AI Risk End User License Agreement (US - Reseller)

1. Introduction

1.1 Acceptance. Client is deemed to have accepted these terms when it places an order with reseller.

1.2 Definitions. In the agreement the following terms have the meaning given below:

Client is the entity that places the order with the reseller;

Client data is data made available to the platform by Client or its staff which will include personal data as set out in schedule 1 (Processing of personal data);

CultureAI is CultureAI Ltd, English company number 09671771 with registered office at 27 Old Gloucester St, Holborn, London WC1N 3AX;

data protection laws are applicable data protection laws, including (without limitation) (i) the Data Protection Act 2018 (DPA), the United Kingdom General Data Protection Regulation as defined in section 3(10) and 205(4) of the DPA, and the Privacy and Electronic Communications (EC Directive) Regulations 2003 and any successor or amending legislation from time to time; collectively UK data protection laws and (ii) the California Consumer Privacy Act of 2018, California Civil Code § 1798.100 et seq. (CCPA), as amended by the California Privacy Rights Act (CPRA) and any successor or amending legislation from time to time, collectively California privacy laws);

order is the order Client places with the reseller in a format that references these terms and sets out the Client entity, number of permitted users and subscription period;

permitted users are those members of Client’s staff who are permitted to use the platform;

personal data has the meaning given to that term in data protection laws;

platform is CultureAI’s AI Security & Governance Platform provided on a SaaS basis;

reseller is the entity with whom Client places the order and with whom CultureAI has entered into a separate agreement in relation to reselling subscriptions to the platform;

staff are employees, contractors or other personnel under a person’s control; and

the agreement is these terms as informed by the order.

1.3 Interpretation. These terms take precedence in the event of any conflict with the order.

2. Platform

2.1 Access and use. Subject to clause 2.2 (Limitations), CultureAI grants Client a non-exclusive, non-transferable and non-sublicensable licence for permitted users to access and use the platform.

2.2 Limitations. The following limitations apply to the licence in clause 2.1 (Access and use): (i) it is only for number of permitted users and the subscription period stated in the order; (ii) the rights to access and use the platform may not be leased, assigned or otherwise transferred by Client; (iii) the platform may not be used to build a competitive service or comparative features or for any unlawful purpose, and (iv) save as expressly permitted by law, the platform or any element thereof may not be copied, modified, decompiled, reverse engineered or translated.

2.3 Functionality. CultureAI may update and enhance the functionality of the platform from time to time but will ensure that functionality or performance of the platform is not degraded unless agreed with Client in advance. CultureAI will ensure that the platform is available for use by Client as specified in the service level agreement set out in schedule 2 (Platform Availability).

2.4 Third party platforms or services. Where Client wishes to use features of the platform that interface with third party platforms or services Client is using, Client: (i) shall hold permissions required to use such platforms or services and (ii) acknowledges CultureAI gives no warranties and has no obligations or liability in connection with such platforms or services.

2.5 Warranty. The platform is free of any viruses, trojans or other malware but is otherwise provided ‘as is’ and, to the extent permitted by law, all warranties implied by statute, common law or otherwise are excluded.

3. Client data

3.1 Permission. Client grants CultureAI permission to process Client data to the extent necessary to provide, maintain and improve the platform. Client data is used to improve the platform by refining prompts sent to CultureAI’s pre-trained models, but not to train such models.

3.2 Personal data. Personal data collected in connection with the platform will be processed in accordance with schedule 1 (Processing of personal data).

3.3 Compliance. Client is solely responsible for ensuring Client data complies with applicable laws and regulations and for securing any necessary approvals for CultureAI’s use of Client data.

4. Fees

4.1 Fees. Reseller shall invoice Client directly for the fees set out in the order and pay CultureAI the fees they have separately agreed for Client's use of the platform.

4.2 Service credits. Any refunds or service credits payable by CultureAI under these terms shall be paid by CultureAI to the reseller and reseller may pass these on to Client in its absolute discretion.

5. Intellectual Property

5.1 Definitions. In this clause the following terms have the meaning given below:

CultureAI materials are materials created by or on behalf of CultureAI and include machine learning data and platform data generated by CultureAI where personal information has been removed or anonymised;

intellectual property rights means any intellectual property right or other proprietary right, including copyright, patents, design, database and moral rights, rights in trade and service marks, trade and business names, domain names, confidential information, trade secrets, inventions, software code or know-how, in each case whether registered or not, and in any country;

machine learning data is data including patterns, trends, statistical correlations and performance metrics derived, generated or inferred through automated processing of platform data and used solely for the purpose of developing, training, testing and improving the platform’s machine learning algorithms and associated services; and

platform data is: (i) Client data, (ii) other data that describes and/or gives information about Client data, including but not limited to metadata, context, files and URLs and (iii) data derived from the platform regarding how it is being used, such as reports and logs.

