, denial-of-service attacks, malware attacks, changes in law, government action and supply chain disruption.

18.3 The affected party shall use reasonable endeavours to mitigate the effect of the Force Majeure event.

18.4 If a Force Majeure event prevents the Supplier from providing the Services or Additional Services for more than 60 consecutive days, either party may terminate the affected Services or affected Additional Services by giving not less than 30 days' written notice. The Customer shall remain liable for all Fees accrued up to the effective date of termination and for any Services or Additional Services provided, commenced or reserved.

19. Data protection

19.1 Each party shall comply with Schedule 1, which forms part of the Agreement.

19.2 The parties agree that, for the purposes of Applicable Data Protection Laws:

(a) the Customer is the controller and the Supplier is the processor in respect of Customer Personal Data processed by the Supplier on behalf of the Customer to provide the Services and any Additional Services, as further described in Schedule 2; and

(b) the Supplier is an independent controller in respect of Supplier Personal Data processed for account administration, billing, security, authentication, usage analytics, service improvement, support, legal compliance and the Supplier's own business operations, as further described in Schedule 2.

19.3 The parties do not intend to act as joint controllers unless expressly agreed in writing.

19.4 The Customer shall not submit high-risk personal data to the Services or provide it in connection with Additional Services unless expressly agreed by the Supplier in writing, including special category data, criminal offence data, children's data, health data, consumer financial data or payment card data.

19.5 If there is any conflict or inconsistency between this clause 19, Schedule 1 and any other provision of the Agreement, clause 21 shall apply.

20. Security, assurance and audit

20.1 The Supplier shall implement and maintain technical and organisational measures as described in Schedule 3. The Customer acknowledges that it has reviewed those measures and considers them appropriate for the Customer Data and Customer Personal Data that the Customer intends to submit to the Services or provide in connection with Additional Services.

20.2 The Supplier may update, replace or modify the technical and organisational measures from time to time, provided that the Supplier shall not materially reduce the overall level of protection for Customer Personal Data during the Subscription Term.

20.3 Unless the Order Form expressly states otherwise, the Supplier does not warrant or undertake that it holds or will obtain any particular security certification, accreditation, audit report or standard, including Cyber Essentials, ISO/IEC 27001 or SOC 2.

20.4 On the Customer's reasonable written request not more than once in any Contract Year, the Supplier shall provide reasonable information about its security controls and data-protection compliance, which may include responses to security questionnaires, summaries of policies, certificates, third-party attestations or other information selected by the Supplier.

20.5 The Supplier may withhold or redact information where disclosure could compromise security, confidentiality, legal privilege, third-party obligations, trade secrets, other customers' data or the Supplier's legitimate business interests.

20.6 The Customer shall not conduct or attempt penetration testing, vulnerability scanning, load testing, security testing, social engineering or other testing of the Services, Supplier systems or Supplier personnel without the Supplier's prior written consent. Any approved testing shall be subject to scope, timing, technical, confidentiality and reporting conditions specified by the Supplier.

20.7 The Customer shall promptly and confidentially report any vulnerability or security issue it discovers or suspects in the Services. The Customer shall not publicly disclose any vulnerability or security issue without the Supplier's prior written consent.

21. Conflict and order of precedence

21.1 If there is any conflict or inconsistency between documents forming the Agreement, the following order of precedence applies:

(a) any mandatory standard contractual clauses, UK International Data Transfer Addendum, International Data Transfer Agreement or other mandatory data-transfer terms incorporated under Schedule 1, but only for the relevant data-transfer matter;

(b) Schedule 1, but only for data-protection matters;

(c) the Order Form, but only for commercial matters expressly addressed in it, such as Package, modules, Base Subscription Fees, Discounts, Net Subscription Fees, billing frequency, Initial Subscription Term, account allowance and agreed Additional Services or Consulting Services;

(d) these Conditions; and

(e) the Documentation and Support Services Policy.

21.2 For all legal, risk, liability, intellectual property, confidentiality, data protection, security, acceptable use, suspension, termination and general contractual matters, these Conditions prevail over the Order Form unless the Order Form expressly identifies the clause of these Conditions being amended and states that it is intended to override that clause.

