Master Services Terms

Part A - General Terms

Halo Technology Lab Ltd, a company registered in England and Wales (company number 13798042), registered office 20-22 Wenlock Road, London, N1 7GU, VAT number GB446634184, ICO registration number ZC222454 ("Halo", "we", "us").

1. About these Terms

1.1 These Master Services Terms (the "Terms") apply to services provided by Halo to a business customer (the "Client"), including a company, partnership or individual acting in the course of business. Each engagement is described in a Statement of Work agreed and signed by the parties (an "SOW"). Each SOW, together with these Terms and the Service Modules selected in it, forms a separate contract (the "Agreement").

1.2 These Terms have two parts. Part A applies to each SOW. Part B contains Service Modules which apply only when expressly selected in the SOW. Schedule 1 (Data Processing Terms) applies whenever Halo processes personal data on the Client's behalf as processor, including through authorised remote access to the Client's systems; physical transfer or download of the data is not required.

1.3 Business customers only. Halo contracts under these Terms only with customers acting wholly or mainly for purposes relating to their trade, business, craft or profession, including sole traders and founders operating an unincorporated business. The Client confirms that it is not acting as a consumer. An individual contracting in their own name is personally the Client, and signs for themselves; a person signing on behalf of an organisation warrants authority to bind that organisation. These Terms are not intended to exclude any statutory consumer rights where consumer law nevertheless applies.

1.4 Order of precedence. If the Agreement documents conflict, they apply in this order: (a) Schedule 1, solely as to personal data processing matters and subject to mandatory Data Protection Laws; (b) provisions expressly headed "Changes to the Terms" in the SOW, identifying the clause varied (but not disapplying mandatory data protection requirements); (c) each selected Service Module, as regards the Services under that module; (d) Part A; and (e) the remaining SOW terms. The SOW governs the agreed identity of the parties, specification, scope, deliverables, service levels, pricing, and processing particulars without needing to restate Part A. A purchase order or standard terms supplied by the Client do not alter the Agreement unless accepted by an express written variation signed by both parties.

1.5 Version. These Terms are identified by the version number and effective date shown at the top of this document. Each SOW is governed by the version of these Terms stated in it. Halo may publish new versions, but a new version applies only to SOWs signed after it is published, or where both parties agree in writing. Publishing a new version does not change an existing SOW.

2. Definitions

In these Terms:

• Acceptance means the process in clause 6 (Approvals and acceptance), and Accepted is read accordingly.
• AI Services means the configuration, integration, development, deployment or operation of artificial intelligence or machine-learning models or systems under an SOW, including generative AI models or agents provided by third parties.
• Business Day means a day other than a Saturday, Sunday or public holiday in England.
• Client Materials means all content, data, credentials, brand assets, footage, documents, instructions and other materials the Client (or anyone on its behalf) provides to Halo.
• Confidential Information has the meaning in clause 11.
• Data Protection Laws means the UK GDPR, Data Protection Act 2018 (as amended), Privacy and Electronic Communications Regulations 2003 (PECR), and, to the extent applicable to a party or processing activity, the EU GDPR and other relevant data protection legislation, each as amended or replaced from time to time.
• Deliverables means the items Halo is to deliver under an SOW, as described in it.
• Fees means the fees set out in the SOW.
• Halo Background IP means all Intellectual Property Rights owned or licensed by Halo before an SOW, or created or developed independently of its bespoke Deliverables, including methods, frameworks, know-how, code libraries, reusable components, workflow and automation templates (including n8n workflows), prompts, prompt libraries, agent configurations, documentation, training materials, templates, tools and general improvements to them. It excludes Client Materials and items expressly identified in the SOW as assigned Bespoke Deliverables.
• Intellectual Property Rights means copyright, database rights, rights in software, designs, trade marks, patents, rights in know-how and confidential information, and all similar rights anywhere in the world, whether registered or not.
• Services means the services described in an SOW.
• Third-Party Services means services, platforms, APIs, AI models, hosting, open-source software, datasets and other products or materials supplied by a third party, including those configured, recommended or integrated by Halo. Their third-party licences and service terms may apply independently of this Agreement.

Words such as "including" and "for example" do not limit the words before them. "Writing" includes email but not messages on chat apps unless the SOW says otherwise.

3. The Services

3.1 Halo will provide the Services and Deliverables described in each SOW using reasonable skill and care. Anything not described in the SOW is out of scope.

3.2 Halo decides the method and means of delivering the Services, including the tools, working hours and location, unless the SOW says otherwise. Halo may serve other clients, including in the Client's sector, provided it does not misuse the Client's Confidential Information.

3.3 Dates in an SOW are estimates unless the SOW expressly states that a date is fixed. Time is not of the essence.

3.4 Halo's normal working hours are 9:00 to 17:00 UK time on Business Days unless the SOW or a selected Service Module expressly specifies extended hours, an on-call arrangement or an alternative support window. General marketing references to round-the-clock availability do not by themselves create a 24/7 contractual support obligation. Response targets apply only during the agreed support hours unless the SOW states otherwise.

4. Client responsibilities

4.1 The Client will:

• provide accurate, complete Client Materials, decisions and feedback on time;
• give Halo the access it reasonably needs to systems, accounts, environments, premises and people;
• name one person with authority to make decisions and approve work;
• own, or have all rights and consents needed for Halo to use, the Client Materials, and ensure they do not infringe anyone's rights or break any law;
• keep its own backups of its data and systems unless backups are part of the Services;
• be responsible for its own business decisions, including whether and how to use any advice, Deliverable or AI output; and
• comply with the terms of any Third-Party Services it uses.

4.2 Client delay. If the Client, or anyone it is responsible for, does not do something it should, or does something that stops or slows Halo's work (a "Client Delay"), Halo is not liable for the resulting delay or failure. Halo may extend any affected dates by a reasonable period and charge its reasonable costs, including idle time already scheduled. If a Client Delay lasts more than 30 days, Halo may, by a single written notice, do any or all of the following: (a) treat any milestone or Deliverable that Halo has completed, apart from steps that depend on the Client, as complete for payment purposes and invoice it; (b) invoice all other work done, a fair proportion of the Fees for work in progress on fixed-price work, and any committed costs; and (c) suspend the affected Services or end the SOW under clause 15.3. A Deliverable already delivered is Accepted under clause 6.3(b) if the Client does not respond within its Review Period.

4.3 Non-responsiveness. If the Client does not respond to Halo's reasonable attempts to contact it in writing for 30 consecutive days, Halo may give 7 days' written notice and then suspend or end the affected SOW. If Halo ends the SOW, the Client will pay for all work done up to the end date, whether or not it has been approved, a fair proportion of the Fees for work in progress on fixed-price work, and any non-cancellable third-party or committed costs, on the same basis as clause 15.2.

4.4 The Client grants Halo a non-exclusive, worldwide, royalty-free licence to use, copy and adapt Client Materials only as reasonably necessary to provide the Services and fulfil this Agreement, subject to clauses 11 and 12 and Schedule 1. The licence ends when no longer needed, except to the extent retention is required by law or permitted under the Agreement.

