Terms & Conditions

In this Agreement:

If there is a conflict between documents, the following order applies:

1. a signed or expressly accepted Project Agreement (Order Form, SOW or Proposal) for the relevant engagement;
2. a project-specific schedule or written amendment to that Project Agreement;
3. this Master Service Agreement;
4. an unaccepted proposal or quotation;
5. other written communications — only to the extent they expressly state they vary this Agreement. General correspondence and emails do not vary this Agreement unless they say so expressly.

“In writing” includes email and other written digital communication, for giving notices, approvals and instructions. This is separate from the requirements for varying this Agreement itself, set out in Clause 1.4.

No variation of this Agreement is effective unless made by way of a Project Agreement, a signed written amendment, or another written document that expressly states it varies this Agreement — agreed by both parties. This prevents an informal email or conversation from unintentionally rewriting the contract, while still allowing the parties to expressly agree project-specific terms in writing.

This Agreement starts when the Client accepts a Proposal, pays an invoice, subscribes to a Service, approves work, signs a Project Agreement or otherwise begins using the Services. It continues until terminated under Clause 15.

The parties may agree multiple Project Agreements, projects or Subscriptions. Each is governed by this Agreement unless expressly agreed otherwise in writing.

The Supplier acts as an independent contractor. Nothing in this Agreement creates a partnership, joint venture, employment or agency relationship.

The Supplier will provide the Services described in the applicable Project Agreement.

VV Design provides tailored digital services. Features, access levels, support levels, development allowance and Deliverables vary by package, business requirements, project complexity and the agreed commercial terms.

Many Deliverables — custom builds, booking systems, dashboards, CRM functionality, AI features and similar — represent a development value that a monthly Subscription fee, spread over time, does not fully reflect on its own. Where a project is delivered through a Subscription rather than paid upfront, ownership and handover are dealt with under Clause 10, and the applicable Project Agreement specifies which ownership model applies.

The Client will provide timely access, approvals, content, feedback, login credentials and Client Materials reasonably needed for the Supplier to perform the Services. Delays caused by the Client may extend timelines or require re-quoting where requirements, complexity or availability change materially.

A material change to agreed scope, features, structure or integrations may be treated as a change request. The Supplier may quote separately, adjust timelines, defer work, or decline requests that fall outside the agreed scope or package value.

The Supplier may exercise reasonable professional judgement on technical, design, security, SEO, hosting and development decisions, unless the Client has given specific written requirements that the Supplier has accepted.

Fees are set out in the applicable Project Agreement or invoice, quoted and payable in Pounds Sterling (GBP, £) unless otherwise agreed in writing. Fees are exclusive of VAT where VAT is legally applicable.

Subscription fees are payable one (1) month in advance unless otherwise agreed in writing. Subscription is VV Design’s standard commercial model.

One-Off Projects are offered only in limited or exceptional circumstances, at the Supplier’s discretion — VV Design’s standard commercial model is a Subscription. Where a One-Off Project is agreed, it is typically billed fifty percent (50%) upfront and fifty percent (50%) on completion, unless the Project Agreement states otherwise. Staged payments may be agreed for larger projects.

Payment is due by the method specified on the invoice or agreed in writing. The Client is responsible for ensuring payment details remain valid so payments can be taken on time.

If a payment fails, the Supplier will notify the Client and request payment before any suspension under Clause 15.1 takes effect.

Third-party costs — hosting, domains, paid plugins, API fees, app-store fees, licences, stock media, premium tools and similar — are either billed to the Client separately or included only where the Project Agreement expressly says so.

The Client must not withhold, deduct or set off amounts against an invoice, except in respect of an amount genuinely disputed in good faith and notified in writing, or an amount the Supplier has admitted in writing is owed to the Client.

The Installation Fee is a service-activation fee covering upfront work such as consultation and planning, discovery, system configuration, hosting and DNS setup, framework deployment, CMS setup, account provisioning, security setup and project scheduling.

