Application Terms of Use

These Terms of Use, together with any other terms agreed to between the Parties regarding payment and service provision, form the Licence Agreement (or the Agreement) that is made on the Effective Date between the Parties:

1. Enlytning Ltd, a company incorporated in England and Wales with registered number 16766981 whose registered office is at Sussex Innovation Centre, Science Park Square, Falmer, Brighton, BN1 9SB, England (the Provider); and

2. The User (or you);

which sets out the terms under which the User is granted a licence by the Provider to use the Provider’s Software. Users must only use the Software in accordance with these Terms of Use. By indicating acceptance of these Terms of Use in order to access or use the Software, the User enters into the Agreement and accepts all of these Terms of Use and must always abide by them when using the Software or the Software’s output. If you do not agree with these Terms of Use, you must not use the Software. 

Definitions

3. In this Agreement, the following words are defined:

Grant of Licence

4. Subject to these Terms of Use and all other terms comprising the Licence Agreement, the Provider grants the User a limited, revocable, non-exclusive, non-sublicensable, and non-transferable licence for the duration of the Term to use the Software and the Content, together the (“Package Materials”) in accordance with these Terms of Use (the Licence).

5. To access the Package Materials under the Licence, the Provider will require the User to register for an account by providing certain information (e.g. an email address, name, and password).

6. The User acknowledges that they are not granted any ownership of the Package Materials or any proprietary rights in the Package Materials (including Intellectual Property Rights) and, as such, the User does not have permission to alter, reproduce, sell, disassemble, edit, rebrand, distribute, lend, hire, or sub-license the Package Materials or any component part of the Package Materials, or otherwise use the Package Materials in a manner only consistent with ownership of the Package Materials.

Term and Termination of Use of the Paid Version of the Software

7. The clauses within this section (i.e. the section headed “Term and Termination of Use of the Paid Version of the Software”) only apply to an Agreement for the use of the Paid Version of the Software.

8. The Term of the User’s Licence begins on the Effective Date and shall continue for the duration of time agreed to in accordance with the selection the User made on the website upon entering into the Agreement (whether comprised of a single fixed term or of multiple Recurring Subscription Periods), unless the Agreement is terminated before the end of the Term, in which case the Licence will end immediately on termination.

9. The Agreement may be terminated before the expiry of the Term: 

   1. By the Provider giving the User 30 Working Days’ prior written notice of their intention to terminate the Agreement for a legitimate reason (e.g. because they are to cease providing the Software); or

   2. Immediately, by the Provider giving the User written notice of their intention to terminate the Agreement, if:

      1. The User breaches any of these Terms of Use; or

      2. The Provider deems that termination is necessary to allow the Provider to comply with any applicable laws; or

       

   3. By the User giving the Provider written notice of their intention to terminate the Agreement (or by the User’s following other termination procedures provided by the Provider, e.g. by following an online question flow), in which case the Agreement will be terminated: 

      1. In the case of a Recurring Subscription Period, at the end of the Recurring Subscription Period within which notice of termination was given; or

      2. Otherwise, immediately.

Term and Termination of Use of the Free Version of the Software

10. The clauses within this section (i.e. the section headed “Term and Termination of Use of the Free Version of the Software“) only apply to an Agreement for the use of the Free Version of the Software.

11. The Term of the User’s Licence begins on the Effective Date and shall continue until the Agreement is terminated by either Party. 

12. The User may immediately terminate the Agreement by cancelling their account (either by emailing the Provider requesting that their account be cancelled or by following alternative instructions for such provided by the Provider).

13. The Provider may immediately terminate the Agreement by providing written notice to the User of their intention to end the User’s Licence to use the Software.

Effect of Termination

14. When the Agreement is terminated or expires, the User’s Licence to use the Package Materials and the Provider’s obligation to provide the Package Materials will end.