5. Changes

5.1 Either party may ask for a change to the Services, scope, timetable or Deliverables (a "Change Request"). Halo will tell the Client in writing the likely effect on Fees, timetable and other terms.

5.2 A change to an SOW, including a material change to scope, Deliverables, Fees or committed dates, takes effect only once both parties sign a Change Order using Halo's Change Order form through an agreed electronic signature platform. Calls, emails and informal messages do not change the SOW until that Change Order is signed. The parties may approve day-to-day implementation details within the existing agreed scope through the SOW communication channels, but such approvals cannot waive contractual terms or authorise otherwise prohibited processing.

5.3 Halo may make changes that are needed to comply with law or to keep the Services secure, provided they do not materially reduce the Services.

6. Approvals and acceptance

6.1 Where an SOW or selected Service Module requires acceptance, the Client has 5 Business Days after delivery of the relevant Deliverable and the agreed information reasonably needed to test it (the "Review Period") to accept it or give written reasons identifying material non-conformities against the SOW's acceptance criteria. The SOW may specify different acceptance criteria or periods for particular milestones.

6.2 Halo will use reasonable efforts to correct timely notified material non-conformities within the agreed scope and resubmit the affected Deliverable. A new Review Period applies only to the corrected items. A request for new or changed functionality, design or scope is a Change Request under clause 5, not a defect correction.

6.3 A Deliverable is Accepted on the earliest of: (a) the Client's written approval; (b) expiry of the Review Period without written notice identifying material non-conformities; or (c) the Client putting the Deliverable into live production or materially using it for its intended business purpose, other than solely for agreed acceptance testing. Acceptance does not waive latent defects covered by an express warranty, rights arising from fraud or remedies that cannot lawfully be excluded.

6.4 The number of revision rounds included is stated in the SOW. If none is stated, two rounds of consolidated feedback are included. Further rounds are charged at Halo's day rate.

7. People, subcontractors and non-solicitation

7.1 Halo may use suitably qualified employees, contractors and subcontractors in the UK or abroad to provide the Services. Halo remains responsible for their contractual performance and will impose confidentiality, security and intellectual-property obligations appropriate to their work. Where they access or process Client Personal Data, their engagement and any international access or transfer are subject to Schedule 1, the SOW, the Client's documented instructions and applicable Data Protection Laws. No contractual permission is a substitute for obtaining legally required sub-processor authorisation or transfer safeguards.

7.2 Halo is an independent contractor. Nothing in the Agreement creates an employment, partnership, joint venture or agency relationship. Neither party may bind the other. Each party is responsible for its own staff, taxes and National Insurance or equivalent contributions.

7.3 Non-solicitation. During each SOW and for 12 months after it ends, neither party will, without the other's prior written consent, directly or indirectly solicit, employ or engage any person who was employed or engaged by the other party and was involved in the Services. "Engage" includes engagement through the person's own company, an agency or any other intermediary. General recruitment advertising not aimed at those people is not solicitation, but it does not permit employing or engaging them. A party may give its consent on condition that the other pays a transfer fee equal to 25% of the person's annualised pay or fees in the new role. The parties agree that this fee reflects the typical cost of recruiting and training a replacement and the loss of the investment made in that person. If a party employs or engages such a person without consent, it will pay the same fee within 14 days of demand, in place of any other damages for that breach and without affecting the other party's right to seek an injunction.

8. Fees, payment and tax

8.1 The Client will pay the Fees and any expenses set out in the SOW. Unless the SOW says otherwise or the parties agree otherwise in writing: (a) fixed-price work is invoiced 50% on signature and 50% on Acceptance of the final Deliverable; (b) time-based work is invoiced monthly in arrears at Halo's day rate; (c) pre-paid hours, workshops and subscriptions are invoiced in advance; and (d) invoices are payable within 14 days.

8.2 Fixed-price Fees cover only the scope in the SOW. Pre-paid hours expire 6 months after purchase unless the SOW says otherwise, are drawn down in 30-minute increments, and are non-refundable except under clause 15.6.

8.3 Third-party costs. Hosting, software licences, domains, AI model usage (for example API tokens), sending platforms, data, stock assets, travel and other Third-Party Services are paid by the Client, either directly to the provider or reimbursed to Halo at cost plus any handling fee stated in the SOW. Halo will get the Client's approval before committing to any single cost over £250 or the amount in the SOW.

8.4 Currency. Fees are in pounds sterling unless the SOW states another currency. The Client pays all bank, transfer and card charges so that Halo receives the full invoiced amount.

8.5 Tax. Fees are exclusive of VAT or equivalent applicable taxes, charged where required by law. VAT, place-of-supply and reverse-charge treatment depend on the particular services and the Client's status and location; the Client will provide reasonable evidence of business or tax status requested for invoicing. Where a withholding is legally required, the Client will notify Halo, provide evidence of it and, except where prohibited by law or expressly agreed otherwise in the SOW, gross up payments so that Halo receives the contracted net Fees.

8.6 Late payment. If any amount is unpaid on its due date, Halo may: (a) charge interest at 8% a year above the Bank of England base rate from the due date until payment, together with the fixed sums and reasonable recovery costs allowed by the Late Payment of Commercial Debts (Interest) Act 1998; (b) suspend the Services and access to any Halo-hosted system after giving 7 days' written notice (suspension will not involve deleting Client data); and (c) if payment is more than 30 days overdue, either require immediate payment of all remaining instalments of any fixed Fee under the SOW (in which case Halo will continue to perform once they are paid) or end the SOW under clause 15.3. The Client will also pay Halo's reasonable costs of recovering overdue amounts, including collection agency and legal fees, to the extent they are not already recovered under that Act.

8.7 Disputed invoices. The Client must raise any dispute about an invoice in writing within 7 days of receiving it, giving reasons, and must pay the undisputed part on time. The parties will try to resolve the dispute under clause 17. Halo will not suspend the Services solely because of an amount disputed in good faith under this clause while the undisputed part is paid. An instalment due under clause 8.9 cannot be disputed on the grounds of delivery progress or the Client's concerns about the work.

8.8 Card payments and chargebacks. Where the Client pays by card or payment link, the Client's consent to Halo and its payment processor charging that payment method for scheduled instalments and other amounts due under the SOW will be recorded in the SOW or at checkout, in the form the payment processor requires. The Client will raise any concern about a charge with Halo first and will not start a chargeback, payment dispute or reversal for amounts properly due. As between Halo and the Client, a chargeback or reversal of amounts properly due is a material breach, the amount remains payable, and Halo may provide the Agreement and delivery records to the processor or card issuer as evidence. Nothing in this clause affects the Client's rights against its own payment provider for unauthorised or incorrectly executed transactions. Halo will promptly refund any amount charged in error.

