Terms and Conditions

1. Definitions

In these Terms:

• "Affiliate" means any entity that directly or indirectly controls, is controlled by, or is under common control with a party, where "control" means ownership of more than 50% of the voting interests.
• "AI Credits" means the metered units used by Pimlico to measure usage of AI-powered functionality within the XHS™ Copilot (including, for example, automated monitoring, summarisation, classification, tagging, enrichment and delivery workflows, and associated API or integration calls).
• "AI Credit Allowance" means the number of AI Credits included in the Fees for a given period, as specified in the applicable Order Form or Online Order.
• "Authorised User" means an individual who is authorised by Customer to use the XHS™ Copilot under Customer's account, and to whom unique login credentials are supplied by Pimlico.
• "Beta Customer" means a Customer that is expressly identified as participating in a beta, pilot or early-access programme for the XHS™ Copilot in an Order Form or similar document.
• "Beta Period" means, for a Beta Customer, the period of up to six (6) months from the Service start date (or such other period expressly stated in the Order Form) during which AI Credit Usage Fees and AI Credit overage charges are waived in accordance with clause 8.4.
• "Contract" means the legally binding agreement between Pimlico and Customer formed in accordance with clause 4.
• "Customer Data" means any data, content, documents, configuration, prompts, queries or other information submitted to, stored within or generated within the XHS™ Copilot by or on behalf of Customer or its Authorised Users (including personal data relating to Customer's employees, clients or other contacts).
• "Data Processing Addendum" or "DPA" means the data processing terms agreed between Pimlico and Customer from time to time, as set out in Schedule 2 (Data Processing Addendum).
• "Documentation" means any user guides, technical documentation, onboarding materials and usage policies for the XHS™ Copilot made available by Pimlico, as updated from time to time.
• "General Release" means the date on which Pimlico designates a version of the XHS™ Copilot (or relevant module) as generally available for production use outside the applicable beta, pilot or early-access programme.
• "Intellectual Property Rights" or "IPR" means patents, rights to inventions, copyright and related rights, trade marks, trade names, domain names, rights in get-up, goodwill, rights in designs, database rights, confidential information, and all similar or equivalent rights existing anywhere in the world, whether registered or unregistered.
• "Materials" means all reports, dashboards, alerts, newsletters, data outputs, analyses, research, templates, written commentary and other content provided through the XHS™ Copilot or otherwise by Pimlico (excluding Customer Data).
• "Online Order" means a subscription or purchase for the XHS™ Copilot placed through an online sign-up, in-app purchase flow or similar mechanism made available by Pimlico.
• "Service Period" or "Subscription Term" means the initial term and any renewal term(s) for the XHS™ Copilot, as specified in the applicable Order Form or Online Order.
• "Service Level Agreement" or "SLA" means the service levels and support commitments set out in Schedule 1 (Service Level Agreement), as updated from time to time in accordance with these Terms.
• "Security Overview" means any high-level description of Pimlico's technical and organisational security measures published on the XHS™ website or made available to Customer on request, as updated from time to time.
• "Services" means the XHS™ Copilot, any related APIs, professional services (including onboarding, configuration or bespoke research) and support services supplied by Pimlico under these Terms.
• "AI Credit Usage Fees" means the usage-based fees payable by Customer for consumption of AI Credits beyond any AI Credit Allowance, as specified in the applicable Order Form or Online Order.
• "Website" means any website operated by or on behalf of Pimlico through which the XHS™ Service or related information is made available.
• "XHS™ Service" means the Pimlico XHS™ software-as-a-service platform, including all modules, features, APIs, interfaces and related services supplied by Pimlico under these Terms.
• "XHS™ Copilot" means any conversational, assistant, agentic or similar AI-powered functionality made available by Pimlico as part of the XHS™ Service (including any plans or tiers branded as "XHS™ Copilot"). For the purposes of these Terms, XHS™ Copilot forms part of the XHS™ Service and is not a separate service.

2. Scope of services

2.1 Nature of the XHS™ Copilot

XHS™ is a subscription-based platform providing regulatory and market intelligence, workflow tools and analytical functionality. The precise modules, features, usage limits and Authorised User numbers purchased by Customer are set out in the applicable Order Form or Online Order and any accompanying service description.

2.2 Access methods

Customer may access the XHS™ Copilot via web interfaces, APIs, agents, integrations or other methods described in the Documentation.

2.3 AI features in the XHS™ Service

Customer acknowledges that the XHS™ Service (including any XHS™ Copilot features) uses artificial intelligence and related techniques to assist with searching, analysing and presenting information. While Pimlico aims to provide high-quality outputs, the XHS™ Service is intended as a decision-support tool and does not replace Customer's own judgement or the need for independent professional advice.

The Materials and outputs of the XHS™ Service are provided for general information only and do not constitute legal, financial, regulatory, tax or other professional advice. Customer remains responsible for assessing whether any output is appropriate for its purposes, and for verifying information that is important to its business before relying on it or acting on it.

2.4 Support and service levels

Unless expressly stated otherwise in an Order Form:

• Pimlico will provide reasonable remote support during normal business hours for issues relating to the XHS™ Copilot; and
• any uptime, response-time or service credit commitments will be as expressly set out in the Order Form or a separate service level agreement (if any). Any service credits specified in such documents shall be Customer's sole and exclusive remedy for service availability or performance issues.

2.5 Beta programme and General Release

Where Customer is a Beta Customer:

• during the Beta Period, Pimlico will make the relevant XHS™ Copilot functionality available on a beta, pilot or early-access basis and may change, suspend or withdraw such functionality at any time;
• during the Beta Period, there will be no contractual limit on the number of Authorised Users or monitored jurisdictions that may access or use the XHS™ Copilot for Customer's internal business purposes, provided Customer's use remains reasonable and in accordance with these Terms; and
• Customer's use of AI-powered functionality during the Beta Period will be measured in AI Credits but AI Credit Usage Fees and associated overage charges for such usage will be waived in accordance with clause 8.4.

Pimlico will notify the Beta Customer when the relevant functionality moves to General Release. From the effective date of General Release, the charging of AI Credit Usage Fees will commence or continue in accordance with clause 8 and the applicable Order Form.

3. Eligibility, authority and customer responsibilities

3.1 Business use only

Customer warrants that it is entering into these Terms in the course of its trade, business or profession and not as a consumer, and that it is acquiring the XHS™ Service solely for business and not for private or domestic use.

3.2 Authority and internal approvals

Customer represents and warrants that:

• the individual accepting these Terms or signing the relevant Order Form has full authority to bind Customer to the Contract;
• Customer has obtained all necessary corporate approvals and internal consents required to enter into and perform the Contract; and
• entering into and performing the Contract will not cause Customer to breach any other agreement or obligation to which it is subject.

3.3 Customer information and contacts

Customer warrants that all information it provides to Pimlico (including in any Order Form, Online Order, vendor set-up process or subsequent update) is true, accurate and complete, and will promptly update such information if it changes. This includes, without limitation:

• legal name and registered details of Customer;
• billing and tax information (including any applicable VAT registration numbers); and
• nominated administrative, technical and billing contacts for the XHS™ Service.

Customer is responsible for ensuring that its nominated contacts have the necessary authority to give instructions to Pimlico in relation to the Services.

