Standard Terms of Business

We are Oblifee Ltd, a company registered in England and Wales with company number 17537669, whose registered office is at 66 Paul Street, London, EC2A 4NA, United Kingdom (Oblifee, we, us). The Oblifee platform, brand and regulatory dataset are owned by LataSys Limited (company number 17261093) and licensed to us.

These Terms are for business customers only. By signing or accepting an Order Form you confirm that you are acting for the purposes of your trade, business, craft or profession and not as a consumer. We do not contract with consumers.

Transitional note. Until 1 January 2027 the Oblifee service is supplied by LataSys Limited. A Contract signed before that date is with LataSys Limited, and in it every reference to Oblifee means LataSys Limited. With effect from 1 January 2027, LataSys Limited will transfer those Contracts to Oblifee Ltd on the same terms under clause 26.3, and we will tell you in writing when that happens.

A Contract is formed when both parties sign an Order Form, or when you accept an Order Form online (for example by completing checkout for a self-service plan). Each Order Form, with these Terms and the documents they refer to, forms a separate Contract.

In these Terms:

• Administrator means a User you appoint to manage your Workspace, its Users and its settings.
• AI Features means the parts of the Service that use machine learning models, including Obli, AI imports, label checks, Label Rework, the Packaging Builder and classification proposals.
• Assurance Level means whether a Regulatory Fact is shown as an Interpretation or as Ratified (clause 6.4).
• Business Day means a day other than a Saturday, Sunday or public holiday in England.
• Change Alert means a notice, in the Service or by email or another channel you configure, that a Regulatory Fact you have viewed, saved or rely on has changed (clause 6.7).
• Contract Year means each period of 12 months from the Start Date.
• Customer, you means the legal entity named in the Order Form.
• Customer Data means all data, documents and content you, your Users or your Outside Contacts put into the Service, including product, packaging, formulation and supply-chain data, and the records generated from it for you.
• Documentation means the user guides published at docs.oblifee.com, as updated from time to time.
• Fees means the fees set out in the Order Form or, where none are stated, in our price list at oblifee.com/pricing on the date of the order.
• Information Status means the status shown against a figure or fact: Confirmed, Illustrative or Estimate (clause 6.3).
• Interpretation means a Regulatory Fact that is our reading of the cited law and has not been Ratified.
• Modules and Add-ons means the optional parts of the Service listed in the Order Form or at oblifee.com/pricing, such as the Labelling checker, Recyclability, WEEE and Batteries, Reporting and PPWR, Digital Product Passport, Drinks, Retailer Exchange, Consultant Workbench, packs, connectors and the Brain API.
• Order Form means the order document (paper or online) that identifies you, the Plan, Modules, Add-ons, Optional Services, Fees and term, and refers to these Terms.
• Optional Services means services we perform for you that are not part of the subscription, each described in a Service Schedule (clause 8).
• Outputs means reports, dossiers, report packs, declarations, label checks, exports and other material the Service produces for you.
• Outside Contact means a person outside your organisation whom you invite into the Service, including suppliers, guest users, outside compliance contacts and outside signers.
• Plan means the subscription tier set out in the Order Form (for example Starter, Growth, Scale or Enterprise).
• Qualified Reviewer means a person who holds a current practising certificate or equivalent professional qualification in the law of the relevant jurisdiction, and appropriate professional indemnity insurance, engaged by us to review Regulatory Facts.
• Ratified means a Regulatory Fact that a Qualified Reviewer has reviewed and signed off, as shown by a Ratification Stamp (clause 6.4).
• Ratification Stamp means the record shown with a Ratified fact of who ratified it, their qualification, the date, and the version of the source law reviewed.
• Regulatory Dataset means our database of regulatory duties, fee rates, labelling rules, deadlines, absences and related facts, with their citations, statuses and history.
• Regulatory Fact means a single item in the Regulatory Dataset as shown to you, for example a duty, rate, threshold, deadline, labelling requirement or recorded absence of a duty.
• Service means the Oblifee platform at oblifee.app and its related applications (including Obli in Microsoft Teams and Microsoft 365 Copilot, the passport service and the Brain API) that you subscribe to under an Order Form.
• Service Schedule means a schedule describing an Optional Service, attached to or referred to in an Order Form.
• Start Date means the date the Contract starts, as set out in the Order Form.
• Subscription Term means the Minimum Term and each renewal period (clause 14).
• User means an individual you authorise to use the Service under your account, including your employees and contractors.
• Workspace means your isolated area of the Service holding your Customer Data.

Headings do not affect interpretation. Including and similar words do not limit the words before them. A reference to a law includes that law as amended or replaced. Writing includes email but not other electronic messaging unless we say so.