8.9 Payment schedules and instalments. Where the SOW sets out an instalment plan or fixed payment dates, each payment is due on its stated date regardless of the progress of the Services or Deliverables, including any delay, pending Acceptance or dispute about the work. An instalment plan spreads a fixed total Fee over time. It is not a rolling subscription that can be cancelled to stop future instalments. The Client may not withhold, delay or reduce any payment because of delivery timelines or concerns about the work; its remedies for any concern about Halo's performance lie under clauses 14 and 15. If an instalment is missed, Halo may require all remaining instalments to be paid immediately under clause 8.6. This clause does not affect the Client's rights under clause 15.6.

8.10 Set-off. The Client will pay all amounts in full without set-off, counterclaim or deduction, except as required by law.

8.11 Rate changes. Halo may change its day rate and standard prices for new SOWs at any time. For ongoing monthly services, Halo may change the Fees once in any 12 months by giving at least 60 days' written notice.

9. Third-Party Services and AI

9.1 Third-Party Services. The Services may depend on Third-Party Services subject to their providers' independent terms, availability and pricing. Wherever practical the Client will hold and pay for its own production hosting, domain, AI-model, automation and other service accounts. Halo is not responsible for failures or changes attributable solely to a Third-Party Service outside Halo's reasonable control, but remains responsible for its own contractual duties, including reasonable care in selecting, configuring or integrating Third-Party Services where included in the SOW. Work arising from external changes may be treated as a Change Request unless included in agreed support or warranty obligations.

9.2 Open source and third-party licences. Deliverables may incorporate approved open-source or other third-party components subject to their own licences, which are not assigned under clause 10. Halo will use reasonable care to identify material components and licence restrictions where relevant to the Deliverables. The Client must comply with applicable third-party licence requirements; neither party may require the other to breach them.

9.3 Nature of AI. AI Services may produce probabilistic outputs that are inaccurate, biased, incomplete, inconsistent, unoriginal or unsuitable for the Client's intended use, and their performance may change with third-party models. Halo will perform its agreed development, configuration and testing obligations with reasonable skill and care, but does not guarantee the accuracy, legal status, uniqueness or fitness of individual AI-generated outputs except to the extent expressly specified in the SOW or required by law.

9.4 Human review. The Client is responsible for reviewing AI outputs before relying on them, and for keeping appropriate human oversight of how AI Services are used in its business. The Client will not use AI Services to make decisions that have legal or similarly significant effects on individuals, or in regulated activities (for example medical, legal, financial or employment decisions), without its own qualified human review and any assessments required by law. Neither party will use AI Services for purposes prohibited by law. Where the SOW records additional testing, documentation or oversight tasks within Halo's scope, Halo will carry them out.

9.5 Data sent to AI providers. Unless the SOW selects "No AI tools" or restricts their use, the Client authorises Halo, and contractors working on the Services, to use AI coding, drafting and analysis assistants with Client Materials, including the Client's source code and technical documentation, to provide the Services. Those tools must be used under business, enterprise or API terms that keep inputs confidential, prevent the provider from using them to train its models and include appropriate retention and access controls; consumer accounts will not be used. Credentials, secrets and access keys must not be entered into any AI tool, and Halo will take reasonable steps (for example, excluding environment and secrets files) to keep them out of a tool's reach. Client Personal Data may be submitted to an AI provider only where that provider is an authorised sub-processor under Schedule 1 and any safeguards required by clause S1.6 are in place, and special category personal data, children's data or other highly sensitive information only where the SOW expressly identifies the categories, purpose, provider and safeguards. This authorisation does not override the Client's documented instructions or the requirements of Schedule 1, and does not by itself authorise a new sub-processor or a restricted international transfer. Halo will use data minimisation and de-identification where reasonably practicable.

9.6 AI law and roles. Each party will comply with AI legislation directly applicable to its own activities, including the EU AI Act where its territorial and substantive scope is met. A party's status as provider, deployer, importer, distributor or other regulated actor is determined by applicable law and the factual design, branding, marketing and deployment arrangements, not solely by this Agreement. The SOW should identify any known regulated intended use and allocate agreed technical, testing, transparency, recordkeeping, documentation, human oversight, information-sharing and regulatory cooperation tasks without purporting to displace non-transferable statutory duties. Halo will reasonably cooperate with requests relating to the AI Services it supplied, subject to agreed scope and Fees for material additional work.

9.7 Transparency and safeguards. Where required by applicable law and allocated in the SOW, the parties will implement suitable notices to users interacting with AI systems, identification or labelling of AI-generated or manipulated content, logging, testing and oversight measures. Unless the SOW identifies an applicable regulatory classification and the services needed to address it, Halo does not undertake a general certification or high-risk conformity assessment. Neither party shall use the Services for legally prohibited AI practices.

9.8 Changes in law or model capabilities. If a material legal requirement or third-party model change affects the agreed AI Services, the parties will discuss necessary modifications to purpose, scope, documentation, compliance measures, Fees and timetable through a Change Order. Nothing requires either party to continue unlawful processing or deployment pending agreement.

10. Intellectual property

10.1 Each party keeps ownership of the Intellectual Property Rights it owned before the SOW or creates independently of it. The Client owns the Client Materials. Halo owns Halo Background IP.

10.2 Bespoke Deliverables. Subject to the Client paying all Fees due under the relevant SOW, Halo hereby assigns to the Client, by way of present assignment of existing and future rights, the Intellectual Property Rights which Halo owns or is entitled to assign in Deliverables specifically created for the Client under that SOW ("Bespoke Deliverables"). This excludes Halo Background IP, Client Materials, Third-Party Services, open-source components and rights that cannot lawfully be assigned. Until payment, Halo grants a limited, non-exclusive, non-transferable licence to use the relevant Deliverables for agreed testing and evaluation. To the extent applicable law requires any further instrument to perfect an assignment, clause 10.8 applies.

10.3 Licence of Halo Background IP. To the extent Halo Background IP is built into, or needed for the normal operation, maintenance or modification of, a Bespoke Deliverable, Halo grants the Client, once the relevant Fees are paid, a non-exclusive, perpetual, worldwide, royalty-free licence to use, copy, modify, distribute and make it available as part of that Deliverable for the Client's business. This includes making the Deliverable available to the Client's customers and end users (for example through an app store or website), allowing those end users to use it as part of the Deliverable, and allowing the Client's service providers to host, support and maintain it. The Client may transfer this licence only together with the Deliverable or the business it forms part of. The Client may not sell, license or distribute Halo Background IP on its own, or use it to build a competing product or service. Halo keeps ownership of Halo Background IP.

10.4 Licensed materials. Where a Service Module states that a type of work (for example training materials or advisory reports) is licensed rather than assigned, Halo grants the Client a non-exclusive, perpetual, royalty-free licence to use that material for its internal business purposes, once paid for.

10.5 Know-how. Nothing in the Agreement stops Halo using the general skills, knowledge, experience, ideas and techniques it gains while providing the Services, provided it does not disclose the Client's Confidential Information.