The Installation Fee reflects work already performed and resources already allocated; it is not held as a refundable deposit.

The Supplier may waive, reduce or discount the Installation Fee at its discretion, confirmed in writing.

Fees are generally non-refundable once the corresponding work has started, been delivered, or resources or third-party costs have been committed to it.

Subscription payments are non-refundable for a billing period that has already started, except where required by law or expressly agreed in writing.

For One-Off Projects, payments already made are non-refundable once the corresponding stage of work has started or been delivered.

The Client is not entitled to a refund simply because it changes direction, no longer requires the Services, delays the project, or decides not to proceed after work has started.

Nothing in this Agreement excludes or limits rights that cannot legally be excluded or limited.

Subscription Services may include hosting, maintenance, security updates, monitoring, minor content changes, backups, support and a limited development allowance, depending on the package.

The applicable Project Agreement may state a number of hours per month, a defined support level, or an equivalent development allowance. Unused allowance does not roll over unless expressly agreed in writing.

Minor changes may include reasonable content updates, small layout adjustments, text and image changes, plugin updates and basic troubleshooting that fit within the agreed package.

Work that goes materially beyond the agreed package, fair use or development allowance is not included, and may be quoted separately. This commonly includes matters such as major redesigns, new feature development, new third-party integrations, custom dashboards or CRM builds, e-commerce expansion, major SEO campaigns, data migrations, and urgent out-of-hours work — this list is illustrative, not exhaustive.

The Supplier will determine, acting reasonably, whether a request falls within the agreed package, fair use or development allowance. Where a request is outside scope, the Supplier may quote separately, defer the work, or schedule it subject to availability.

The Supplier may refuse, defer or limit requests that are excessive, repetitive, unclear or commercially unreasonable relative to the agreed package.

The Supplier may provide hosting through reputable Third-Party Services (for example Hetzner, AWS, Google Cloud or Vercel), selected according to the technical requirements of the project.

Access levels vary by package and security requirements; some packages do not include server-level access.

Where the Client provides its own hosting, the Supplier gives no warranty as to that environment’s performance, security or reliability, and the uptime, performance and backup commitments in this Agreement do not apply to it unless expressly agreed in writing.

Where the Supplier provides hosting, it targets 99.9% annual uptime, excluding downtime attributable to Third-Party Services, scheduled or emergency maintenance, force majeure events, cyberattacks, DNS or registrar issues, Client actions, third-party software failures, payment-related suspension, or other circumstances outside the Supplier’s reasonable control. This is a target, not a guaranteed service level; Clause 20 governs remedies for any shortfall.

Backup frequency is set out in the applicable Project Agreement and may range from monthly to multiple times daily depending on the package and risk profile. Backups are a recovery measure, not a guarantee against all data loss; restoration, forensic recovery or complex data reconstruction beyond routine backup restoration may incur additional fees.

The Client remains responsible for keeping its own copies of important materials it uploads or provides, unless a specific managed backup service is agreed.

The Client must use hosting and infrastructure responsibly. Where usage of CPU, storage, bandwidth, database load, email sending, API requests or similar becomes excessive or risks service stability, the Supplier may throttle resources, require an upgrade, charge additional fees, or move the Client to a different plan.

The Client must not upload malware, unlawful content or harmful scripts. The Supplier may remove or quarantine harmful content and charge reasonably for remediation or recovery work made necessary by it.

The Supplier may register domains for the Client where agreed, or the Client may provide its own.

Unless the Project Agreement says otherwise, the Client is responsible for domain renewals and keeping payment details valid.

Where a domain is registered in the Client’s own name, the Client is responsible for maintaining access to it. Where the Supplier registers a domain on the Client’s behalf, transfer is handled as part of the project or exit process, subject to payment of outstanding fees and any registrar requirements.

The Supplier is not liable for losses arising from domain expiry, registrar issues, DNS changes or propagation delays outside its reasonable control.