21.3 Customer terms and conditions do not apply in any circumstances unless expressly agreed in accordance with clause 2.6.

21.4 If the Customer or an Authorised User is presented with any website terms, click-through terms or online policy relating to general website use, these Conditions prevail in respect of the Services unless the relevant term or policy is expressly incorporated into the Agreement.

22. Variation and updates

22.1 Subject to clauses 22.2 to 22.5, no variation of the Agreement shall be effective unless it is in writing and signed or electronically accepted by authorised representatives of the parties.

22.2 The Supplier may update the Documentation, Support Services Policy, technical requirements, security controls, URLs, online policies and operational procedures from time to time, provided that such updates do not materially reduce the core functionality of the subscribed Package during the then-current Subscription Term except as permitted by the Agreement.

22.3 The Supplier may update Schedule 1, Schedule 2 or Schedule 3 to reflect mandatory changes in Applicable Data Protection Laws, transfer mechanisms, sub-processors, security controls, processing activities or operational requirements, provided that such updates do not materially reduce the overall level of protection for Customer Personal Data during the then-current Subscription Term.

22.4 The Supplier may update these Conditions from time to time by publishing an updated version at the Terms URL or otherwise notifying the Customer. Updated Conditions shall apply to new Order Forms and to any Renewal Period commencing after the update where the Supplier has given at least 30 days' notice before the start of that Renewal Period.

22.5 The Supplier may apply an update during a current Subscription Term where the update is required by law, regulation, third-party provider requirement, security requirement, tax requirement or operational necessity, or where the update is administrative, corrective or not materially adverse to the Customer.

23. Waiver

23.1 A waiver of any right or remedy is effective only if given in writing and shall not be deemed a waiver of any subsequent right or remedy.

23.2 A delay or failure to exercise, or the single or partial exercise of, any right or remedy does not waive that or any other right or remedy, nor does it prevent or restrict further exercise of that or any other right or remedy.

24. Rights and remedies

24.1 Except as expressly provided in the Agreement, the rights and remedies provided under the Agreement are in addition to, and not exclusive of, any rights or remedies provided by law.

24.2 Where the Agreement states that a remedy is sole or exclusive, the Customer shall have no other remedy for the relevant matter to the fullest extent permitted by law.

25. Severance

25.1 If any provision or part-provision of the Agreement is or becomes invalid, illegal or unenforceable, it shall be deemed deleted to the minimum extent necessary, but that shall not affect the validity and enforceability of the rest of the Agreement.

25.2 If any provision or part-provision is deemed deleted under clause 25.1, the parties shall negotiate in good faith to agree a replacement provision that, to the greatest extent possible, achieves the intended commercial result of the original provision.

26. Entire agreement

26.1 The Agreement constitutes the entire agreement between the parties and supersedes and extinguishes all previous and contemporaneous agreements, promises, assurances, warranties, representations and understandings between them, whether written or oral, relating to its subject matter.

26.2 Each party acknowledges that in entering into the Agreement it does not rely on, and shall have no remedies in respect of, any statement, representation, assurance, forecast, demo, proposal, marketing material, sales statement, security response or warranty that is not expressly set out in the Agreement.

26.3 Each party agrees that it shall have no claim for innocent or negligent misrepresentation or negligent misstatement based on any statement in or relating to the Agreement.

26.4 Nothing in this clause 26 limits or excludes liability for fraud.

27. Assignment and subcontracting

27.1 The Customer shall not, without the Supplier's prior written consent, assign, transfer, mortgage, charge, subcontract, delegate, declare a trust over or otherwise deal with any of its rights or obligations under the Agreement.

27.2 The Supplier may at any time assign, transfer, mortgage, charge, subcontract, delegate, declare a trust over or otherwise deal with any or all of its rights and obligations under the Agreement.

27.3 The Supplier may use subcontractors, contractors, agents, hosting providers, data providers, payment processors, professional advisers and other third parties to perform or support the Agreement, provided that the Supplier remains responsible for its subcontractors to the extent required by the Agreement.