10.6 AI-assisted outputs. To the extent any assignable Intellectual Property Rights owned by Halo arise in AI-assisted or AI-generated outputs specifically produced as paid-for Bespoke Deliverables, they are dealt with under clause 10.2. The parties acknowledge that ownership, originality, registrability or exclusivity of AI-generated material may be limited or uncertain under applicable law or provider terms. Nothing in this Agreement purports to assign rights that do not exist or belong to a third party; the Client is responsible for clearance where required for its intended downstream use, except to the extent the SOW expressly assigns that task to Halo.

10.7 Moral rights and chain of title. To the extent legally possible, Halo will obtain appropriate written assignments, licences and moral-rights waivers from personnel and authorised contractors who create Bespoke Deliverables, sufficient to give effect to this clause. Halo need not assign rights in third-party or pre-existing materials beyond the rights it validly holds.

10.8 Further assurance. Each party will sign any documents reasonably needed to give effect to this clause, at the requesting party's cost.

11. Confidentiality

11.1 "Confidential Information" means information disclosed by or on behalf of one party (the discloser) to the other (the recipient) in connection with the Agreement that is marked confidential or would reasonably be considered confidential, including business plans, customer and pricing information, source code, system credentials, Halo's methods and Halo Background IP, and the terms of the Agreement.

11.2 It does not include information that the recipient can show: (a) is or becomes public other than through the recipient's breach; (b) it already lawfully held without restriction; (c) it received from a third party entitled to share it; or (d) it developed independently without using the discloser's information.

11.3 The recipient will keep Confidential Information confidential, use it only for the Agreement's permitted purpose, protect it using at least reasonable care, and disclose it only to personnel, approved contractors, professional advisers, insurers and funders with a genuine need to know and substantially equivalent confidentiality obligations. The recipient remains responsible for disclosures by those permitted recipients. Confidential Information may be entered into an AI tool only where expressly permitted under the Agreement, the relevant SOW and, where applicable, Schedule 1.

11.4 The recipient may disclose Confidential Information if required by law, a court or a regulator, provided it gives the discloser prompt notice where legally allowed and discloses only what is required. Halo may also use the Client's name, logo and the existence of the Agreement as permitted by clause 16.2.

11.5 On reasonable request or when the relevant Agreement ends, each recipient will return or securely delete Confidential Information not required for an ongoing permitted purpose, subject to reasonable records retention, legal obligations and secure routine backups inaccessible for ordinary use. Personal data processed on the Client's behalf is separately subject to the Client's return/deletion choice under Schedule 1; this clause does not override it.

11.6 These obligations last during the Agreement and for 5 years after it ends, and indefinitely for trade secrets and system credentials.

11.7 A separate non-disclosure agreement between the parties continues to protect information disclosed before the first SOW to the extent stated in that agreement. For disclosures made after the relevant SOW takes effect, this clause governs confidentiality relating to the Services unless a later expressly signed agreement states otherwise. Accrued rights and obligations in respect of earlier disclosures are preserved.

12. Data protection

12.1 Each party will comply with the Data Protection Laws that apply to it.

12.2 Each party is an independent controller of the business contact details of the other party's staff that it uses to manage the relationship. Halo's privacy notice at https://halotechlab.com/privacy explains how Halo uses that data. Questions about personal data can be sent to support@halotechlab.com.

12.3 Where Halo processes personal data on behalf of the Client, including by accessing records within the Client's own systems, the Client generally acts as controller and Halo as processor, and Schedule 1 applies. The precise legal roles depend on actual processing purposes and applicable law; any joint-control or independent-control activity materially different from this model must be identified and documented separately where required. The SOW records the processing particulars and any specific restrictions.

12.4 The Client is responsible for identifying an appropriate lawful basis, providing legally required privacy information, and obtaining consents where needed for the personal-data processing it instructs, including PECR or equivalent marketing requirements. Halo remains responsible for its own processor duties and will promptly raise instructions it reasonably considers unlawful under Schedule 1.

12.5 Personal data in Client systems. The parties acknowledge that Halo may process personal data through access to a Client-controlled administrative panel, repository or production environment without transferring a data file to Halo. The Client will identify relevant personal data categories and access controls in the SOW; Halo will implement appropriate restrictions under Schedule 1. The fact that the Client controls the hosting account does not, on its own, remove Halo's processor obligations.

13. Warranties and no guarantee of results

13.1 Halo warrants that it will perform the Services with reasonable skill and care, using suitably competent personnel and reasonable industry practices, and will comply with law directly applicable to Halo in performing the agreed Services. Any project-specific testing, security standard, service level or compliance deliverable must be stated in the SOW.

13.2 Each party warrants that it has authority to enter into the Agreement. The Client warrants that the Client Materials and its instructions to Halo comply with law and do not infringe anyone's rights.

13.3 No guarantee of results. Halo's Services are advisory, technical, educational and creative. Halo does not promise any particular business result, including revenue, profit, leads, replies, meetings, conversion rates, email deliverability, search or platform rankings, time or cost savings, productivity gains, AI accuracy, funding or regulatory approval. Results depend on many things outside Halo's control, including the Client's own decisions, data, staff, market and Third-Party Services. Case studies, examples, estimates and figures Halo shares are illustrative only and are not a forecast or guarantee.

13.4 Not regulated advice. Unless the SOW expressly says so, nothing Halo provides is legal, tax, financial, accounting, investment, medical or other regulated professional advice. The Client should take its own professional advice where needed.

13.5 Except as expressly provided and to the fullest extent permitted by applicable law, implied warranties, conditions and terms are excluded. Nothing in this clause limits an express obligation, the reasonable skill and care warranty in clause 13.1, or a right or liability that cannot lawfully be restricted.

14. Limitation of liability

This clause is designed so that neither party carries open-ended risk for the other. Please read it carefully.

14.1 What is never limited. Nothing in the Agreement limits or excludes either party's liability for: (a) death or personal injury caused by its negligence; (b) fraud or fraudulent misrepresentation; or (c) anything else that cannot be limited or excluded by law. The Client's obligation to pay Fees and other sums properly due (including instalments, amounts payable under clauses 8.6, 8.9 and 15.2, and amounts under clause 15.3(i) to (iii)) is not excluded by clause 14.2, is not limited by the cap in clause 14.3 and does not count towards it. Compensation for loss of bargain under clause 15.3(iv) is not excluded by clause 14.2 or limited by clause 14.3, but can never exceed the Fees that would have been payable for the remainder of the SOW or minimum term. Nothing in this clause 14 limits a data subject's rights or a regulator's powers under Data Protection Laws.

14.2 Excluded losses. Subject to clause 14.1, neither party is liable to the other, whether in contract, tort (including negligence), breach of statutory duty, misrepresentation or otherwise, for any: (a) loss of profit, revenue, sales or business, whether direct or indirect; (b) loss of anticipated savings; (c) loss of contracts or business opportunity; (d) loss of goodwill or damage to reputation; (e) loss, corruption or unavailability of data, except the reasonable cost of restoring it from the most recent backup or otherwise recovering it; (f) wasted expenditure; (g) fines or penalties imposed by a regulator or platform, to the extent the law allows them to be excluded; or (h) indirect, special or consequential loss. This clause does not exclude a refund of Fees under clause 14.5 or 15.6, amounts payable under an indemnity in clause 14.6 (which remain subject to clause 14.3), or the sums described in clause 14.1.