3.4 Compliance with laws and internal policies

Customer is responsible for:

• complying with all applicable laws, rules and regulations in connection with its access to and use of the XHS™ Service and Materials, including any sector-specific rules that apply to its business (for example, financial services, gambling, payments, data protection or competition laws); and
• determining how the XHS™ Service fits within its own internal policies, controls and governance frameworks (including, where relevant, model risk, operational resilience and outsourcing policies), and for configuring its use of the XHS™ Service accordingly.

3.5 Responsibility for accounts and Authorised Users

Customer is responsible for:

• all activities occurring under its accounts, whether by Authorised Users or otherwise, and whether such use is authorised by Customer or not;
• establishing and maintaining appropriate user access controls (including the allocation and revocation of roles and permissions for Authorised Users); and
• ensuring that all Authorised Users are made aware of, and comply with, these Terms and the Documentation.

Customer shall promptly notify Pimlico if it becomes aware of any unauthorised access to the XHS™ Service, misuse of credentials or other security incident relating to its accounts.

3.6 Third-party users

If Customer permits contractors, advisers or other third parties to act as Authorised Users, Customer remains responsible for their acts and omissions as if they were Customer's own employees and shall ensure that any such third parties use the XHS™ Service only for Customer's internal business purposes and in accordance with these Terms.

4. Orders, formation of Contract and priority

4.1 Orders

Services may be ordered:

• by signing an Order Form provided by Pimlico; or
• by completing an Online Order.

4.2 Offer and acceptance

• Submission of a signed Order Form by Customer constitutes an offer to purchase the Services on these Terms (together with any terms in the Order Form that supplement, but do not conflict with, these Terms).
• Completion of an Online Order and payment of the relevant fees constitutes an offer to purchase the Services on these Terms and any plan-specific details presented at checkout.
• The Contract between Pimlico and Customer is formed when Pimlico issues written confirmation (including by email or through the XHS™ Service interface) or enables Customer's access to the XHS™ Service (whichever is earlier).

4.3 Priority of documents

In case of conflict or inconsistency, the following order of precedence applies:

1. the Order Form (including any specific service descriptions or SLAs therein);
2. any service-specific policy expressly incorporated into the Order Form;
3. these Terms;
4. the Documentation; and
5. any other document.

4.4 Visitors

Where Customer or its personnel access any public portion of the Website without an Order Form or Online Order, a Contract is formed when they first access or use those sites, and these Terms apply (mutatis mutandis) to that use.

5. Access, accounts and security

5.1 Account creation

Once the Contract is formed, Pimlico will issue login credentials for the agreed number and type of Authorised Users or provide access keys for API-based use of the XHS™ Service.

5.2 Customer responsibilities

Customer shall:

• ensure that each username and password is used only by a single individual Authorised User;
• keep all credentials secure and confidential;
• promptly notify Pimlico if it becomes aware of any actual or suspected unauthorised use of its accounts or credentials; and
• maintain appropriate security, backup and virus-protection measures in relation to its own systems and devices.

5.3 Unauthorised access

Pimlico is not liable for any loss or damage arising from unauthorised access to the XHS™ Service resulting from Customer's or its Authorised Users' failure to safeguard credentials.

5.4 Connectivity and equipment

Customer is solely responsible for procuring and maintaining network connections, hardware, software, browsers and other equipment necessary for accessing the Services. Pimlico is not responsible for any failure to access the Services caused by Customer's systems, connectivity or third-party providers.

6. Licence grants and use restrictions

6.1 Licence to use the XHS™ Service and Materials

Subject to timely payment of all applicable fees and compliance with the Contract, Pimlico grants to Customer, for the Subscription Term, a non-exclusive, non-transferable, non-sublicensable, limited licence to:

• allow Authorised Users to access and use the XHS™ Service in accordance with the Documentation and these Terms; and
• access, view and use the Materials internally for Customer's own business purposes only.

Unless expressly stated in the Order Form, Customer's licence is limited to internal business use and does not permit resale, onward provision as a service, or redistribution of Materials to third parties.

6.2 Permitted internal use of Materials

Each Authorised User may, for Customer's internal business purposes:

• display Materials on screen;
• download and store a reasonable number of extracts from Materials; and
• print a reasonable number of copies of such extracts,

provided that Customer maintains all notices of Pimlico's and third parties' rights and complies with the restrictions in clause 6.3.

6.3 Restrictions

Customer shall not (and shall ensure that Authorised Users do not), except to the extent expressly permitted by law and not capable of exclusion by agreement:

• copy, reproduce, modify, adapt, translate, create derivative works from, frame, mirror or otherwise exploit any part of the XHS™ Service or Materials (other than as expressly permitted under clause 6.2);
• sublicense, sell, rent, lease, transfer, distribute, provide as a service bureau or otherwise commercially exploit the XHS™ Service or Materials to any third party;
• attempt to reverse engineer, disassemble, decompile or otherwise derive source code from any software forming part of the XHS™ Service (except to the limited extent permitted by section 50B of the Copyright, Designs and Patents Act 1988 and only after giving Pimlico prior written notice);
• bypass or interfere with any security, access control or rate-limiting mechanisms;
• access or use the Services in order to build a product or service that is competitive with the XHS™ Service or that replicates any substantial part of its functionality, architecture or content;
• systematically download, scrape, harvest, cache or store Materials to create a database or archive of regulatory or market content (whether in electronic or physical form) other than as reasonably required for internal use;
• remove, obscure or alter any copyright, trade mark or other proprietary notices;
• carry out or commission any benchmarking, penetration testing or load testing of the XHS™ Service without Pimlico's prior written consent;
• use the Services in any unlawful, fraudulent or abusive manner, including in breach of applicable sanctions, export controls, data protection or financial crime laws; or
• use the Services in high-risk environments where failure could reasonably be expected to result in death, personal injury, or severe physical or environmental damage.

Pimlico may suspend or restrict access to the Services (without liability) where it reasonably suspects that the Services are being used in breach of this clause 6.3 or otherwise in a way that may compromise security, integrity or availability.

7. Customer obligations and Customer Data

7.1 Customer obligations

Customer shall:

• use the XHS™ Service and Materials only in accordance with these Terms, the Documentation and applicable laws;
• provide Pimlico with all co-operation and information reasonably required to deliver the Services;
• promptly correct any errors in its own systems or software that adversely impact the XHS™ Service;
• ensure that Customer Data does not contain viruses, malicious code or other harmful components; and
• ensure that it has obtained all necessary rights, licences and consents (including from data subjects) to upload, process and use Customer Data in connection with the Services.

7.2 Ownership of Customer Data

As between the parties, Customer retains all rights, title and interest (including IPR) in and to Customer Data. Pimlico acquires no rights to Customer Data except as expressly granted in these Terms.

7.3 Licence to Customer Data

Customer grants Pimlico a non-exclusive, worldwide, royalty-free licence to host, copy, process, transmit and otherwise use Customer Data:

• to provide, support and maintain the XHS™ Service and related Services;
• to prevent or address service, security or technical issues; and
• as otherwise documented in the Contract or instructed by Customer.

7.4 Aggregated and anonymised data

Pimlico may collect and use (during and after the Subscription Term) aggregated and anonymised data derived from Customer's use of the Services, provided that such data does not identify Customer or any individual. Pimlico may use such data to operate, analyse, improve and develop the XHS™ Service and its business, and may publish high-level statistical information that does not identify Customer.

7.5 Responsibility for Customer Data

Customer is solely responsible for the accuracy, quality, legality and appropriateness of Customer Data and for how it uses the outputs of the XHS™ Service. Pimlico has no obligation to monitor Customer Data but may remove or disable access to Customer Data that it reasonably believes to be unlawful, in breach of these Terms or otherwise likely to give rise to liability.

