Terms and Conditions

Looking for an earlier version? Browse the Terms and Conditions Archive.

TERMS OF SERVICE

Last updated October 30, 2026

The Terms of Service below govern your access to and use of the Verda Services. It includes the service terms and conditions, Data Processing Terms, and schedules, and incorporates the Acceptable Use Policy (together, the “Agreement”). It is a legally binding contract between you (the “Customer”) and Verda (Verda Cloud Oy) (the “Supplier”).

1. Definitions and How to Interpret These Terms

1.1 The following definitions apply in this Agreement:

1.2 The following rules of interpretation shall apply in this Agreement:

1. The Clause and Schedule headings are for convenience only and shall not affect the interpretation of this Agreement.
2. A person includes a natural person, corporate or unincorporated body (whether or not having separate legal personality).
3. A reference to a company shall include any company, corporation or other body corporate, wherever and however incorporated or established.
4. Unless the context otherwise requires: (i) words in the singular shall include the plural and, in the plural, include the singular; and (ii) a reference to one gender shall include a reference to the other genders.
5. A reference to writing or written includes e-mail.
6. References to Clauses (Sub-clauses, paragraphs, sub-paragraphs) are to the Clauses (Sub-clauses, paragraphs, sub-paragraphs) of this Agreement.
7. A reference to a statute or statutory provision is a reference to it as it is in force as at the date of this Agreement and as amended by any subsequent statute or statutory provision.
8. Any phrase introduced by the expressions including, includes, in particular or any similar expression shall be construed as illustrative only and shall not limit the sense of the words preceding those terms.

2. When This Agreement Starts and How Long It Lasts

2.1. This Agreement shall commence on the Commencement Date and will continue indefinitely unless terminated earlier in line with this Agreement.

3. Using Our Service

3.1. Subject to the Customer’s payment of the Service Fees and the Customer’s strict compliance with the other terms and conditions of this Agreement, the Supplier hereby grants to the Customer a limited, non-exclusive and non-transferable right (without the right to grant sub-licences) to use and access, and to permit the Customer Users to use and access, the Service, solely in accordance with this Agreement, including the Acceptable Use Policy during the Term.

3.2. The Supplier may amend the Service and the Service Description from time to time, including to reflect changes in hardware or infrastructure specifications, provided such amendments do not materially reduce the functionality or performance of the Service. The Supplier shall use commercially reasonable endeavours to notify the Customer in advance of any material amendment to the Service or Service Description. For the avoidance of doubt, updates to technical specifications, configurations, or operational parameters that do not materially and negatively impact the security of or diminish the Service shall not constitute a breach of this Agreement. The current Service Description is available on the Supplier’s website.

3.3. The Customer acknowledges and agrees that as between the Customer and the Supplier, the Supplier and its licensors own all Intellectual Property Rights in the Service, Information, Software and the Service Description. Except as expressly stated herein, this Agreement shall not grant the Customer any rights to, or in, any Intellectual Property Rights in respect of the Service, Information, Software and the Service Description.

3.4. The Supplier and its licensors shall have a royalty-free, worldwide, transferable, sub-licensable, irrevocable, perpetual license to use or incorporate into the Service, Information, Software and/or the Service Description, as the case may be, any enhancement requests or feedback provided by the Customer and any Customer Users to the Supplier, so long as the Customer is not identified in any way as the source of such feedback. For the avoidance of doubt, the Supplier shall not be obligated to implement any such enhancement requests or feedback.

3.5. Where the Service ordered under this Agreement includes or incorporates NVIDIA Confidential Computing (as defined in the NVIDIA Product-Specific Terms), the additional service-specific terms set out in Schedule 4 (Confidential Computing) shall apply.

4. Our Obligations as Supplier

4.1. The Supplier warrants that during the Term the Service shall perform materially in accordance with the Service Description.

4.2. The Supplier shall perform its obligations under this Agreement in compliance with all laws applicable to the Supplier’s provision of the Service.

4.3. If the Supplier fails to comply with the warranty at Sub-clause 4.1, it shall use its reasonable endeavours to rectify, repair or correct such failure within a reasonable time. The warranty at Sub-clause 4.1 shall not apply to the extent of any non-conformance, including unavailability, which is caused by: (i) the Customer’s breach of this Agreement; (ii) use of the Service contrary to the Supplier’s instructions; (iii) modification or alteration of the Service by any party other than the Supplier or authorised Supplier Personnel; or (iv) failure of third-party services or infrastructure, including but not limited to data centre and/or co-location services, power, or connectivity services, which are beyond the Supplier’s control.

4.4. Without limitation to Sub-clause 17.1 (Force Majeure), the Customer acknowledges that the Supplier has no direct control over the availability of, or limitations in, bandwidth over the entirety of the internet and that, while the Supplier will use such endeavours as the Supplier deems appropriate to facilitate the Service, the Supplier shall not be responsible for delays in or unavailability of the Service caused by such bandwidth limitations or unavailability.

5. Disclaimers

5.1. The Supplier does not warrant, represent, undertake or agree that: (i) the use of the Service by the Customer or its Customer Users will meet the Customer’s requirements nor that any recommendations derived from use of the Service will deliver any particular benefits if implemented; (ii) defects in the Service will be corrected; or (iii) the functions of the Service will operate in the combinations which the Customer selects for use. Under no circumstances shall the Supplier or the Supplier Personnel have any liability for any losses, claims, damages, costs or expenses caused by errors or omissions in any information, instructions or scripts provided to the Supplier and/or the Supplier Personnel by or on behalf of the Customer in connection with the Service, or any actions taken by the Supplier and/or the Supplier Personnel at the Customer’s direction.

5.2. Except as expressly provided in this Agreement, the Service is provided “as is” and to the extent permitted by law, the Supplier disclaims all other conditions, warranties, representations, undertakings or other terms which might have effect between the Parties with respect to the Service, or be implied or incorporated into this Agreement, whether by statute, common law, custom or otherwise, including any implied conditions, warranties, undertakings or other terms relating to satisfactory quality, reasonable skill and care, fitness for any particular purpose, ability to achieve a particular result or arising from course of dealing or usage of trade. Supplier does not warrant anything in relation to systems that do not make up the Service or the connection to the Service or those systems.

5.3. The Supplier makes no representation, and gives no warranty or undertaking, that the operation or availability of the Service will be uninterrupted or error-free.

6. Your Obligations and Acceptable Use of the Service

6.1. The Customer must comply at all times with the Acceptable Use Policy in Schedule 1, which forms part of this Agreement.

6.2. The Customer shall use its best endeavours to prevent any unauthorised access to, or use of, the Service and shall notify the Supplier promptly of any such unauthorised access or use.

6.3. The Customer shall provide the Supplier with all necessary co-operation in relation to this Agreement, including access to such information as may be required by the Supplier in order to provide the Service and to fulfil the Supplier’s compliance obligations (including in relation to know-your-customer checks, screening requirements and other applicable regulatory obligations). The Supplier may, no more than once annually during the Term (or at any time where the Supplier has reasonable grounds for concern regarding the Customer’s compliance with this Agreement or where required under applicable law), conduct a review or audit of the Customer’s compliance with this Agreement. The Customer shall provide all reasonably necessary assistance and access to information in connection with any such review or audit, provided that the Supplier shall not require access to Customer Data or the Customer’s systems beyond what is strictly necessary to verify compliance or to fulfil the Supplier’s obligations under applicable law. For the avoidance of doubt, the Supplier’s automated security monitoring, threat and abuse detection, and incident response activities form part of the normal operation of the Service and do not constitute an audit for the purposes of this Sub-clause 6.3, and nothing in this Sub-clause 6.3 shall limit or restrict such activities.

6.4. The Customer shall:

a) ensure that the Customer Users comply with the Acceptable Use Policy and any policies relating to the security or technical operation of the Service as published by the Supplier and notified to the Customer from time to time;

b) maintain sufficient licences to any software (from third parties or licensed by the Supplier separately to this Agreement) operated using or in conjunction with the Service;

c) maintain adequate technical capabilities to access and use the Service, including complying with possible Minimum Technical Requirements. The Customer acknowledges that as between the Parties, it is solely responsible for ensuring that its firewalls, security and privacy systems and settings, and other plug-ins or applications, do not interfere with or restrict the Customer’s, or its Customer Users’, access and use of the Service, and the Supplier and Supplier Personnel shall have no responsibility or liability in relation thereto;

d) provide such personnel assistance as may be reasonably requested by the Supplier from time to time;

e) comply with all applicable laws and regulations with respect to its activities under this Agreement;

f) carry out all other Customer responsibilities set out in this Agreement in a timely and efficient manner. In the event of any delays in the Customer’s provision of such assistance as agreed by the Parties, the Supplier may adjust any timetable or delivery schedule set out in this Agreement as reasonably necessary;

g) before the Customer uses any updates to any third-party software in a live environment, carry out testing updates to any third-party software to its satisfaction, to ensure that such updates meet the Customer’s own requirements without causing any issues with the Customer’s use of the Service; and

h) undertake appropriate back-ups to its data and to secure media with such regularity and in such a manner so as to ensure that it can restore such data and media in the event of data loss or corruption from any cause.

6.5. The Customer represents and warrants that, as of the Commencement Date it is not or its ultimate beneficial owners are not Sanctioned Persons. If, after the Commencement Date, the Customer or its ultimate beneficial owner become a Sanctioned Person or Sanctions or Export Control Laws prevent the provision of the Service to the Customer, the Customer shall immediately notify the Supplier in writing.

6.6 The Customer shall comply with the AI Terms of Service (Schedule 5) when using AI Services.

7. Your Responsibilities for Users and Access

7.1. In relation to Customer Users:

a) the Customer shall ensure that the Customer Users comply with the terms of this Agreement, and shall be responsible for any acts and omissions of the Customer User as if committed by the Customer itself;

b) the Customer shall ensure that each Customer User keeps any user log-in(s), and password(s) for their use of the Service secure and confidential, password(s) are of adequate strength and conforming to the password policies of the Service, and that each Customer User does not share their login password(s) to allow any other employees, contractors (individuals or otherwise), representatives and agents of the Customer or any other individual or third party to access the Service;

c) in respect of any Customer User, the Customer will not allow any Customer User account to be used by more than one (1) individual Customer User; and

d) the Customer shall ensure that each Customer User is an individual natural person who is at least eighteen (18) years of age; and

e) if a Customer User leaves the employment or engagement of the Customer or where the employment or engagement of a Customer User is transferred such that the Customer does not intend for them to have access to the Service, the Customer shall promptly ensure that the Customer User shall not have access to the Service.