15. If the Agreement is terminated by the User, the User is not entitled to receive a refund for any fees already paid before the date of termination unless:

    1. A specific refund is agreed to between the Parties before termination (in which case the User will only be entitled to the refund agreed to); or

    2. The termination was due to one of the following situations (in which case pre-paid fees will be refunded to the User on a pro rata basis in relation to the amount of the relevant pay period that remains after termination):

       1. The Provider breached a term of the Agreement; 

       2. The Provider stopped supplying the Software;

       3. The Provider terminated the Agreement before the end of the User’s Term for reasons other than:

          1. The User’s breach of the Terms of Use; or

          2. The Provider’s deeming that termination is necessary to allow the Provider to comply with any applicable laws; or

       4. The Provider changed the Software in a major way that made the Software an essentially different product; or

       5. The User was unwilling to accept a significant change to these Terms of Use.

16. The terms contained in the sections headed “Restrictions on Use”, “Intellectual Property Rights”, “Proprietary Rights to Data”, and “Data Protection and Privacy”, any other terms that by their nature must survive this Agreement, shall remain effective after termination or expiry of the Agreement. All other obligations between the Parties shall end at the time of termination.

Suspension of Use of the Software

17. In the case of a User paying to use the Software on the basis of Recurring Subscription Periods, if a payment is overdue for any reason, the Provider reserves the right to suspend the User’s access to the Software until payment is made in full.

Fees

18. In exchange for use of the Paid Version of the Software, the User agrees to pay the Provider the sum agreed to at the frequency agreed to and via the manner agreed to separately in writing when or before this Agreement is formed (e.g. on the Provider’s website’s sign up or subscription page) (i.e. the Fees).

19. The Provider reserves the right to, from time to time, change the Fees due in relation to Recurring Subscription Periods. Any such changes will be communicated to the User in writing, giving a reasonable period of notice. If the User does not terminate the Agreement before the new fees are implemented and the User continues to use the Software after this date, the User is deemed to have accepted the new Fees.

20. All Fees are exclusive of VAT, unless otherwise specified.

21. If the User has agreed to only access and only accesses the Free Version of the Software, they are not and will not be required to pay any fees to access the Software.

Restrictions on Use

22. To use the Software or to hold a Licence to use the Software, an individual must be aged 18-years-old or older and must be capable of entering into a legal contract for the use of the Software.

23. Except as allowed elsewhere in the Agreement, the User must not:

    1. Alter, reproduce, sell, disassemble, edit, rebrand, distribute, lend, hire, or sub-license the Software or any right of use of the Software to any other parties; 

    2. Allow others to use the Software via the User’s exclusive permitted access (e.g. using the User’s email address and account), except that Authorised Users may access the Software in accordance with the section headed "Consultant and Client Use"; 

    3. Use the Software, its components, or its output in any way that may infringe the Intellectual Property Rights or any other proprietary rights of the Provider or of any third party; 

    4. Remove or alter any markings that indicate ownership of the Software or of its output, for example, trade mark or copyright symbols;

    5. Input any parties’ personal data or other private information into the Software, or use any of the Software’s output that contains such, except in accordance with UK Data Protection Laws and with this Agreement; 

    6. Attempt to reverse engineer or otherwise access or use the Software or its components in order to set up or contribute to an endeavour that may compete with the Provider’s Software, whether such an endeavour is commercial or not (e.g. by using aspects of the Software as part of the development of the User’s own software product);

    7. Use the Software to construct any kind of database or to conduct automated or systemic data scraping, data mining, data extraction, or similar data collection activities;

    8. Negligently or intentionally input content into the Software that introduces any virus, worm, cancelbot, trojan horse, or other destructive or contaminating code or programme;

    9. Attempt to damage, interfere with, slow, or otherwise alter the Software, its performance, or its integrity;

    10. If the User is a Consumer, use the Software for any commercial purposes; 

    11. Use the Software’s output to provide information, advice, or other services to a commercial client of the User, except as permitted under the section headed "Consultant and Client Use";

    12. Use output generated using the Software to sell, lend, or otherwise commercially exploit as a product of or as part of a product of the User’s own business, except as permitted under the section headed "Consultant and Client Use";

    13. Use output generated using the Software to inform research or analysis or to make decisions in a manner that may impact people’s access to any goods or services, unless the relevant output has been reviewed by a suitably qualified person before being relied upon;

    14. Rely on the Software’s output as being factually accurate, up-to-date, or complete;

    15. Input information into the Software or use the Software in a manner that breaches any applicable laws, regulations, or other rules; 

    16. Input information into the Software or use the Software in a manner that is defamatory, unlawful, immoral, tortuous, fraudulent, harmful, or deceptive.