8. Fees, billing and payment

8.1 Fees

Fees for the Services are set out in the Order Form, Online Order or applicable plan description and, unless stated otherwise, are:

• exclusive of VAT and any other applicable taxes, which shall be added at the appropriate rate; and
• based on (i) subscription or base fees for access to the XHS™ Copilot and its modules, and (ii) usage-based AI Credit charges, together with any other metrics specified in the Order Form or plan.

Where Customer exceeds any agreed usage parameters or AI Credit Allowance, Pimlico may charge additional fees at the overage rates set out in the Order Form or otherwise notified to Customer.

8.2 Subscription commitment and auto-renewal

Unless the Order Form states otherwise:

• each Subscription Term is twelve (12) months, or such other period expressly stated in the Order Form;
• Customer commits to the full fees for the Subscription Term, which are collected on a monthly schedule as set out in clause 8.3; and
• at the end of each Subscription Term, the subscription will automatically renew for a further Subscription Term of the same length (twelve months or the alternative period stated in the Order Form), unless either party gives notice in accordance with clause 9.1.

8.3 Payment method and timing (card, monthly)

Unless the Order Form expressly states different billing terms:

• fees for each Subscription Term are payable in equal monthly instalments in advance, calculated by dividing the total subscription or base fees for the Subscription Term by the number of months in that term;
• the first monthly instalment is due and will be charged on the date the Customer signs the relevant Order Form or completes the Online Order (as applicable);
• subsequent monthly instalments will be charged automatically on or around the same calendar day each month during the Subscription Term (or, where the month has no such day, on the last day of that month); and
• by providing card details, the Customer represents that it is authorised to use the relevant card and authorises Pimlico and its third-party payment processors to charge all amounts due under the Contract on a recurring basis using that card (or any replacement card the Customer later provides).

8.4 AI Credit charging model

AI Credits are used to measure Customer's usage of AI-powered functionality within the XHS™ Copilot. Unless the Order Form states otherwise:

• an AI Credit Allowance for a given period (for example, per month) will be set out in the Order Form or applicable plan description;
• where Customer's AI Credit consumption in that period exceeds the AI Credit Allowance, AI Credit Usage Fees will apply to the excess usage at the rates specified in the Order Form or applicable plan description;
• Pimlico will make reasonable usage and consumption information available to Customer via the XHS™ Copilot or other reporting mechanism so that Customer can monitor its AI Credit consumption; and
• AI Credit Allowances, rate cards and overage pricing may be updated by Pimlico for any renewal Subscription Term in accordance with clause 8.9.

For Beta Customers, during the Beta Period:

• AI Credit consumption will continue to be measured and reported, but AI Credit Usage Fees and overage charges for AI Credit consumption will be waived; and
• all other fees set out in the Order Form, including any subscription or base fees, remain payable.

From the earlier of (a) the end of the Beta Period or (b) the applicable General Release date notified by Pimlico, AI Credit Usage Fees and overage charges will become payable in accordance with the Order Form and this clause 8.4.

8.5 Changes during the Subscription Term

If the Customer upgrades its plan, adds modules or increases the number of Authorised Users or other billable units during a Subscription Term, Pimlico may:

• increase the monthly instalments for the remainder of that Subscription Term to reflect the new scope; and
• where applicable, charge a pro-rated amount for the period from the date of the change to the next billing date.

8.6 Card failures and alternative payment

The Customer must ensure that its payment card details remain valid and that sufficient funds are available. If a card payment fails:

• Pimlico may notify the Customer and request updated payment details;
• the Customer shall provide valid replacement details promptly; and
• Pimlico may, if payment has not been successfully taken within 7 days of the due date, suspend access to the Services until payment is received in cleared funds.

Pimlico may, at its discretion, agree to accept payment by invoice and bank transfer for some or all fees, in which case the due date for such invoice(s) shall be as stated on the invoice and interest may accrue under clause 8.7.

8.7 Late payment and interest

Without prejudice to Pimlico's other rights:

• Pimlico may charge interest on any overdue amount that is not collected by card on the due date at the rate of 5% per annum above the Bank of England base rate, accruing daily from the due date until payment is received in full; and
• Pimlico may suspend access to the Services under clause 8.6 and/or clause 9.5 where undisputed amounts remain unpaid.

8.8 Taxes

The Customer is responsible for all applicable taxes arising out of the Contract, other than Pimlico's own corporation tax. If any withholding or deduction is required by law, the Customer shall increase the amount it pays such that Pimlico receives the full amount it would have received had no withholding or deduction been required.

8.9 Price changes and renewals

Pimlico may adjust pricing, including subscription or base fees, AI Credit Allowances and AI Credit Usage Fees, for any renewal Subscription Term by notifying the Customer in writing at least 60 days prior to the end of the then-current Subscription Term. If the Customer does not wish to renew at the updated price, it may choose not to renew in accordance with clause 9.1.

8.10 Non-payment and refunds

Pimlico reserves the right to deny or suspend access to any Services for which fees and applicable taxes have not been received in cleared funds. Except as expressly stated in these Terms or the Order Form, all fees are non-cancellable and non-refundable, irrespective of actual usage.

9. Term, renewal and termination

9.1 Subscription Term and non-renewal

The Subscription Term is as stated in the Order Form or Online Order. If no period is stated, the Subscription Term is twelve (12) months from the date the Customer signs the relevant Order Form or completes the Online Order (as applicable).

At the end of each Subscription Term, the subscription will automatically renew for a further Subscription Term of the same length, unless either party gives the other at least 30 days' written notice of non-renewal before the end of the then-current Subscription Term.

9.2 Termination for convenience (where allowed)

Where expressly stated in the Order Form or applicable plan, Customer may terminate a month-to-month or other flexible plan by giving Pimlico at least 30 days' written notice, effective at the end of the then-current billing period. Pre-paid annual or multi-year subscriptions are otherwise non-cancellable except as provided in clauses 9.4 or 10.6.

9.3 Termination for breach or insolvency

Either party may terminate the Contract by written notice if the other party:

• commits a material breach of the Contract and fails to remedy it within 30 days of receiving written notice describing the breach; or
• becomes insolvent, enters into administration or liquidation (other than for a bona fide solvent restructuring), or suffers any analogous event under the laws of its jurisdiction.

9.4 Termination by Customer for materially detrimental changes

If Pimlico makes a change to the Services or these Terms that materially and adversely affects Customer's permitted use of the Services, Customer may terminate the Contract by giving written notice before the change takes effect. If Customer terminates under this clause 9.4, Pimlico will refund a pro-rata portion of any pre-paid fees for the unused remainder of the Subscription Term. This is Customer's sole and exclusive remedy for such changes.

9.5 Termination or suspension for misuse

Pimlico may suspend or terminate access to the Services immediately on written notice if it reasonably believes that:

• the Services are being misused, used fraudulently or unlawfully;
• Customer has provided false or misleading information; or
• there is any other material breach of these Terms that justifies immediate suspension to protect the Services, other customers or third parties.

9.6 Effect of termination

On expiry or termination of the Contract for any reason:

• all rights to access and use the Services and Materials (other than Materials already lawfully downloaded and retained for internal records) shall cease;
• Customer shall immediately stop all use of the Services and Materials and pay all outstanding fees and charges;
• Pimlico will, on request made within 30 days of termination, provide Customer with a copy of Customer Data in a commonly used, machine-readable format, to the extent reasonably practicable. After this period, Pimlico will delete or anonymise Customer Data in its production systems, except to the extent Pimlico is required to retain certain data by law or for the establishment, exercise or defence of legal claims; and
• clauses which by their nature should continue (including clauses 7.2–7.4, 8, 9.6, 10–18 and the Schedules) shall survive termination or expiry.