If documents in a Contract conflict, they apply in this order, the first taking priority:

• (a) the Order Form, but only where it expressly overrides a numbered clause of these Terms;
• (b) any special terms written into the Order Form or a Service Schedule;
• (c) these Standard Terms of Business, including their Schedules;
• (d) policies and documents we link to, such as the Privacy Policy, the Sub-processor List, the Security page and the Documentation.

Your purchase order terms, supplier portal terms or other standard terms do not apply, even if referred to in a purchase order or accepted by us in the course of getting paid, unless they are expressly accepted in the Order Form.

These Terms are versioned. Each version has a number and an effective date and is published at oblifee.com/terms. Each version stays available at its own address (for example oblifee.com/terms/v1.0) for as long as any Contract refers to it, and in any case for at least six years after it is replaced.

Your Order Form states the version that applies to your Contract. That version applies until the end of your current Subscription Term, except as set out in clause 4.4.

On renewal, the version current at the renewal date applies, provided we told you of it at least 30 days before the renewal date.

We may change the Terms during a Subscription Term only where the change is (a) needed to comply with law, a regulator or a court; (b) needed to protect the security of the Service; or (c) not materially adverse to you. We will give you at least 30 days notice, except where a shorter period is required by law or for security.

We tell you about a new version by email to your Administrators and by a notice in the Service, with a summary of what has changed and a link to both versions.

If a change under clause 4.4 is materially adverse to you, you may end the affected Contract by notice before the change takes effect and we will refund any Fees prepaid for the period after the end date.

We will provide the Service described in your Order Form and the Documentation, with the Plan, Modules, Add-ons and quantities (such as Users, products, business entities, markets, guest seats, suppliers and connections) set out there.

Fair use. Some features have allowances or fair-use limits, which are set out in the Order Form or at oblifee.com/pricing. These include a daily fair-use limit on Obli, monthly AI generation allowances, and call and rate limits on the Brain API. If your use goes beyond an allowance we may ask you to buy a pack or move Plan, and we may slow or pause the feature concerned until you do. We will not charge for excess use without your agreement.

Beta and preview features. Features marked beta, preview or early access are provided for evaluation, may change or be withdrawn, and are excluded from the service levels in Schedule 3.

Improvements. We continually improve the Service. We may change how it works, but we will not materially reduce the core functionality of your Plan or a paid Module during a Subscription Term.

Third-party systems. The Service connects to systems we do not control, such as your ERP or commerce platform, Microsoft 365, scheme and regulator portals and payment providers. We are not responsible for those systems, their availability or their terms.

Brain API. Use of the Brain API is also subject to the data licence published at oblifee.app/api/v1/brain/terms.

Trials. There is no self-service free trial. A trial is available only where Oblifee staff grant it in writing, stating its scope and end date. A trial ends automatically on that date, does not include exporting your data, and becomes a paid subscription only if you place an order.

What the Regulatory Dataset is. The Regulatory Dataset is compiled from published primary sources (legislation, official journals, regulators and compliance schemes). Each Regulatory Fact shows the source it relies on, with a link and the date the source was accessed. We monitor sources for change and update the Regulatory Dataset through a reviewed process.

Information, not legal advice. Unless a Regulatory Fact is shown as Ratified, it is information about the law, prepared by us, and not legal advice. We are not a law firm and are not regulated by the Solicitors Regulation Authority or any other legal regulator. Nothing in the Service creates a lawyer and client relationship between you and us or anyone we engage.

Information Status. Every figure and fact carries one of these statuses, shown with it:

• (a) Confirmed: computed from a verified, in-force rule in the Regulatory Dataset, with a citation to its source;
• (b) Illustrative: shows the shape of an answer using representative values (for example a scheme's draft figures) where a confirmed rule is not yet available;
• (c) Estimate: a reasoned approximation, clearly marked, where no official figure exists. An Estimate is never presented as Confirmed.

Assurance Level. Separately from its Information Status, every Regulatory Fact has an Assurance Level:

• (a) Interpretation: our reading of the cited law. This is the default. It is labelled as our interpretation and not legal advice.
• (b) Ratified: a Qualified Reviewer has reviewed the fact against the cited law and signed it off. A Ratified fact carries a Ratification Stamp showing who ratified it, their qualification, the date and the version of the law reviewed.

Ratification lapses when the law changes. When the law or source behind a Ratified fact changes, or our monitoring detects a possible change, the fact reverts to Interpretation and is labelled accordingly until it is ratified again. The Ratification Stamp only ever speaks for the date and source version it shows.

How far you can rely on each level.

