Terms & Conditions and Privacy Policy

Welcome to the website and online service of Sevva, the platform developed by All Street Research Limited (“All Street”, “we,” or “us”).

1. Preliminaries

This Agreement sets out the terms that apply when you use our online services, web site, and software provided on or in connection with the service (collectively the “Service”). This Agreement applies in addition to the general terms of access to the open-access pages of this web site (for example, our privacy and data protection policy), which is included below.

Please read this Agreement carefully to ensure that you understand each provision. You may also download this Agreement for future reference. This Agreement is divided into four parts. Part One explains the terms that govern your use of the Service. Part Two contains additional legal terms, including provisions that limit our liability to you. Part Three describes our privacy and data protection policy.

Part I: Terms Governing Use of the Service

2. Information about us

www.sevva.ai is a website and online service operated by All Street Research Limited. We are registered in England and Wales under company number 9108009 and have our registered office at The Frames, 1 Phipp Street, London EC2A 4PS. Please note that we are not, and have been advised that we do not need to be, authorised and regulated by the Financial Conduct Authority or any other regulator.

3. Your general representations and obligations

Use of All Street information available from this web site is at your own risk. In no event will you hold All Street or any affiliated party liable for any direct or indirect trading or investment losses caused by any information on this site. You further agree that you will not communicate any content of our web site (nor effect links thereto) to any other person unless that person has agreed to be bound by this Agreement. If you are acting as an agent for any other person, such person must also be identified by name to All Street.

4. Disclaimer

The information provided through the Service represents our opinions, which we may have based upon generally available information, field research, inferences and deductions through our due diligence and analytical process. To the best of our knowledge and belief, all information contained herein is accurate and reliable, but we do not warrant to you that this is so. Where so disclosed, information on this web site will have been obtained from public or other third party sources that we believe to be accurate and reliable, but, such information is presented “as is,” without warranty of any kind, whether express or implied. All Street makes no representation, express or implied, as to the accuracy, timeliness, or completeness of any information appearing on this web site or with regard to the results to be obtained from its use. Please assume that all information which you review through the Service is subject to change or updating at any time, and may be updated or deleted without warning or liability on our part.

Part II: Additional Legal TermsIntellectual Property

The Website may include at any given time text, graphics, logos, icons, images, sound clips, video clips and data compilations, and together with the Website's page layout, underlying code and software we refer to all of these as "Content". All of the Content is the property of All Street, our affiliates or third parties with whom we do business, and this means that it is protected by United Kingdom and international intellectual property laws and other relevant laws. Except as provided by Part 1, Chapter 3 of the UK Copyright, Designs and Patents Act 1988 (which contains what are generally known as the "fair use" provisions for copyrighted materials), you may not reproduce, copy, distribute, store or in any other fashion re-use material from the Website unless otherwise indicated on the Website or unless given express written permission to do so by All Street.

Links to other websites.

The Service may contain links to third-party websites, advertisers, services, special offers, or other events or activities that are not owned or controlled by All Street. All Street does not endorse or assume any responsibility for any such third-party sites, information, materials, products, or services. If you access a third party website from the Service, you do so at your own risk, and you understand that this Agreement and All Street’s Privacy Policy do not apply to your use of such sites. You expressly relieve All Street from any and all liability arising from your use of any third-party website, service, or content. Additionally, your dealings with or participation in promotions of advertisers found on the Service, including payment and delivery of goods, and any other terms (such as warranties) are solely between you and such advertisers. You agree that All Street shall not be responsible for any loss or damage of any sort relating to your dealings with such advertisers.

No Warranties.

The service is provided on an “as is” and “as available” basis. Use of the service is at your own risk. To the maximum extent permitted by applicable law, the service is provided without warranties of any kind, whether express or implied, including, but not limited to, implied warranties of merchantability, fitness for a particular purpose, or non-infringement. No advice or information, whether oral or written, obtained by you from All Street or through the service will create any warranty not expressly stated herein. Without limiting the foregoing, All Street, its subsidiaries, and its licensors do not warrant that the content is accurate, reliable, or correct; that the service will meet your requirements; that the service will be available at any particular time or location, uninterrupted, or secure; that any defects or errors will be corrected; or that the service is free of viruses or other harmful components. Any content downloaded or otherwise obtained through the use of the service is downloaded at your own risk and you will be solely responsible for any damage to your computer system or mobile device or loss of data that results from such download or your use of the service. All Street does not warrant, endorse, guarantee, or assume responsibility for any product or service advertised or offered by a third party through the All Street service or any hyperlinked website or service, and All Street will not be a party to or in any way monitor any transaction between you and third-party providers of products or services.