14.3 Cap. Subject to clauses 14.1 and 14.2, each party's total aggregate liability arising out of or in connection with each SOW, however it arises (including in contract, tort (including negligence), breach of statutory duty, misrepresentation, restitution or otherwise), is limited to the greater of (a) the total Fees paid and payable under that SOW in the 12 months before the event giving rise to the first claim (or, if the SOW had run for less than 12 months at that time, the Fees paid and payable under it up to that event) and (b) the total Fees paid and payable under that SOW in its final 12 months (or in total, if it ran for less than 12 months), up to a maximum of £500,000. All claims under an SOW, including claims under clause 14.6 and Schedule 1, share this single cap unless the SOW agrees a different cap under "Changes to the Terms".

14.4 Third-Party Services and AI. Halo has no liability for loss caused by: (a) the failure, change, unavailability or suspension of any Third-Party Service, unless caused by Halo's own failure to configure or integrate it with reasonable skill and care as required by clause 9.1; (b) the Client's reliance on an AI output without the human review required by clause 9.4; or (c) any change to a Deliverable made by anyone other than Halo after it is delivered.

14.5 Remedy for defective work. If Halo breaches clause 13.1, the Client's first remedy is for Halo to re-perform or correct the affected Services at no extra charge, provided the Client notifies Halo in writing within 30 days of becoming aware of the problem and gives Halo reasonable access to investigate. If Halo cannot do so within a reasonable time, the Client may claim a refund of the Fees paid for the affected Services, subject to the cap in clause 14.3. Halo is not liable for any additional loss that notice within that 30-day period would have avoided. This clause does not affect the warranty in Module B1.3.

14.6 Limited indemnities. (a) Halo will indemnify the Client against a third-party claim that a Bespoke Deliverable, as supplied by Halo, infringes Intellectual Property Rights enforceable in the United Kingdom, excluding claims resulting from Client Materials, the Client's unlawful instructions, Third-Party Services, open-source components, unprotectable AI-only outputs or modifications not made or authorised by Halo, except to the extent infringement was caused by Halo's own breach of an express obligation. (b) The Client will indemnify Halo against third-party claims resulting from Client Materials, unlawful instructions, or the Client's use of Services or Deliverables in material breach of the Agreement or applicable law, including outreach sent from Client accounts. (c) The indemnified party must give prompt notice, permit reasonable control of the defence and settlement, avoid admissions without consent and provide reasonable cooperation at the indemnifying party's cost. A settlement imposing obligations on the indemnified party requires its prior consent, not unreasonably withheld. These indemnities remain subject to clauses 14.1–14.3 to the extent lawful.

14.7 Time limit for claims. A party may only bring a claim against the other if it has notified the other in writing, with reasonable detail of the facts and the nature of the claim, within 12 months after it became aware (or ought reasonably to have become aware) of those facts. A claim not notified within that period is waived and cannot be brought. This clause concerns notice only and does not require proceedings to be started within that period. It does not apply to claims for unpaid Fees, claims for fraud or any liability that cannot be limited by law, and it does not extend any statutory limitation period.

14.8 No personal claims. Halo is a limited company. The Client agrees that it will bring any claim only against Halo Technology Lab Ltd and not personally against Halo's directors, employees, contractors or subcontractors. They may rely on this clause under the Contracts (Rights of Third Parties) Act 1999.

14.9 Why these limits are reasonable. The parties agree these limits are reasonable given the Fees, the availability of insurance, the Client's ability to protect itself (for example through backups, review of outputs and its own insurance), the Client's ability to agree a different cap or other changes in the SOW, and that each party has had the chance to take legal advice.

15. Term, suspension and termination

15.1 Each SOW starts on the date it is signed by both parties (or any later start date it states) and continues until the Services are complete or its stated term ends. These Terms continue to govern an SOW until it ends.

15.2 Termination for convenience. Unless the SOW or a Service Module says otherwise, either party may end an SOW by giving 30 days' written notice. Where the Client does so, it will pay for all work done to the end of the notice period, any non-cancellable third-party costs and, for fixed-price work, a fair proportion of the Fees for work in progress. Where the Fees are payable in instalments, any instalments that relate to work already done become payable immediately.

15.3 Termination for cause. Either party may end an affected SOW, or all SOWs where justified, immediately by written notice if the other: (a) commits a material breach incapable of remedy, or fails to remedy a remediable material breach within 14 days after notice specifying it; (b) becomes insolvent or subject to liquidation or administration, to the extent termination is lawful in the circumstances; or (c) ceases substantially all business operations. Halo may also terminate under clauses 4.2, 4.3 or 8.6 or where continuing performance would materially breach applicable sanctions, export controls or other law. Applicable statutory restrictions on termination and supply continue to govern. Where Halo ends an SOW because of the Client's breach (including non-payment), the Client will pay: (i) the Fees for work done to the end date; (ii) a fair proportion of the Fees for work in progress on fixed-price work; (iii) committed costs; and (iv) as compensation for loss of bargain, the Fees for the remainder of any fixed-price SOW or minimum term not covered by (i) and (ii), less the costs Halo saves because the SOW has ended. Amounts already paid, including instalments paid after acceleration under clause 8.6, are credited, and Halo will not recover the same amount twice.

15.4 Suspension. Where Halo has a right to end an SOW, it may instead suspend some or all of the Services. Halo is not liable for any effect of a suspension made in line with these Terms.

15.5 Effect of termination. On ending an SOW: (a) properly accrued Fees, reasonable agreed costs and lawful termination charges become payable; (b) subject to payment of Fees due for the relevant work, Halo will provide completed Deliverables and paid-for work in progress together with agreed documentation and credentials for Client-controlled accounts; (c) additional transition assistance is charged at the SOW day rate unless expressly included; (d) Confidential Information is handled under clause 11; and (e) Client Personal Data is returned or deleted in accordance with Schedule 1, including the Client's choice and agreed backup arrangements. Halo will not disable or withhold access to the Client's own systems or personal data contrary to applicable law or the agreed processing terms.

15.6 If the Client ends an SOW under clause 15.3 because of Halo's material breach, the Client will not owe any instalments or Fees for Services not provided by the end date, and Halo will refund any Fees already paid for those Services, including unused pre-paid hours.

15.7 Ending one SOW does not affect any other SOW. Clauses that by their nature should continue after an SOW ends (including clauses 8, 10, 11, 12, 14, 15.5, 16 and 17) continue.

16. General

16.1 Force majeure. Neither party is liable for delay or failure caused by events beyond its reasonable control, including outages of Third-Party Services or the internet, cyber attacks on third parties, natural events, epidemics, war, terrorism, civil unrest, strikes (other than of its own staff) and government action. The affected party will notify the other promptly and try to limit the effect. If the event lasts more than 60 days, either party may end the affected SOW by written notice. This clause never excuses payment of money.