5.2 CultureAI materials. All intellectual property rights in the platform, any improvements thereto and all CultureAI materials, vest in and remain with CultureAI and Client does not acquire any rights therein save for the permissions expressly granted in the agreement.

5.3 Client data and outputs. CultureAI assigns to Client all intellectual property rights it would otherwise own in Client data and any information, reports or other materials generated by Client’s use of the platform (other than CultureAI materials).

5.4 Indemnity. Each party will indemnify the other against all losses and reasonable costs finally awarded by a court of competent jurisdiction or agreed in settlement (with the indemnifying party’s consent), arising in relation to any third party claim brought against the other party alleging that (in the case of CultureAI) the platform infringes such third party’s intellectual property rights or (in the case of Client) the processing and use of Client data in accordance with the agreement infringes any third party intellectual property rights or breaches any data protection laws.

5.5 Claims. In the event a party receives a claim from a third party that such third party’s intellectual property rights have been infringed:

(a) the party receiving the claim shall (where relevant): (i) promptly provide the other with details of the claim, (ii) allow them to conduct the defence of the claim and any settlement, providing such assistance reasonably required and (iii) use reasonable endeavours to mitigate any loss they may suffer;

(b) where the claim relates to (i) the platform, CultureAI will promptly seek to settle such claim or modify the platform to avoid the infringement with the minimum impact reasonably feasible for Client and (ii) the processing and use of Client data, Client will promptly seek to settle such claim or remove the problematic Client data to avoid the infringement or resolve the breach of data protection laws; and

(c) if such claim cannot be settled or modifications cannot reasonably be made within 30 days, either party may terminate the agreement on written notice.

6. CultureAI Staff and Subcontractors

6.1 Staff. All CultureAI staff involved in providing the platform or who have access to Client data will be bound by confidentiality obligations relating to Client data and shall comply with all applicable laws, regulations and directions of any competent authority in the performance of their role.

6.2 Subcontractors. CultureAI may use third parties to perform any aspect of the agreement but shall: (i) remain primarily responsible for complying with its obligations hereunder and (ii) ensure that contracts with sub-processors of personal data comply with the requirements of schedule 1 (Processing of personal data) as relevant.

7. Termination

7.1 Immediate. A party may terminate the agreement immediately by giving written notice to the other if: (i) the other is in material breach and (where capable of remedy) does not remedy the breach within 30 days or (ii) the other is unable to pay its debts or has become insolvent.

7.2 On notice. Either party may terminate the agreement at the end of the then-current subscription period by giving not less than 30 days’ written notice prior to that date. Otherwise, the agreement will renew for successive periods of the same duration as the then-current subscription period.

7.3 Consequences. On termination of the agreement Client’s access to the platform shall cease and CultureAI shall within 30 days of such termination (i) (where requested by Client) provide Client with an export of the Client data and (ii) delete the Client data. Where such termination is at Client’s initiative due to CultureAI’s material breach, CultureAI will refund to Client any prepaid but unused fees for that part of the subscription period remaining.

7.4 Survival. All obligations or liabilities accruing prior to termination or expiration of the agreement shall survive such termination or expiration and any clause that is meant to continue thereafter will do so, including but not limited to clauses 5 (Intellectual Property), 7.3 (Consequences), 8 (Liability), 9 (General) and schedule 1 (Processing of Personal Data).

8. Liability

8.1 Capped liability. Subject to clauses 8.2 (Unlimited liability) and 8.3 (Specific exclusions), each party’s total liability arising out of or in connection with the platform or the agreement (including but not limited to negligence or breach of statutory duty) in any year is limited to $1,000.

8.2 Unlimited liability. Nothing in the agreement will limit a party’s liability for: (i) death or personal injury caused by that party’s negligence, (ii) fraud or wilful misconduct, (iii) gross negligence, (iv) breach of clause 5.4 (Indemnity) or (v) anything else that cannot by law be limited.

8.3 Specific exclusions. Subject to clause 8.2 (Unlimited liability), neither party will be liable for any consequential, indirect, special, incidental, punitive or exemplary damages, whether foreseeable or unforeseeable, including loss of profit (whether direct or indirect), business or goodwill, loss of or corruption of data.

8.4 Matters beyond reasonable control. Save for Client’s payment obligations hereunder, neither party will be liable for failure to meet obligations due to matters beyond its reasonable control.