Indemnity.

You agree to indemnify All Street and its subsidiaries, agents, licensors, managers, and other affiliated companies, and their employees, contractors, agents, officers and directors, from and against any and all claims, damages, losses, liabilities, costs and expenses (including reasonable legal advisory fees incurred in relation to the same) arising from: (i) your use of and access to the Service; (ii) your violation of any term of this Agreement; (iii) your violation of any third-party right; (iv) your violation of any applicable law, rule or regulation; (v) your User Content or any content that is submitted via your account; or (vi) access of a third party to the Service using your password. All Street has the right to represent all and any such indemnified persons in relation to a claim under this indemnity.

Limitation of Liability

All Street, its directors, officers and employees, as well as companies in All Street's Group and their directors, officers and employees, shall not be liable to you for the financial consequences of any action you take (or fail to take) as a result of using the Service or placing reliance on any information from time to time appearing on this Website, other than where these consequences arise from the relevant company's or its directors', officers' or employees' fraud.Under no circumstances will All Street be responsible for any damage, loss, or injury resulting from hacking, tampering, or other unauthorized access or use of the Service or your account or the information contained therein. To the maximum extent permitted by applicable law, All Street assumes no liability or responsibility for any (i) errors, mistakes, or inaccuracies of content; (ii) property damage resulting from your access to or use of the Service; (iii) any unauthorized access to or use of our secure servers and/or any and all personal information stored therein; (iv) any interruption or cessation of transmission to or from the Service; (v) any bugs, viruses, trojan horses, or the like that may be transmitted to or through our Website by any third party; (vi) any errors or omissions in any content or for any loss or damage incurred as a result of the use of any content posted, emailed, transmitted, or otherwise made available through the Website; or (vii) user content or the defamatory, offensive, or illegal conduct of any third party. Other than in the case of fraud or personal injury or death, All Street’s maximum quantum of liability to you for any claim not limited or excluded as above shall not exceed 100 GBP. The service is controlled and operated from facilities in the United Kingdom. All Street makes no representations that the Service is appropriate or available for use or legal to use in other locations.

Governing Law and Arbitration

This Agreement is governed by English law. Any dispute or claim arising out of or in connection with any such contract will be governed by English law. You and we both agree that the courts of England and Wales will have exclusive jurisdiction. If you have any complaint about All Street or the Service, you should contact us at all@allstreet.org. All Street maintains a written policy for the handling of complaints concerning the Service, and undertakes to use all reasonable endeavors to resolve complaints referred to us within 2 weeks.

General Provisions

A. Assignment.

This Agreement, and any rights and licences granted hereunder, may not be transferred or assigned by you, but may be assigned by All Street without restriction upon written notice to you. Any attempted transfer or assignment in violation hereof shall be null and void.

B. Notification Procedures and Changes to the Agreement.

All Street may provide notifications, whether such notifications are required by law or are for marketing or other business related purposes, to you via email notice, written or hard copy notice, or through posting of such notice on our website, as determined by All Street in our sole discretion. All Street reserves the right to determine the form and means of providing notifications to our Registered Users, provided that you may opt out of certain means of notification as described in this Agreement. All Street is not responsible for any automatic filtering you or your network provider may apply to email notifications we send to the email address you provide us. All Street may, in its sole discretion, modify or update this Agreement from time to time, and so you should review this page periodically. When we change the Agreement in a material manner, we will update the ‘last modified’ date on this page. Your continued use of the Service after any such change constitutes your acceptance of the new Terms of Use.

C. Entire Agreement/Severability.

This Agreement, together with any amendments and any additional agreements you may enter into with All Street in connection with the Service, shall constitute the entire agreement between you and All Street concerning the Service. If any provision of this Agreement is deemed invalid by a court of competent jurisdiction, the invalidity of such provision shall not affect the validity of the remaining provisions of this Agreement, which shall remain in full force and effect.

D. No Waiver.

No waiver of any term of this Agreement shall be deemed a further or continuing waiver of such term or any other term, and All Street’s failure to assert any right or provision under this Agreement shall not constitute a waiver of such right or provision.