Supplier IP remains the Supplier’s property. This includes, without limitation, reusable libraries, frameworks, internal tooling, generic modules, deployment and infrastructure-automation systems, templates, know-how, methodologies, pre-existing IP, and components designed for use across multiple customers. The Client does not acquire ownership of Supplier IP, whether or not it is used in delivering the Services, unless expressly agreed in writing.

The Supplier may reuse generic, non-client-specific components, frameworks and know-how across other client projects.

Unless the Client asks for confidentiality in writing, the Supplier may reference the work — including screenshots, description, Client name and logo — in its portfolio and marketing materials.

Unless and until the applicable Project Agreement provides for ownership on a different basis, while a Subscription is active: the Client has a licence to use the Website or Deliverables for its own business purposes; the Supplier retains ownership of the underlying code until ownership transfers under Clause 10.6; and the Client must not copy, resell, sublicense or reverse-engineer Supplier IP.

Many Deliverables carry development value beyond what an initial or monthly fee alone reflects. Where cost is spread through a Subscription, the Client has the benefit of using the Deliverable while that cost, along with ongoing hosting, support and improvement, is spread across an agreed term. For that reason, ownership of a Client-specific Deliverable is governed by the model set out in the applicable Project Agreement, rather than transferring automatically by default.

Ownership of a Client-specific Deliverable transfers to the Client only where, and on the basis that, the applicable Project Agreement expressly says so. The Project Agreement will identify which model applies, which may include:

• ownership from commencement (“day one”);
• ownership transferring after completion of an agreed Minimum Term;
• ownership transferring on payment of an agreed buyout fee (which may be exercised instead of, or before the end of, a Minimum Term where the Project Agreement allows it);
• a perpetual licence to use the Deliverable, without transfer of source-code ownership; or
• another model expressly agreed in writing.

Whichever model applies, all outstanding fees, charges and third-party costs relating to the Deliverable must be paid in full before ownership transfers. Where no Project Agreement specifies an ownership model, the interim licence in Clause 10.4 continues to apply and ownership does not transfer.

Where ownership of a Client-specific Deliverable transfers under Clause 10.6, the Client receives ownership of the Client-specific source code and materials created specifically for that Deliverable. Ownership transfer does not extend to Supplier IP as defined in Clause 10.1 — including the Supplier’s reusable frameworks, internal tooling, deployment systems, generic modules and proprietary methodologies — which the Supplier may continue to use freely in its own business and other engagements.

To the extent any Supplier IP is embedded in a transferred Deliverable, the Supplier grants the Client a perpetual, worldwide, royalty-free, non-exclusive licence to use, execute, maintain and modify that embedded Supplier IP, solely to the extent reasonably necessary to operate, maintain and further develop the transferred Deliverable. This licence may be exercised on the Client’s behalf by its contractors or a replacement developer, for that same purpose. It does not permit the Client, or anyone acting for it, to extract the embedded Supplier IP for use outside the transferred Deliverable, to resell or sublicense it as a standalone product, or to use it to build a competing reusable product or framework.

Where ownership transfers, or on termination where the Client is otherwise entitled to a handover, the Supplier will provide a reasonable, commercially useful handover, which may include: the Client-specific source code; relevant database exports where legally and technically appropriate; project-specific documentation that exists; the environment-variable and configuration requirements needed to operate the Deliverable (without disclosing unrelated credentials); and instructions reasonably necessary to deploy or operate it. The Supplier is not required to provide: unrelated customer or business information; access to its internal company systems or master infrastructure credentials; proprietary internal tooling or deployment platforms; details of its internal security architecture; reusable Supplier IP not included in the transfer; or third-party licences that are not legally transferable. Substantial migration assistance, re-platforming, training, or work to support a replacement supplier may be charged at the Supplier’s then-current rates.

Unless the Client already holds ownership, or a continuing licence, under the applicable Project Agreement, a Subscription ending, being cancelled or being suspended for non-payment before an ownership condition is met will end the Client’s licence to use the Website or Deliverables, and access may be removed.