Consultant and Client Use

24. A Business Customer may act as a Consultant and use the Software to provide services to its Clients, including generating, editing, downloading, and delivering Output (for example, handbooks, policies, contracts, and training materials) to Clients as part of the Consultant's own services. The restrictions set out in the section headed "Restrictions on Use" (including those relating to the provision of services to commercial clients and the commercial exploitation of output) do not prevent this permitted use, provided that the Consultant complies with this section.

25. Ownership of Intellectual Property Rights in Output is determined in accordance with the section headed "Intellectual Property Rights". Where Output incorporates content in which the Provider or a third party (including a publisher of Marketplace templates) holds Intellectual Property Rights, the Provider grants the Consultant and each relevant Client a non-exclusive, royalty-free, perpetual licence to use that content solely as embedded in Output delivered to that Client, and this licence survives termination of the Agreement in respect of Output delivered before termination. The Consultant must not extract embedded Provider or third party content from Output for standalone use, resale, or republication as templates.

26. A Consultant may invite Clients and their personnel to access the Software as Authorised Users within the Consultant's account or organisation(s), subject to any user, seat, or plan limits agreed with the Provider. Where it does so, the Consultant:

    1. Is responsible for the acts and omissions of its Authorised Users in connection with the Software as if they were the Consultant's own, and must ensure that each Authorised User complies with these Terms of Use;

    2. Must configure organisations, permissions, and access controls so that each Client and its personnel can access only the data, documents, and Output relating to that Client; and

    3. Must not resell access to the Software as a standalone product, represent the Software as the Consultant's own product, or white-label the Software, in each case except under a separate written agreement with the Provider.

27. The Consultant is solely responsible for the services and advice it provides to its Clients, including any services or advice based on Output, and for reviewing Output for accuracy and suitability before delivering it to a Client. The Provider has no liability to any Client of a Consultant, and the Consultant must ensure that its contracts with Clients reflect this.

28. As between the Parties, the Consultant is responsible for ensuring that it has all rights, consents, and authority needed to input Client data (including personal data of a Client's personnel) into the Software and to share that data within the Consultant's account or organisation(s).

Warranties

29. The Provider warrants that the Software will be provided as a service with reasonable care and skill, as described, and in accordance with these Terms of Use and with any other specifications set out by the Provider and incorporated into the Agreement. If this clause is breached, the User may be entitled to correction of errors or a refund as the Provider considers appropriate. 

30. If the User is a Consumer, the Provider warrants that the Software is fit for purpose and of satisfactory quality. If this clause is breached, the User may be entitled to a correction of errors or a refund as appropriate. 

31. Aside from the warranties in the two clauses above, the Provider does not provide any warranties regarding the quality, suitability for particular uses, or other aspects of the Software. In particular: 

    1. The Provider does not warrant that output produced by the Software is accurate, up-to-date, or complete, and content should not be relied on to provide advice or otherwise treated as factually correct;

    2. The Provider does not warrant that the Software will always be available and is not responsible for any temporary unavailability (e.g. due to platform or network issues).

32. The User warrants that it has the right (via rights or interests in or rights to use) to input into the Software any data that it inputs into the Software. Further, the User warrants that any such data is not harmful, corrupted, unlawful, or otherwise in breach of the Agreement.