7.2. The Customer will not allow any Customer User account to be used (including to access or use the Service) in Restricted Locations.

7.3. The Customer acknowledges that the Service may provide functionality or features that enable Customer Users to perform functions, or order services that may incur additional Service Fees (as specified in the Service Description and/or on the Service itself) and the Customer agrees to be bound by the actions and orders performed by the Customer Users (or any person who obtains access to the Service as a result of a breach of this Agreement by the Customer) using the Service and pay any additional Service Fees arising as a result.

8. Service Fees and Payment Terms

Service Fees

8.1. The Customer shall pay the applicable Service Fees for using the Service as specified by the Supplier at the time of purchase or subscription.

8.2. For on-demand use of the Service, the Supplier may require the Customer to maintain a minimum account balance or credit (as specified by the Supplier from time to time on its website or at the point of purchase) in order to access or continue using the Service.

8.3. Unless otherwise agreed by the Supplier, the Customer shall make payment by valid credit or debit card through the Supplier’s designated online payment system. By providing payment details, the Customer authorizes the Supplier (and its appointed payment processor) to charge the Service Fees, including any recurring, top-ups, renewal or usage-based charges, together with applicable taxes.

8.4. The Supplier may, at its sole discretion, permit the Customer to pay by another method (including based on invoice). In such cases, the Customer shall comply with the payment instructions provided by the Supplier.

Payment Terms

8.5. The Service Fees shall include all public charges determined by the authorities, but are exclusive of all sales, use, and excise taxes, including value added tax, and any other similar taxes, duties, and charges of any kind imposed by any governmental authority on any amounts payable by the Customer. The Customer shall be responsible for all such charges, costs and taxes; provided that the Customer shall not be responsible for any taxes imposed on, or with respect to, the Supplier’s income, revenues, gross receipts, personal or real property, or other assets. If the amount of any charges, costs, and taxes determined by a governmental authority or their collection basis change due to changes in applicable law, the Service Fees and other prices, if any, shall be revised correspondingly.

8.6. If the Customer is or may be required under any law or regulation of any governmental entity or authority, domestic or foreign, to withhold or deduct any portion of any payment due to the Supplier pursuant to this Agreement and the Supplier is unable to reclaim or recover that deduction through the exercise of reasonable efforts, then the sum payable to the Supplier will be increased by the amount necessary to yield to the Supplier an amount equal to the sum it would have received had no withholdings or deductions been made.

8.7. If the Customer fails to make any payment in accordance with this Agreement, then the Supplier shall (without prejudice to its other rights and remedies) be entitled to:

a) charge interest on the overdue amount from the date the payment was due until paid in full, at an annual rate equal to the lower of twenty-five per cent (25%) or the maximum rate of late payment interest permitted under the governing law of this Agreement; and/or

b) suspend the Customer’s and the Customer Users’ access to and use of the Service until payment (including any accrued overdue interest thereon pursuant to Sub-clause 8.7.a)) is made by the Customer in accordance with this Agreement.

8.8. Any Service Fees paid in accordance with this Clause 8, to the extent permitted by applicable law, shall be non-refundable in any circumstances, including upon early termination of this Agreement, except as expressly envisaged under this Agreement.

8.9. Without limiting Sub-clause 8.8, if the Supplier suspends or terminates the Customer’s access to or use of the Service, or terminates this Agreement, as a result of the Customer’s or any Customer User’s material breach of this Agreement or prohibited conduct, including any breach of Clause 6.1, then, to the fullest extent permitted by applicable law: (i) all Service Fees for Services already provided, consumed, or made available before suspension or termination shall be non-refundable; (ii) any prepaid Service Fees, minimum account balance, account credits, promotional credits, discounts, or other unused amounts associated with the Customer’s account shall be non-refundable except to the extent a refund is required by applicable law; (iii) Supplier may apply any such amounts listed in (iv) against any unpaid Service Fees, taxes, chargebacks, payment processing fees, investigation or remediation costs, third-party claims, or other losses, costs, or expenses arising out of or relating to the Customer’s breach or prohibited conduct. Supplier’s rights under this Sub-clause 8.9 are without prejudice to any other rights or remedies available under this Agreement or applicable law. Nothing in this Sub-clause 8.9 shall limit any mandatory statutory rights that cannot be excluded or limited by law.

8.10. The Customer represents and warrants that all information provided to the Supplier regarding the Customer’s country of residence, place of establishment, billing address and billing contacts, including email address and phone number, and any other location-related information used by the Supplier to determine applicable taxes (including VAT, sales tax, or other indirect taxes) (collectively, “Tax Location Information”) is and shall remain accurate, current and complete at all times. The Customer shall promptly notify the Supplier of any change to its Tax Location Information.

8.11. The Customer acknowledges that the Supplier relies on the Tax Location Information provided by the Customer in order to determine and apply the correct rate of VAT, sales tax, or other applicable indirect taxes. Where the Customer provides inaccurate, incomplete, or misleading Tax Location Information (including by self-selecting a jurisdiction that does not reflect the Customer’s actual place of residence or establishment), and as a result the Supplier fails to charge, collect, or remit the correct amount of tax:

a) the Customer shall remain liable for, and shall promptly pay to the Supplier upon demand, all taxes that should have been charged but were not charged or were under-charged as a result of such inaccuracy, together with any interest, penalties, or administrative charges imposed on the Supplier by any tax authority in connection therewith;

b) the Supplier may, upon becoming aware of the inaccuracy, correct the tax treatment applied to the Customer’s account on a prospective basis and, to the extent permitted by applicable law, on a retrospective basis; and

c) without prejudice to any other right or remedy, the Supplier may suspend the Customer’s access to the Service in accordance with Clause 14.4 until the Customer provides corrected Tax Location Information and any outstanding tax amounts have been paid.

8.12. The Customer shall indemnify and hold harmless the Supplier against any losses, costs, penalties, interest, and expenses (including reasonable legal fees) arising out of or in connection with the Customer’s provision of inaccurate Tax Location Information, including any assessment, demand, or claim by a tax authority resulting from the Customer’s misrepresentation of its location or residency status.

9. Customer Data

9.1. The Customer shall own all rights, title and interest in and to all of the Customer Data and shall at all times have sole responsibility for the legality, reliability, integrity, accuracy and quality of the Customer Data and for ensuring that its use does not infringe the rights of any third parties.

9.2. The Customer hereby grants to the Supplier and the Supplier Personnel, on and subject to the terms and conditions of this Agreement, a non-exclusive, non-transferable licence to use the Customer Data for the purpose of providing the Service and the exercise of the Supplier’s rights under this Agreement (together with the right to sub-licence these rights to its subcontractors to the extent necessarily required for the performance of the Supplier’s obligations) and for any requirements ancillary to the provision of the Service (including any data analytics and service modelling specified in the Service Description) provided this does not result in a significant detriment to the Customer’s interests. The Customer warrants to the Supplier that the use of the Customer Data in accordance with this Agreement will not: (i) breach any laws, statutes or regulations; (ii) infringe the Intellectual Property Rights or other rights of any person; or (iii) give rise to any cause of action against the Supplier, in each case in any jurisdiction and under any applicable law.

9.3. In the event of any loss or damage to Customer Data, the Customer’s sole and exclusive remedy shall be for the Supplier to use reasonable commercial endeavours to restore the lost or damaged Customer Data from the latest back-up of such Customer Data where such back-ups are made by the Supplier, without prejudice to other available remedies. The Supplier shall not be responsible for any loss, destruction, alteration or disclosure of Customer Data to the extent that such loss or damage arises from or is attributable to: (i) the acts or omissions of the Customer, its Customer Users, or the Customer’s Affiliates; (ii) any third party (other than those third parties sub-contracted by the Supplier to perform services related to Customer Data hosting and back-up); (iii) the Customer’s failure to maintain adequate backups in accordance with Sub-clause 6.4.h); or (iv) any cause not directly attributable to the Supplier’s breach of this Agreement. Where the Supplier is liable, such liability shall be subject to the limitations and exclusions set out in this Agreement, including those set out in this Clause 9 (Customer Data) and Clause 13 (Limitation of Liability).

10. Data Processing Terms

The terms relating to the Processing of Personal Data by the Supplier on behalf of the Customer are set out in Schedule 2 (Data Processing Terms), which shall form part of this Agreement.

11. Confidentiality

11.1. The Receiving Party shall:

1. only use (including making copies of) Confidential Information in connection with and to the extent necessary for the purposes of this Agreement;
2. not disclose the Confidential Information to any person, other than to its Representatives, except with the prior written consent of the Disclosing Party or in accordance with Sub-clauses 11.2 and 11.3; and
3. keep all Confidential Information secret and securely protected against theft or unauthorised access. 11.2. The Receiving Party may disclose Confidential Information of the Disclosing Party to its Representatives who have legitimate need to know the Confidential Information and are bound by confidentiality obligations no less protective than those set out in this Agreement. 11.3. The Receiving Party may disclose any Confidential Information to any regulator, law enforcement agency or other third party if it is required to do so by law, regulation, or similar authority. In those circumstances the Receiving Party shall (to the extent practical and lawful to do so) notify the Disclosing Party in writing as soon as practicable before the disclosure and use all reasonable endeavours to consult with the Disclosing Party with a view to agreeing the timing, manner and extent of the disclosure. The Supplier may disclose Customer Account Information to its auditors, consultants, and legal counsel, provided that such persons are bound by confidentiality obligations no less protective than those set out in this Agreement. 11.4. All Confidential Information shall remain the property of the Disclosing Party and the Disclosing Party reserves all rights in its Confidential Information. Nothing in this Agreement or the disclosures envisaged by this Agreement shall (except as expressly agreed otherwise in this Agreement) operate to transfer, or operate as a grant of any licences or right to use, to any Intellectual Property Rights in the Confidential Information. 11.5. The Parties’ obligations under this Clause 11 shall continue in force notwithstanding the termination or expiry of this Agreement. 11.6. Each Party acknowledges that damages alone would not be an adequate remedy in the event of breach by the other Party of the provisions of this Clause 11. Accordingly, it is agreed that either Party shall be entitled, without proof of special damages, to seek an injunction or other interim remedy for any threatened or actual breach of this Clause 11 by the other Party, without prejudice to any other rights and remedies which that first Party may have.

12. Indemnities

12.1. The Customer shall indemnify, keep indemnified and hold the Supplier and the Supplier Personnel harmless against any and all damages, claims, actions, proceedings, losses and reasonable costs (including legal fees) and expenses arising from any third party claims or actions arising out of or in connection with: (i) the Customer’s or the Customer Users’ use (or misuse) of the Service in breach of this Agreement; and/or (ii) any breach of the Customer’s warranty in Sub-clause 9.2.