For One-Off Projects, on full payment the Supplier assigns the Client-specific Deliverables to the Client, excluding Supplier IP and third-party materials, together with the handover described in Clause 10.8.

Third-party themes, plugins, fonts, APIs and similar remain subject to their own licences. The Client is responsible for ongoing third-party licence fees unless the Project Agreement expressly includes them.

The Supplier will configure and deploy AI Systems with reasonable skill and care, in line with Clause 19.1. AI Systems may be configured or trained using Client Materials, prompts, rules and data the Client provides.

The Client is responsible for the accuracy, legality and compliance of Client Materials used to configure AI Systems.

AI outputs are probabilistic and may be incomplete, inaccurate or unsuitable for a particular purpose.

Unless expressly agreed as a paid service, the Supplier does not independently review, approve or monitor AI outputs after deployment.

The Client must review and approve AI-generated content and automation outputs before relying on them in business-critical contexts.

AI Systems must not be relied on as legal, financial, medical, tax or other professional advice unless specifically designed and reviewed for that purpose by qualified professionals appointed by the Client.

To the maximum extent permitted by law, and subject to Clause 20, the Supplier is not liable for decisions or losses arising from AI outputs, Client-defined configurations, Client-provided data, or unsupervised use of AI Systems.

Services may depend on Third-Party Services such as hosting, payment processors, app stores, analytics and advertising platforms, and external software.

The Supplier is not liable for outages, pricing or policy changes, suspensions or discontinuation of Third-Party Services outside its control.

The Client is responsible for its own third-party accounts and their policies and payment obligations, unless the Project Agreement states otherwise.

If a third-party API changes materially or becomes unavailable, the Supplier may propose alternatives and quote separately for redevelopment or migration.

The Supplier does not guarantee approval by third-party platforms, including payment processors, app stores or advertising platforms.

The Client is responsible for its own Apple App Store and Google Play developer accounts and associated fees.

The Client may grant the Supplier technical access for development, build and submission assistance.

The Supplier is not responsible for app-store policy decisions, rejections or account restrictions.

Underlying frameworks and reusable components remain Supplier IP under Clause 10.1. Unless otherwise agreed, the Client receives a non-exclusive licence to use them only within its own branded application.

Each party will comply with UK GDPR and the Data Protection Act 2018 to the extent applicable to its role.

Depending on the Services, the Supplier may act as Controller, Processor, or both, for different categories of Personal Data. Where the Supplier processes Personal Data on the Client’s behalf as a Processor, the Data Processing Schedule at Schedule 1 applies and is incorporated into this Agreement.

In providing the Services, the Supplier may use reputable third-party cloud, hosting, analytics, communications, AI and payment providers as reasonably necessary, on the basis set out in Schedule 1.

The Supplier will apply the security measures described in Schedule 1, appropriate to the risk. No system can be guaranteed completely secure, and the Supplier does not represent or warrant that the Services will be immune from unauthorised access, cyberattack or data loss.

The Client warrants it has the right to provide Client Materials and Personal Data to the Supplier and has collected and will process Personal Data lawfully, including providing appropriate privacy notices and obtaining any required consents.

Where the Supplier is required to notify the Client of a Personal Data breach, it will do so without undue delay after becoming aware of it, in line with Schedule 1 and applicable law.

If fees remain unpaid for fourteen (14) days, the Supplier may suspend the Services, including hosting, support and system access, until overdue amounts are paid in full. Suspension does not cancel the underlying debt or terminate this Agreement (see Clause 4.5).

The Supplier may suspend Services immediately where reasonably necessary to protect systems, comply with law, prevent abuse, mitigate a security threat, or respond to unlawful content.

Either party may terminate a Subscription on thirty (30) days’ written notice, subject to any Minimum Term and outstanding fees.

Either party may terminate this Agreement or a Project Agreement if the other commits a material breach and fails to remedy it within fourteen (14) days of written notice, where the breach is capable of remedy.