33. The User warrants that it has a right to use any personal data (as defined by the UK GDPR) that it inputs into the Software. Further, the User warrants that it has a lawful basis for any use made of this personal data in relation to the Software and that all processing of this data that it carries out in relation to the Software is in accordance with the lawful basis for processing and with UK Data Protection Laws generally.

Indemnities

34. The Provider shall indemnify the User against all losses, liabilities, costs, expenses, or damages, whether due to claims or action by third parties or otherwise, that the User directly or indirectly incurs arising out of or as a consequence of any breach of the Provider’s Warranties set out above under the heading “Warranties”.

35. The User shall indemnify the Provider against all losses, liabilities, costs, expenses, or damages, whether due to claims or action by third parties or otherwise, that the Provider directly or indirectly incurs arising out of or as a consequence of any breach of the User’s Warranties set out above under the heading “Warranties”.

36. The User shall indemnify the Provider against any reasonably foreseeable direct losses, damages, or reasonable expenses that the Provider incurs in relation to the User’s breach of the Agreement, the User’s infringement of any third party’s rights, or the User’s otherwise unlawful use of the Software.

Limitation of Liability

37. Nothing in this Agreement limits or excludes either Party’s liability in any way for:

    1. Death or personal injury caused by its negligence;

    2. Fraud or fraudulent misrepresentation; or

    3. Any other losses that cannot be limited or excluded by applicable law.

38. This clause applies to Consumers only: except as set out in the first clause of this section (i.e. the section headed “Limitation of Liability”) and in the sections headed “Warranties” and “Indemnities”, the Provider is only liable to the User for loss or damage resulting from the Provider’s negligence or the Provider’s breach of the Agreement when such loss or damage is foreseeable (i.e. when both the User and the Provider knew at the time the Agreement was formed that this loss or damage may reasonably occur as a result of the Provider’s conduct). The Provider is not liable for any unforeseeable loss or damage, any business damage or loss, any loss or damage not caused by the Provider’s negligence or breach of the Agreement, or any loss or damage caused by the User’s reliance on the output of the Software against these Terms of Use.

39. This clause applies to Business Customers only: except as set out in the first clause of this section (i.e. the section headed “Limitation of Liability”) and in the sections headed “Warranties” and “Indemnities”, the Provider shall not have any direct or indirect liability to the User, whether in contract, tort (including negligence), for breach of statutory duty, or otherwise, arising under or in connection with this Agreement or in connection with the use or lack of use of the Software, for:

    1. Loss of profits, business, sales, revenue, opportunity, savings, or contracts;

    2. Loss of use or corruption of software, data, or information, or damage to equipment;

    3. Any harm to reputation or goodwill; or 

    4. Any indirect, special, incidental, or consequential loss.

40. This clause applies to Business Customers only: except as set out in the first clause of this section (i.e. the section headed “Limitation of Liability”) and in the sections headed “Warranties” and “Indemnities”, the total liability of the Provider for any losses experienced by the User in respect of any one event or series of connected events in relation to the Provider’s conduct in relation to this Agreement shall not exceed the lower of the total aggregate of the payments made by the User to the Provider under this Agreement within the last 12 months or £5,000.00.

41. Particularly, except as set out elsewhere in these Terms of Use, note that the Provider is not responsible for issues that occur as a result of the User’s use of the Software that may be due to the Software’s use of AI, including but not limited to:

    1. Intellectual Property Right infringements occurring due to the User’s use of the Software or their use of the output created by use of the Software; 

    2. Losses or inefficiencies incurred due to the provision of inaccurate, misleading, or non-specific information; 

    3. Breaches of UK Data Protection Laws occurring due to the User’s use of the Software or their use of the output created by their use of the Software;

    4. Breaches of equality laws or specific data protection laws related to decision making; 

    5. Breaches of advertising or marketing laws occurring due to the User’s use of the Software or their use of the output created by their use of the Software; 

    6. Breaches of defamation laws occurring due to the User’s use of the Software or their use of the output created by their use of the Software; 

    7. Breaches of any duty held by the User not to disclose another party’s Confidential Information; or

    8. Losses incurred due to damage to technical infrastructure.

Intellectual Property Rights

42. The Provider retains all Intellectual Property Rights it owns in the Package Materials and in aspects of the Provider’s wider business, including but not limited to trade marks, copyrights, moral rights, patents, design rights, and data rights. 