• (a) For an Interpretation, you may use the fact to plan and organise your compliance work, but before you rely on it for a filing, a product launch, a label, a declaration or any decision with legal consequences you must check it against the cited source and, where it matters, take your own legal advice. Our responsibility for an Interpretation is limited to having compiled it with reasonable care from the source cited (clause 22.1(c)).
• (b) For a Ratified fact, we warrant that it was reviewed and signed off as shown in its Ratification Stamp and that, at the date of the stamp, it was a correct statement of the cited law in the jurisdiction concerned. Liability for a Ratified fact is subject to the separate cap in clause 23.4(b).
• (c) Neither level covers how the law applies to facts we do not hold or that you have not entered correctly, such as your product's actual composition, the supply role you occupy, or your sales volumes.

Point-in-time records and Change Alerts. Every Output records the date it was produced and the version of the Regulatory Dataset it used, so you can show what the Service said at that time. When the rules behind a saved check or Output change, the Service marks it as out of date. Where alerts are switched on, the Service sends Change Alerts (in the Service, by email, or to a Slack, Microsoft Teams or shared mailbox channel you configure) for fee rates taking effect, duties falling due and reviewed changes in your markets and programmes, each with its status and source.

Your duty to review Change Alerts. You must keep Change Alerts switched on for at least one Administrator, keep your contact details current, and review each Change Alert within a reasonable time and in any event within 10 Business Days, or sooner where the alert shows a deadline falling earlier. We are not liable for loss that would have been avoided had you reviewed and acted on a Change Alert we sent.

Coverage and absences. The Service shows which markets, regimes and product types the Regulatory Dataset holds. Where it records that a market imposes no duty, that record is itself a Regulatory Fact, cited and carrying a status. Where the Service shows that it does not hold a market, regime or question, it makes no statement about it, and you must not treat silence as an absence of duty.

Fees and levies. Fee rates are those published by schemes and authorities. The amount you actually owe is set by the scheme or authority, not by us, and calculations in the Service are estimates of it unless the scheme has confirmed them.

You are responsible for:

• (a) the accuracy, completeness and lawfulness of Customer Data, including weights, materials, compositions, formulations, markets, volumes and the supply role you occupy for each product and market. Outputs are only as accurate as the data they are built from;
• (b) checking Outputs before you rely on them, in particular before filing, labelling, printing, signing or placing a product on the market;
• (c) your own compliance with the law, including registrations, reports, declarations, fee payments and record-keeping. These remain yours unless you have ordered a Filing Service under clause 8.3, and then only to the extent set out in its Service Schedule;
• (d) your Users and Outside Contacts, their use of the Service, and keeping sign-in credentials and multi-factor authentication secure. Tell us promptly at security@oblifee.com if you suspect unauthorised access;
• (e) having the rights and any notices or consents needed for us to process Customer Data as these Terms describe.

Acceptable use. You must not, and must make sure your Users and Outside Contacts do not: attempt to access another customer's data; probe, scan, overload or disrupt the Service; reverse engineer it except as the law allows; extract, copy, resell or redistribute the Regulatory Dataset beyond clause 20; use the Service to build a competing product or dataset; upload malware or unlawful content; or use the Service in breach of sanctions or export control law.

Optional Services are provided only when listed in an Order Form, and on the terms of their Service Schedule. These Terms apply to each Optional Service except where its Service Schedule says otherwise.

Onboarding Service. Where ordered, we help you set up your Workspace, import your products, packaging and supplier data, and train your Users, as described in the Order Form. The onboarding fee is billed with your first invoice. Data we import for you is Customer Data and you remain responsible for its accuracy under clause 7.1(a); you must review and confirm it before relying on it.

Responsible Person and Filing Service. Where ordered under a Responsible Person and Filing Service Schedule, we may act as your named responsible person, authorised representative or agent for the markets and regimes listed, or submit registrations and reports on your behalf. This service needs a written mandate from you naming the markets, regimes and acts we may perform. Unless the Schedule says otherwise: you supply and confirm the data; we submit only what you have approved; you pay all fees, levies and charges due to schemes and authorities; and our liability is subject to the separate cap in clause 23.4(c).

Ratified Facts. Where ordered, we will obtain ratification by a Qualified Reviewer of the Regulatory Facts for the regimes and markets listed in the Order Form, maintain it as the law changes in line with clause 6.5, and show the Ratification Stamp on each.

Research, custom regimes and training. Research requests, custom regimes, extra training and other professional services are provided as described in the Order Form or at oblifee.com/pricing. Research results are added to the Regulatory Dataset as Interpretations unless the Order Form provides for ratification.

UK-only processing. Where ordered for an enterprise Contract, we will process your Customer Data, including AI processing, only in the United Kingdom, using capacity provisioned for you. Features for which no UK-hosted model exists (today, label image generation) are switched off or run only with your written agreement for each use. Fees are priced per Contract; there is no list price.

AI Features produce suggestions. Their outputs are proposals, not decisions. Where an AI Feature proposes a change to your records (for example a column mapping, a product classification or a label correction), nothing is saved until a User confirms it, and you are responsible for what your Users confirm.