10. Intellectual property

10.1 Pimlico IPR

Pimlico and its licensors own all right, title and interest (including IPR) in and to:

• the XHS™ Service, Documentation and underlying software;
• the Materials (including all reports, templates, data models and analyses produced by Pimlico, whether standard or bespoke); and
• all modifications, enhancements and derivative works of the foregoing,

in each case excluding Customer Data. No ownership rights are transferred to Customer under these Terms; only the limited licences set out herein are granted.

10.2 Customer IPR

Customer retains ownership of all IPR in Customer Data and any items supplied by Customer to Pimlico. Customer grants Pimlico the licences described in clause 7.3.

10.3 Use of Pimlico marks

Customer shall not use any Pimlico trade marks, logos or branding except as expressly permitted in writing by Pimlico.

10.4 Feedback

If Customer or its Authorised Users provide feedback, ideas or suggestions regarding the XHS™ Service or any other Services (Feedback), Pimlico may use such Feedback without restriction and without obligation to Customer. Customer assigns (or shall procure assignment of) all rights in Feedback to Pimlico to the fullest extent permitted by law.

10.5 IPR indemnity

Pimlico shall defend Customer against any claim by a third party that Customer's authorised use of the XHS™ Service or standard Materials in accordance with these Terms infringes that third party's IPR in the United Kingdom, and shall pay any damages, costs and expenses finally awarded against Customer by a court of competent jurisdiction or agreed in settlement, provided that Customer:

• promptly notifies Pimlico in writing of the claim;
• allows Pimlico sole control of the defence and settlement of the claim; and
• provides all reasonable co-operation at Pimlico's expense.

10.6 IPR indemnity exceptions and remedies

Pimlico shall have no liability under clause 10.5 to the extent the claim arises from:

• Customer Data;
• Customer's combination of the Services or Materials with products, services or data not supplied or authorised in writing by Pimlico;
• Customer's use of the Services in breach of these Terms; or
• use of an outdated version of the XHS™ Service where the claim could have been avoided by using a version or configuration provided by Pimlico.

If a claim is made or threatened, Pimlico may, at its option and expense:

• procure for Customer the right to continue using the affected Services;
• modify the Services so they are non-infringing without materially reducing functionality; or
• terminate the affected Services and refund a pro-rata portion of pre-paid fees for the unused remainder of the Subscription Term.

This clause 10.6 states Customer's sole and exclusive remedy in respect of any IPR infringement claim relating to the Services or Materials.

11. Confidentiality

11.1 Confidential Information

"Confidential Information" means all information disclosed by or on behalf of one party (Disclosing Party) to the other party (Receiving Party) in connection with the Contract that is either marked or identified as confidential or that would reasonably be understood to be confidential given the nature of the information and circumstances of disclosure. Pimlico's Confidential Information includes the Services, Materials, Documentation, pricing and any non-public technical or business information. Customer's Confidential Information includes Customer Data that is not publicly available.

11.2 Obligations

The Receiving Party shall:

• use the Disclosing Party's Confidential Information only for the purposes of performing or receiving the Services under the Contract;
• not disclose the Confidential Information to any third party except to its employees, contractors or professional advisers who have a need to know and are bound by obligations of confidentiality no less protective than those in these Terms; and
• protect the Confidential Information using at least the same degree of care it uses to protect its own similar information, and in any event not less than reasonable care.

11.3 Exceptions

The obligations in clause 11.2 do not apply to information that:

• is or becomes public through no fault of the Receiving Party;
• was lawfully known to the Receiving Party before disclosure;
• is lawfully received from a third party without breach of any duty of confidence; or
• is independently developed by the Receiving Party without use of or reference to the Disclosing Party's Confidential Information.

11.4 Required disclosure

The Receiving Party may disclose Confidential Information if required by law, court order or regulatory authority, provided it (where lawful to do so) gives the Disclosing Party reasonable advance notice and co-operates (at the Disclosing Party's expense) in any effort to resist or limit such disclosure.

11.5 Equitable relief

Unauthorised disclosure or use of Confidential Information may cause irreparable harm. Without prejudice to any other rights or remedies, the Disclosing Party is entitled to seek injunctive or other equitable relief for any breach of this clause 11.

12. Data protection, privacy and security

12.1 Roles

The parties acknowledge that, in providing the XHS™ Service, Pimlico may process personal data on behalf of Customer. Where Pimlico acts as a processor and Customer as controller (as defined in the UK General Data Protection Regulation and the Data Protection Act 2018), the parties shall comply with their respective obligations under applicable data protection laws, and Pimlico shall process personal data only on Customer's documented instructions (unless required otherwise by applicable law).

12.2 Data Processing Addendum

Where Pimlico processes personal data as a processor on behalf of Customer, the parties agree that the Data Processing Addendum in Schedule 2 (Data Processing Addendum) applies and forms part of the Contract. In the event of any conflict between these Terms and the Data Processing Addendum in relation to the processing of personal data, the Data Processing Addendum shall prevail.

12.3 Privacy Policy

Any personal data provided to Pimlico (including contact details for Authorised Users and Customer representatives) will be handled in accordance with Pimlico's Privacy Policy as updated from time to time and accessible via the XHS™ website. The Privacy Policy describes, among other things, how Pimlico collects and uses personal data as an independent controller for its own business purposes (for example, billing, account management and product improvement).

12.4 Information security

Pimlico will implement and maintain appropriate technical and organisational measures to protect Customer Data against unauthorised or unlawful processing and against accidental loss, destruction or damage, having regard to the nature of the Services, the information to be protected and the state of technological development.

Without prejudice to Customer's obligations under these Terms:

• Pimlico's current technical and organisational measures are further described in the Security Overview or similar documentation made available by Pimlico on request or via the XHS™ website, as updated from time to time; and
• updates to such documentation will not materially reduce the overall level of protection for Customer Data during the then-current Subscription Term.

Customer remains responsible for securing its own networks, devices and systems used to access the XHS™ Service, and for configuring the XHS™ Service and managing Authorised Users and permissions in accordance with its own security, governance and access-control policies.

12.5 Use of Customer Data for AI, logging and analytics

Pimlico may use Customer Data:

• to provide, operate, support and improve the XHS™ Service for Customer (including troubleshooting, monitoring, capacity planning and performance optimisation); and
• in aggregated and/or anonymised form, in accordance with clause 7.4, to improve and develop Pimlico's products and services.

Pimlico will not use Customer Data to train or fine-tune any foundation model or generally-available AI model intended for use by other customers, unless:

• Customer has expressly agreed to such use in writing or via an in-product setting; or
• the data has been anonymised and/or aggregated such that Customer and data subjects are not identifiable.

The XHS™ Service may record logs, prompts and interaction data for security, audit, troubleshooting and product improvement purposes. Pimlico will retain such data for no longer than is necessary for those purposes, subject to any longer retention required by law.