16.2 Publicity and marketing.

(a) The Client grants Halo a non-exclusive, worldwide, royalty-free, perpetual licence to use, at Halo's discretion, the Client's name and logo, a description of the Services, and images, screenshots and recordings of the Deliverables (with the Client's Confidential Information and personal data removed or obscured), in Halo's website, case studies, proposals, social media, videos and other marketing in any medium. Halo will not publish images or details of a Deliverable that has not yet been publicly released without the Client's approval. This licence does not apply to the extent the SOW records a restriction under "Changes to the Terms". Halo is not required to recall material already distributed, but will remove or correct online material where the law requires it (for example where an individual exercises a data protection right).

(b) Before publishing a testimonial, quote or results figure attributed to the Client, Halo will give the Client a reasonable opportunity to check it for factual accuracy and will correct any inaccuracy the Client points out. Halo will only publish testimonials that are genuine and results it can substantiate.

(c) Where marketing material includes the name, image, voice or words of an individual, Halo will rely on its legitimate interests or that individual's consent, as appropriate, and if the individual objects will stop new uses and remove existing online uses where the law requires. The Client will make its staff aware of this clause where relevant.

16.3 Fair comment. Neither party will knowingly publish false or misleading statements intended to damage the other. This does not stop either party giving honest reviews or feedback (for example on Trustpilot or Google), making disclosures required by law, or reporting concerns to a regulator.

16.4 Anti-bribery and sanctions. Each party will comply with the Bribery Act 2010 and applicable anti-corruption laws, and with UK and other applicable sanctions and export control laws. The Client confirms that it is not owned or controlled by a person subject to UK, EU, UN or US sanctions, and will not use the Services or Deliverables in breach of those laws.

16.5 Assignment. The Client may not assign, transfer or subcontract its rights or obligations without Halo's written consent. Halo may assign the Agreement to a successor to all or part of its business, or to a group company, on written notice.

16.6 Notices. Formal notices (for example of breach, termination or a claim) must be in writing and sent by email to the address in the SOW, with a copy by post to a registered office if the notice is of breach or termination. An email notice is received at the time sent if sent between 9:00 and 17:00 on a Business Day (UK time) and otherwise at 9:00 on the next Business Day. Day-to-day communication may use any channel agreed in the SOW.

16.7 Electronic signature. SOWs and change orders may be signed electronically, including through an electronic signature platform, and in counterparts. Each counterpart is an original, and together they form one agreement.

16.8 Entire agreement. The Agreement is the whole agreement between the parties about its subject matter and replaces all earlier proposals, discussions and understandings. Each party confirms it has not relied on any statement or promise not set out in the Agreement. Nothing in this clause limits liability for fraud.

16.9 Variation and waiver. Any change to the Agreement must be in writing and agreed by both parties (clause 5 applies to scope changes). A failure or delay in enforcing a right is not a waiver of it.

16.10 Severance. If any part of the Agreement is found invalid or unenforceable, it will be changed to the minimum extent needed to make it valid, and the rest continues in force.

16.11 Third-party rights. Except under clause 14.8, no one other than the parties may enforce the Agreement under the Contracts (Rights of Third Parties) Act 1999 or any similar law.

16.12 Language. The Agreement is in English. Any translation is for convenience only and the English version prevails.

16.13 Costs. Each party pays its own costs of negotiating and entering into the Agreement.

17. Governing law and disputes

17.1 Governing law. The Agreement, and any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with it, is governed by the law of England and Wales, wherever the Client is based.

17.2 Talk first. If a dispute arises, either party may give written notice of it. The parties' named contacts will meet (in person or by video) within 10 Business Days to try to resolve it, then escalate to a director of each party for a further 10 Business Days.

17.3 Mediation. If the dispute is not resolved, the parties will consider mediation in good faith, under the CEDR Model Mediation Procedure or another procedure they agree, before starting court or arbitration proceedings. Neither party is obliged to settle.

17.4 Courts. Unless the SOW selects arbitration under clause 17.5, the courts of England and Wales have exclusive jurisdiction over any dispute.

17.5 Arbitration option for international clients. Where the SOW selects arbitration (recommended where the Client is based outside the UK), any dispute will be finally resolved by arbitration under the LCIA Rules, by a sole arbitrator, seated in London, conducted in English.

17.6 Urgent relief and debts. Nothing in this clause stops either party seeking an injunction or other urgent relief from any court, or Halo bringing a claim for unpaid Fees in the courts of England and Wales or of the country where the Client is based.

Part B - Service Modules

Each module applies only where the SOW selects it, and adds to Part A. Clause references starting with A refer to Part A.

Module B1 - Build and Implementation

For bespoke web and mobile applications, AI-powered tools and agents, integrations, automations and data pipelines.

B1.1 Discovery first. Where the SOW includes discovery or specification work, the approved PRD, TRD or other written specification becomes the baseline for subsequent agreed build milestones. Preliminary estimates do not become fixed commitments unless expressly accepted in an SOW or signed Change Order.

B1.2 Acceptance. Each agreed milestone or release is assessed against the acceptance criteria in the SOW and clause A6, normally in a staging or agreed test environment. The Client shall give timely access, test data and consolidated feedback. Security, data integrity and other material acceptance criteria identified in the SOW cannot be waived solely by lack of minor cosmetic feedback.

B1.3 Warranty period. For 30 days after Acceptance of each agreed release, Halo will remedy, without additional charge, reproducible defects that materially prevent the Deliverable from conforming to the approved specification and are attributable to Halo's work. This does not include new requirements, Client or third-party modifications, misuse, or third-party platform changes outside Halo's control, except to the extent Halo expressly assumed responsibility in the SOW. Further support is provided under Module B4 or an agreed Change Order.

B1.4 Environments and accounts. Production hosting, repositories, domain, app-store, AI-model and automation accounts should be held in the Client's name wherever practicable, with named, least-privilege access for Halo and authorised contractors. The SOW will identify any Halo-hosted environment and the agreed transition or ongoing support arrangements.

B1.5 Handover. After payment of applicable Fees, Halo will supply the agreed source code, configuration, deployment and environment information, credentials or access handover and documentation specified in the SOW. Handover excludes third-party materials that cannot be lawfully transferred and Halo Background IP beyond the licence in clause A10.3. Additional training or support requires an express SOW provision.

B1.6 Security. Halo will use reasonable secure-development practices appropriate to its agreed scope, including proportionate access controls, secrets management, code review and handling of discovered vulnerabilities. The Client remains responsible for its own security governance, backups and penetration testing unless those functions are expressly included in the SOW. Where Halo processes Client Personal Data, Schedule 1 also applies.

B1.7 No guarantee of uptime. Halo does not guarantee that Deliverables will run without interruption or error, or that they will continue to work after changes to Third-Party Services, operating systems or browsers.