12.2. Subject to the provisions of this Sub-clause 12.2 and Sub-clauses 12.3 to 12.5, the Supplier shall indemnify the Customer and hold the Customer harmless in respect of all damages and reasonable costs (including court costs and legal fees) and expenses arising directly from an IPR Claim which is valid and enforceable in the legal jurisdiction in which the IPR Claim is commenced provided that:

a) the Customer shall give the Supplier prompt notice of any actual or threatened IPR Claim;

b) the Customer shall not admit any liability or agree to any settlement or compromise of an IPR Claim without the prior written consent of the Supplier;

c) the Supplier shall be entitled at any time to assume exclusive conduct of the IPR Claim (which shall include, but not be limited to, the exclusive right to conduct any proceedings or action, negotiate the settlement of the IPR Claim and to conduct all discussions and dispute resolution efforts in connection with the IPR Claim);

d) the Customer shall, at the Supplier’s request, cost and expense, give the Supplier all reasonable assistance in connection with the conduct of the IPR Claim (including taking such steps as is necessary to enable the Supplier to assume conduct of the IPR Claim pursuant to Sub-clause 12.2.c)); and

e) the Customer takes all reasonable steps to mitigate any liabilities which are the subject of the indemnity in this Sub-clause 12.2.

12.3. If any IPR Claim is made, or in the Supplier’s reasonable opinion is likely to be made, against the Customer, the Supplier may at its option and expense:

a) obtain for the Customer the right to continue using the Service in the manner permitted under this Agreement; or

b) modify or replace the infringing part of the Service so as to avoid the infringement or alleged infringement, but in such a way that does not materially adversely affect the functionality of the Service; or

c) terminate this Agreement immediately on notice to the Customer.

12.4. Under no circumstances shall the Supplier or any Supplier Personnel be liable to the Customer under Sub-clauses 12.2 or 12.3 (or otherwise) to the extent that the infringement (whether actual or threatened) is based on: (i) any changes, modifications, updates or enhancements made to the Service other than by the Supplier or the Supplier Personnel; (ii) any use of the Service by the Customer or its Customer Users in a manner contrary to the Supplier’s instructions and/or in breach of this Agreement; or (iii) the Customer’s or its Customer Users’ use of the Service after notice or becoming aware of the actual or threatened IPR Claim.

12.5. The provisions of Sub-clauses 12.2 to 12.4 inclusive state the entire liability of the Supplier to the Customer in connection with an IPR Claim and shall be the Customer’s sole and exclusive remedy in that regard.

13. Limitation of Liability

13.1. Nothing in this Agreement excludes or limits the liability of either Party to the other for:

a) death or personal injury caused by negligence;

b) fraud or fraudulent misrepresentation by it or its employees;

c) wilful misconduct; or

d) any other liability that cannot be excluded or limited by law.

13.2. Subject to Sub-clause 13.1, the Supplier or the Customer shall not be liable whether in tort (including for negligence), breach of statutory duty, contract, misrepresentation (whether innocent or negligent), restitution or otherwise for:

a) any loss of profits, loss of business, loss of savings, depletion of goodwill and/or similar losses, or pure economic loss or (subject to Sub-clause 9.3) any loss or corruption of data or information (regardless of whether these types of loss or damage are direct, indirect or consequential); or

b) any special, indirect or consequential loss or damage whatsoever, in each case however arising under or in connection with this Agreement and even if the Supplier or the Customer were aware of the possibility that such loss or damage might be incurred.

13.3. Subject to Sub-clauses 13.1 and 13.2 and save for the Customer’s payment obligations of the Service Fees and obligation to indemnify under 12.1, the total aggregate liability of the Supplier or Customer (including liability for breach) in contract (including indemnities under Clause 12.2), tort (including negligence or breach of statutory duty), misrepresentation (whether innocent or negligent), restitution or otherwise, arising under or in connection with the performance, non-performance or contemplated performance of this Agreement in respect of any and all causes of action shall in no event exceed 20% of the value of the Service Fees paid or payable by the Customer to the Supplier in the twelve (12) months immediately preceding the event giving rise to the claim.

13.4. The provisions of this Agreement allocate risks under this Agreement between the Supplier and the Customer and form an essential basis of the bargain between the Parties and, absent any of such provisions, the remaining provisions of this Agreement, including, without limitation, the economic terms, would be substantially different. The Supplier pricing reflects this allocation of risks and limitation of liability. The provisions of Clause 13 shall apply to the maximum extent permitted by law, even if any remedy fails of its essential purpose.

14. Termination and Suspension

14.1. The Customer may terminate this Agreement for its convenience at any time by either providing written notice to the Supplier, or deleting its account through the functionality provided in the Service.

14.2. Without affecting any other right or remedy available to it, either Party may terminate this Agreement with immediate effect by giving written notice to the other Party if:

a) the other Party commits a material breach of any term of this Agreement which breach is irremediable or (if such breach is remediable) fails to remedy that breach within a period of thirty (30) days after being notified in writing to do so;

b) the Customer suffers an Insolvency Event; or

c) regulations, rules, laws, orders, or measures related to Sanctions or Export Control Laws prohibit or materially restrict the performance of this Agreement, as imposed, issued, administered, enacted or enforced by the relevant authorities in relevant jurisdictions, after the Commencement Date of this Agreement.

14.3. On termination of this Agreement for any reason:

a) all licences and other rights granted under this Agreement shall immediately terminate and the Customer and the Customer Users shall immediately cease all use of the Service. For the avoidance of doubt, any licences and other rights granted under this Agreement which are stated to be granted on a perpetual and irrevocable basis shall survive the termination of this Agreement for any reason and shall continue in full force and effect;

b) the Supplier may immediately end the Customer’s and the Customer Users’ use of and access to the Service;

c) the Customer shall immediately pay all sums and amounts payable to the Supplier under the terms of this Agreement;

d) each Party shall return or destroy, and (in each case) make no further use of any equipment, property, materials and other items (and all copies of them) belonging to the other Party, including the other Party’s Confidential Information (except the Supplier may retain reasonable professional records of the Customer’s and its Customer Users’ use of the Service and shall be entitled to retain the Customer’s Confidential Information for the purposes of internal audit, litigation and/or to comply with applicable laws);

e) Subject to Sub-clauses 9 and 10 of Schedule 2 (Data Processing Terms), the Supplier may destroy or otherwise dispose of any of the Customer Account Information in its possession at any point thirty (30) days or more after termination of this Agreement unless the Supplier is required to retain such information under applicable law or for the purposes described in Sub-clause 10.3 of Schedule 2 (Data Processing Terms);

f) any rights, remedies, obligations or liabilities of the parties that have accrued up to the date of termination, including the right to claim damages in respect of any breach of this Agreement which existed at or before the date of termination shall not be affected or prejudiced; and

g) Clauses 8 to 20 and any other provisions which are necessary for the interpretation or enforcement of this Agreement shall continue in force notwithstanding termination.

14.4. The Supplier may suspend the Customer’s right to access the Service or use any portion or all of the Service immediately upon written notice to the Customer if it determines acting reasonably:

a) that the Customer’s (or a Customer User’s) use of or access to the Service (i) poses a security risk to the Supplier, the Service or any third party; (ii) may adversely impact availability or performance of the Service, the Software or the systems or software of any other customer of the Supplier; (iii) may subject the Supplier or any third party to any liability; or (iv) may be fraudulent; or

b) that the Customer, or any Customer User, is in breach of this Agreement or any other agreement by which software being used on or in conjunction with the Service is licensed.

14.5. The Supplier shall reinstate the suspended Service once it has established the cause of the suspension has been remedied or ceased to exist. Where the cause of the suspension persists for more than thirty (30) days, the Supplier may immediately terminate this Agreement without incurring any liability to the Customer.

15. Entire Agreement

15.1. This Agreement constitutes the entire agreement between the parties in relation to its subject matter. It replaces and extinguishes all prior agreements, collateral warranties, collateral contracts, statements, representations and undertakings made by or on behalf of the parties, whether oral or written, in relation to that subject matter.

15.2. The Customer acknowledges that it has been provided access to the Supplier’s Privacy Policy and has had the opportunity to review it. For the avoidance of doubt, the Privacy Policy does not form part of this Agreement, amend or override the Data Processing Terms, or impose any additional contractual obligations on either Party except to the extent expressly set out in this Agreement.

15.3. Each Party acknowledges that in entering into this Agreement it has not relied upon any collateral warranties, collateral contracts, statements, representations or undertakings, whether oral or written, which were made by or on behalf of the other Party in relation to the subject matter of this Agreement (together “Pre-Contractual Statements”) and which are not set out in this Agreement. Each Party hereby waives all rights and remedies which might otherwise be available to it in relation to such Pre-Contractual Statements.

15.4. Nothing in this Clause shall exclude or restrict the liability of either Party arising out of its pre-contractual fraudulent misrepresentation or fraudulent concealment.

16. Notices

16.1. Any notice required to be given under this Agreement shall be in writing in English and shall be delivered by email to the other Party at its email address [email protected] or such other address as may have been notified by that Party for such purposes.

16.2. A notice sent by email shall be deemed to have been received at the time and date of transmission shown on the saved sent copy kept by the sender (or if delivery is not in business hours, at 9am (EET) on the first Business Day following delivery).

16.3. This Clause 16 shall not apply to the service of legal proceedings.

17. Miscellaneous

17.1. Force Majeure. The Supplier shall not be in breach of this Agreement nor liable for delay in performing, or failure to perform, any of its obligations under this Agreement if such delay or failure results from events, circumstances or causes beyond its reasonable control, including, without limitation, strikes, lock-outs or other industrial disputes (whether involving the workforce of the Supplier or any other party), failure of a utility service or transport or telecommunications network or the internet, natural disasters, war, pandemic, riot, civil commotion, malicious damage, compliance with any law or governmental order, rule, regulation or direction, accident, breakdown of plant or machinery, fire, flood, storm or default of suppliers or sub-contractors. In such circumstances the Supplier shall be entitled to a reasonable extension of the time for performing such obligations, provided that if the period of delay or non-performance continues for three (3) months, either Party may terminate this Agreement by giving thirty (30) days’ written notice to the other Party.

17.2. No Waiver. The failure to exercise, or delay in exercising, a right, power or remedy provided by this Agreement or by law shall not constitute a waiver of that right, power or remedy. If a Party waives a breach of any provision of this Agreement, this shall not operate as a waiver of a subsequent breach of that provision, or as a waiver of a breach of any other provision.