9. General

9.1 Scope of agreement. The agreement forms the entire agreement between the parties in relation to its subject matter and replaces any earlier agreements, representations, proposals and discussions. Subject to clause 8.2 (Unlimited liability) neither party is liable to the other (whether for negligence or otherwise) for a representation that is not in the agreement. If any provision of the agreement is or becomes invalid, illegal or unenforceable, it shall be deemed deleted, but that shall not affect the validity and enforceability of the remainder.

9.2 Parties and changes. A person who is not party to the agreement has no rights to enforce it and their consent is not required to vary or terminate it. Changes to the agreement will be effective only when agreed in writing by the parties. Neither party may assign, transfer or deal with its rights under the agreement without the other’s prior written consent, not to be unreasonably withheld.

9.3 Notices. Any notice to be given to a party shall be sent by postal recorded delivery or by email to the applicable address set out in the order. Such notice shall be deemed received the earlier of actual receipt or two business days later in the case of postal delivery or the next day in the case of email (subject to no bounce-back notification being received).

9.4 Confidential information. The parties shall each use information provided by the other solely in accordance with the agreement and not disclose it except where required by law or regulation or to staff and professional advisors on a need-to-know basis. This restriction does not apply to information (i) independently developed by or already known to the receiving party, (ii) in the public domain or (iii) lawfully obtained from a third party.

9.5 References. Subject to any express reservations communicated by Client to CultureAI in writing, Client grants CultureAI a revocable, non-transferable, worldwide, royalty-free, fully paid up, non-exclusive license to use Client’s name and logo in sales presentations, marketing and on CultureAI’s website, for the purpose of identifying Client as a Client of CultureAI. Any such use of Client’s name or logo shall be subject to Client’s brand guidelines provided.

9.6 Waiver. No failure or delay by a party to exercise any right will constitute a waiver of that right nor restrict the further exercise of that right. No single or partial exercise of any right will restrict the further exercise of that or any other right.

9.7 Law and jurisdiction. The agreement and any dispute arising from it, whether contractual or not, will be governed by the laws of the State of New York, without giving effect to the principles of conflicts of law and be subject to the exclusive jurisdiction of the New York courts. The provisions of the United Nations Convention on the International Sale of Goods and the Uniform Computer Information Transactions Act, however designated, are excluded and shall not apply to this agreement or any transactions hereunder.

SCHEDULE 1: PROCESSING OF PERSONAL DATA

1. Definitions

In this schedule the terms data subject, personal data, processing, processor and supervisory authority have the meanings given to them in data protection laws and the following terms have the meaning given below:

adequate country is any country determined by the UK Government as providing an adequate level of protection as set out in Section 17A of the DPA;

incident is any accidental, unlawful, or unauthorised destruction, loss, alteration, processing, disclosure of, or access to any Client data (including any personal data) or to any facilities or systems where such data is maintained; and

IDTA is the ICO’s International Data Transfer Agreement for the transfer of personal data from the UK and/or the ICO’s International Data Transfer Addendum to the standard contractual clauses set out in European Commission Decision 2021/914.

2. Processing

2.1 Personal data. In relation to personal data processed in connection with the platform:

(a) Client is the data controller and CultureAI is the data processor for the purposes of UK data protection laws;

(b) a description of the personal data processed by CultureAI and its sub-processors is set out at the end of this schedule (in the format used in the IDTA);

(c) CultureAI and Client will: (i) comply with (and not cause the other to breach) data protection laws, and (ii) promptly (and in any event within 2 business days) inform the other of any relevant notices or requests; and

(d) CultureAI will: (i) process personal data only as set out in this schedule (and CultureAI shall immediately inform Client if, in CultureAI’s opinion, an instruction from Client infringes data protection laws); (ii) not process or transfer (or allow others to process or transfer) personal data outside the United Kingdom, EEA or another adequate country unless in accordance with paragraph 4 (Transfers) below; (iii) impose a duty of confidentiality on its staff in accordance with clause 6.1 (Staff) and implement and maintain appropriate technical and organisational measures for handling Client data, including having an information security policy and restricting access to relevant staff only; (iv) provide Client with such reasonable information and assistance to enable Client to comply with data protection laws in connection with the agreement, including in relation to data protection impact assessments, consulting the supervisory authority, data subjects’ rights, notifying breaches, submitting to audits and inspections and complying with security obligations and (v) delete or deliver up personal data to Client on its request.

2.2 Incidents. CultureAI will inform Client immediately after becoming aware of an incident, take immediate steps to contain and provide any additional information and assistance as reasonably requested by Client.

