AI Risk End User Licence Terms (UK AI Risk Assessment)

1. Introduction

Definitions. In these terms the following terms have the meaning given below:

assessment period is a period agreed between CultureAI and Client for Client to conduct an "AI risk assessment" using the platform, being at least 14 days commencing on the date nominated by Client; and

Client is the entity that accepts these terms when signing up for an "AI risk assessment";

Client data is data made available to the platform by Client or its staff which will include personal data as set out in schedule 1 (Processing of personal data);

CultureAI is CultureAI Ltd, English company number 09671771 with registered office at 27 Old Gloucester St, Holborn, London WC1N 3AX;

data protection laws are applicable data protection laws, including (without limitation) the Data Protection Act 2018 (DPA), the United Kingdom General Data Protection Regulation as defined in section 3(10) and 205(4) of the DPA, and the Privacy and Electronic Communications (EC Directive) Regulations 2003 and any successor or amending legislation from time to time;

personal data has the meaning given to that term in data protection laws;

platform is CultureAI's AI Security & Governance Platform provided to Client on a SaaS basis; and

staff are employees, contractors or other personnel under a person's control.

2. Platform and Client Data

2.1 Access and use. CultureAI grants Client a non-exclusive, non-transferable and non-sublicensable licence to access and use the platform at no cost during the assessment period. The platform's operation will be limited to a specified number of Client's staff.

2.2 Warranty. The platform is free of any viruses, trojans or other malware but is otherwise provided 'as is' and, to the extent permitted by law, all warranties implied by statute, common law or otherwise are excluded.

2.3 Permission. Client grants CultureAI permission to process Client data to the extent necessary to provide, maintain and improve the platform. Client data is used to improve the platform by refining prompts sent to CultureAI's pre-trained models, but not to train such models.

2.4 Use. Personal data collected in connection with the platform will be processed in accordance with schedule 1 (Processing of personal data). CultureAI will delete all Client data at the end of the assessment period.

3. Intellectual Property

3.1 Definitions. In this clause the following terms have the meaning given below:

CultureAI materials are materials created by or on behalf of CultureAI and include machine learning data and platform data generated by CultureAI where personal information has been removed or anonymised;

intellectual property rights means any intellectual property right or other proprietary right, including copyright, patents, design, database and moral rights, rights in trade and service marks, trade and business names, domain names, confidential information, trade secrets, inventions, software code or know-how, in each case whether registered or not, and in any country;

machine learning data is data including patterns, trends, statistical correlations and performance metrics derived, generated or inferred through automated processing of platform data and used solely for the purpose of developing, training, testing and improving the platform's machine learning algorithms and associated services; and

platform data is: (i) Client data, (ii) other data that describes and/or gives information about Client data, including but not limited to metadata, context, files and URLs and (iii) data derived from the platform regarding how it is being used, such as reports and logs.

3.2 CultureAI materials. All intellectual property rights in the platform, any improvements thereto and all CultureAI materials, vest in and remain with CultureAI and Client does not acquire any rights therein save for the permissions expressly granted in these terms.

4. CultureAI Staff and Subcontractors

4.1 Staff. All CultureAI staff involved in providing the platform or who have access to Client data will be bound by confidentiality obligations relating to Client data and shall comply with all applicable laws, regulations and directions of any competent authority in the performance of their role.

4.2 Subcontractors. CultureAI may use third parties to perform any aspect of these terms but shall (i) remain primarily responsible for complying with its obligations hereunder and (ii) ensure that contracts with sub-processors comply with the requirements of schedule 1 (Processing of personal data) as relevant.

5. Term

5.1 Duration. The obligations and permissions set out in these terms expire automatically at the end of the assessment period.

5.2 Survival. All obligations or liabilities accruing prior to expiry of the assessment period shall survive such expiration and any clause that is meant to continue thereafter will do so, including but not limited to clauses 3 (Intellectual Property), 6 (Liability), 7 (General) and Schedule 1 (Processing of Personal Data).

6. Liability

6.1 Capped liability. Subject to clause 6.2 (Unlimited liability), each party's total liability arising out of or in connection with the platform or these terms (including but not limited to negligence or breach of statutory duty) is limited to £500.

6.2 Unlimited liability. Nothing in these terms will limit a party's liability for (i) death or personal injury caused by that party's negligence, (ii) fraud or (iii) anything else that cannot by law be limited.

7. General

1.1 Confidential information. The parties shall each use information provided by the other solely in accordance with these terms and not disclose it except where required by law or regulation or to staff and professional advisors on a need-to-know basis. This restriction does not apply to information (i) independently developed by or already known to the receiving party, (ii) in the public domain or (iii) lawfully obtained from a third party.

1.2 Law and jurisdiction. These terms and any dispute arising in connection with them, whether contractual or not, will be governed by English law and be subject to the exclusive jurisdiction of the English courts.

SCHEDULE 1

PROCESSING OF PERSONAL DATA

1. Definitions

In this schedule the terms data subject, personal data, processing, processor and supervisory authority have the meanings given to them in data protection laws and the following terms have the meaning given below:

adequate country is any country determined by the UK Government as providing an adequate level of protection as set out in Section 17A of the DPA; and

incident is any accidental, unlawful, or unauthorised destruction, loss, alteration, processing, disclosure of, or access to any Client data (including any personal data) or to any facilities or systems where such data is maintained.

2. Processing

2.1 Personal data. In relation to personal data processed in connection with the platform:

(a) Client is the data controller and CultureAI is the data processor for the purposes of data protection laws;

(b) a description of the personal data processed by CultureAI and its sub-processors is set out at the end of this schedule;

(c) CultureAI and Client will (i) comply with (and not cause the other to breach) data protection laws, and (ii) promptly (and in any event within 2 business days) inform the other of any relevant notices or requests; and

(d) CultureAI will (i) process personal data only as set out in this schedule (and CultureAI shall immediately inform Client if, in CultureAI's opinion, an instruction from Client infringes data protection laws), (ii) not process or transfer (or allow others to process or transfer) personal data outside the United Kingdom, EEA or another adequate country unless in accordance with applicable data protection laws, (iii) impose a duty of confidentiality on its staff in accordance with clause 4.1 (Staff) and implement and maintain appropriate technical and organisational measures for handling Client data, including having an information security policy and restricting access to relevant staff only, (iv) provide Client with such reasonable information and assistance to enable Client to comply with data protection laws in connection with these terms, including in relation to data protection impact assessments, consulting the supervisory authority, data subjects' rights, notifying breaches, submitting to audits and inspections and complying with security obligations and (v) delete or deliver up personal data to Client on its request.

2.2 Incidents. CultureAI will inform Client immediately after becoming aware of an incident, take immediate steps to contain and provide any additional information and assistance as reasonably requested by Client.

3. SUBPROCESSORS

Authorisation. CultureAI may engage sub-processors as listed in Annex 1.B below of paragraph 4 (the approved sub-processors) which may be updated from time to time and Client provides a general authorisation for CultureAI to engage sub-processors that is conditioned on the following:

(a) CultureAI will (i) restrict the sub-processor's access to Client data only to what is strictly necessary to provide the platform or operate its business and (ii) prohibit the sub-processor from processing Client data for any other purpose; and

(b) CultureAI agrees to impose contractual data protection obligations, including appropriate technical and organisational measures to protect personal data, on any sub-processor it appoints that require such sub-processor protect Client data to the standard required by data protection laws.

4. Description of personal data processed