28. No partnership or agency

Nothing in the Agreement is intended to or shall operate to create a partnership, joint venture, employment relationship or agency between the parties, or authorise either party to act as agent for the other. Neither party has authority to act in the name of or on behalf of the other, or otherwise to bind the other, except as expressly stated in the Agreement.

29. Third-party rights

29.1 Except for the Supplier's affiliates, officers, directors, employees, contractors, agents and licensors who may enforce any provision expressed for their benefit, the Agreement does not give rise to any rights under the Contracts (Rights of Third Parties) Act 1999 to enforce any term of the Agreement.

29.2 The parties may vary or terminate the Agreement without the consent of any third party.

30. Electronic signature and counterparts

30.1 The Agreement and any Order Form may be executed or accepted electronically, including through an online proposal, ordering or e-signature platform.

30.2 Each party agrees that electronic signatures, electronic approvals and electronic records are intended to authenticate the relevant document and bind the party providing them.

30.3 An Order Form or other document may be executed in any number of counterparts, each of which shall constitute a duplicate original, and all counterparts together shall constitute one document.

30.4 Transmission of an executed signature page by email or through an e-signature platform takes effect as delivery of an executed counterpart.

31. Notices

31.1 Any notice given under or in connection with the Agreement shall be in writing and shall be:

(a) delivered by hand or by pre-paid first-class post or other next working day delivery service to the party's registered office, if a company, or principal place of business, in any other case; or

(b) sent by email to the notice email address stated in the Order Form or, for the Supplier, to contact@paveinsight.com, or such other email address as the relevant party may notify in writing.

31.2 Any notice shall be deemed received:

(a) if delivered by hand, when left at the proper address;

(b) if sent by next working day delivery service, at 9.00 am on the second Business Day after posting; and

(c) if sent by email, at the time of transmission if sent during Normal Business Hours on a Business Day, or at 9.00 am on the next Business Day if sent outside that period, provided that no bounce-back or automated delivery failure notification is received.

31.3 Notices of termination, material breach, legal claim or formal dispute must be clearly identified as legal notices. Email may be used for such notices, but the sender should also use reasonable endeavours to send a copy by post or courier.

31.4 This clause 31 does not apply to service of proceedings or other documents in any legal action or, where applicable, any arbitration or other formal dispute resolution process.

32. Governing law

The Agreement and any dispute or claim arising out of or in connection with it or its subject matter or formation, including non-contractual disputes or claims, shall be governed by and interpreted in accordance with the law of England and Wales.

33. Jurisdiction

Each party irrevocably agrees that the courts of England and Wales shall have exclusive jurisdiction to settle any dispute or claim arising out of or in connection with the Agreement or its subject matter or formation, including non-contractual disputes or claims.

Schedule 1 - Data Protection Addendum

1. Definitions

1.1 In this Schedule 1, controller, processor, data subject, personal data, personal data breach, processing and special category data have the meanings given to them in the UK GDPR.

1.2 Customer Personal Data means personal data processed by the Supplier as processor on behalf of the Customer in connection with the Agreement.

1.3 Supplier Personal Data means personal data processed by the Supplier as controller in connection with the Agreement.

1.4 Purpose means the purposes for which Customer Personal Data is processed, as set out in Schedule 2.

2. General compliance and roles

2.1 Each party shall comply with Applicable Data Protection Laws in connection with the Agreement.

2.2 The parties have determined that:

(a) the Customer is controller and the Supplier is processor in respect of Customer Personal Data; and

(b) the Supplier is an independent controller in respect of Supplier Personal Data.

2.3 If the roles in paragraph 2.2 change, the parties shall work together in good faith to make any necessary changes to this Schedule 1, provided that the Supplier shall not be required to accept any change that materially increases its risk, cost or obligations unless the parties agree appropriate commercial terms.

2.4 The Customer shall ensure that it has all necessary notices, consents, lawful bases, rights and authorisations to enable lawful transfer of Supplier Personal Data and Customer Personal Data to the Supplier and lawful processing by the Supplier for the purposes of the Agreement.

2.5 The Customer shall not provide special category data, criminal offence data, children's data, health data, payment card data or other high-risk personal data to the Supplier unless expressly agreed by the Supplier in writing.