Where the Supplier reasonably believes the Client’s conduct amounts to fraud, illegal activity, cyber abuse, threats or serious harassment towards staff or contractors, deliberate compromise of security, deployment of malware, a sanctions violation, serious payment fraud, or dangerous or unlawful content, the Supplier may terminate immediately without a cure period. Other material breaches follow the cure period in Clause 15.5.

Separately from Clause 15.6, the Supplier may also terminate or suspend where it reasonably believes the Client’s conduct creates a material legal, regulatory, cybersecurity, fraud, abuse, safety or reputational risk to the Supplier, its staff or its infrastructure, subject to the cure period in Clause 15.5 where the conduct is capable of remedy.

On termination or expiry: outstanding fees become immediately due; any interim licence under Clause 10.4 ends unless an ownership or continuing-licence condition under Clause 10.6 has been met; the Supplier may disable hosting, support and system access; and handover is provided under Clause 10.8, subject to payment of outstanding sums.

Migration, backup restoration, extended documentation, training, or assistance transitioning to a replacement supplier may be charged at the Supplier’s then-current rates.

Following termination, cancellation or expiry, the Supplier will retain the Client-specific source code, project files and configuration (excluding Client Personal Data) for twelve (12), eighteen (18) or twenty-four (24) months — depending on the complexity of the project — as agreed with the Client in the applicable Project Agreement. This period does not apply to, and does not authorise retention of, Client Personal Data: that is deleted or returned under Schedule 1, paragraph 12 instead. The Supplier may charge for source-code retention, recovery or export requests made after the applicable period.

If the Client initiates a chargeback or payment reversal, the Supplier may suspend Services unless the dispute relates to an obvious billing error by the Supplier.

Services may be restored once the disputed amount and any associated recovery costs are paid.

The Supplier may recover unpaid sums and reasonable administrative or legal costs incurred resolving payment disputes.

A fraudulent or bad-faith chargeback may result in immediate termination under Clause 15.6.

Each party may receive confidential business, technical, pricing, security, client or operational information from the other.

Each party must keep the other’s confidential information secure and use it only to perform this Agreement.

This does not apply to information that is public, independently developed, lawfully received from a third party, or must be disclosed by law.

A party required by law to disclose confidential information will give notice where lawful and practical to do so.

The Client must not publish statements about the Supplier, its staff or its services that it knows to be false or misleading, or that are defamatory. Nothing in this Clause restricts the Client (or its staff) from: leaving an honest review based on genuine experience; raising a genuine complaint directly with the Supplier; reporting a matter to a regulator or relevant authority; taking part in legal proceedings; making a protected disclosure (whistleblowing); or making a truthful statement about its own experience of the Services.

The Client must not solicit or hire the Supplier’s staff or contractors involved in delivering the Services, during the engagement and for twelve (12) months afterwards, unless agreed in writing.

The Supplier will perform the Services with reasonable skill and care.

The Supplier does not guarantee search-engine rankings, revenue, sales, leads, conversion rates, traffic, or approval by any payment processor, app store or advertising platform — these depend on factors outside the Supplier’s control, including third-party decisions, market conditions and the Client’s own content and reputation.

The Supplier is not responsible for inaccuracies, infringement or compliance issues in Client Materials.

The Supplier aims to deliver Services to reasonable modern technical standards, but does not guarantee compatibility with outdated browsers, devices or unsupported configurations unless expressly agreed in writing.

Nothing in this Agreement limits or excludes liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, or any other liability that cannot lawfully be excluded or limited under the law of England and Wales.

Subject to Clause 20.1, the Supplier is not liable for indirect or consequential losses, or loss of profits, revenue, business, goodwill, anticipated savings, business opportunity or data, arising out of or in connection with this Agreement.

Subject to Clauses 20.1 and 20.6, the Supplier’s total liability arising out of or in connection with a Subscription is limited to the total fees paid or payable by the Client for that Subscription in the twelve (12) months immediately before the event giving rise to the claim, or such other cap as the applicable Project Agreement specifies.