Module B2 - Advisory, Consultancy and Fractional CTO

For AI strategy, technical advisory, architecture reviews, pre-paid consultancy hours and fractional CTO or technical leadership roles.

B2.1 Advisory nature. The Services are advice. The Client makes and is responsible for its own decisions, including technology choices, hiring, supplier selection, spend and product direction. Build or implementation work is outside this module unless the SOW also selects Module B1.

B2.2 Time commitment. The SOW sets out the time included (for example hours per month or days per week). Time includes preparation, reviews, follow-up and travel time where stated. Unused time does not roll over unless the SOW says so. Halo will keep a record of time used and share it on request.

B2.3 Sessions. Either party may reschedule a booked session with at least 1 Business Day's notice. Sessions cancelled by the Client with less notice, or missed, are counted as used.

B2.4 Fractional role. A named fractional CTO or equivalent acts as Halo's representative, not as the Client's employee, director or officer, unless separately and validly appointed. They cannot bind the Client, hire personnel or approve expenditure without specific written authority. The Client's directors, proprietor or other authorised decision-makers retain responsibility for governance and decisions. Halo may provide a suitably qualified substitute on reasonable notice, subject to agreed confidentiality and security obligations. Any appointment as statutory director requires a separate instrument and agreed insurance and governance arrangements.

B2.5 Work product. Reports, roadmaps, recommendations and templates prepared under this module are licensed to the Client under clause A10.4, not assigned.

B2.6 Minimum term. Monthly advisory or fractional retainers have a minimum term stated in the SOW (default 3 months), after which either party may end them on 30 days' written notice.

Module B3 - Training and Workshops

For in-person and virtual workshops, AI enablement programmes, team training and talks.

B3.1 Delivery. Sessions are delivered online unless the SOW states a venue. Where in person, the Client provides a suitable venue, screen, power and internet access, and is responsible for venue health and safety. Travel and accommodation outside the M25 are charged as expenses unless included in the Fees.

B3.2 Attendees. The SOW states the maximum number of attendees. The Client is responsible for attendees completing any pre-work and for their conduct. Halo may remove an attendee who behaves abusively or disruptively.

B3.3 Cancellation by the Client. If the Client cancels or postpones a session: more than 10 Business Days before it, no charge (Fees paid are carried forward to a rescheduled date within 6 months); 5 to 10 Business Days before, 50% of the session Fee is payable; fewer than 5 Business Days before, or if the session does not go ahead because of the Client, 100% is payable. Non-refundable travel costs are always payable.

B3.4 Cancellation by Halo. If Halo has to cancel because of illness or an event outside its control, it will offer a new date or a substitute trainer of similar experience, or refund the session Fee. Halo has no other liability for the cancellation.

B3.5 Materials and recordings. Slides, handouts, exercises, prompts, templates and agreed recordings are licensed for the Client's internal training use under clause A10.4, not for resale or delivery of courses to third parties. Recording requires both parties' prior agreement and compliance with applicable participant privacy and consent requirements, with responsibility for attendee notices allocated in the SOW.

B3.6 Exercise data. The parties will normally use fictitious, anonymised or appropriately minimised data in practical exercises. The Client must instruct participants not to input personal, confidential or regulated information into unauthorised AI tools. Halo remains responsible for any data handling within its own agreed Services and for its applicable legal obligations.

B3.7 Follow-up support. Any post-session email support is limited to clarifying the material covered, for the period stated in the SOW (default 14 days).

Module B4 - Managed Support and Maintenance

For ongoing support, maintenance, monitoring and hosting management of systems Halo has built or agreed to take on.

B4.1 What is covered. For the monthly Fee, Halo will, for the systems listed in the SOW: fix defects in the scope as delivered; keep libraries, dependencies and AI model integrations reasonably up to date; apply security patches; monitor uptime and errors where monitoring is included; and investigate incidents.

B4.2 What is not covered. New features, design changes, new integrations, migrations, data fixes caused by the Client, work caused by changes made by anyone other than Halo, retraining or replacing AI models beyond routine updates, and out-of-hours emergency work, unless the SOW includes them. These are quoted separately and need the Client's approval.

B4.3 Response targets. During the support hours expressly stated in the SOW (otherwise Halo's normal Business Day hours), Halo will aim to meet the following initial response targets. These are response targets, not guaranteed repair times:

Priority	Meaning	Response target	First action
P1 Critical	System down or unusable, no workaround	4 working hours	Start investigation and mitigation
P2 High	Major function broken, no workaround	6 working hours	Assign developer, assess fix
P3 Medium	Partial impact, workaround exists	1 Business Day	Add to maintenance queue
P4 Low	Cosmetic or minor	3 Business Days	Add to backlog

These are targets, not guarantees, and no service credits apply. Fix times depend on complexity. Halo sets the priority acting reasonably.

B4.4 Tickets and incidents. Tickets must be raised through the channel named in the SOW with sufficient details to investigate. Ordinary targets run from receipt of a sufficiently described ticket during the agreed support window. Material security incidents involving Client Personal Data will also be handled promptly under Schedule 1 and any express incident process, irrespective of whether a routine ticket is complete.

B4.5 Client changes. If the Client or a third party changes the system without telling Halo, Halo may charge for any resulting work and the response targets do not apply to issues caused.

B4.6 Add-ons. The SOW may add reserved developer hours (which do not roll over), training sessions, priority queueing, or security and compliance services, each at the price stated.

B4.7 Term. Support runs month to month from the start date, with any minimum term stated in the SOW, and either party may end it on 30 days' written notice after that. Fees are invoiced on the 1st of each month in advance and are payable within 7 days.

Module B5 - Outreach and Lead Generation Systems

For cold email and outreach infrastructure, lead list building and enrichment, sequence writing, campaign set-up and management, and related automations.

B5.1 Sender and controller. Outreach is conducted in the Client's name and for the Client's business purposes. Unless the SOW documents a different lawful arrangement, the Client determines campaign purpose and audience as controller of prospect personal data and is responsible for sender identity, lawful basis, privacy notices and honouring opt-outs. Halo acts as processor only to the extent it processes such data on the Client's behalf under Schedule 1.

B5.2 Compliance. Halo will configure agreed campaigns with appropriate sender identification and opt-out mechanisms, but the Client must approve lawful audience selection, contact channels, recipients and campaign content. In the UK, PECR rules distinguish corporate subscribers from individual subscribers, including sole traders and certain partnerships, who ordinarily require consent for unsolicited electronic marketing unless a valid exception such as the soft opt-in applies. UK GDPR obligations separately apply when personal data is used, including in B2B outreach. The Client must check local marketing requirements for other recipient countries and notify Halo promptly of objections, complaints or regulator contacts. Halo shall not knowingly execute instructions it reasonably believes are unlawful.

B5.3 Domains and accounts. Sending domains, mailboxes and platform accounts (for example Instantly) are registered in the Client's name or transferred to it on request once Fees are paid. The Client is responsible for the reputation of its domains and for not using them in ways that breach the platform's terms.