2.6 The Customer shall indemnify the Supplier against all losses, liabilities, costs, claims and expenses arising from the Customer's breach of this Schedule 1 or Applicable Data Protection Laws, or from the Supplier's processing of Customer Personal Data in accordance with the Customer's instructions.

3. Supplier as controller

3.1 The Supplier processes Supplier Personal Data as controller for the purposes set out in Schedule 2, including account administration, billing, authentication, security, support, service improvement, usage analytics, legal compliance and its own business operations.

3.2 By entering into the Agreement, the Customer consents to, and shall procure all required notices and consents from its personnel, representatives and agents for, the Supplier's processing of Supplier Personal Data in accordance with the Agreement and the Supplier's privacy policy, as updated from time to time.

3.3 If there is any inconsistency between the Supplier's privacy policy and the Agreement, the Agreement shall prevail in respect of the Services.

4. Supplier as processor

4.1 In relation to Customer Personal Data, the Supplier shall:

(a) process Customer Personal Data only on the documented instructions of the Customer, which include processing for the Purpose and as otherwise necessary to provide, secure, support, administer and improve the Services, provide Additional Services, prepare Deliverables, and comply with the Agreement, unless required by applicable law to process Customer Personal Data otherwise;

(b) inform the Customer if, in the Supplier's opinion, an instruction infringes Applicable Data Protection Laws, but without any obligation to provide legal advice;

(d) ensure that personnel authorised to process Customer Personal Data are subject to appropriate confidentiality obligations;

(e) assist the Customer, taking into account the nature of processing and information available to the Supplier, with data subject requests and the Customer's obligations relating to security, breach notifications, data protection impact assessments and consultations with supervisory authorities, in each case at the Customer's cost and subject to the Customer's written request;

(f) notify the Customer without undue delay after becoming aware of a personal data breach involving Customer Personal Data;

(g) at the Customer's written direction after termination or expiry, delete or return Customer Personal Data unless applicable law requires continued storage, provided that Customer Personal Data shall be treated as deleted where it is put beyond further active use by the Supplier; and

(h) maintain records to demonstrate compliance with this Schedule 1 as required by Applicable Data Protection Laws.

4.2 Any notification under paragraph 4.1(f) shall not be treated as an admission of fault or liability by the Supplier. The Supplier shall provide information reasonably available to it, subject to legal, security, confidentiality and operational restrictions.

4.3 The Supplier may charge the Customer at its then-current rates for assistance under paragraphs 4.1(e), 4.1(g), 6 or 8, except to the extent the assistance is required because of the Supplier's breach of this Schedule 1.

5. Sub-processors

5.1 The Customer provides prior general authorisation for the Supplier to appoint sub-processors to process Customer Personal Data.

5.2 The Supplier shall ensure that sub-processors are engaged under written terms that impose data-protection obligations substantially equivalent to those imposed on the Supplier under this Schedule 1 to the extent required by Applicable Data Protection Laws.

5.3 The Supplier shall remain responsible for the acts and omissions of its sub-processors to the extent required by Applicable Data Protection Laws.

5.4 The Supplier shall make available or notify the Customer of information about material sub-processors on reasonable request or through a webpage, policy or other mechanism selected by the Supplier. Provider information is available on the Supplier’s Data processing providers and locations page.

5.5 The Supplier shall inform the Customer of intended material changes concerning the addition or replacement of sub-processors, thereby giving the Customer the opportunity to object where required by Applicable Data Protection Laws.

5.6 Any objection must be made in writing within 10 Business Days after the Supplier's notice and must explain the reasonable data-protection grounds for the objection. If the Customer does not object within that period, the Customer shall be deemed to have authorised the change.

5.7 If the Customer objects, the parties shall discuss the objection in good faith. If the Supplier reasonably considers that the objection cannot be resolved without disproportionate cost, risk or operational impact, the Supplier may terminate the affected Services on written notice without liability.

6. International transfers

6.1 The Customer authorises the Supplier and its sub-processors to transfer Customer Personal Data outside the UK and European Economic Area as required for the Purpose, provided that the Supplier shall ensure such transfers are made in accordance with Applicable Data Protection Laws.