17.3. Rights and Remedies. Except as expressly provided in this Agreement, the rights and remedies provided under this Agreement are in addition to, and not exclusive of, any rights or remedies provided by law.

17.4. Severance. If any provision, or part of a provision, of this Agreement is found by any court or authority of competent jurisdiction to be illegal, invalid or unenforceable, that provision or part-provision shall be deemed not to form part of this Agreement, and the legality, validity or enforceability of the remainder of the provisions of this Agreement shall not be affected, unless otherwise required by operation of applicable law. If any invalid, unenforceable or illegal provision would be valid, enforceable or legal if some part of it were modified, the provision shall apply with whatever modification is necessary to give effect to the commercial intention of the parties.

17.5. Assignment. The Customer shall not, without the prior written consent of the Supplier, assign, transfer, charge, sub-contract or deal in any other manner with all or any of its rights or obligations under this Agreement. The Supplier may at any time assign, transfer, charge, sub-contract or deal in any other manner with this Agreement or any of its rights or obligations under this Agreement in whole or part without the Customer’s consent. The Customer shall enter into any further agreements reasonably required by the Supplier to give effect to any of the above.

17.6. Relationship of the Parties. Nothing in this Agreement is intended to, or shall be deemed to, establish or constitute any partnership or joint venture between any of the parties, create a relationship of principal and agent for any purpose between the parties, or authorise either Party to make or enter into any commitments for or on behalf of the other Party.

17.7. Variation. No variation of this Agreement shall be effective unless made in writing and signed by or on behalf of each of the parties or by their duly authorised representatives. If the Customer wishes the Supplier to proceed with any proposed variation, the Supplier has no obligation to do so unless and until the parties have agreed in writing the necessary variations to the Service Fees and any other relevant terms of this Agreement to take account of the change.

17.8. Changes. This Agreement may only be amended by written agreement agreed by both Parties. Nevertheless, the Parties acknowledge and agree that the Supplier’s field of business is subject to continuous changes (including changes regarding the Supplier’s Service as well as the applicable regulatory framework) which may also require changes to this Agreement. The Supplier may amend this Agreement to the extent reasonably required due to changes in applicable legislation, regulatory guidance, mandatory security requirements, essential changes in the Supplier’s Services, changes in the license terms or other contractual terms applicable to the Supplier and having impact on the Service. The Supplier will notify the Customer of such changes at least thirty (30) days in advance, unless compliance with the law or regulation requires that the changes be made sooner. Following the change notification, the Customer may terminate the Agreement without penalty, if the amendments are not acceptable.

17.9. Conflicts. In the event of any conflict between the Clauses of this Agreement and the Schedules, the Schedules shall prevail over the Clauses of this Agreement relating to the specific subject matter governed by the Schedule.

17.10 Export Control. The Customer agrees to comply during the Term with Sanctions and Export control Laws as in force from time to time. The Customer may not allow any Customer User account to be used (including to access or use the Service) in Restricted Locations. The Customer may not permit the use of the Service by persons or entities whose access to the Service is not permitted under Sanctions and Export Control Laws. Customer shall be solely responsible for compliance with Sanctions and Export Control Laws related to its Customer Data including but not limited to applying any necessary approvals and licenses for exporting Customer Data.

18. Third-Party Rights

18.1. Subject to the Supplier Personnel being entitled to rely on and enforce the provisions of Clauses 5, 12, and 13, a person who is not a party to this Agreement may not enforce any of its provisions under any legislation otherwise entitling it to do so nor bring a claim for the recovery of any losses, liabilities, expenses or costs arising out of or relating to this Agreement or the Service. The consent of any third party is not necessary for any variation (including any release or compromise in whole or in part of any liability) or termination of this Agreement.

18.2. All claims brought by the Customer under or as a result of this Agreement (whether in contract, misrepresentation (whether tortious or statutory), tort (including negligence), restitution, breach of statutory duty or otherwise) shall be brought against the Supplier only and not any Supplier Personnel. The limitations and exclusions of liability set out in this Agreement shall apply to all such claims.

19. EU and UK Consumer Rights

19.1. The terms relating to EU and UK consumer rights are set out in Schedule 7 (EU and UK Consumer Rights), which shall form part of this Agreement.

20. Governing Law and Jurisdiction

20.1. This Agreement and any dispute or claim arising out of or in connection with it or its subject matter or formation (including non-contractual disputes or claims) shall be governed by and construed in accordance with the law of Finland.

20.2. The United Nations Convention on Contracts for the International Sale of Goods (CISG) shall not apply to this Agreement.

20.3. Any dispute, controversy or claim arising out of or relating to this Agreement, or the breach, termination or validity thereof, shall be finally settled by arbitration in accordance with the Arbitration Rules of the Finland Chamber of Commerce. The number of arbitrators shall be one, and the seat of arbitration shall be in Helsinki, Finland. The language of the arbitration shall be English.

Schedule 1: Acceptable Use Policy

This Acceptable Use Policy (the “Acceptable Use Policy”) sets out the standards that apply when Customer or Customer Users use the Services and forms part of the Agreement between Customer and the. Any capitalized terms not defined herein shall have the meanings as described to them in the Clause 1 of the Agreement (Definitions and Interpretations).

1. Use Restrictions.

The Customer shall not (and shall ensure that its Customer Users do not):

1. store, distribute or transmit any Malware, or any material, information or data through the Service that:
   1. is unlawful, harmful, threatening, defamatory, obscene, knowingly infringing, harassing or racially or ethnically offensive, or facilitates illegal activity;
   2. contains illegal images; or
   3. promotes violence, discrimination based on race, gender, color, religious belief, sexual orientation, disability, or any other illegal activities;
2. reverse engineer, decompile, disassemble or otherwise attempt to derive the source code of the Software, Service or Documentation without Supplier's prior written consent.
3. engage in any malicious automated use of the Services, including but not limited to the malicious use of scripts, bots, scrapers, robots, or similar data gathering or extraction tools or crypto mining, except where expressly authorized;
4. send unsolicited commercial communications (“spam”) or other unauthorized messages using the Services;
5. except as may be allowed by any applicable law which is incapable of exclusion by agreement between the Parties, attempt to copy, duplicate, modify, create derivative works from or distribute all or any portion of the Service, Information, Software or Service Description;
6. access, develop, supply or market all or any part of the Service in order to build a product or service which replicates, competes with or is substantially similar to the Service;
7. attempt to undertake any security, vulnerability, penetration, or similar testing of the Service without the prior written consent of the Supplier;
8. attempt to gain unauthorized access to the Service or assist third parties in obtaining unauthorized access to the Service
9. interfere with or disrupt security, integrity or performance of the Service, Software, underlying hardware or infrastructure.
10. make improper use of support services or submit knowingly false reports of abuse, security incidents, or misconduct;
11. create, register, or use multiple Customer accounts for the purpose of claiming, obtaining, or repeatedly benefiting from promotional campaigns, discounts, credits, or other benefits beyond what is intended for a single Customer;
12. use, or attempt to use, payment methods that the Customer knows or reasonably ought to know are stolen, unauthorized, or fraudulently obtained;
13. engage in any activity in connection with the Agreement that breaches, circumvents, or attempts to circumvent any Sanctions or Export Controls, or that permits any Sanctioned Person, or any person acting on behalf of or for the benefit of a Sanctioned Person, to access, use, or benefit from any services under the Agreement;
14. use the Service for any purpose or engage in any activity that would cause the Supplier to violate Sanctions or Export Controls;
15. subject to Sub-clause 17.5 (Assignment) of the Terms of Service, transfer, temporarily or permanently, any of its rights under the Agreement;
16. assist third parties in obtaining access to the Service;
17. use the Service to develop, train, modify, deploy or operate any algorithm, machine learning model or artificial intelligence system for illegal purposes or practices, including but not limited to social scoring, untargeted facial scraping, inferring emotions in sensitive contexts such as workplace or education systems, unlawful biometric categorization, manipulative or exploitative techniques, or otherwise engage in AI development that may contribute to social harm;
18. resell, rent, license, or otherwise make the Service available to any third party, except as expressly permitted under the Agreement; or
19. use or offer the Service for military purposes, including but not limited to the development, production, testing, or use of weapons, unless otherwise agreed in the Agreement.

For the purposes of this Acceptable Use Policy, “Malware” means any thing or device (including any software, code, file or programme) which may: prevent, impair, spy on, or otherwise adversely affect the operation of any computer software, hardware or network, any telecommunications service, equipment or network or any other service or device; prevent, impair, or otherwise adversely affect access to or the operation of any programme or data, including the reliability of any programme or data (whether by re-arranging, altering or erasing the programme or data in whole or part or otherwise); or adversely affect the user experience, including worms, trojan horses, viruses and other similar things or devices.

2. Permitted Platform Use.

Notwithstanding the foregoing, the Customer may use the Service as a platform to offer its own services to third parties, provided that the service offered to the third party does not consist entirely or predominantly of the Service.

3. Compliance with Laws.

The Customer’s use of the Service must at all times comply with the governing law of the Agreement and all other applicable laws.

Schedule 2: Data Processing Terms

These Data Processing Terms (“Data Processing Terms”) constitute the terms for the Processing of Personal Data between the Controller and the Processor in accordance with Data Protection Legislation and sets out the terms and conditions for the Processing of Personal Data by the Supplier on behalf of the Customer under the Agreement. The Supplier shall act as a Processor on behalf of the Customer who may act either as a Controller or as a Processor on behalf of a third-party Controller.

Terms defined in Data Protection Legislation which are not defined under the Agreement shall have the meaning given to them in Data Protection Legislation.

1. Background, purpose & rules in case of conflict

1.1. The Processing of Personal Data is described in more detail in the Description of the Personal Data Processing.

2. Rights and responsibilities of the Customer

2.1. The Customer shall Process Personal Data in compliance with Data Protection Legislation and good data processing practices.

2.2. At the time of signing this Agreement, the written instructions given by the Customer to the Supplier are included in these Data Processing Terms and the Schedules thereto. The Supplier shall Process Personal Data only on the Customer’s documented instructions, unless required by the Data Protection Legislation. The Customer may issue additional or amended written instructions. The Supplier may charge reasonable additional costs, subject to prior written notice, where new or amended documented instructions from the Customer materially extend the agreed scope of Processing or cause significant additional effort.