12.6 Security incidents and personal data breaches

If Pimlico becomes aware of a personal data breach affecting Customer Data (as defined in applicable data protection laws), Pimlico shall:

• notify Customer without undue delay after becoming aware of the breach; and
• provide information and co-operation reasonably requested by Customer to meet its own obligations under applicable data protection laws (for example, notifications to regulators or affected individuals),

in each case to the extent such information is reasonably available to Pimlico and provided that Customer is responsible for assessing whether any regulatory or other notifications are required. Nothing in this clause limits the Parties' respective obligations under the Data Processing Addendum.

13. Warranties and disclaimers

13.1 Mutual warranties

Each party warrants that:

• it has full power and authority to enter into and perform the Contract; and
• entering into and performing the Contract will not cause it to breach any other agreement or legal obligation.

13.2 Service warranty

Pimlico will provide the Services with reasonable skill and care and in material accordance with the Documentation.

13.3 Beta or trial features

From time to time, Pimlico may make preview, beta or trial features or modules of the XHS™ Copilot (including AI-powered functionality measured in AI Credits) available. Such features are provided "as is" without warranty, may be changed, suspended or withdrawn at any time and are not subject to any service level or support commitments. For Beta Customers, the Beta Period and any waiver of AI Credit Usage Fees are as described in clauses 1 and 8.4. All other Terms continue to apply in full during any beta, pilot or early-access use.

13.4 Exclusions

Except as expressly stated in these Terms, and to the fullest extent permitted by law:

• the Services and Materials are provided "as is";
• Pimlico does not warrant that the Services will be uninterrupted or error-free, or that they will meet Customer's specific requirements;
• Pimlico gives no warranty as to the accuracy, completeness or currency of any particular piece of information within the Materials, or that any particular regulatory, compliance or commercial outcome will be achieved; and
• all warranties, terms and conditions implied by statute, common law or otherwise (including implied warranties of satisfactory quality, fitness for a particular purpose and non-infringement) are excluded.

13.5 Customer warranties

Customer warrants that:

• it has and will maintain all rights, licences and consents necessary to provide Customer Data and to use the Services;
• its use of the Services and the Customer Data will not infringe any third-party rights or violate any applicable law; and
• it will use reasonable professional standards in relying on and applying outputs from the XHS™ Service, and will not treat any Materials as a substitute for independent professional advice.

13.6 AI-specific disclaimers

Customer acknowledges and agrees that:

• the XHS™ Service uses artificial intelligence and machine learning models, which by their nature may generate outputs that are incorrect, incomplete, biased, offensive or otherwise unsuitable;
• Pimlico does not guarantee that any particular output will be accurate, complete, lawful, free from third-party rights, or suitable for any specific use case;
• the same or similar outputs may be generated for other customers or users; and
• Customer is solely responsible for reviewing, testing and validating outputs and for implementing appropriate human review, quality control and approval processes before using any outputs in its business, providing them to third parties or relying on them for any decisions.

Without limiting clauses 13.4 and 15, Pimlico shall have no liability for any loss or damage arising from Customer's or any third party's use of, reliance on, or actions taken in response to, any output generated or delivered by the XHS™ Service, except to the extent that such liability cannot lawfully be excluded and in all cases subject to the limitations set out in clause 15.

14. Indemnities

14.1 Customer indemnity

Customer shall indemnify and keep indemnified Pimlico from and against all losses, damages, costs (including reasonable legal fees) and expenses arising out of any third-party claim relating to:

• Customer Data (including allegations that Customer Data infringes any IPR or privacy rights or is otherwise unlawful);
• Customer's use of the Services in breach of these Terms or applicable law; or
• any combination of the Services with third-party products or services not supplied or authorised by Pimlico that gives rise to the claim.

14.2 Procedure

Pimlico shall:

• promptly notify Customer of any claim for which it seeks indemnity;
• allow Customer sole control of the defence and settlement of the claim (provided that Customer shall not settle any claim in a way that imposes any admission of liability or non-monetary obligation on Pimlico without Pimlico's prior written consent); and
• provide reasonable co-operation at Customer's expense.

15. Limitation of liability

15.1 Non-excludable liability

Nothing in these Terms limits or excludes either party's liability for:

• death or personal injury caused by negligence;
• fraud or fraudulent misrepresentation; or
• any other liability that cannot be excluded or limited under applicable law.

15.2 Excluded types of loss

Subject to clause 15.1, neither party shall be liable to the other (whether in contract, tort, negligence, misrepresentation, restitution or otherwise) for:

• loss of profits, revenue or anticipated savings;
• loss of business, contracts or opportunity;
• loss of or damage to goodwill or reputation;
• loss or corruption of data; or
• any indirect, consequential or special loss or damage,

in each case arising out of or in connection with the Contract, even if foreseeable.

15.3 Overall cap

Subject to clauses 15.1 and 15.2, Pimlico's total aggregate liability to Customer arising out of or in connection with the Contract (whether in contract, tort, negligence, misrepresentation, restitution or otherwise) in any 12-month period shall be limited to the total fees paid by Customer to Pimlico under the Contract in that 12-month period.

15.4 Customer responsibility

Customer acknowledges that:

• it is solely responsible for how it interprets and applies the Materials and outputs of the XHS™ Service; and
• it must not rely on the XHS™ Service as the sole basis for regulatory, legal or strategic decision-making.

15.5 Service levels

Customer's sole and exclusive remedy (and Pimlico's entire liability) in respect of any failure to meet the service levels or availability targets described in Schedule 1 (Service Level Agreement) is the award of any applicable service credits in accordance with that Schedule, in each case subject to the exclusions and procedures set out therein and to the overall limitations in this clause 15.

16. Service changes, maintenance and updates

16.1 Service changes

Pimlico may improve, update or modify the XHS™ Service from time to time (including adding, removing or changing features or content), provided that such changes do not materially reduce the overall functionality of the Services purchased by Customer during the then-current Subscription Term. Where Pimlico intends to make a change that would materially reduce such functionality, it will give Customer reasonable prior notice and Customer may exercise its rights under clause 9.4.

16.2 Changes to these Terms

Pimlico may amend these Terms from time to time. For existing Customers, material changes will normally take effect from the start of the next renewal Subscription Term, unless a change is required earlier by law, regulation or a regulator. Pimlico will notify Customer of any material change in a reasonable manner (for example by email or via the XHS™ Service interface).

16.3 Planned maintenance

Pimlico may carry out scheduled maintenance which may cause temporary unavailability. Pimlico will use reasonable efforts to schedule such maintenance outside normal business hours and to give advance notice via the XHS™ Service or email.

16.4 Emergency maintenance

Pimlico may carry out emergency maintenance without prior notice where necessary to address urgent security or stability issues, and will use reasonable efforts to minimise disruption.

17. Force majeure

Neither party shall be liable for any delay or failure in performing its obligations (other than payment obligations) to the extent such delay or failure is caused by events beyond its reasonable control, including but not limited to acts of God, natural disasters, epidemics or pandemics, war, terrorism, civil commotion, strikes or other industrial disputes, failure of utilities or telecommunications, or governmental restrictions. The affected party shall use reasonable endeavours to mitigate the effects of such events.

18. Compliance, notices and general

18.1 Anti-bribery, sanctions and export

Customer shall comply with all applicable anti-bribery, anti-corruption, sanctions and export control laws, including the UK Bribery Act 2010 and any applicable local laws. Customer shall not use the XHS™ Service in any country or territory, or for the benefit of any individual or entity, in breach of such laws or applicable sanctions.

18.2 Assignment

Customer may not assign, transfer or sub-contract any of its rights or obligations under the Contract without Pimlico's prior written consent (not to be unreasonably withheld). Pimlico may assign or transfer its rights and obligations under the Contract to an Affiliate or in connection with a merger, acquisition or sale of substantially all of its assets relating to the Services.