43. The User retains all Intellectual Property Rights it owns in any data or information that they input into the Software or otherwise use as part of their use of the Software. 

44. The User owns any Intellectual Property Rights arising in, or that it registers in relation to, any original creations produced as output of the Software due to the User’s use of the Software in accordance with the Agreement.

45. If the User inputs data or content in which the User holds Intellectual Property Rights into the Software, and consequent output of the Software contains elements of this data or content as well as data or content in which the Provider (or, in the case of Intellectual Property Rights that the Provider has permission to use, other parties) holds Intellectual Property Rights, all parties involved will retain ownership of their respective Intellectual Property Rights. This clause qualifies the clause on Intellectual Property Rights ownership immediately preceding this clause. The User is responsible for ensuring that it does not use any such Software output in a way that infringes on the Intellectual Property Rights of any other parties.

Proprietary Rights to Data

46. The User retains all rights, interests, and titles held in any data that it inputs into the Software.

47. The User grants the Provider a non-exclusive, royalty-free, worldwide licence, for the duration of the Term, to host, copy, transmit, process, and display any data that the User inputs into the Software, solely to the extent necessary to: (a) provide the Software and generate Output for the User; (b) maintain, secure, and support the Software; and (c) comply with applicable law. This licence ends when the Agreement ends, except that the Provider may retain the data for a limited period after termination in order to allow the User to export it, to meet legal retention requirements, or in routine encrypted backups pending scheduled deletion.

48. The Provider will not use the User's data, or any Output generated for the User, to train, fine-tune, or otherwise develop any artificial intelligence or machine learning model, whether the Provider's own or a third party's. The Provider will ensure that any third party AI model provider that processes the User's data in the delivery of the Software is contractually prohibited from using that data for training and from retaining it beyond what is necessary to process the relevant request. For clarity, the Provider may use anonymised and aggregated usage statistics (which do not include the content of the User's data or Output and do not identify the User, any Client, or any individual) to operate and improve the Software.

Data Protection and Privacy

49. Both the User and the Provider commit to abiding by UK Data Protection Laws in relation to the Software and its development and use. The Provider commits to using any of the User’s data that is provided to it only in accordance with UK Data Protection Laws and will not disclose this data to any third parties unless authorised to do so. For more information on how the Provider uses users’ data, see the Provider’s Website Privacy Policy, accessible here: enlytning.com/privacy-policy. 

50. Where, in providing the Software, the Provider processes personal data on behalf of the User (for example, personal data of the User's or a Client's employees contained in documents, contracts, or training records), the Provider does so as a processor for the User under UK Data Protection Laws. The Parties shall comply with the Data Processing Agreement set out in the Schedule to these Terms of Use, which contains the terms required by Article 28 of the UK GDPR and forms part of this Agreement.

51. The User is responsible for and maintains control over any personal data that it is the data controller of or that it is otherwise responsible for and authorised to use as input into the Software. The User (and not the Provider) is responsible for ensuring that processing of any such personal data using the Software is carried out in reliance on a lawful basis for processing and in accordance with UK Data Protection Laws. If such personal data is: 

    1. Included in output of the Software, it is the User’s responsibility to ensure that use of this output does not infringe upon anybody’s data protection rights.

    2. Processed by the Provider in providing the Software, the Provider will process it only in accordance with the section headed "Proprietary Rights to Data", the Data Processing Agreement, and UK Data Protection Laws, and will not use it to train any artificial intelligence or machine learning model.

Service Provision Information

52. The Provider reserves the right to make updates or changes to the Software as necessary to maintain, fix, or improve the Software.