2.3. In addition, the Customer undertakes to:

2.3.1. ensure that there is a legal ground for Processing the Personal Data covered by these Data Processing Terms, and that necessary data Processing agreements in accordance with Data Protection Legislation are in force;

2.3.2. warrant, if the Customer acts as a Processor on behalf of a third-party Controller, on an ongoing basis that the third-party Controller has authorized (i) the Customer’s documented instructions; (ii) the Supplier as a sub-processor of the Customer; and (iii) the Supplier’s engagement of Sub-processors;

2.3.3. ensure that the Data Subjects, as required by the Data Protection Legislation, have received sufficient information regarding the Processing, including information on that the Supplier may Process the Personal Data on behalf of the Customer;

2.3.4. in a timely manner, provide the Supplier with lawful and documented instructions regarding the Supplier’s Processing of Personal Data; and

2.3.5. act as Data Subjects’ point of contact.

3. Responsibilities of the Supplier

3.1. General principles applicable to the Processing of Personal Data

The Supplier shall:

3.1.1. Process Personal Data in compliance with these Data Processing Terms and Data Protection Legislation. In particular, the Supplier shall not (i) “sell” or “share” (as those terms are defined under Data Protection Legislation) Personal Data it Processes pursuant to these Data Processing Terms; (ii) retain, use, or disclose Personal Data it receives from or Processes on behalf of the Customer for any purpose other than for the business purposes specified in these Data Processing Terms and except as otherwise permitted by Data Protection Legislation; (iii) retain, use, or disclose Personal Data receives from or Processes on behalf of the Customer outside of the direct business relationship between the Supplier and the Customer; (iv) combine Personal Data it receives from or Processes on behalf of the Customer with Personal Data it receives from or on behalf of another person or which it collects from its own interaction with another individual provided that the Supplier may use Personal Data for internal uses permitted by Data Protection Legislation.

3.1.2. Process Personal Data on documented instructions from the Customer, unless prescribed otherwise by a provision of Data Protection Legislation applicable to the Supplier. In such cases, the Supplier shall inform the Customer of such requirements in reasonable time before beginning the Processing of Personal Data in accordance with the instructions, unless informing of such requirement is prohibited in Data Protection Legislation. In case the Supplier considers that instructions of the Customer are in breach of Data Protection Legislation, the Supplier shall inform the Customer without undue delay;

3.1.3. ensure that Supplier Personnel with access to Personal Data have committed themselves to appropriate confidentiality obligations;

3.1.4. carry out the measures prescribed in Sub-clause 4 (Data security) of these Data Processing Terms;

3.1.5. follow the conditions concerning the use of Sub-processors as prescribed in Sub-clause 7 (Sub-processors) of these Data Processing Terms;

3.1.6. taking into account the information available to the Supplier, provide reasonable assistance to the Customer in responding to requests for exercising the rights of Data Subjects where the Customer does not have access to the needed information. Where the Customer requests assistance that requires effort or resources beyond the standard level of support ordinarily provided under the Services, the Supplier is entitled to charge the Customer for costs and expenses that are incurred as a result of complying with this Sub-clause 3.1.6;

3.1.7. taking into account the information available to the Supplier, provide reasonable assistance to the Customer in ensuring compliance with its obligations set out in Data Protection Legislation, relating to data security, Personal Data Breaches (as further defined in Sub-clause 5 of these Data Processing Terms), data protection impact assessments, and prior consulting obligations. Where the Customer requests assistance that requires effort or resources beyond the standard level of support ordinarily provided under the Services, the Supplier is entitled to charge the Customer for costs and expenses that were incurred as a result of complying with this Sub-clause 3.1.7;

3.1.8. at the choice of the Customer, delete or return Personal Data to the Customer as prescribed in Sub-clause 9 of these Data Processing Terms;

3.1.9. make available to the Customer all information necessary to demonstrate compliance with obligations set out in these Data Processing Terms and in Data Protection Legislation. The Customer is obliged to keep all such information confidential, except to the extent that such information is publicly available or can be disclosed without breach of any confidentiality obligation or is required to be disclosed pursuant to applicable law or to the Customer’s directors, officers, employees, legal counsel, accountants, auditors, and other professional advisers or representatives who have a need to know such information for the purposes of exercising or enforcing the Customer’s rights under this Agreement, provided that such persons are bound by confidentiality obligations no less protective than those set out in this Agreement. Where the Customer requests assistance that requires effort or resources beyond the standard level of support ordinarily provided under the Services, the Supplier is entitled to charge the Customer for costs and expenses that were incurred as a result of complying with this Sub-clause 3.1.9;

3.1.10. allow the Customer to perform audits as prescribed in Sub-clause 8 (Auditing) of these Data Processing Terms;

3.1.11. comply with all applicable Data Protection Legislation; and

3.1.12. where required by Data Protection Legislation, notify the Customer after it makes the determination acting in good faith and based on facts then known to it, that it can no longer meet its material obligations under such Data Protection Legislation. Upon such notice, the Customer shall have the right to take reasonable and appropriate steps to stop and remediate any unauthorized use of Personal Data by the Supplier.

4. Data security

4.1. The Supplier shall implement the technical and organisational security measures detailed in Schedule 3 (Technical and Organisational Security Measures) to ensure an appropriate level of security to protect Personal Data against unauthorised access and loss, destruction, damage, alteration or disclosure, or against other unlawful Processing.

5. Personal Data Breach notification

5.1. The Supplier shall notify the Customer of all Personal Data Breaches without undue delay and no later than forty-eight (48) hours after the Supplier has become aware of a Personal Data Breach. The Personal Data Breach notification shall contain the following:

5.1.1. description of the nature of the Personal Data Breach, including the categories and approximate number of Data Subjects concerned and the categories and approximate number of data records concerned;

5.1.2. name and contact details of the contact person of the Supplier handling the Personal Data Breach;

5.1.3. description of likely consequences and/or realised consequences of the Personal Data Breach; and

5.1.4. description of the measures the Supplier has taken to address the Personal Data Breach and to mitigate its adverse effects.

5.2. If it is not possible to provide the information listed above at the same time, the information may be provided by the Supplier to the Customer in phases.

5.3. The Supplier shall document Personal Data Breaches and disclose the documentation to the Customer upon the Customer’s reasonable written request.

5.4. After the Supplier has become aware of the Personal Data Breach, the Supplier shall use commercially reasonable efforts to restore and maintain the security of Personal Data and take appropriate measures to mitigate the effects of the Personal Data Breach including by (i) identifying and containing the source of the breach, (ii) remediating any known vulnerabilities exploited in connection with the breach, (iii) restoring affected systems and data to a secure state, and (iv) implementing measures reasonably designed to prevent a recurrence of the same or a similar breach, and shall take appropriate measures to mitigate the effects of the Personal Data Breach. The Supplier shall keep the Customer reasonably informed of the nature and status of its remediation efforts and, to the extent reasonably practicable, consult with the Customer regarding measures to protect Personal Data. The Supplier shall retain operational control over its technical response.

6. Data Storage and Transfers of Personal Data

6.1. The Supplier shall store and Process all Personal Data in the processing location specified for the Customer's Services at the time of purchase or subscription (the “Primary Processing Location”).

6.2. The Customer may request or instruct a change to the Primary Processing Location by selecting an alternative location through the Service or by providing documented instructions to the Supplier. Where the Supplier supports the requested location, the Supplier shall confirm the change and Process the Customer’s Personal Data in the updated Primary Processing Location.

6.3. Personal Data may be transferred outside of the Primary Processing Location where (i) the Customer instructs or consents to such transfer, storage, or Processing (including through selection of a processing location or other documented instruction); or (ii) such transfer is necessary for the provision of the Services, including where the Supplier relies on Sub-processors to perform such Services.

6.4. Any such transfer to a jurisdiction outside the Primary Processing Location shall only take place where: (i) the destination jurisdiction is covered by an Adequacy Decision; or (ii) in the absence of an Adequacy Decision, the transfer is subject to Standard Contractual Clauses, and, where necessary, supported by additional technical and organisational security measures to ensure that Personal Data is protected to a level essentially equivalent to that provided within the jurisdiction of origin.

6.5. The Supplier shall inform the Customer of the country or region where Personal Data will be stored or Processed, including where Sub-processors are engaged. Where the Supplier initiates or proposes the storage or Processing of Personal Data outside the Primary Processing Location, the Supplier shall inform the Customer in advance, including the location and the Sub-processor involved. The Customer shall have the right to object to such transfer on reasonable data protection or security grounds.

6.6. If the Customer exercises its right to object, the Supplier shall not carry out the transfer. In such circumstances, the Customer may suspend or terminate the affected Services with immediate effect and without penalty by providing written notice to the Supplier.

7. Sub-processors

7.1. The Supplier is entitled to use Sub-processors in the Processing of Personal Data when the Customer has approved such Sub-processors. On the Commencement Date, the Customer has agreed that the Supplier may use the Sub-processors as provided in the Description of the Personal Data Processing. The Customer acknowledges that the Supplier may use Affiliates of the Supplier as a Sub-processor in the Processing of Personal Data. Such Affiliates acting as Sub-processors as at the Commencement Date are identified in the Description of Personal Data Processing.

7.1.1. The engagement of any additional Affiliate as a Sub-processor after the Commencement Date shall be subject to the same notice and objection procedure set out in Sub-clauses 7.3 and 7.4. For the avoidance of doubt, any transfer of Personal Data to an Affiliate located outside the Customer's Primary Processing Location shall comply with the transfer requirements set out in Clause 6, including the requirement to implement appropriate safeguards under applicable Data Protection Legislation.

7.2. The Supplier is entitled to reduce the number of Sub-processors without separate notice to the Customer.

7.3. The Supplier shall notify the Customer about an addition of a Sub-processor processing Personal Data under these Data Processing Terms at least fifteen (15) days before engaging the Sub-processor. The notice must include at least: (i) the name of the Sub-processor; (ii) the type of Personal Data to be Processed by such Sub-processor and for which purposes; (iii) and location of the Processing to be performed by such Sub-processor.

7.4. If the Customer does not object to the Supplier’s use of the proposed Sub-processor within the notice period pursuant to Sub-clause 7.3, the Supplier may proceed with the engagement of the Sub-processor.

7.5. The Supplier shall take appropriate measures to ensure that its Sub-processors comply with the obligations specified in these Data Processing Terms, including security and confidentiality requirements. The Supplier shall at all times remain responsible for the performance of its Sub-processors under this Agreement.