18.3 Third-party rights

The Contract is not intended to confer any rights on any third party, and no person other than the parties shall have any rights under the Contracts (Rights of Third Parties) Act 1999 to enforce any of its terms.

18.4 Relationship of the parties

Nothing in the Contract is intended to or shall operate to create a partnership, joint venture, agency or employment relationship between the parties. Neither party has authority to bind the other in any way.

18.5 Entire agreement

The Contract constitutes the entire agreement between the parties regarding its subject matter and supersedes all prior agreements, arrangements and understandings. Each party acknowledges that in entering into the Contract it does not rely on any statement, representation or warranty not set out in the Contract.

18.6 Severance

If any provision of the Contract is held to be invalid, illegal or unenforceable, it shall be deemed modified to the minimum extent necessary to make it valid, legal and enforceable. If such modification is not possible, the relevant provision shall be deemed deleted. Any such modification or deletion shall not affect the validity of the remaining provisions.

18.7 Waiver

A failure or delay by either party to exercise any right or remedy under the Contract shall not constitute a waiver of that or any other right or remedy. A waiver of any right or remedy shall be effective only if in writing and signed by the waiving party.

18.8 Notices and contact details

Formal notices under the Contract must be in writing and sent:

• by hand or pre-paid recorded delivery post to the registered office or principal place of business of the recipient; or
• by email to the email address specified in the Order Form (or, for Pimlico, to contact@pimlicosolutions.com, or such other address Pimlico notifies).

Notices sent by post are deemed received two business days after posting within the UK (or five business days if sent internationally). Notices sent by email are deemed received at the time of transmission, provided no delivery failure notice is received.

If you have any questions about these Terms, you may contact Pimlico at contact@pimlicosolutions.com.

18.9 Governing law and jurisdiction

The Contract and any dispute or claim arising out of or in connection with it (including non-contractual disputes or claims) shall be governed by and construed in accordance with the laws of England and Wales, and the parties submit to the exclusive jurisdiction of the courts of England and Wales.

Schedule 1 – Service Level Agreement

This Schedule 1 (the "Service Level Agreement" or "SLA") forms part of the Contract between Pimlico and Customer and sets out the service levels and support commitments that apply to the production XHS™ Service, subject to Customer's payment of all applicable fees in accordance with the Contract.

1. Scope and relationship with the Terms

1.1 This SLA applies only to the production instance of the XHS™ Service used by Customer under a paid Subscription Term. It does not apply to:

• any free trial, proof-of-concept, beta, pilot or early-access environment; or
• any professional services, bespoke research or deliverables outside the XHS™ Service.

1.2 If there is any conflict between this SLA and the main body of the Terms, the Terms shall prevail, except that this SLA governs:

• how service availability is measured; and
• the calculation and application of any service credits.

1.3 Service credits, where applicable, are not refundable in cash and may only be applied as a discount against future fees for the XHS™ Service. Service credits do not increase or alter the limitations of liability in clause 15 of the Terms.

1.4 Customer's sole and exclusive remedy (and Pimlico's entire liability) in respect of any failure to meet the availability or service levels set out in this SLA is the award of service credits, in accordance with this Schedule and subject to the Contract.

2. Definitions (SLA)

For the purposes of this Schedule:

• "Business Day" means Monday to Friday, excluding public holidays in England.
• "Business Hours" means 09:00–18:00 (UK time) on a Business Day.
• "Monthly Service Fee" means the subscription or base fee charged for the XHS™ Service for the relevant calendar month for the affected environment, excluding any usage-based AI Credit charges and any professional services or one-off fees.
• "Service Month" means a calendar month.
• "Service Availability" means the percentage of time in a Service Month during which the production XHS™ Service is available for Customer to send requests and receive responses at the service boundary, excluding Planned Maintenance and Excluded Events (as defined below).

  Service Availability for a Service Month is calculated as:

  Service Availability (%) = [(Total minutes in the Service Month - Downtime) / Total minutes in the Service Month] × 100

• "Downtime" means the total number of minutes during a Service Month when the production XHS™ Service is unavailable for Customer to send requests and receive responses at the service boundary, excluding Planned Maintenance and Excluded Events.
• "Planned Maintenance" means maintenance performed by Pimlico on the XHS™ Service during a notified maintenance window, as described in clause 3.2, and which is excluded from Downtime.
• "Excluded Events" has the meaning given in clause 3.3.

3. Availability commitment

3.1 Availability target

Pimlico will use commercially reasonable efforts to ensure that Service Availability for the production XHS™ Service is at least 99.5% in each Service Month (the "Availability Commitment").

Service Availability is measured using Pimlico's monitoring systems and, where applicable, third-party monitoring tools designated by Pimlico. Customer agrees that these measurements will be the authoritative source for determining Service Availability and any associated service credits.

3.2 Planned Maintenance

Pimlico may perform Planned Maintenance from time to time. Where reasonably practicable, Pimlico will:

• schedule Planned Maintenance outside Business Hours; and
• provide at least 48 hours' prior notice to Customer by email or via the XHS™ Service interface.

Periods of Planned Maintenance are excluded from Downtime and do not reduce Service Availability for the purposes of this SLA.

3.3 Excluded Events

The following are "Excluded Events" and are not counted as Downtime and do not reduce Service Availability:

• any failure or degradation of the XHS™ Service caused by Customer's or any third party's networks, infrastructure, hardware, software, VPNs, security controls, browser configuration or internet connectivity;
• any misuse of the XHS™ Service, use in breach of the Terms or use contrary to the Documentation by Customer or its Authorised Users;
• any beta, pilot, early-access or trial features or environments, including any XHS™ Copilot features designated as beta;
• any suspension of the Services in accordance with the Terms (including for non-payment, misuse or security reasons);
• any Force Majeure events (as described in clause 17 of the Terms);
• any emergency maintenance required to address urgent security, stability or performance issues, provided Pimlico uses reasonable efforts to minimise the duration and impact;
• issues caused by third-party services or providers (including cloud infrastructure providers, hosting providers or telecommunications providers) that are outside Pimlico's reasonable control; and
• issues arising from Customer's configuration, integrations or changes to its own systems that affect access to or performance of the XHS™ Service.

4. Service credits

4.1 Eligibility and calculation

If, in a given Service Month, Service Availability for the production XHS™ Service falls below the Availability Commitment, Customer may be eligible for a service credit calculated as a percentage of the Monthly Service Fee for that Service Month, as set out below:

The maximum total service credit for any Service Month is 25% of the Monthly Service Fee for that Service Month.

4.2 Application of service credits

Service credits:

• will be applied as a credit against future invoices or card charges for the XHS™ Service;
• may not be exchanged for cash or any other payment;
• may not be transferred or applied to any other account or service; and
• will expire if not used against future invoices within twelve (12) months of the date on which the credit is granted.

If the Contract ends before service credits have been fully used, any remaining credits shall be forfeited.

4.3 Requesting service credits

To be eligible for a service credit, Customer must submit a written request to Pimlico:

• by email to contact@pimlicosolutions.com; and
• within 30 days after the end of the Service Month in which the relevant Downtime occurred.

The request must include:

• Customer's name and primary contact details;
• the dates and approximate times of each incident of suspected unavailability; and
• reasonable supporting details (for example, screenshots or error messages) where available.