3. Subprocessors

3.1 Authorisation. CultureAI may engage sub-processors as listed in Annex 1.B of paragraph 5 below (the approved sub-processors) which may be updated from time to time and Client provides a general authorisation for CultureAI to engage sub-processors that is conditioned on the following:

(a) CultureAI (i) restricting the sub-processor’s access to Client data only to what is strictly necessary to provide the platform or operate its business, and (ii) prohibiting the sub-processor from processing Client data for any other purpose;

(b) such sub-processors undertaking contractual obligations to protect Client data to the standard required by data protection laws, including appropriate technical and organisational measures; and

(c) CultureAI remaining liable and accountable for any breach of this schedule that is caused by an act or omission of its sub-processors.

3.2 Additional sub-processors. CultureAI will notify Client if it intends to add or replace approved sub-processors at least 10 days prior to any such changes. If Client objects within such notice period to the appointment of an additional sub-processor on reasonable grounds relating to the protection of Client data, then CultureAI will work in good faith with Client to find an alternative solution. In the event that the parties are unable to find such a solution, Client may terminate the agreement at no additional cost.

4. Transfers

Where CultureAI transfers Client data to sub-processors or other third parties in a location that is not an adequate country, such transfers will take place in accordance with: (i) the IDTA and those clauses will be incorporated into the agreement populated by the information set out in this schedule, or (ii) another lawful transfer mechanism providing appropriate safeguards that meet the requirements of applicable data protection laws.

5. Description of personal data processed

SCHEDULE 2: PLATFORM AVAILABILITY

1. Service Levels

1.1 Purpose. This schedule sets out CultureAI’s obligations and liability and Client’s sole remedy in respect of the availability or non-availability of the platform. This schedule does not apply to: (i) any pre-production, development, testing or similar environments, or (ii) previews, proof-of-concepts, beta or trial versions, all of which are provided "AS-IS," "WITH ALL FAULTS," and "AS AVAILABLE" and which may be changed or discontinued by CultureAI at any time without notice.

1.2 Availability. CultureAI will make the platform available to Client for at least 99.9% of business hours in each calendar month, excluding scheduled downtime or excused unavailability. Availability shall be determined as follows:

where:

business hours are the hours between 08:00 and 18:00 on weekdays excluding public holidays in the United Kingdom;

total is the total number of minutes in business hours during a calendar month;

unavailable is the total number of minutes during business hours the calendar month where the platform was not available to Client, not including any unavailability due to scheduled downtime or excused unavailability;

scheduled downtime is time where the platform is not available due to routine maintenance notified to Client in advance;

excused unavailability is the time where the platform is not available due to matters:

(a) beyond CultureAI’s reasonable control (which shall not include emergency maintenance); or

(b) that result from Client’s:

(i) use of hardware, software or services not provided by CultureAI, including issues resulting from inadequate bandwidth or related to third-party software or services;

(ii) employees, agents, contractors, or vendors, or anyone gaining access to CultureAI’s network by means of permitted users’ passwords or equipment, or otherwise resulting from Client’s failure to follow appropriate security practices, unauthorised action or lack of action when required;

(iii) failure to adhere to any required configurations, use supported platforms, or follow any policies for acceptable use; or

(iv) use of the platform in a manner inconsistent with the features and functionality of the platform (for example, attempts to perform operations that are not supported).

1.3 Scheduled downtime. CultureAI shall use commercially reasonable efforts to provide prior notice to Client at least seven calendar days before any scheduled downtime.

1.4 Emergency maintenance. CultureAI may perform emergency maintenance on the platform at any time without prior notice to Client, provided that CultureAI will use commercially reasonable efforts to provide prior notice to Client.

2. Service Credits

2.1 Entitlement. If CultureAI determines that the required platform availability level has not been met for a particular month, Client shall be entitled to a service credit representing a portion of the fees paid by it for that month as follows:

2.2 Conditions. A service credit only applies to fees paid for a month where the required availability level has not been met. Client must be in compliance with the agreement in order to be eligible for a service credit.

2.3 Claims. In order for CultureAI to consider a claim for service credit, Client must submit the claim to CultureAI Client support by the end of the calendar month following the month in which the unavailability occurred and include all information necessary for CultureAI to assess the claim, including: (i) a detailed description of the unavailability; (ii) information regarding the time and duration the platform was unavailable; (iii) the number of permitted users affected and their location and (iv) descriptions of attempts to resolve the unavailability at the time of occurrence.

2.4 Application. CultureAI will use commercially reasonable efforts to process claims during the subsequent month and make a good faith determination of whether a service credit is owed. Where a service credit is owed it shall be offset against fees payable in the subsequent month (for Clients that are billed monthly) or offset against the fees for the following year (for Clients that are billed annually) or refunded at the end of the remaining subscription period where Client chooses not to renew.