53. The User is responsible for ensuring that they have adequate hardware and software to run the Software as intended.

54. Descriptions of the Software are available on the Provider’s website. Make sure that you read these before agreeing to the Terms of Use.

55. If the User is a Consumer, the User has a statutory right to cancel the Agreement (e.g. their purchase of access to the Software) within a period of 14 days from the date of purchase. However, by accepting these Terms of Use, the User expressly requests the Provider to grant the User immediate access to the Software following the acceptance of the Terms of Use and the User acknowledges that, in making such a request, they waive the right to cancel as described. 

56. The Software has the following functionality: 

    1. Learning platform and marketplace which includes course creation and management; policy creation and management; course marketplace for creators and buyers; and user tracking and administration.

57. Any complaints regarding the Software or the Provider’s provision of it will be dealt with by the Provider as follows:

    1. Contact your account manager or e-mail us at support@enlytning.com and we will come back to you.

58. Details of the support provided by the Provider are set out on the Provider's website.

59. The Provider can be contacted by e-mail at support@enlytning.com.

Circumstances Beyond the Control of Either Party (Force Majeure)

60. Neither Party shall be liable for any failure or delay in performing their obligations under this Agreement (e.g. provision of payment or of Software) where such failure or delay results from any cause that is beyond the reasonable control of that Party.  

61. Such causes include, but are not limited to: power failure, Internet Service Provider failure, acts of God, epidemic, pandemic, civil unrest, fire, flood, droughts, storms, earthquakes, collapse of buildings, explosion or accident, acts of terrorism, acts of war, governmental action, any law, or any action taken by a government or public authority, including without limitation imposing an export or import restriction, quota, or prohibition, or any other event that is beyond the control of the Party in question. 

62. The Party affected by a circumstance beyond its control shall use all reasonable endeavours to mitigate the effect of the circumstance upon the performance of its obligations. 

63. The corresponding obligations of the other Party will be suspended to the same extent as those of the Party affected by the force majeure event.

64. If the delay continues for a period of 30 days, either Party may terminate the Agreement. Other termination methods, as set out above in the sections headed “Term and Termination of Use of the Paid Version of the Software” and “Term and Termination of Use of the Free Version of the Software” may, if applicable, be used to end the Agreement before such a 30-day period has elapsed.

General Terms

65. If the User is a Business Customer placing an order on behalf of a business, the User confirms that they have the necessary authority to place the relevant order for and on behalf of that business.

66. The Agreement contains the whole agreement between the Parties relating to its subject matter and supersedes all prior discussions, arrangements, or agreements that might have taken place in relation to the Agreement. Nothing in this clause limits or excludes any liability for fraud or fraudulent misrepresentation.

67. Except as allowed above, neither Party may assign, transfer, sub-licence, or sub-contract to any third party the benefit and/or burden of the Agreement or of any of the rights under this Agreement without the prior written consent (not to be unreasonably withheld) of the other Party.

68. No variation of the Agreement will be valid or binding unless it is recorded in writing and signed by or on behalf of both Parties, except that: 

    1. Changes may be made by the Provider in accordance with other terms of these Terms of Use; and 

    2. Changes may be made by the Provider to these Terms of Use. The version of the Terms of Use that applies to a specific Agreement are those that are current on the Effective Date. Notification of any changes to the Terms of Use will be made in writing either in a manner that brings notice to the User’s attention before they next use the Software (e.g. via a pop-up on a login screen) or via direct communication with the User (e.g. by email). If changes are made to the Terms of Use, the User’s use of the Software after the changes are communicated and implemented is deemed to constitute their acceptance of the new Terms. If the User does not wish to accept the new Terms of Use, they can terminate the Agreement in accordance with the provisions above in the sections headed “Term and Termination of Use of the Paid Version of the Software” and “Term and Termination of Use of the Free Version of the Software”.

69. The Contracts (Rights of Third Parties) Act 1999 does not apply to the Agreement and no third party has any right to enforce or rely on any provision of the Agreement.