Subject to Clauses 20.1 and 20.6, the Supplier’s total liability arising out of or in connection with a One-Off Project is limited to the total fees paid for that project, or such other cap as the applicable Project Agreement specifies.

The Supplier is not liable for the failure, outage or discontinuation of Third-Party Services, except to the extent directly caused by the Supplier’s own breach of this Agreement.

For claims arising from a breach of Clause 17 (Confidentiality), a breach of Schedule 1 that the Supplier is responsible for, or an indemnity claim under Clause 21.2 (Supplier IP indemnity), the cap in Clause 20.3 or 20.4 is increased to two (2) times the amount that would otherwise apply, unless the applicable Project Agreement specifies a different figure. This Clause 20.6 does not create liability that would not otherwise exist; it only adjusts the cap on liability that does exist.

The Client will indemnify the Supplier against claims, damages, losses and reasonable legal costs arising from: Client Materials infringing third-party rights; unlawful or non-compliant content or instructions provided by the Client; the Client’s misuse of the Services; or the Client’s breach of third-party platform, app-store, advertising or payment-processor rules.

Subject to Clause 20 (including the higher cap in Clause 20.6), the Supplier will indemnify the Client against reasonable losses and legal costs directly arising from a third party’s claim that a Client-specific Deliverable, as developed and delivered by the Supplier (excluding Client Materials, Client instructions, third-party or open-source components, and any modification made otherwise than by the Supplier), infringes that third party’s UK intellectual property rights. This does not apply where a claim arises from the Client’s own materials or instructions, use outside the intended purpose, or combination with something not supplied by the Supplier. It is conditional on the Client promptly notifying the Supplier, giving the Supplier sole control of the defence or settlement, not admitting liability, and providing reasonable cooperation. The Supplier may, at its option, procure continued use rights, modify or replace the affected element, or refund fees paid for it and terminate the relevant part of the engagement — this is the Client’s sole remedy under this Clause.

The Client must not use the Services for unlawful activity, fraud, phishing, malware, spam, copyright infringement, misleading claims, hate or abusive content, harassment, unlawful adult content, unauthorised gambling, scams, pyramid or high-risk financial schemes, or activity that may damage the Supplier’s infrastructure, reputation or third-party relationships.

A Client operating in a regulated or high-risk sector (for example financial services, gambling, healthcare, legal services, crypto-assets, alcohol, adult content or insurance) must disclose this before work begins. The Supplier may decline, pause or require additional compliance checks for such projects.

The Supplier may refuse or suspend work where it reasonably believes the Client’s business, content or instructions create a material legal, regulatory, cybersecurity, infrastructure, fraud, abuse, safety or reputational risk.

Neither party is liable for failure or delay caused by events beyond its reasonable control, including war, civil unrest, government action, natural disasters, pandemics, cyberattacks, internet or power outages, data-centre or cloud-infrastructure failures, strikes, or third-party platform outages.

Performance obligations are suspended for the duration of the force majeure event.

The parties will first attempt to resolve disputes through good-faith negotiation, and if that fails, through mediation, before starting court proceedings — except where urgent injunctive relief or debt recovery is required.

This Agreement is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

Notices must be in writing and sent to the address or email last notified by each party.

The Client may not assign this Agreement without the Supplier’s written consent. The Supplier may assign this Agreement to an Affiliate, successor or purchaser, or in connection with a business transfer, and will give the Client reasonable notice of such an assignment.

If a clause is found invalid or unenforceable, the rest of the Agreement remains in force.

A waiver is only effective if given in writing and applies only to the specific circumstance it addresses.

This Agreement, together with the applicable Project Agreement, constitutes the entire agreement between the parties for that engagement and supersedes prior discussions or proposals relating to the same Services.