Pimlico will review the request using its monitoring records. If Pimlico determines that Customer is entitled to a service credit, Pimlico will apply the appropriate credit to Customer's next invoice or card charge for the XHS™ Service.

If Customer does not submit a request within the timeframe set out above, Customer waives any right to claim a service credit for the relevant Service Month.

5. Support

5.1 Support scope and hours

Pimlico will provide support for the production XHS™ Service to Customer's designated contacts:

• during Business Hours; and
• via email at contact@pimlicosolutions.com or via any in-product support channel identified in the Documentation.

Support is provided only to Customer's nominated contacts, not to Customer's end users or clients.

5.2 Issue categories

Pimlico will categorise support issues it receives, acting reasonably, as follows:

• Priority 1 – Critical: the production XHS™ Service is unavailable for all Authorised Users, or a critical function is materially inoperable with no reasonable workaround.
• Priority 2 – Major: significant degradation or impairment of the XHS™ Service affecting multiple users or key functionality, but the XHS™ Service remains usable and/or a reasonable workaround is available.
• Priority 3 – Standard: all other issues, including minor defects, cosmetic issues, how-to questions and feature requests.

5.3 Target response times

During Business Hours, Pimlico will use commercially reasonable efforts to provide an initial response (acknowledgement and assignment, not necessarily a fix) within the following target times:

• Priority 1 – Critical: within 4 Business Hours;
• Priority 2 – Major: within 1 Business Day;
• Priority 3 – Standard: within 2 Business Days.

Pimlico will keep Customer reasonably informed of progress in resolving issues, but makes no guarantee as to resolution times.

5.4 Support exclusions

Support under this SLA does not include:

• on-site services, implementation, configuration, custom development or training (unless separately agreed and charged);
• support for Customer's own systems, infrastructure, networks, hardware, software or third-party services;
• issues caused by modifications to the XHS™ Service not made or authorised by Pimlico; or
• issues arising from use of the XHS™ Service in breach of the Terms or outside the scope of the Documentation.

Pimlico may, at its discretion, agree to provide additional support or professional services outside this SLA, which may be subject to additional fees.

6. Miscellaneous (SLA)

6.1 Pimlico may update this SLA from time to time to reflect changes in the XHS™ Service, provided that any such changes will not materially reduce the overall level of service available to Customer during the then-current Subscription Term. Any updated SLA will apply from the start of the next renewal Subscription Term unless a change is required earlier by law or regulation.

6.2 This SLA is subject to, and shall be interpreted in accordance with, the Terms. Capitalised terms used but not defined in this Schedule have the meaning given to them in the Terms.

Schedule 2 – Data Processing Addendum

This Data Processing Addendum (the "DPA") forms part of, and is incorporated into, the Contract between Pimlico and Customer. Capitalised terms used but not defined in this DPA have the meaning given to them in the Terms.

1. Scope and roles

1.1 This DPA applies to the extent Pimlico processes Personal Data on behalf of Customer in the course of providing the XHS™ Service and related Services under the Contract.

1.2 For the purposes of applicable Data Protection Laws:

• Customer is the controller (or, where Customer itself acts as a processor, "controller" in this DPA shall be interpreted as a reference to the relevant controller on whose behalf Customer acts); and
• Pimlico is the processor in respect of such Personal Data.

1.3 The subject-matter, duration, nature and purpose of the processing, the types of Personal Data and categories of data subjects are described in Annex 1 (Processing Details).

2. Definitions (DPA)

In this DPA:

• "Data Protection Laws" means all applicable laws and regulations relating to the processing of Personal Data and privacy, including (where applicable) the UK GDPR, the Data Protection Act 2018, the EU General Data Protection Regulation (EU) 2016/679 and any national laws implementing or supplementing any of the foregoing.
• "Personal Data" means any information relating to an identified or identifiable natural person that is processed by Pimlico on behalf of Customer in connection with the provision of the Services.
• "Personal Data Breach" means a personal data breach as defined in the UK GDPR or other applicable Data Protection Laws.
• "Sub-processor" means another processor engaged by Pimlico to process Personal Data on behalf of Customer.
• "UK GDPR" means the General Data Protection Regulation as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018.

3. Customer instructions

3.1 Pimlico shall process Personal Data only:

• on the documented instructions of Customer (including as set out in the Contract and this DPA); and
• as required to comply with applicable laws, in which case Pimlico shall (to the extent legally permitted) inform Customer of that legal requirement before processing.

3.2 Customer instructs Pimlico to process Personal Data:

• to provide, operate and support the XHS™ Service and related Services as described in the Contract;
• to perform its obligations and exercise its rights under the Contract; and
• as further documented in Annex 1 and any additional written instructions that Customer may reasonably give from time to time (provided such instructions are consistent with the Contract and this DPA).

3.3 If Pimlico considers that an instruction from Customer infringes Data Protection Laws, Pimlico shall inform Customer without undue delay. Pimlico shall be entitled to suspend the relevant processing until Customer has modified or confirmed the instruction in a manner that does not infringe Data Protection Laws.

4. Customer responsibilities

4.1 Customer is responsible for:

• ensuring that it has a lawful basis under Data Protection Laws for the processing of Personal Data and for the instructions it gives to Pimlico;
• providing all required notices to data subjects and obtaining all necessary consents (where required) in connection with the collection and use of Personal Data;
• the accuracy, quality and lawfulness of Personal Data and the means by which Personal Data is acquired; and
• ensuring that the processing described in the Contract and this DPA is covered by an appropriate record of processing activities (where required by Data Protection Laws).

4.2 Customer shall not instruct Pimlico to process any special categories of data or criminal offence data (as defined in Data Protection Laws) unless expressly agreed in writing.

5. Confidentiality

5.1 Pimlico shall ensure that any person authorised to process Personal Data on its behalf is subject to a duty of confidentiality (whether contractual or statutory) in respect of that processing.

6. Security

6.1 Pimlico shall implement and maintain appropriate technical and organisational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data, having regard to:

• the nature, scope, context and purposes of the processing;
• the type of Personal Data processed; and
• the risks to the rights and freedoms of natural persons.

6.2 Pimlico's current technical and organisational measures are described at a high level in the Security Overview or similar documentation made available by Pimlico on request or via the XHS™ website, as updated from time to time. Updates to such documentation will not materially reduce the overall level of protection for Personal Data during the then-current Subscription Term.

7. Sub-processors

7.1 Customer authorises Pimlico to appoint Sub-processors to process Personal Data on its behalf, provided that Pimlico:

• imposes on each Sub-processor data protection obligations that are no less protective than those set out in this DPA; and
• remains liable to Customer for the performance of each Sub-processor's obligations in relation to the processing of Personal Data.

7.2 Pimlico shall maintain a list of current Sub-processors for the XHS™ Service and make this available to Customer on request or via the XHS™ website. Pimlico may update this list from time to time.

7.3 Where required by applicable Data Protection Laws, Pimlico shall provide Customer with advance notice of any intended changes concerning the addition or replacement of Sub-processors that process Personal Data. Customer may object to such changes on reasonable data protection grounds by notifying Pimlico in writing within ten (10) Business Days of receiving the notice. If Customer reasonably objects and the parties are unable to agree on an alternative solution within a reasonable period, either party may terminate the affected Services on written notice, without penalty, and Pimlico shall refund any pre-paid fees for the unused portion of the Subscription Term for those Services.

8. International transfers

8.1 Pimlico may transfer Personal Data to, and process Personal Data in, countries outside the United Kingdom and/or European Economic Area, provided that such transfers comply with Data Protection Laws.