70. Unless otherwise agreed, no delay, act, or omission by a Party in exercising any right or remedy available in relation to this Agreement will be deemed a waiver of that, or any other, right or remedy.

71. If any court or competent authority finds that any provision or part of the Agreement is invalid, illegal, or unenforceable, that provision or part will, to the extent required, be deemed to be deleted, and the validity and enforceability of the other provisions of the Agreement will not be affected.

72. Nothing in the Agreement will establish any employment relationship, partnership, or joint venture between the Parties, or mean that one Party becomes the agent of the other Party, nor does the Agreement authorise any Party to enter into any commitments for or on behalf of the other Party.

73. Any notice (other than in legal proceedings) to be delivered under the Agreement must be in writing and delivered by email to the email address provided in these Terms of Use (for notices sent to the Provider) or to the email provided by the User when the User registers their account used to access the Software (for notices sent to the User).

Governing Law and Jurisdiction

74. This Agreement will be governed by and interpreted according to the laws of England and Wales. 

75. If the User is a Consumer who resides elsewhere in the UK, the User may also make use of any protections given to the User by the laws of the constituent country in which they reside. All disputes and claims arising under the Agreement where the User is a Consumer (including non-contractual disputes or claims) will be subject to the non-exclusive jurisdiction of the courts of England and Wales.

76. If the User is a Business Customer, all disputes and claims arising under the Agreement (including non-contractual disputes or claims) will be subject to the exclusive jurisdiction of the courts of England and Wales.

Schedule: Data Processing Agreement

This Schedule (the "DPA") forms part of the Agreement and applies where, in providing the Software, the Provider processes personal data on behalf of the User ("Protected Data"). Terms defined in the Terms of Use have the same meaning in this DPA. "Data Protection Legislation" means UK Data Protection Laws. This DPA sets out the terms required by Article 28(3) of the UK GDPR and takes effect in electronic form in accordance with Article 28(9).

1. Roles

1.1 In respect of Protected Data, the User is the controller and the Provider is the processor. Where the User is a Consultant processing personal data on behalf of a Client, the User may itself act as a processor for that Client, in which case the Provider acts as the User's sub-processor and the User warrants that it has the Client's authorisation to engage the Provider on the terms of this DPA.

1.2 The Provider acts as an independent controller of account, billing, and usage data relating to the User's relationship with the Provider, which it processes in accordance with its Privacy Policy. Such data is not Protected Data.

2. Particulars of Processing

2.1 Subject matter and duration: the processing of Protected Data in the course of providing the Software, for the duration of the Agreement plus the deletion period in paragraph 8.

2.2 Nature and purposes: hosting and storage; document, policy, contract, and course generation (including AI-assisted generation of Output); training assignment, completion tracking, and reporting; signature workflows; user administration; support; and backup.

2.3 Categories of data subjects: employees, workers, contractors, candidates, and other personnel of the User or of a Client, and other individuals whose personal data the User inputs into the Software.

2.4 Types of personal data: identification and contact details; employment and organisational details; contractual terms; remuneration, payroll, and benefits data; right to work and compliance data; training and assessment records; and any other personal data the User chooses to input. The User must not input special category or criminal offence data unless it is necessary and the User has a lawful basis and an applicable condition for processing it.

3. Instructions

3.1 The Provider will process Protected Data only on the User's documented instructions, which comprise the Agreement, this DPA, and the User's use and configuration of the Software, including with regard to transfers of Protected Data outside the UK, unless processing is required by law to which the Provider is subject, in which case the Provider will inform the User of that requirement before processing unless the law prohibits this.

3.2 The Provider will inform the User immediately if, in its opinion, an instruction infringes Data Protection Legislation.

3.3 For clarity, and consistently with the section headed "Proprietary Rights to Data", the Provider's instructions do not include, and the Provider will not carry out, any use of Protected Data to train, fine-tune, or otherwise develop any artificial intelligence or machine learning model.

4. Confidentiality and Security

4.1 The Provider will ensure that persons authorised to process Protected Data are subject to binding obligations of confidentiality.