B5.4 Approval. Halo will not launch a campaign until the Client approves the audience, data sources, content, sending volumes and identified sender in writing or in a recorded message on the agreed channel. Halo will maintain reasonable evidence of that approval; authorisation does not waive either party's independent obligations under applicable law.

B5.5 No guarantee. In addition to clause A13.3, Halo does not guarantee open rates, reply rates, meetings booked, deliverability or inbox placement, and is not liable for any blocklisting, domain or account suspension, or platform action.

B5.6 Lead data. Lead data sourced from third-party providers is supplied as provided by them, without any warranty of accuracy, and subject to their terms. The Client will not use it for any purpose those terms do not allow.

Schedule 1 - Data Processing Terms

This Schedule applies where Halo processes personal data as the Client's processor ("Client Personal Data"). Terms such as controller, processor, personal data, processing, data subject and personal data breach have the meanings in the UK GDPR.

S1.1 Instructions. Halo will process Client Personal Data only on the Client's documented instructions, including regarding access from outside the UK/EEA and disclosure to AI providers or sub-processors, unless Union, Member State or UK law applicable to Halo requires otherwise. In that case Halo will inform the Client in advance unless prohibited by law. Halo will promptly tell the Client if it believes an instruction breaches applicable Data Protection Laws. Instructions may be contained in the SOW or recorded in subsequent agreed written communications.

S1.2 Details of processing. The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects for each SOW are recorded in the "Data processing" section of the SOW, together with any later written instructions (including by email) that clarify or operate within that agreed scope, which together form the processing details for this Schedule; no separate annex is needed. A material change to the types of personal data, the purpose or the scope of processing needs a Change Order under clause 5.2, except for urgent instructions needed to protect security or comply with law. Halo will not begin processing Client Personal Data until those details have been recorded, and will process it only within them. The Client's obligations and rights as controller are set out in clause 12 and this Schedule. Special category or criminal offence data may be processed only where the SOW expressly says so. Viewing identifiable information in a Client system is processing even if no copy is downloaded.

S1.3 Personnel confidentiality. Halo will ensure that persons authorised to access Client Personal Data are subject to appropriate contractual or statutory confidentiality duties, receive instructions on permitted processing, and have access only as necessary for their role.

S1.4 Security. Taking account of the state of the art, implementation costs, the processing, and risks to individuals, Halo will maintain appropriate technical and organisational security under Article 32 UK GDPR and, where applicable, EU GDPR. Measures will include, as appropriate, named accounts and least-privilege access, strong authentication, encryption in transit, secure credentials, device protections, vulnerability management, incident handling, and testing or reviewing controls. Halo will comply with additional agreed security requirements in the SOW, and will not copy Client Personal Data into its own systems unless reasonably necessary and authorised.

S1.5 Sub-processors. (a) The Client gives general authorisation for Halo to use sub-processors, including hosting, AI model, automation, communication and productivity providers. Sub-processors on Halo's Sub-processor List attached to the SOW, and contractors named in the SOW with their country, are authorised when the SOW is signed. (b) Halo will notify the Client by email of any intended new or replacement sub-processor before it is given access to Client Personal Data: at least 14 days before for a provider, and at least 5 Business Days before for a contractor engaged under Halo's Contractor Framework Agreement (whether an individual or a company), unless the SOW requires a longer period. (c) The Client may object on reasonable data protection grounds within that period. If it does, Halo will not give that sub-processor access to Client Personal Data while the parties try in good faith to resolve the objection; if they cannot, either party may end the affected Services. (d) Halo will impose data protection terms on each sub-processor that are no less protective than this Schedule, will ensure that any safeguards required by clause S1.6 are in place before access begins, and remains responsible for each sub-processor's performance. Halo's own employees are not sub-processors, and providers the Client engages directly are the Client's own suppliers.

S1.6 International transfers and access. Halo will not initiate a restricted international transfer of Client Personal Data, including where an independent overseas contractor remotely accesses Client systems, unless it is authorised by the Client's documented instructions and an applicable adequacy regulation/decision or other lawful transfer mechanism is in place. Depending on the transfer and relevant law, safeguards may include a valid UK International Data Transfer Agreement, UK Addendum to EU Standard Contractual Clauses or EU Standard Contractual Clauses, together with any transfer risk assessment (the "data protection test" under UK law) and supplementary measures that the chosen mechanism requires. Halo will identify and document the responsible exporter/importer and ensure required instruments are actually executed before access begins. Transfers subject to EU GDPR must additionally satisfy its Chapter V requirements. A provider's or country's inclusion on a list is not itself proof of an adequate safeguard.

S1.7 Assistance and compliance. Taking account of the nature of processing and information available to it, Halo will assist the Client reasonably in responding to data subject requests and in meeting obligations concerning security, breach notification, data protection impact assessments and prior consultation with regulators. Halo will promptly pass on relevant requests received directly. Substantial assistance outside the agreed scope may be charged at the SOW day rate unless required as a result of Halo's breach or prohibited by law.

S1.8 Personal data breaches. After becoming aware of a personal data breach affecting Client Personal Data, Halo will notify the Client without undue delay and in any event within 48 hours, providing details then available about its nature, likely consequences and containment steps, and supplying updates promptly as information becomes known. Halo will reasonably cooperate with the Client's investigations and required notifications. The Client, as controller, determines its statutory regulator and data subject notifications, without prejudice to duties directly applicable to Halo.

S1.9 Return and deletion. At the end of the relevant Services, Halo will, at the Client's choice, return or securely delete Client Personal Data and delete existing working copies within 30 days, except where applicable law requires retention or another agreed ongoing instruction applies. Data in routine protected backups will be put beyond ordinary use and removed in accordance with a documented reasonable deletion cycle; retained data remains protected by this Schedule. Halo will confirm completion on reasonable written request. This clause prevails over inconsistent general termination or confidentiality provisions as to Client Personal Data.

S1.10 Audit. Halo will make available the information reasonably needed to show compliance with this Schedule and Article 28 UK GDPR, and will allow for and contribute to audits, including inspections, by the Client or an auditor it appoints, on these terms: (a) Halo may first provide existing certifications, audit reports or written answers, and the Client will rely on them where they reasonably answer its questions; (b) otherwise, the Client may audit once in any 12 months, on at least 30 days' written notice, during working hours, through an auditor bound by confidentiality, in a way that minimises disruption and protects other clients' information; (c) the Client bears its own costs of any audit and Halo's reasonable costs of supporting it, unless the audit reveals a material breach of this Schedule by Halo; and (d) the once-a-year limit and 30-day notice do not apply where a regulator requires an audit or after a personal data breach affecting Client Personal Data, when reasonable shorter notice applies.

S1.11 Liability. Each party's liability to the other arising out of or in connection with this Schedule, including liability for a personal data breach and any claim between the parties for compensation, contribution or indemnity, is subject to clause 14, including the cap in clause 14.3. This does not limit either party's liability to a data subject or the powers of a regulator.