6.2 The Customer shall promptly comply with any reasonable request of the Supplier to enter into, approve or execute standard contractual clauses, the UK International Data Transfer Agreement, the UK International Data Transfer Addendum or any other transfer mechanism or documentation reasonably required for the transfer.

6.3 If a transfer mechanism changes, is invalidated or is reasonably considered by the Supplier to be insufficient, the Supplier may implement an alternative lawful transfer mechanism and update this Schedule 1 accordingly.

7. Security

7.1 The Supplier shall implement and maintain technical and organisational measures appropriate to the risk of processing Customer Personal Data, taking into account the nature, scope, context and purposes of processing, the harm that might result from unauthorised or unlawful processing, accidental loss, destruction or damage, the state of technological development and the cost of implementation.

7.2 The Customer confirms that the measures described in Schedule 3 are appropriate for the Customer Personal Data it intends to submit to the Services or provide in connection with Additional Services.

7.3 The Customer shall implement appropriate technical and organisational measures for Customer systems, Customer Data, Authorised Users and its use of the Services.

8. Audit and information rights

8.1 The Supplier shall make available to the Customer information reasonably necessary to demonstrate compliance with Article 28 of the UK GDPR and this Schedule 1.

8.2 The Supplier may satisfy paragraph 8.1 through security or compliance summaries, policies, certificates, audit reports, third-party attestations, questionnaire responses or other materials selected by the Supplier.

8.3 The Customer may request an audit not more than once in any 12-month period, unless required by a supervisory authority or following a confirmed personal data breach involving Customer Personal Data caused by the Supplier's breach of this Schedule 1.

8.4 Any audit shall be subject to:

(a) at least 30 days' prior written notice;

(b) agreement of scope, timing, duration and auditor;

(c) the auditor being independent, suitably qualified and subject to confidentiality obligations acceptable to the Supplier;

(d) the audit being conducted during Normal Business Hours and in a manner that does not disrupt the Supplier's business or compromise security;

(e) the Customer bearing its own costs and reimbursing the Supplier's reasonable costs of supporting the audit; and

(f) restrictions necessary to protect security, legal privilege, trade secrets, third-party confidentiality, other customers' data and the Supplier's legitimate business interests.

8.5 The Customer shall not be entitled to access the Supplier's source code, detailed vulnerability information, internal security tooling, other customers' data, commercially sensitive financial information or information that would create security risk if disclosed.

9. Liability

9.1 Liability arising under or in connection with this Schedule 1 is subject to clause 14 of the Conditions.

10. Changes to data-protection terms

10.1 Either party may request replacement or amendment of this Schedule 1 with applicable standard clauses, an approved code of conduct, certification scheme, International Data Transfer Agreement, UK International Data Transfer Addendum or other terms required by Applicable Data Protection Laws.

10.2 Any amendment under paragraph 10.1 shall apply only to the extent required by Applicable Data Protection Laws and shall not affect the commercial terms or risk allocation of the Agreement except to the extent legally required.

Schedule 2 - Particulars of Processing

Part 1 - Supplier as controller

Processing activities: account administration, billing, payment administration, customer relationship management, authentication, access logging, security monitoring, service improvement, usage analytics, support, Consulting Services administration, project management, legal compliance, dispute management and the Supplier's own business operations.

Categories of data subjects: Customer contacts, Authorised Users, billing contacts, support contacts, representatives and other personnel of the Customer.

Types of personal data: names, business email addresses, business phone numbers, job titles, employer details, login credentials, access logs, IP addresses, device/browser information, usage metadata, support correspondence, Consulting Services communications, project information, billing information and communications between the Customer and the Supplier.

Purpose of processing: account setup, authentication, communication, invoicing, payment administration, support, Consulting Services administration, project management, security, service improvement, legal compliance and business administration.

Duration of processing: for the Subscription Term and for such period afterwards as the Supplier reasonably requires for legal, accounting, audit, insurance, dispute, security and legitimate business purposes, normally up to 6 years for financial and contractual records unless a longer period is required or justified.

Part 2 - Supplier as processor

Subject matter: hosting, operation and support of the PAVE Insight cloud-based data analytics, dashboarding and forecasting platform, and provision of any agreed Additional Services.