AI outputs can be incomplete or wrong. Answers from Obli are drawn from the Regulatory Dataset, your Customer Data and the Documentation, and show where they come from where they can; a Regulatory Fact keeps its own Information Status and Assurance Level when Obli repeats it. A generated label, design or text is not checked artwork until you have approved it.

Where the models run. The AI models we use run in Microsoft Azure under our own Azure subscription, except as stated below. Today:

• (a) Processed only in the UK: documentation search for Obli, commodity code search (the search embeddings) and label text recognition (OCR) run on resources in the UK South region that process requests only in that region;
• (b) UK resource, global processing: the models for the Obli conversation, document reading, artwork and image understanding, the label reader, the label design check and commodity code ranking are deployed in UK South on Microsoft's Global Standard tier. Anything stored stays in UK South, but Microsoft may process each request in any Azure region it chooses;
• (c) Sweden: label image generation runs from a resource in Sweden Central on the Global Standard tier, because no image generation model is offered in UK South;
• (d) Fallback outside Azure: only if the Azure models fail, Obli may send the question and the results of the tools it used (never uploaded documents) to Anthropic's API, processed on Anthropic's infrastructure in the United States;
• (e) Our own model: product photo background removal runs on our own model in our own hosting, with no third-party AI service.

The Sub-processor List at oblifee.com/subprocessors shows the current position. Microsoft does not use these requests to train models. We do not use Customer Data to train AI models, and our model providers' terms do not allow them to use it to train theirs.

Microsoft Teams and Microsoft 365 Copilot. If you use Obli inside Microsoft Teams or Microsoft 365 Copilot, messages pass through Microsoft's services under your own agreement with Microsoft, and Obli shows only what the linked User could see in the Service.

Your own AI tools. If you connect a third-party AI assistant to the Service (for example through Obli Connect), that provider acts for you and not for us, and its terms govern what it does with the data it receives.

The Service may show regulatory rules that apply to ingredients and formulations, such as restricted or prohibited substances, concentration limits and labelling duties. These are regulatory facts, not safety advice.

We never assess whether a product is safe. Any statement about a formulation is limited to whether it matches the cited regulatory rules, and where the Service refers to a formulation it refers only to known, acceptable formulations.

Before placing any product on the market you must carry out, and we always recommend, stability testing, compatibility testing between the product and its packaging, patch testing where the product touches skin, hair or nails, and any safety assessment the law requires (for cosmetics, a safety assessment by a qualified safety assessor).

Subject to clause 23.1, we are not liable for harm or loss arising from the safety, composition or performance of your products.

You may invite Outside Contacts, such as suppliers, guest users, agencies, printers, retailer contacts, outside compliance contacts and outside signers, to see or contribute to specific products or requests. You decide what each can see and for how long, and you are responsible for their access as if they were your Users.

Declarations, specifications, certificates and documents provided by suppliers and other Outside Contacts are their statements. We record who supplied them and when, but we do not verify them unless an Optional Service says so.

When you share a sealed dossier or product file with another Oblifee customer (for example through the Retailer Exchange), the recipient receives a read-only copy and we act on your instruction in providing it.

Outside Contacts accept our short terms of use when they first sign in. These Terms do not give them any rights against us.

The Service lets Users and outside signers sign documents such as declarations of conformity and approvals. A signature made in the Service is designed to meet the requirements of an advanced electronic signature (where signing is switched on for your Workspace) under Article 26 of the UK eIDAS Regulation and of Regulation (EU) 910/2014: it is uniquely linked to and capable of identifying the signer, created under the signer's sole control (including step-up authentication at the moment of signing), and linked to the signed data so that any later change is detectable. It is not a qualified electronic signature.

You agree that a signature made in the Service by you or your Users is a valid way for you to sign, and that you will not challenge a signed document between us solely because it was signed electronically (Electronic Communications Act 2000, section 7).

You are responsible for deciding whether a document needs a qualified electronic signature, a wet-ink signature, a witness or another formality in the relevant market.

Each signature is recorded with an evidence record showing the signer, the time, the authentication used and a fingerprint of the document.

You will pay the Fees set out in the Order Form. Subscription Fees are payable in advance for each billing period (monthly or annually, as the Order Form says). Annual billing, including for Enterprise Contracts, is charged at 10 months' Fees for 12 months. One-off items are payable when ordered. Fees are in pounds sterling unless the Order Form says otherwise.

Onboarding fees. Where the Order Form includes an onboarding fee, it is billed with your first invoice and is not refundable once onboarding work has started.

VAT and taxes. Fees exclude VAT and other applicable taxes, which you will pay at the rate in force.