4.2 The Provider will implement and maintain appropriate technical and organisational measures to protect Protected Data as required by Article 32 of the UK GDPR, including as a minimum the measures described in Annex 2.

5. Sub-processors

5.1 The User provides general written authorisation for the Provider to engage sub-processors to process Protected Data. The current list of sub-processors is available on request.

5.2 The Provider will give the User at least 30 days' written notice (which may be by e-mail or in-product notice) of the addition or replacement of a sub-processor. If the User reasonably objects on data protection grounds and the Parties cannot resolve the objection, the User may terminate the Agreement and will receive a pro rata refund of prepaid Fees for the remainder of the Term.

5.3 The Provider will impose on each sub-processor, by written contract, data protection obligations no less protective than those in this DPA, including the prohibition on using Protected Data for the training or development of AI models, and the Provider remains fully liable to the User for the performance of each sub-processor's obligations.

6. Assistance

6.1 Taking into account the nature of the processing, the Provider will assist the User by appropriate technical and organisational measures, insofar as this is possible, in fulfilling the User's obligations to respond to requests from data subjects exercising their rights under Data Protection Legislation. If the Provider receives such a request directly, it will promptly forward it to the User and will not respond except on the User's instructions or as required by law.

6.2 The Provider will assist the User in ensuring compliance with the User's obligations under Articles 32 to 36 of the UK GDPR (security, personal data breach notification, data protection impact assessments, and prior consultation), taking into account the nature of the processing and the information available to the Provider.

6.3 The Provider will notify the User without undue delay after becoming aware of a personal data breach affecting Protected Data, and will provide the User with such information as the User reasonably requires to meet its own breach notification obligations, including the nature of the breach, the categories and approximate numbers of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address it.

7. International Transfers

7.1 The Provider will not transfer Protected Data outside the UK unless the transfer is to a country covered by adequacy regulations made under Data Protection Legislation, or is subject to appropriate safeguards such as the ICO International Data Transfer Agreement or the ICO Addendum to the EU Standard Contractual Clauses, or another lawful transfer mechanism.

8. Deletion and Return

8.1 On termination or expiry of the Agreement, the Provider will, at the User's choice, delete or return all Protected Data within 30 days of a written request received within that period, and will in any event delete Protected Data no later than 90 days after termination, save that Protected Data may persist in encrypted backups until those backups are overwritten in the ordinary cycle, and the Provider may retain Protected Data to the extent required by law, in which case this DPA continues to apply to it.

9. Records and Audit

9.1 The Provider will make available to the User the information necessary to demonstrate compliance with Article 28 of the UK GDPR, which the Provider may satisfy in the first instance by providing its most recent security documentation, certifications, or third party audit summaries.

9.2 The Provider will allow for and contribute to audits, including inspections, conducted by the User or an auditor mandated by the User, no more than once in any 12-month period (except following a personal data breach or where required by a regulator), on at least 30 days' written notice, during normal business hours, subject to reasonable confidentiality obligations, and at the User's cost.

10. General

10.1 This DPA is subject to the limitations and exclusions of liability in the Agreement. In the event of conflict between this DPA and the rest of the Agreement in relation to the processing of Protected Data, this DPA prevails.

10.2 Paragraphs of this DPA that by their nature should survive termination, including paragraphs 3.3, 7, and 8, survive termination or expiry of the Agreement.

Annex 1: Summary of Processing

The particulars of processing are set out in paragraph 2 of this DPA.

Annex 2: Technical and Organisational Measures

The Provider maintains, as a minimum: encryption of Protected Data in transit and at rest; logical separation of each User's (and, where applicable, each Client's) data through organisation-level access controls; role-based access control and authentication for Provider personnel, with access limited to those who need it; context isolation of AI assistants so that each assistant can access only the data of the relevant organisation and document; secure software development and change management practices; regular backups and tested recovery procedures; vulnerability management and security testing; personnel security and data protection training; and a documented incident response process.