8. Auditing

8.1. The Supplier grants the Customer the right to take reasonable and appropriate steps to ensure that the Supplier uses the Personal Data collected pursuant to these Data Processing Terms in a manner consistent with the Customer’s obligations under Data Protection Legislation. In particular, Supplier shall make available to the Customer all information reasonably necessary to demonstrate compliance with these Data Processing Terms and Data Protection Legislation, including providing copies of relevant, industry-standard security and privacy certifications and audit reports prepared by independent third parties.

8.2. If the information provided under Sub-clause 8.1 is not sufficient for the Customer to reasonably verify compliance, the Customer may request an independent third-party auditor to conduct an audit of the Supplier or carry out an inspection itself.

8.3. The Customer shall be responsible for all costs and expenses associated with an audit/inspection it initiates under this Agreement, including any fees and expenses of an independent third-party auditor engaged by the Customer. The Supplier may charge the Customer for its reasonable costs and expenses incurred in connection with supporting the audit/inspection.

8.4. The Customer shall notify the Supplier in writing at least twenty (20) Business Days in advance of any intended audit. Notwithstanding the above notice period, the Customer may request an audit on shorter notice where required by a supervisory authority. Audits shall be carried out no more than once in any twelve (12) month period, unless otherwise required by applicable law or a competent supervisory authority. The Supplier shall assist the Customer and the third party during normal business hours in conducting the audit/inspection with reasonable measures. The audit/inspection shall be carried out as quickly as possible and it shall not disturb the Supplier’s normal business operations. The audit/inspection shall comply with the Supplier’s work rules, security requirements and standards to protect other customers, the security and continuity of the Service, and confidentiality. Before commencing any audit/inspection, the independent auditor (including relevant parties/persons conducting the audit) and/or the Customer and its representatives shall enter into appropriate non-disclosure agreement(s) provided by or approved by the Supplier.

9. Customer Data Retrieval and Deletion

9.1. The Customer is responsible for managing, retrieving and deleting any Customer Data uploaded to the Service using the functionalities provided by the Supplier.

9.2. Where the Customer deletes the Customer Data, such data may be recoverable for up to ninety-six (96) hours thereafter, after which it will be irreversibly deleted, unless the Customer has used the delete permanently functionality, in which case the Customer Data will be irreversibly deleted without a recovery option.

9.3. Following effective termination of this Agreement (which, in the case of a remediable breach, may occur only after expiry of the applicable cure period under Sub-clause 14.2.a) and, in the absence of further instructions from the Customer, any Customer Data uploaded to the Service shall be automatically deleted within ten (10) days.

9.4. The Supplier may charge reasonable additional fees for maintaining Customer Data during the recovery period referred to in Sub-clause 9.2, calculated with reference to the volume of Customer Data retained and the duration for which it is retained (if recovered) during that ninety-six (96) hour period.

9.5. Other Personal Data that constitutes Customer Account Information Processed by the Supplier as a Controller in connection with the provision or administration of the Service (including but not limited to account information, billing records, system logs, or compliance-related data) shall be Processed solely to the extent and for the duration permitted or required under applicable Data Protection Legislation or other legal obligation and subject to the Supplier’s Privacy Policy. The Supplier shall ensure that such Personal Data is securely deleted or anonymised without undue delay once no further legal ground exists for its Processing.

10. Customer Account Information

10.1. The Customer acknowledges that the Supplier collects and processes Customer Account Information as a Controller for business purposes such as account administration, billing, fraud prevention, security, compliance with applicable law, service improvement, and communication with the Customer.

10.2. The Supplier shall process Customer Account Information in accordance with applicable Data Protection Legislation and the Supplier’s Privacy Policy.

10.3. On termination of this Agreement for any reason, the Supplier may retain Customer Account Information to the extent and for the duration permitted or required under applicable Data Protection Legislation or other legal obligation.

Appendix 1 to Schedule 2: Description of the Personal Data Processing

Purpose of Data Processing

The purpose of the Processing of Personal Data is to provide the Customer with the Service under the Agreement.

Categories of Data Subjects

The Customer may submit Personal Data to the Supplier, the extent of which is determined and controlled by the Customer in its sole discretion, and which may include, but is not limited to Personal Data relating to the following categories of Data Subjects:

• Prospective customers, customers, resellers, referrers, business partners, and suppliers of the Customer (who are natural persons);
• Employees or contact persons of the Customer’s prospective customers, customers, resellers, referrers, subcontractors, business partners, and Suppliers (who are natural persons);
• Employees, agents, advisors, and freelancers of the Customer (who are natural persons);
• Natural persons instructed by the customers of the Customer to use its services.

Categories of Personal Data

The Personal Data Processed includes the following categories of data:

• Identification data
• Professional life data
• Connection data or localization data (including IP addresses whether dynamic or not)
• Customer support chats with users of Customer
• Contact information
• Usage data (e.g., service usage patterns, activity logs)
• Preferences and interests (e.g., user settings, preferred features)
• Other data provided by the Customer for Processing by the Service, including special categories of Personal Data if such data is provided by the Customer (e.g., sensitive personal data such as racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, or data concerning a person’s sex life or sexual orientation).

Data Processing Operations

As appropriate for the provision of the Service by the Supplier to the Customer including collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, anonymization, erasure or destruction of Personal Data.

Duration of the Processing

Personal Data shall be retained for no longer than necessary for the purposes for which it was collected, in accordance with the Agreement, unless a longer retention period is required or permitted by law.

Sub-Processors

A list of the Supplier’s current Sub-Processors is available at https://trust.verda.com/subprocessors. The Customer hereby authorizes the Sub-processors on the list.

Schedule 3: Technical and Organisational Security Measures

Technical Security Measures

The Supplier and the Customer agree to a shared responsibility model, in which both Parties have their own responsibilities towards the security measures to ensure the confidentiality, integrity, and availability of Personal Data. This model is described in detail on the Supplier’s publicly available documentation at https://docs.verda.com/resources/shared-responsibility-model (the “Shared Responsibility Model”). The Shared Responsibility Model forms an integral part of this Agreement and is hereby incorporated by reference.

The Supplier will ensure the protection of the infrastructure that is responsible for the Service, inclusive of the hardware, software, networking, and facilities required in order to operate. This responsibility is regarded as security “of” the cloud.

Depending on the Services engaged, the Customer is responsible for data security, regulatory and legal compliance, identity and access management, application security, operating system security, configuration and resource management, monitoring and incident response, and backup and disaster recovery. This responsibility is regarded as security “in” the cloud.

The Supplier agrees to implement the following technical security measures to ensure the confidentiality, integrity, and availability of the cloud:

Data Encryption

The Supplier will ensure the capability for the Customer to implement data encryption for at-rest data. The Supplier is not responsible for enabling or ensuring data encryption for at-rest or in-use data.

Access Control

Access to Personal Data shall be restricted based on role-based access control (RBAC) principles.

All users shall be authenticated using strong passwords.

Access logs shall be maintained for all activities involving Personal Data, and access to such logs shall be restricted to authorized Supplier Personnel only.

Network Security

The Supplier shall maintain a firewall to protect internal systems from unauthorized external access.

Secure communication channels will be available to the Customer to transfer Personal Data with encryption (e.g. TLS, SSH)

Backup and Data Recovery

The Supplier does not provide a data recovery plan or procedure for the Customer.

Organisational Security Measures

The Supplier will adopt the following organisational measures to ensure compliance with Data Protection Legislation and maintain security standards:

Supplier Personnel Training and Awareness

All Supplier Personnel with access to Personal Data shall receive regular training on data protection principles, security best practices, and their responsibilities regarding Personal Data.

Security awareness training will be conducted at least annually or when significant changes occur to the data protection practices or Data Protection Legislation.

Incident Response and Breach Management

The Supplier shall maintain an incident response plan that includes clear procedures for detecting, reporting, and managing Personal Data Breaches.

Monitoring and Auditing

The Supplier shall perform regular security audits and assessments to verify compliance with internal security policies and Data Protection Legislation at least annually.

Regular monitoring will be conducted to detect and respond to potential security threats and vulnerabilities.

Auditing processes shall ensure that only authorized Supplier Personnel have access to Personal Data and that access is appropriate and consistent with business needs.

Data Access and User Management

Personal Data shall only be accessible to Supplier Personnel who need it for legitimate business purposes.

User access shall be regularly reviewed and revoked when no longer necessary (e.g., upon termination of employment or contract).

Data Retention and Disposal

The Supplier will only retain data of any kind for as long as the Customer indicates. Removal of data occurs within ninety-six (96) hours after the Customer removes the data.

Third-party and Sub-processor Security

The Supplier shall ensure that any third-party service providers or Sub-processors involved in the Processing of Personal Data implement appropriate security measures that meet or exceed the standards set out in this Schedule.

Physical Security Measures - Access Control to Facilities

Physical access to locations where Personal Data is stored or Processed (such as data centres or offices) shall be restricted to authorized Supplier Personnel only.

The Supplier shall implement keycard access systems, biometric authentication, or other appropriate physical security measures at all entry points to facilities where Personal Data is stored.

Environmental Security

Data centres or facilities that store Personal Data shall be equipped with fire suppression systems, climate control to prevent overheating, and backup power (e.g., UPS systems) to ensure that data is not lost or corrupted due to power failure.