How you pay. Payment by card or direct debit through our payment provider is always taken in advance for each billing period, whatever the Order Form says about payment terms. Where the Order Form provides for invoicing, invoices are payable within 30 days of the invoice date, or the longer period (not more than 60 days) stated in the Order Form.

Late payment. If you do not pay an undisputed amount on time, we may charge interest and compensation under the Late Payment of Commercial Debts (Interest) Act 1998 (at the time of writing, interest at 8 percent a year above the Bank of England base rate and a fixed sum for each late invoice). If an amount remains unpaid 14 days after we send you a reminder, we may suspend the Service under clause 15.

Disputed invoices. If you dispute an invoice in good faith, tell us in writing within 14 days with your reasons and pay the undisputed part. We will work with you to resolve the dispute promptly.

Price changes. We may change list prices. A change applies to your Contract only from your next renewal, and only if we told you at least 60 days before the renewal date.

Annual increase. On each anniversary of the Start Date (including during renewal periods) the recurring Fees increase by the greater of: (a) 3 percent; and (b) the 12-month rate of the Retail Prices Index (all items), published by the Office for National Statistics, for the month before the month in which the anniversary falls. If that index stops being published, we will use the closest official replacement. This increase applies in addition to any list price change under clause 13.7.

You may not withhold or set off amounts you owe us against amounts we owe you, except where a court orders it.

Digital Product Passports: the keep-live charge. If you publish Digital Product Passports or e-labels through the Service, the law may require each one to stay available for a minimum period (for example for the expected lifetime of the product, or a fixed number of years after the last unit was placed on the market), set for each product category in the law that requires the passport (the Passport Period). The charge for keeping a passport live is payable for the whole Passport Period, at the rate in the Order Form or, if none is stated, our list price (currently £2 per passport per year, which may change under clause 13.7), and remains payable if the Contract ends or you cancel. It is not payable for any period after: (a) you move the passports to another provider, when we will hand over the passport data and redirect the passport addresses we host to the new provider for the rest of the Passport Period; or (b) the passports are reached through a QR code or web address on your own domain name, so that you can point them elsewhere.

Each Contract starts on the Start Date and continues for the minimum term in the Order Form (the Minimum Term). Unless the Order Form says otherwise, monthly self-service Plans have a Minimum Term of one month.

Renewal. At the end of the Minimum Term, and each renewal period, the Contract renews automatically for the renewal period in the Order Form (or, if none is stated, 12 months, or one month for monthly Plans), unless either party gives notice of non-renewal at least the notice period in the Order Form before the end of the current period (or, if none is stated, 60 days, or before the end of the current month for monthly Plans). We will remind you of an annual renewal at least 30 days before it takes effect.

Ending for breach or insolvency. Either party may end a Contract by written notice if the other party: (a) commits a material breach that cannot be remedied; (b) commits a material breach that can be remedied and fails to remedy it within 30 days of a written request; or (c) becomes insolvent, enters administration, liquidation or a similar process, or stops trading.

We may end a Contract by written notice if Fees remain unpaid 30 days after the Service was suspended for non-payment.

Ending a Contract early does not reduce Fees for the rest of the Minimum Term, except where you end it under clause 4.6 or 14.3. The passport keep-live charge in clause 13.10 continues after a Contract ends, for whatever reason, except as that clause allows.

We may suspend all or part of the Service, giving notice where we reasonably can, if: (a) undisputed Fees remain unpaid as described in clause 13.5; (b) suspension is reasonably necessary to protect the security or integrity of the Service or other customers; or (c) use of your account breaches clause 7.2 or the law.

We will limit any suspension to what is necessary and restore the Service promptly once the reason has been dealt with. During a suspension for non-payment you can still export your Customer Data.

When a Contract ends, your Workspace closes and your right to use the Service, including read-only access, ends on that date. Before it closes we offer you a final sealed export (clause 16.2). Please take it, and any other export you need, before the end date.

Export. You can export Customer Data at any time before your Workspace closes, in the formats the Service offers, including a sealed export of each product file: a dated archive with an index and a fingerprint of every document, so its integrity can be shown later. Exporting is not included in a trial granted under clause 5.7.

After closure we delete or anonymise Customer Data within 90 days, except: (a) product-file records, which are kept under clause 17.5; (b) published passports, which are kept under clause 13.10; (c) data we must keep by law; (d) copies in encrypted backups, which expire on their normal cycle (currently up to 35 days); (e) usage telemetry already sent to our analytics and monitoring providers, which is deleted on their own retention cycles; and (f) our own records of the Contract, invoices and the security audit log. We will confirm deletion in writing on request.

Passports after the Contract ends. Published Digital Product Passports stay live for the Passport Period under clause 13.10, unless you move them to another provider or they run on your own domain name, in which case we hand over the passport data and set up redirects.