The Supplier may update the general terms of this Master Service Agreement from time to time — for example for regulatory change, security, service improvements, operational changes, clarification, new technology, or third-party requirements — with reasonable notice. However, such an update will not unilaterally and materially change, during an active Minimum Term, the pricing, Minimum Term, ownership arrangements, core Deliverables, agreed liability caps, or other material project-specific commercial rights set out in the Client’s Project Agreement, unless required by law or agreed with the Client.

Each party will comply with applicable anti-bribery, anti-corruption, sanctions and modern slavery laws relevant to its performance of this Agreement, and will not engage the other in dealings that would breach such laws.

A person who is not a party to this Agreement has no right under the Contracts (Rights of Third Parties) Act 1999 to enforce any term of it, except where this Agreement expressly says otherwise.

Clauses relating to payment, intellectual property, confidentiality, liability, indemnities, data protection (Schedule 1), source code retention, dispute resolution, and any other clause intended to survive termination, continue after termination or expiry of this Agreement.

Processing of Personal Data submitted to, or generated through, the Services — for example via website contact forms, hosted CRM or booking-system records, hosted databases, analytics, and AI-assisted automation.

For the term of the Agreement, and thereafter until Client Personal Data is deleted or returned in accordance with paragraph 12. This is independent of the Source Code Retention Period under Clause 15.10, which governs source code, configuration and non-personal project materials only, and does not itself authorise retention of Client Personal Data.

Hosting, storage, backup, technical support, development, analytics, AI-assisted automation, and booking/CRM management reasonably necessary to provide the Services described in the applicable Project Agreement.

Names, contact details, correspondence, account and login data, transaction and booking records, and technical/usage data such as IP addresses and device information, together with any other categories the Client submits via the Services. The Supplier will process special category data only where the Client has expressly instructed this and confirmed a lawful basis for it.

The Client’s customers, enquirers, website visitors, staff and other individuals whose Personal Data the Client submits to, or processes through, the Services.

The Supplier will process Personal Data only on the Client’s documented instructions — including this Agreement and the applicable Project Agreement — unless required to do otherwise by law, in which case the Supplier will inform the Client before processing, where legally permitted to do so.

Personnel authorised to process Personal Data are subject to confidentiality obligations.

The Supplier will apply appropriate technical and organisational measures proportionate to the risk, which may include access controls, least-privilege permissions, appropriate encryption in transit (including TLS where technically applicable) and encryption at rest where appropriate to the risk, firewalling, patching, backups, monitoring and reasonable account-security practices. No system can be guaranteed completely secure, and this Schedule does not promise absolute security.

The Client gives the Supplier general authorisation to engage reputable hosting, cloud, analytics, communications, AI and payment sub-processors, in each case under a written contract that imposes data-protection obligations on the sub-processor consistent with Article 28 UK GDPR. The Supplier remains responsible for its sub-processors’ performance of those obligations, and will give the Client reasonable notice of the appointment of a new or replacement sub-processor with a reasonable opportunity to object on legitimate data-protection grounds.

The Supplier will give the Client reasonable assistance, to the extent reasonably required and relevant to the Supplier’s own processing, with data-subject rights requests, security incidents, data protection impact assessments and engagement with supervisory authorities. Where such assistance is substantial or outside normal support, the Supplier may charge a reasonable fee, as under Clause 7.4.

The Supplier will notify the Client without undue delay after becoming aware of a Personal Data breach affecting Client Personal Data, with the information reasonably available to it at the time.

The Supplier will make available information reasonably necessary to demonstrate compliance with this Schedule, and will allow for and contribute to a reasonably scoped audit conducted by the Client or its appointed third party, on reasonable prior notice, no more than once per year (except following a security incident or where required by a regulator), during business hours, subject to confidentiality and to the parties agreeing reasonable costs in advance for any on-site or third-party-led audit.

Personal Data will be processed outside the UK by the Supplier or its sub-processors only where an appropriate transfer mechanism recognised under UK GDPR is in place — such as an applicable adequacy decision, or the UK International Data Transfer Agreement/Addendum.