Nature of processing: collection, receipt, storage, hosting, transmission, retrieval, access, display, analysis, modelling, visualisation, consulting review, configuration, training support, preparation of Deliverables, backup, support access, deletion and return of Customer Personal Data contained in Customer Data or otherwise supplied by the Customer.

Purpose of processing: to provide, maintain, secure, support, administer and improve the Services; to provide Additional Services; to administer Customer accounts and user access; to generate dashboards, forecasts, reports, Deliverables and analytical outputs requested by the Customer; and to comply with the Agreement and applicable law.

Duration of processing: throughout the Subscription Term and for the duration of any agreed Additional Services, and for up to 30 days following termination, expiry or completion for data return or deletion, subject to backups, logs, legal retention requirements and ordinary deletion cycles.

Types of personal data: business contact information of Customer personnel, names, job titles, business email addresses, business phone numbers, login credentials, usage metadata, IP addresses, device information, access times, support ticket information, consulting communications, training attendance information, project information, Customer instructions, and limited identifiers appearing in Customer-supplied datasets where such datasets include personal data.

Categories of data subjects: Customer employees, contractors, agents, representatives, Authorised Users and individuals whose information appears in Customer-supplied datasets.

Special category or high-risk data: not expected or permitted in the Services or Additional Services unless expressly agreed by the Supplier in writing.

Schedule 3 - Technical and Organisational Measures

Governance and personnel. The Supplier shall maintain internal policies and procedures designed to protect Customer Personal Data, and shall ensure that personnel with access to Customer Personal Data are subject to confidentiality obligations.
Access control. The Supplier shall use unique credentials for Supplier personnel, apply role-based or least-privilege access controls where reasonably practicable, and use multi-factor authentication for privileged administrative access where supported by the relevant systems.
Customer access. The Customer is responsible for managing Authorised User access, password hygiene, device security and timely removal of users who no longer require access. The Supplier may provide access-control functionality through the Services from time to time.
Encryption. The Supplier shall use TLS or equivalent encryption for data transmitted over public networks where technically supported, and encryption at rest for production Customer Personal Data where supported by the Supplier's hosting environment.
Network and application security. The Supplier shall maintain reasonable network and application security controls, which may include firewalls, monitoring, vulnerability scanning, patch management, access restrictions and secure configuration practices.
Backups and resilience. The Supplier shall maintain backup or replication processes for production Customer Data as the Supplier considers appropriate for the Services. Unless expressly stated in the Order Form, the Supplier does not commit to any specific recovery time objective, recovery point objective or backup retention period.
Logging and monitoring. The Supplier shall maintain logs and monitoring reasonably designed to support security, diagnostics, service operation and incident investigation.
Incident response. The Supplier shall maintain a documented process for investigating and responding to security incidents and personal data breaches.
Sub-processors and hosting providers. The Supplier may use reputable hosting providers, infrastructure providers and other sub-processors to provide and secure the Services.
Deletion and retention. The Supplier shall delete or put beyond active use Customer Personal Data in accordance with the Agreement, subject to backups, logs, archival systems and legal retention requirements.
Testing and improvement. The Supplier may test, review and improve its security controls from time to time, taking account of the nature of the Services, the risk of processing, available technology, cost of implementation and operational requirements.
No certification commitment. Unless expressly stated in the Order Form, the Supplier does not undertake to maintain or obtain any specific certification, accreditation, audit report or security standard.

PAVE Insight Ltd Subscription Conditions

Interpretation
Basis of contract and online Order Forms
User accounts and access rights
Additional accounts, upgrades and consulting services
Services, availability and support
Third-party services, data and dependencies
Supplier's obligations and service changes
Customer's obligations
Charges, discounts and payment
Referral rebate scheme
Proprietary rights, Customer Data, outputs and Deliverables
Confidentiality and publicity
Indemnities
Limitation of liability
Term, renewal and termination
Suspension
Effects of termination and exit
Force majeure
Data protection
Security, assurance and audit
Conflict and order of precedence
Variation and updates
Waiver
Rights and remedies
Severance
Entire agreement
Assignment and subcontracting
No partnership or agency
Third-party rights
Electronic signature and counterparts
Notices
Governing law
Jurisdiction