Clauses that by their nature are intended to continue (including 13 (and the passport charge in 13.10), 16, 17, 19, 20, 23 and 29) continue after a Contract ends.

The Service is built to hold your product files as legal records. Many product laws require documents to be kept for a fixed period after the last unit of a product was placed on the market (often ten years). The Service records, for each document, the date it must be kept until.

Replace, not delete. During its retention period a document cannot be deleted from a product file. It can be replaced by a new version or marked as withdrawn, and the earlier version and the reason for the change are kept in the file's history. This protects you if an authority asks what your file showed at a given date.

You are responsible for telling the Service the true date of the last sale or placing on the market of each product or version, because retention periods run from that date.

Personal data in records. Some records contain personal data, such as the details of a person who reported a complaint or safety issue. The Service removes or blanks that personal data when it is no longer needed and in any event at the end of the period the law allows (for example five years for consumer complaint records under Article 9(13) of Regulation (EU) 2023/988), while keeping the rest of the record.

When the Contract ends. Your retention duties continue after our Contract ends. Closing a Workspace always works as follows: before it closes we offer you a final sealed export of your product files; on closure your access ends; we keep the product-file records, read-only, until the latest legal keep-until date among them; and on that date we permanently delete them. For that whole period the Records Retention charge in the Order Form or, if none is stated, our list price (currently £240 a year, which may change under clause 13.7) is payable. While we keep the records you can ask us for copies, or for access for an authority.

Each party will comply with the UK GDPR, the Data Protection Act 2018 and, where they apply, the EU GDPR and other applicable data protection laws.

When we are your processor. For personal data within Customer Data (for example your Users' details, supplier and Outside Contact details, signers, and complaint reporters) we act as your processor, and the Data Processing Agreement in Schedule 1 applies.

When we are a controller. We act as a controller for personal data we use to run our business: account administration, billing, security and audit logs, service communications, and business-to-business marketing to your contacts (who can opt out at any time). Our Privacy Policy at oblifee.com/privacy explains this.

Sub-processors. We use the sub-processors listed by category in Schedule 2 and named in our Sub-processor List at oblifee.com/subprocessors. We will give you at least 30 days notice of a new sub-processor, and you may object on reasonable data protection grounds under Schedule 1.

Where data is held. Customer Data at rest is stored in Microsoft Azure in the United Kingdom (UK South region) unless the Order Form records a different location. Some processing happens elsewhere, as clause 9.3 and the Sub-processor List show (in particular, requests to AI models on Microsoft's Global Standard tier may be processed in any Azure region), and the Microsoft Teams channel runs in Microsoft's West Europe region. Our aim, as Oblifee grows, is to hold each customer's data in its own territory; until then, UK-only processing is available as an Optional Service under clause 8.6. Where a sub-processor processes personal data outside the UK or EEA, we use an appropriate transfer safeguard as described in Schedule 1.

Each party will keep the other's confidential information confidential, use it only to perform or receive the Contract, and disclose it only to its employees, contractors, advisers, insurers, group companies and (in our case) LataSys Limited and sub-processors who need to know it and are bound by equivalent duties.

This does not apply to information that is or becomes public other than through a breach, was already known to the recipient, is independently developed, or must be disclosed by law, a regulator or a court (in which case the recipient will, where lawful, tell the other party first).

These duties continue for five years after the Contract ends, and for trade secrets for as long as they remain trade secrets.

Your data. You own Customer Data. You grant us a non-exclusive licence to use it for the purpose of providing and supporting the Service and Optional Services to you, and for the other purposes these Terms allow.

Our platform and dataset. LataSys Limited owns, and licenses to us, the Service, the software, the Regulatory Dataset (including its database rights), the Documentation and the Oblifee name and marks. Nothing in a Contract transfers any of these to you.

Your licence. During the Subscription Term we grant you a non-exclusive, non-transferable licence for your Users to use the Service for your internal business purposes. You may use, copy and share Outputs for your own compliance purposes, including with your advisers, auditors, insurers, customers, suppliers and authorities, and keep them after the Contract ends.

No resale of the dataset. You may not extract, republish, resell or make available the Regulatory Dataset, or substantial parts of it, to anyone else, or use it to train a machine learning model, except through Outputs as clause 20.3 allows or under a separate data licence.

Usage data. We may use information about how the Service is used, in aggregated form that does not identify you or any individual, to operate, secure and improve the Service.

Feedback. If you give us feedback or suggestions, we may use them freely without obligation to you.

Third-party claims. We will defend you against a claim that your use of the Service in line with these Terms infringes a third party's UK intellectual property rights, and pay damages finally awarded, provided you tell us promptly, let us control the defence and give reasonable help. We may modify or replace the affected part, or end the Contract and refund prepaid Fees for the unused period. This clause states our entire liability for infringement claims.