8.2 Where Personal Data is transferred outside the United Kingdom and/or European Economic Area to a country that is not the subject of an adequacy decision under the applicable Data Protection Laws, Pimlico shall ensure that appropriate safeguards are in place, which may include:

• the use of standard contractual clauses approved or adopted by the relevant supervisory authority or other competent authority;
• the UK International Data Transfer Agreement (IDTA) or UK addendum to EU standard contractual clauses; or
• any other data transfer mechanism or safeguard recognised under Data Protection Laws.

8.3 On request, Pimlico shall provide Customer with reasonable information about the data transfer mechanism relied on for such transfers to the extent not already described in the Security Overview, Privacy Policy or other documentation.

9. Assistance with data subject rights

9.1 Taking into account the nature of the processing and the information available to Pimlico, Pimlico shall provide reasonable assistance to Customer, at Customer's cost, to enable Customer to respond to:

• requests from data subjects to exercise their rights under Data Protection Laws (including rights of access, rectification, erasure, restriction, portability and objection); and
• any other queries, complaints or notices from data subjects or regulators relating to Personal Data processed under the Contract.

9.2 If Pimlico receives a request or communication from a data subject directly that relates to Customer's Personal Data and identifies Customer as the controller, Pimlico shall (where reasonably practicable) notify Customer without undue delay and shall not respond directly to the data subject except:

• on Customer's documented instructions; or
• to confirm that the request has been passed to Customer; or
• as required by applicable law.

10. Assistance with compliance and DPIAs

10.1 Taking into account the nature of the processing and the information available to Pimlico, Pimlico shall provide reasonable assistance to Customer, at Customer's cost, in relation to:

• Customer's obligations to implement appropriate technical and organisational security measures;
• data protection impact assessments (DPIAs) required under Data Protection Laws; and
• consultations with supervisory authorities relating to processing of Personal Data under the Contract.

11. Personal Data Breach notification

11.1 Pimlico shall notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Personal Data processed on behalf of Customer.

11.2 Such notification shall, where possible, include:

• a description of the nature of the Personal Data Breach;
• the categories and approximate number of data subjects and Personal Data records concerned;
• the likely consequences of the Personal Data Breach; and
• the measures taken or proposed to be taken by Pimlico to address the Personal Data Breach, including measures to mitigate its possible adverse effects.

11.3 Pimlico may provide this information in phases as it becomes available. Customer is responsible for determining whether any notifications to supervisory authorities or data subjects are required under Data Protection Laws and for making any such notifications.

12. Audits and information

12.1 Pimlico shall make available to Customer, on request, such information as is reasonably necessary to demonstrate Pimlico's compliance with its obligations as a processor under Article 28 of the UK GDPR (and any equivalent provisions of other applicable Data Protection Laws), which may include:

• responses to reasonable written security or compliance questionnaires; and/or
• certificates or audit reports issued by independent third-party auditors (if available).

12.2 To the extent that the information made available under clause 12.1 is insufficient to demonstrate such compliance, Customer may, no more than once in any twelve (12) month period and on at least thirty (30) days' written notice, carry out (or appoint an independent third party to carry out) a reasonable audit of Pimlico's data processing activities under this DPA, provided that:

• any such audit shall be conducted during Business Hours, in a manner that minimises disruption to Pimlico's business, and subject to Pimlico's security, confidentiality and site access policies;
• Customer (and any third-party auditor) shall keep all information obtained in connection with the audit confidential and use it solely for the purposes of assessing compliance with this DPA; and
• Customer shall bear all costs of any such audit, unless the audit reveals a material breach of this DPA by Pimlico, in which case Pimlico shall bear its own costs of remediation.

13. Return and deletion of Personal Data

13.1 On expiry or termination of the Contract for any reason, Pimlico shall, at Customer's choice and subject to clause 9.6 of the Terms:

• return Personal Data to Customer in a commonly used, machine-readable format; and/or
• delete or anonymise Personal Data in its production systems,

in each case to the extent reasonably practicable and within a reasonable period following termination, unless applicable law requires Pimlico to retain certain Personal Data for a longer period.

13.2 Pimlico may retain copies of Personal Data in backup systems for a limited period after deletion from its primary systems. Such data will remain subject to the obligations in this DPA until deleted.

14. Duration

14.1 This DPA shall remain in force for as long as Pimlico processes Personal Data on behalf of Customer under the Contract.

14.2 Termination or expiry of the Contract shall automatically terminate this DPA, without prejudice to any rights or obligations that by their nature should survive (including, without limitation, clauses relating to confidentiality, liability, audit, and return and deletion of Personal Data).

15. Miscellaneous

15.1 This DPA is without prejudice to any additional obligations of the parties under Data Protection Laws.

15.2 In the event of any conflict between this DPA and the rest of the Contract in relation to the processing of Personal Data, this DPA shall prevail.

15.3 This DPA is governed by, and shall be construed in accordance with, the same law and jurisdiction provisions as the Contract.

Annex 1 – Processing details

Subject-matter of the processing

Provision of the XHS™ Service and related Services (including XHS™ Copilot and other AI-enabled features), including hosting, storage, analysis, enrichment and delivery of regulatory and market intelligence content, dashboards and reports.

Duration of the processing

For the Subscription Term and any renewal Subscription Terms, and for such additional period as is necessary for backup, archiving and deletion in accordance with the Contract and this DPA.

Nature and purpose of the processing

• Hosting and storage of Customer Data within the XHS™ Service;
• enabling Customer and Authorised Users to access, search and analyse content;
• generating, structuring, tagging and summarising content and alerts;
• providing dashboards, reports and other outputs;
• monitoring usage, performance and security of the XHS™ Service; and
• providing support and maintenance services.

Types of Personal Data

Depending on how Customer uses the XHS™ Service, this may include:

• business contact details of Customer's personnel and other users (such as name, job title, role, business email address, business telephone number);
• account and profile information for Authorised Users;
• user-generated content, comments or notes entered into the XHS™ Service;
• log and usage data (such as IP addresses, device identifiers, timestamps and activity logs); and
• any other Personal Data that Customer chooses to include in Customer Data.

Customer shall not intentionally include special categories of data or criminal offence data in Customer Data unless expressly agreed in writing.

Categories of data subjects

• employees, contractors and other personnel of Customer who are Authorised Users of the XHS™ Service;
• employees, contractors and other personnel of Customer's clients or counterparties, to the extent their details are included in Customer Data; and
• any other individuals whose Personal Data is included in Customer Data by or on behalf of Customer.

Annex 2 – Technical and organisational measures (summary)

Pimlico will implement and maintain technical and organisational measures appropriate to the risk, which may include:

• access control measures to ensure only authorised personnel have access to Personal Data on a need-to-know basis;
• authentication and authorisation controls for the XHS™ Service (for example, unique user accounts, role-based access and password policies);
• encryption of data in transit over public networks and encryption of data at rest in core infrastructure components;
• network and infrastructure security measures, including firewalls, segmentation and monitoring;
• logging and monitoring of key systems, together with incident detection and response procedures;
• backup and disaster recovery processes designed to support continuity of the XHS™ Service; and
• policies and training for personnel on information security and data protection.

Further details of Pimlico's technical and organisational measures are described in the Security Overview or similar documentation made available by Pimlico on request or via the XHS™ website, as updated from time to time. Updates to such documentation will not materially reduce the overall level of protection for Personal Data during the then-current Subscription Term.