Schedule 4: Confidential Computing

ADDITIONAL TERMS APPLICABLE TO NVIDIA CONFIDENTIAL COMPUTING

1. Applicability. This Schedule 4 (Confidential Computing) applies where the Service ordered under this Agreement includes or incorporates NVIDIA Confidential Computing (as defined in the NVIDIA Product-Specific Terms).
2. NVIDIA Product-Specific Terms. The Customer acknowledges that the Service incorporates NVIDIA Confidential Computing, which is subject to the Product-Specific Terms for NVIDIA Confidential Computing published by NVIDIA Corporation (the “NVIDIA Terms”) at https://www.nvidia.com/en-us/agreements/enterprise-software/product-specific-terms-for-confidential-computing/.
3. Customer Compliance. The Customer shall, and shall ensure that its Customer Users, comply with the NVIDIA Terms (including any obligations relating to caching, reporting, security measures, data collection, and restrictions on prohibiting end-user access to NVIDIA Confidential Computing) as if such terms were obligations of the Customer under this Agreement. Without limiting the foregoing, the Customer shall:
   1. maintain accurate and complete records related to usage of the Service with NVIDIA Confidential Computing and make such records available to the Supplier for audit in accordance with the NVIDIA Terms;
   2. not modify, misrepresent, or provide inaccurate or misleading information regarding the output of NVIDIA Confidential Computing to Customer Users or third parties;
   3. refresh cached output of NVIDIA Confidential Computing at least once in any twenty-four (24) hour period and comply with all caching requirements set out in the NVIDIA Terms;
   4. disclose to the Supplier such information as is reasonably necessary to ensure that appropriate administrative, physical, and technical security measures are maintained in accordance with the NVIDIA Terms; and
   5. not prohibit, whether directly or indirectly, Customer Users from accessing and using NVIDIA Confidential Computing directly from NVIDIA.
4. Updates to NVIDIA Terms. The Customer acknowledges that NVIDIA may update the NVIDIA Terms from time to time. It is the Customer’s sole responsibility to review the current version of the NVIDIA Terms at https://www.nvidia.com/en-us/agreements/enterprise-software/product-specific-terms-for-confidential-computing/ (or such other URL as may be designated by NVIDIA Corporation from time to time) and to ensure ongoing compliance with the then-current version. The Supplier shall use commercially reasonable endeavors to notify the Customer of material changes to the NVIDIA Terms of which the Supplier becomes aware, but any failure to provide such notice shall not relieve the Customer of its obligation to comply.
5. Indemnity. Without limiting the Customer’s indemnification obligations under Clause 12 (Indemnities) of this Agreement, the Customer shall indemnify, keep indemnified, and hold harmless the Supplier and the Supplier Personnel against any and all damages, claims, actions, proceedings, losses, and reasonable costs (including legal fees) and expenses arising from or in connection with:
   1. the Customer’s breach of the NVIDIA Terms or this Schedule 4 (Confidential Computing);
   2. any audit costs, underpayment obligations, interest, or penalties imposed on the Supplier by NVIDIA as a result of the Customer’s non-compliance with the NVIDIA Terms; and
   3. any claim by NVIDIA against the Supplier arising from the Customer’s use of NVIDIA Confidential Computing.
6. Suspension. Without prejudice to the Supplier’s rights under Clause 14.3 (Term, Termination and Suspension) of this Agreement, the Supplier may immediately suspend the Customer’s access to NVIDIA Confidential Computing (without affecting other Services under this Agreement) where:
   1. the Customer breaches or is reasonably suspected of breaching the NVIDIA Terms;
   2. NVIDIA revokes, suspends, or restricts the Supplier’s license to provide NVIDIA Confidential Computing; or
   3. NVIDIA requires the Supplier to suspend or terminate the Customer’s access.
7. Data Collection. The Customer acknowledges and agrees that NVIDIA will collect IP addresses and information about GPUs (including device unique identity key pairs and device certificates) to provide NVIDIA Confidential Computing and for security, debugging, and troubleshooting purposes, as further described in the NVIDIA Terms.
8. Conflicts. In the event of any conflict between this Schedule 4 (Confidential Computing) and the Clauses of this Agreement, this Schedule 4 (Confidential Computing) shall prevail to the extent of the conflict in accordance with Clause 17.9 (Conflicts) of this Agreement. In the event of any conflict between this Schedule 4 (Confidential Computing) and the NVIDIA Terms, the NVIDIA Terms shall prevail to the extent necessary to ensure the Supplier’s compliance with its obligations to NVIDIA.

Schedule 5: AI Terms of Service

ADDITIONAL TERMS APPLICABLE TO AI SERVICES

1. Scope and Application

1.1. This Schedule 5 (“AI Terms of Service”) sets out the terms that apply to the Customer’s and Customer Users’ access and use of the AI Services (as defined below). The Customer and Customer Users shall comply with these provisions and all applicable laws, including the local laws of any territory in which the Customer or Customer Users access the AI Services.

1.2. The Customer shall comply with this AI Terms of Service and is responsible for ensuring the Customer Users compliance with this AI Terms of Service.

1.3. For avoidance of doubt, these AI Terms of Service supplement the provisions of the Agreement and shall prevail to the extent of the conflict in accordance with Clause 17.9 (Conflicts) of this Agreement.

2. Service

2.1. The Supplier may from time to time add AI Models, make new versions of AI Models available, change the Serving configuration of AI Models, or replace or withdraw any AI Model. In accordance with the Clause 3.2 (Using Our Service) of the Agreement, the Supplier shall use commercially reasonable endeavours to notify the Customer in advance of any material amendment to the Service or Service Description.

2.2. In relation to third party AI Models:

2.2.1. Some AI Models made available through the AI Services are developed by third parties and Licenced by their developers under AI Model Licence Terms. The AI Model Licence Terms for each AI Model are identified and linked in the AI Model’s page;

2.2.2. The Supplier serves each third party AI Model under the applicable AI Model Licence Terms, or under a separate agreement with the AI Model developer, and shall comply with the obligations those terms place on the Supplier in hosting, modifying, serving and making the AI model available. This includes making the AI Model Licence Terms available to the Customer;

2.2.3. The Customer shall comply, and shall ensure that Customer Users comply, with the AI Model Licence Terms in force at the time of use, to the extent they apply to the Customer’s or Customer Users’ use of the AI Models or of any Output. This includes any attribution, notice, use-restriction or acceptable use conditions, and any conditions triggered by the Customer’s own circumstances, such as its user numbers or revenue;

2.2.4. AI Model developers may amend their AI Model Licence Terms from time to time. Where the Supplier becomes aware of a material amendment, it shall use commercially reasonable endeavours to update the Service Description and notify the Customer;

2.2.5. Except as set out in the above Clause 2.2.2. of this Schedule 5, the Supplier gives no warranty or undertaking regarding any third-party AI Model, including its performance or the AI Model developer’s right in it. The Supplier is not a party to any agreement between the Customer and an AI Model developer.

2.3. For Customer Models and the Customer's own applications, the Customer is responsible for determining its role and complying with the resulting obligations including but not limited to obligations deriving from AI Legislation and Data Protection Legislation. For Customer Models, the Supplier acts solely as a provider of infrastructure, unless otherwise agreed between the Parties

2.4. In accordance with the Agreement, the Customer remains responsible for its use and its Customer Users use of the AI Services and undertakes to comply with all applicable laws and regulations relating to the use of artificial intelligence (“AI Legislation”).

2.5. Output may be inaccurate, incomplete, out of date, offensive or biased, may infringe the right of third parties, and may be identical or similar to outputs provided to other customers or third parties. Outputs do not constitute professional, legal, medical, financial or other advice. The Customer acknowledges that Outputs may not be protected by Intellectual Property Rights. The Customer shall evaluate Outputs, including through human review where appropriate for its use case, before relying on, using or publishing them.

3. Restrictions

3.1. The Customer shall not, and shall not permit any Customer Users to:

3.1.1. use the AI Services for any purpose not permitted under the Agreement;

3.1.2. use the AI Services to create, distribute or process child sexual abuse material, any content that sexualises a minor, grooming or sextortion material, or material furthering the exploitation or trafficking of minors;

3.1.3. use the AI Services to create, distribute or process non-consensual intimate imagery, or to use the name, image, voice or other likeness of an identifiable person without that person's consent, including deep fakes and impersonation;

3.1.4. use the AI Services to generate or further harassment, bullying, threats or stalking, or discrimination against any person on the basis of a protected characteristic;

3.1.5. use the AI Services to promote, encourage or give instructions for self-harm or suicide;

3.1.6. use the AI Services to generate or further fraud, scams, phishing, defamation, disinformation, or to misrepresent the provenance of generated content;

3.1.7. use the AI Services to create, generate or distribute malicious code, malware or any material designed to disrupt, damage or gain unauthorised access to any system, network or device;

3.1.8. exceed the usage limits that apply to it, impose an unreasonable or disproportionately heavy load on the AI Services, or carry out load, stress or performance testing beyond limits agreed in writing;

3.1.9. circumvent or attempt to circumvent safety guardrail, content filter, safety classifier or other protective measure implemented by the Supplier or by a model developer;

3.1.10. extract, exfiltrate or reconstruct the weights, architecture or training data of any AI Model that the Customer is not authorised to access, including any modification Supplier has made to an AI Model;

3.1.11. breach any applicable AI Model Licence Terms under which the AI Model developer has made the AI Model available or any acceptable use policy or other terms relating to the use of the AI Model, as may be amended by the AI Model developer from time to time;

3.1.12. use the AI Services, or any Output to build, improve, develop or train product, service, model, foundation model or general-purpose AI system that competes with the AI Model;

3.1.13 use the AI Services, any AI Models, any AI Model derivatives or materials made available in connection with the AI Models for any illegal or unauthorized purpose;

3.1.14 provide any infringing and/or illegal Input to the AI Service;

3.1.15 circumvent, tamper with, disable or interfere with any usage metering, logging or telemetry mechanism relating to the AI Models or AI Services;

3.1.16 distribute, resell, lease, license, transfer, or assign the AI Services or offer the AI Services as standalone basis; and

3.1.17. use the AI Services for purposes including, but not limited to, practices prohibited by Article 5 of the AI Act or by equivalent law, or use the AI Services in a way that causes harm to a third party or to the Supplier.

4. Processing of Input and Output

4.1. The Supplier processes Input to generate Output and to provide, operate, improve, and secure the AI Services.

4.2. Subject to applicable law, the Supplier may apply the technical and organisational measures it considers appropriate to keep the AI Services safe, secure, lawful and to verify Customer and Customer Users compliance with this Schedule 5.

4.3. The Supplier may retain Input or Output where required by applicable law or enforcement authorities.

4.4. The Supplier may collect and retain data relating to the Customer's use of the AI Services for security, abuse prevention, support, billing, capacity planning, service quality and legal compliance.

4.5. The Supplier does not use Input, Output or Customer Models to train any AI Model.

4.6. The Customer may use the AI Services in a high-risk AI system within the meaning of the AI Act, or equivalent law, if it meets the obligations that apply to it for that system, including any required conformity assessment. On request, the Customer shall confirm to the Supplier in writing that it does.

4.7. To the extent that any Input or Output contains Personal Data, the Supplier processes it as a processor on behalf of the Customer in accordance with Clause 10 (Data Processing Terms) of the Agreement. The Customer shall ensure that it has a lawful basis for submitting any Personal Data as an Input and shall not submit special categories of personal data or Personal Data relating to criminal convictions and offences unless permitted by Data Protection Legislation.

5. Miscellaneous

5.1. No Warranty. To the maximum extent permitted by law, the AI Service and any Output is provided “as is” and “as available”, the Supplier disclaims all other conditions, warranties, representations, undertakings or other terms which might have effect between the Parties with respect to the AI Service and any Output, or be implied or incorporated into this Agreement, whether by statute, common law, custom or otherwise, including any implied conditions, warranties, undertakings or other terms relating to satisfactory quality, reasonable skill and care, fitness for any particular purpose, ability to achieve a particular result or arising from course of dealing or usage of trade or accuracy, legality, or non-infringement.