We will not use your name, logo or trademarks, or say that you are a customer, without your prior written consent, which you may withdraw at any time for future use.

We warrant that:

• (a) the Service will perform materially in line with the Documentation;
• (b) we will provide the Service and Optional Services with reasonable skill and care;
• (c) we compile the Regulatory Dataset with reasonable care from the sources cited and show each fact's Information Status and Assurance Level accurately;
• (d) we will not knowingly introduce malware into the Service.

If we breach clause 22.1(a), (b) or (c), your remedy is that we will correct the issue within a reasonable time and, if we cannot, either party may end the affected Service and we will refund prepaid Fees for the unused period. This does not limit clause 23.

Except as set out in these Terms, the Service is provided without any other warranty, condition or term, whether implied by statute, common law or otherwise, to the extent the law allows. We do not warrant that the Service will be uninterrupted or error free, or that the Regulatory Dataset covers every law that applies to you.

Each party warrants that it has the authority to enter into the Contract.

What is not limited. Nothing in a Contract limits or excludes liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, or any other liability that cannot be limited or excluded by law. Nor does anything limit your obligation to pay the Fees.

Losses excluded. Subject to clause 23.1, neither party is liable, however the liability arises (including in negligence), for: (a) loss of profit, revenue, business, contracts, goodwill or anticipated savings; (b) loss or corruption of data, except our obligation to restore it from our latest backup; (c) indirect or consequential loss.

Fines, levies and reliance. Subject to clause 23.1, we are not liable for: (a) fees, levies and charges that you would have had to pay to a scheme or authority in any event; (b) fines or penalties imposed on you, except to the extent caused by our breach of a Filing Service; or (c) loss arising from your reliance on an Interpretation for a purpose described in clause 6.6(a) without checking it as that clause requires.

Caps. Subject to clauses 23.1 to 23.3, each party's total liability arising from or in connection with a Contract in each Contract Year is limited as follows:

• (a) General cap: the greater of £25,000 and the Liability Cap Multiplier in the Order Form (default 1) multiplied by the Fees paid and payable under that Contract in the 12 months before the event giving rise to the claim;
• (b) Ratified facts: for claims arising from a Ratified fact, the greater of £100,000 and 3 times the Fees paid and payable in that period, in place of (a);
• (c) Filing and responsible person services: for claims arising from a Responsible Person and Filing Service, the amount set out in its Service Schedule, or if none, the greater of £50,000 and 2 times the Fees for that service in that period, in place of (a);
• (d) Data protection and confidentiality: for claims arising from a breach of clause 18, Schedule 1 or clause 19, 2 times the general cap, in place of (a).

The caps in clause 23.4 are separate and do not add together for the same claim.

Each party must take reasonable steps to mitigate its loss, and a claim must be notified in writing within 12 months of the party becoming aware of it.

We will maintain, with reputable insurers, professional indemnity insurance of at least £2,000,000 for each claim and cyber liability insurance of at least £1,000,000, and public and products liability and employer's liability insurance as required by law. We will give you a certificate on request.

Neither party is liable for delay or failure to perform caused by events beyond its reasonable control, such as natural disasters, epidemics, war, terrorism, civil unrest, government action, failures of public networks or cloud platforms beyond our reasonable control, or industrial action (other than of its own staff). The affected party will tell the other promptly and take reasonable steps to limit the effect. This clause does not excuse a payment obligation. If the event continues for more than 60 days, either party may end the affected Contract by notice.

You may not assign or transfer a Contract without our prior written consent, which we will not unreasonably withhold.

We may subcontract parts of the Service, including to LataSys Limited for hosting, operations and support, and to our sub-processors. We remain responsible for what our subcontractors do.

We may assign or transfer a Contract to a company in our group or to a buyer of all or most of our business, and LataSys Limited may transfer Contracts made before 1 January 2027 to Oblifee Ltd, in each case on notice to you and without reducing your rights under the Contract. You agree in advance to such a transfer and will sign any document reasonably needed to give effect to it.

Each party will comply with the Bribery Act 2010, the Modern Slavery Act 2015, the Criminal Finances Act 2017 and applicable sanctions laws, and will maintain reasonable policies and procedures to do so. Either party may end a Contract immediately on notice if the other breaches this clause.

Operational notices (such as Change Alerts, service notices and renewal reminders) may be given in the Service or by email to your Administrators.

Formal notices under a Contract (such as notices of breach, termination or a claim) must be in writing and sent by email and by post or hand delivery: to us at legal@oblifee.com and 66 Paul Street, London, EC2A 4NA; to you at the contacts in the Order Form. A notice by email is received at the time of sending if sent before 17:00 on a Business Day, otherwise on the next Business Day.

Entire agreement. A Contract is the entire agreement between the parties about its subject matter and replaces earlier discussions. Each party confirms it has not relied on any statement not set out in the Contract. This does not limit liability for fraud.

Variation. A Contract may be varied only in writing signed by both parties, or as clause 4 allows.

Waiver. A failure or delay in exercising a right is not a waiver of it.

Severance. If any provision is found invalid or unenforceable, the rest of the Contract continues, and the provision applies with the minimum change needed to make it valid.

Third parties. No one other than the parties has any right to enforce a Contract under the Contracts (Rights of Third Parties) Act 1999, except that LataSys Limited may enforce clauses 7.2 and 20.

Relationship. Nothing in a Contract creates a partnership, joint venture or agency, except where a Responsible Person and Filing Service appoints us as your agent for the acts it lists.

Counterparts and electronic execution. An Order Form may be signed in counterparts and electronically.

Escalation. Before starting court proceedings (other than for urgent relief or unpaid Fees), a party will refer a dispute to a senior manager of each party, who will meet within 15 Business Days to try to resolve it.

Each Contract, and any dispute or claim arising from it (including non-contractual disputes), is governed by the law of England and Wales. The courts of England and Wales have exclusive jurisdiction.

This Schedule applies where we process personal data for you as your processor under clause 18.2. It sets out the terms required by Article 28(3) of the UK GDPR and EU GDPR.

Details of processing.

• Subject matter and duration: providing the Service and Optional Services for the Subscription Term, and for records kept under clause 17.
• Nature and purpose: hosting, storage, organisation, retrieval, display, transmission on your instruction, sealing and export, and AI-assisted processing that you initiate.
• Categories of data subjects: your Users; your Outside Contacts (suppliers, guests, outside compliance contacts, signers); people named in your product records, including complaint and incident reporters.
• Categories of personal data: names, work contact details, job titles, sign-in identifiers, authentication and audit records, signatures and their evidence records, and details given in complaints or incident reports. You must not upload special category data or criminal offence data unless a Service Schedule provides for it.

Our obligations. We will:

• (a) process personal data only on your documented instructions, which are these Terms, the Order Form and your use of the Service, unless the law requires otherwise (in which case we will tell you unless the law forbids it);
• (b) make sure people authorised to process the personal data are bound by confidentiality;
• (c) take the security measures described in Schedule 3 and at oblifee.com/security, as required by Article 32;
• (d) engage sub-processors only as clause 18.4 and paragraph S1.4 allow;
• (e) help you, taking into account the nature of the processing, to respond to requests from data subjects exercising their rights;
• (f) help you meet your obligations on security, breach notification, data protection impact assessments and prior consultation;
• (g) tell you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting your personal data, with the information you reasonably need;
• (h) at the end of the Contract, delete or return the personal data as clause 16 describes, unless the law requires us to keep it;
• (i) make available the information needed to show compliance with this Schedule and allow for audits, which may be met first by our security documentation and independent reports, and otherwise by an audit on 30 days notice, not more than once a year, at your cost.

Sub-processors. You give general authorisation for the sub-processors in the Sub-processor List. We will impose data protection terms on each that are no less protective than this Schedule, and we remain liable for them. If you object to a new sub-processor on reasonable grounds within the notice period and we cannot offer a reasonable alternative, you may end the affected Service and receive a refund of prepaid Fees for the unused period.

International transfers. We will not transfer personal data outside the UK or EEA except to a country with an adequacy decision or under an appropriate safeguard, such as the UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses.

Your obligations. You confirm that you have a lawful basis for the processing and have given any notices needed, including to your Outside Contacts.

The current named list, with each provider's location and the transfer safeguard used, is published at oblifee.com/subprocessors. The categories are:

These are the default service levels. The Order Form may set different ones.

Availability target. We aim for the Service to be available 99.5 percent of each calendar month, excluding planned maintenance (announced at least 48 hours ahead and scheduled where possible outside UK business hours), beta features, and events under clause 25.

Support. Support is available by email at support@oblifee.com and through the help centre at support.oblifee.com, during 09:00 to 17:30 UK time on Business Days.

Response targets (time to first response by a person, during support hours):

• Severity 1 (Service unavailable, or a security incident affecting your data): 2 business hours;
• Severity 2 (a major feature unusable with no workaround): 4 business hours;
• Severity 3 (a feature impaired, workaround available): 1 Business Day;
• Severity 4 (questions, minor issues, requests): 2 Business Days.

Security measures. We maintain technical and organisational measures appropriate to the risk, including: hosting in Microsoft Azure UK South; encryption of data in transit and at rest; separation of each customer's data enforced in the database itself (row-level security); multi-factor authentication for Users; malware scanning of uploaded files; encrypted backups kept for 35 days; logging and monitoring of administrative and security events with alerting; least-privilege staff access; and regular review of our controls. Details are at oblifee.com/security.