5.2. Suspension. Without limiting the Supplier’s rights under Clause 14.4 of the Agreement, the Supplier may suspend or terminate the Customer’s access to the AI Service or to any AI Model with immediate effect, giving notice where practicable, if the Supplier reasonably believes that the Customer’s use breaches Section 3 of this Schedule 5 (Restrictions) or a AI Model Licence Terms, or if suspension is required by an AI Model developer, applicable law or a competent authority. Clause 14.5 of the Agreement applies to any such suspension.

5.3. Indemnity. Deviating from the Clause 12.2 of this Agreement, the Supplier’s obligation to indemnify and hold the Customer harmless in respect to all damages and reasonable costs and expenses arising directly from IPR Claim does not apply to any claims or actions against the Customer by any third party relating to Output or AI Model, or that the use, publication or distribution of Output by the Customer, infringes, misappropriates or otherwise violates that third party's intellectual property or other rights. Without limiting the Customer’s indemnification obligations under Clause 12.1 of this Agreement, the Customer shall indemnify, keep indemnified, and hold harmless the Supplier against any and all damages, claims, actions, proceedings, losses and reasonable costs (including legal fees) and expenses arising from or in connection with a) the Customer’s or Customer User’s breach of the AI Model Licence Terms or restrictions in section 3 of this AI Terms of Service, b) any Input or Customer’s or Customer User’s use of any Output.

5.4. Liability. Subject to Clause 13.1 of the Agreement, the Supplier shall have no liability for: a) the content of any Output or the Customer’s use of any Output; or b) any act or omission of a AI Model developer or any change to or termination of an AI Model Licence Terms.

6. Definitions

Capitalised terms used in this Schedule 5 and not otherwise defined in this Schedule 5 shall have the meaning given to them in the Clause 1 of the Agreement (Definitions and Interpretation) or elsewhere in this Agreement. In addition, the following terms shall have the meanings set out below:

“AI Legislation” means the European AI Act (Regulation 2024/1689) (“AI Act) and any other laws, regulations and legally binding requirements, in any jurisdiction, that apply to the development, provision, deployment, distribution or use of AI systems, AI models or their outputs. This includes delegated and implementing acts adopted under any of them, and any amendments, replacements or national implementing measures, each as in force from time to time.

“AI Model License Terms” means, for each third-party AI Model, the licence agreement, acceptable use policy and any other terms or conditions under which the AI Model developer makes that AI Model available, each as amended by the AI Model developer from time to time.

“Customer Model” means any AI Model that is provided by or on behalf of Customer, or that Customer obtains from a source other than Supplier, for use with the Supplier Services. It includes all of that model's weights, parameters, configuration, or any container image or code in which Customer packages it. It also includes any Customer Modification. A Supplier-Provided Model is never a Customer Model.

“Input” means any prompt, instruction, text, image file, parameter or other content submitted by or on behalf of the Customer or Customer Users to the AI Services.

“Output” means the results generated by the AI Services based on the Customer’s Input.

Schedule 6: EU Data Act Terms

1. Scope and Application

1.1. This Schedule 6 (“EU Data Act Terms”) applies to the extent that: (i) the Customer is established in the European Economic Area; and (ii) the Service (or any part of it) constitutes a “data processing service” within the meaning of Article 2(8) of Regulation (EU) 2023/2854 (the “Data Act”). These EU Data Act Terms set out the terms and conditions under which the Customer may exercise its switching and portability rights under Chapter VI of the Data Act.

1.2 In the event of any conflict or inconsistency between these EU Data Act Terms and any other provision of this Agreement, these EU Data Act Terms shall prevail to the extent of the conflict.

1.3. For the avoidance of doubt, nothing in this Schedule 6 affects any right of the Customer under Clause 19 (EU and UK Consumer Rights) of this Agreement or Schedule 6 (EU and UK Consumer Rights), and nothing in Clause 19 or Schedule 6 limits any right of the Customer under this Schedule 6.

2. Switching Rights and Process

2.1. The Customer may, at any time, notify the Supplier of its decision to: (i) switch to a data processing service offered by a different provider; (ii) switch to an on-premises ICT infrastructure; or (iii) erase its Exportable Data and Digital Assets without switching (each, a “Switch”), by giving the Supplier written notice to the email address specified in Clause 16 (Notices) of this Agreement (a “Switching Notice”). The Customer shall specify in the Switching Notice which of the actions in (i) to (iii) above it wishes to take and, where applicable, details of the destination provider.

2.2. The Customer shall provide the Supplier with at least two (2) months’ written notice of its intention to effect a Switch, unless the Parties agree to a shorter period, such notice to be given in advance of the Customer’s target date for completing the Switch (the “Notice Period”). For the avoidance of doubt, the Customer may independently export or delete Customer Data at any time using the self-service functionality provided through the Service without initiating a Switch or becoming subject to the Notice Period.

2.3. Following the expiry of the Notice Period, the Customer shall be entitled to complete the Switch without undue delay and, in any event, within thirty (30) calendar days (the “Transitional Period”), during which this Agreement shall remain in effect. Where completion of the Switch within the Transitional Period is not technically feasible, the Supplier shall notify the Customer within fourteen (14) Business Days of the Switching Notice, explain the reasons for the technical unfeasibility, and specify an alternative transitional period not exceeding seven (7) months. The Customer may extend the Transitional Period (or any alternative transitional period) once, for such further period as the Customer reasonably considers appropriate, by giving the Supplier written notice before expiry of the then-applicable period. The Parties may additionally mutually agree in writing to any further extensions deemed necessary.

2.4. During the Notice Period and the Transitional Period, the Supplier shall: (i) provide reasonable assistance to the Customer and any third party authorised by the Customer in connection with the Switch; (ii) act with due care to maintain business continuity and continue to provide the Service; (iii) provide the Customer with clear information concerning any known risks to the continuity of the Service; and (iv) maintain a high level of security throughout the switching process, including in respect of the security of the Customer’s data during its transfer and during the Retrieval Period referred to in Clause 3.1 below.

2.5. The Supplier shall support the Customer’s exit strategy relevant to the Service, including by providing all information reasonably necessary for that purpose.

2.6. The Customer may port, as part of a Switch, all Exportable Data (including, for the avoidance of doubt, all Customer Data) and all Digital Assets, save to the extent any category of data is exempted from Exportable Data in accordance with Clause 2.7 below.

2.7. The categories of data that are exempted from Exportable Data includes: (i) data specific to the internal functioning of the Services that would, if exported, risk a breach of the Supplier’s or a third party’s trade secrets; (ii) data related to the integrity and/or security of the Services that would, if exported, create security or cybersecurity risks for the Supplier or the Service; and (iii) Supplier or third-party software, models or other assets protected by intellectual property rights or that the Customer has no independent right to use, provided that such exemptions shall not impede or delay the switching process.

2.8. The Parties shall comply with their respective obligations under the Data Act and shall cooperate in good faith to make the switching process effective, enable the timely transfer of data, and maintain the continuity of the Services during the Notice Period and the Transitional Period.

2.9. The Supplier shall not impose any charge on the Customer in connection with a Switch, including any charge for data egress.

3. Data Retrieval, Erasure and Termination

3.1. Following expiry of the Transitional Period (or any alternative or extended transitional period), the Customer may retrieve its Exportable Data and Digital Assets for a further period of at least thirty (30) calendar days (the “Retrieval Period”). If the Customer does not retrieve its Exportable Data and Digital Assets within the Retrieval Period, the Supplier shall erase such data and digital assets in accordance with Clause 3.2 below.

3.2. Upon successful completion of a Switch, or upon expiry of the Retrieval Period (if later), the Supplier shall fully erase all Exportable Data and Digital Assets generated directly by, or relating directly to, the Customer.

3.3. Without prejudice to any other rights or remedies under this Agreement, this Agreement shall be treated as terminated in relation to the Service (or the relevant part of the Service) that is the subject of a Switch: (i) upon the Customer notifying the Supplier that a Switch to a different provider or to an on-premises ICT infrastructure has been successfully completed; or (ii) where the Customer has notified the Supplier that it does not wish to switch but only to erase its Exportable Data and Digital Assets, upon expiry of the Notice Period. The Supplier shall notify the Customer once either event in (i) or (ii) above has occurred.

4. Information and Transparency

4.1. Information regarding the jurisdiction to which the ICT infrastructure used to provide the Services is subject is available at https://docs.verda.com/welcome-to-verda/locations-and-sustainability/#data-center-locations.

4.2. The Supplier implements technical, organisational and contractual measures in order to prevent international governmental access to or transfer of non-personal data held in the European Union. Further information relating to these measures is available at [URL].

5. Definitions

5.1. Capitalised terms used in this Schedule 6 and not otherwise defined in this Schedule 6 shall have the meaning given to them in the Clause 1 of the Agreement (Definitions and Interpretation) or elsewhere in this Agreement. In addition, the following terms shall have the meanings set out below:

“Digital Assets” means elements in digital form, including applications, for which the Customer has the right of use, independently of the contractual relationship with the Service from which the Customer intends to switch.

“Exportable Data” means the input and output data, including metadata, directly or indirectly generated or co-generated by the Customer’s use of the Service, excluding any assets or data protected by intellectual property rights or constituting a trade secret of the Supplier or a third party.

Schedule 7: EU and UK Consumer Rights

1. Right of Withdrawal

1.1. If the Customer qualifies as a consumer under the EU or UK consumer protection legislation, the Customer has the right to withdraw from this Agreement within fourteen (14) days from the Commencement Date without providing any reason.

1.2. To exercise the right of withdrawal, the Customer must inform the Supplier of their decision to withdraw from this Agreement by a clear statement, including by sending an email to [email protected]. The statement must clearly identify the Customer’s decision to withdraw from the Agreement and must clearly identify the agreement to be withdrawn.

1.3. If the Customer withdraws from this Agreement, the Customer shall not have the right to a refund for any Service Fees paid for the use of the Service before withdrawal.

1.4. To meet the withdrawal deadline, it is sufficient for the Customer to send their notification concerning the exercise of the right of withdrawal before the withdrawal period has expired.

2. Statutory Rights

2.1. Nothing in this Agreement shall limit the Customer’s statutory mandatory rights under EU or UK consumer protection legislation, insofar as the Customer is a consumer residing within the EU or the UK. This includes the right to lodge complaints or bring claims before the competent consumer dispute resolution bodies or forums in the Customer’s country of residence.