E. Termination and consequences.

In principle, this Agreement remains in force indefinitely, but both we and you have the right to terminate it on immediate notice, served as provided above. Termination will result in the suspension of your access to the Service. All Street will return to you (or destroy, if you prefer) all confidential information it holds concerning you. You agree on termination to delete from your own computer systems all confidential material relating to All Street and the Service (and All Street may request that you provide it with a statutory declaration to confirm that you have done so). However, you agree that termination shall not require All Street to take down from the Web Site any content that you have lawfully placed on there prior to termination. To the extent All Street is permitted at any time while this Agreement is in force to inform other Registered Users that you are a Registered User, upon termination, All Street shall similarly be permitted to inform such persons that you have ceased to be a Registered User (without providing any reasons therefor).

F. Contact.

Please contact us all@allstreet.org with any questions regarding this Agreement.

Part III. Privacy and Data Protection Policy

This privacy policy applies to the information that All Street Research Ltd may collect about you as a user of the All Street branded website www.sevva.ai and services.This policy does not apply to information about you collected by third party websites and offerings linked to or otherwise accessible from All Street website. The information collected or received by third parties is subject to their own privacy policies. We are committed to safeguarding the privacy of our website visitors and this policy sets out how we will treat your personal information. Our website uses cookies. By using our website and agreeing to this policy, you consent to our use of cookies in accordance with the terms of this policy.

1. What information do we collect?

We may collect, store and use the following kinds of personal information:

(a) information about your computer and about your visits to and use of this website (including your IP address, geographical location, browser type and version, operating system, referral source, length of visit, page views, and website navigation)

(b) information that you provide to us for the purpose of registering with us. We ask for certain information such as your username, real name, short bio, industry, skills, location, interest in certain sectors and e-mail address when you register for an All Street account, or if you correspond with us. We may also retain any messages you send through the Service, and may collect information you provide in User Content you post to the Service. Your username and if you choose to disclose it, your real name, will be published publicly. Once published your username and / or real name may not be able to be removed.

(c) information that you provide to us for the purpose of subscribing to our website services, email notifications and/or newsletters and

(d) any other information that you choose to send to us

2. Social Media Interactivity

To customise your experience on our website and to simplify our registration processes, we provide you with the opportunity to access or interact with third-party services, such as LinkedIn or Facebook. When you login to the All Street website through these third-party services, we may share information about you with these third-party service providers and they may share data about you with us. For example, if you access our websites or Service through a third-party connection or log-in, for example, through LinkedIn profile API, by “following,” “linking,” adding the All Street application, linking your account to the All Street website, etc., that third party may pass certain information about your use of its service to All Street. This information could include, but is not limited to, the user ID associated with your account (for example, your LinkedIn UID), an access token necessary to access that service, any information that you have permitted the third party to share with us, and any information you have made public in connection with that service. You should always review, and if necessary, adjust your privacy settings on third-party websites and services before linking or connecting them to the All Street Website. You may also unlink your third party account from the Service by adjusting your settings on the third party service.

3. Using your personal information

Personal information submitted to us via this website will be used for the purposes specified in this privacy policy or in relevant parts of the website. We may use your personal information to: (a) administer the website; (b) improve your browsing experience by personalising the website; (c) enable your use of the services available on the website; (f) send you general (non-marketing) commercial communications; (g) send you email notifications which you have specifically requested; (h) send you our newsletter and other marketing communications relating to our business, or the businesses of carefully-selected third parties, which we think may be of interest to you, by post or, where you have specifically agreed to this, by email or similar technology (and you can inform us at any time if you no longer require marketing communications); (i) provide third parties with statistical information about our users – but this information will not be used to identify any individual user; (j) deal with enquiries and complaints made by or about you relating to the website; (k) keep the website secure and prevent fraud; (l) verify compliance with the terms and conditions governing the use of the website. We will not, without your express consent, provide your personal information to any third parties for the purpose of direct marketing.

4. Disclosures

We may disclose your personal information to any of our employees, officers, agents, suppliers or subcontractors insofar as reasonably necessary for the purposes set out in this privacy policy. In addition, we may disclose your personal information: (a) to the extent that we are required to do so by law; (b) in connection with any ongoing or prospective legal proceedings; (c) in order to establish, exercise or defend our legal rights (including providing information to others for the purposes of fraud prevention and reducing credit risk); (d) to the purchaser (or prospective purchaser) of any business or asset that we are (or are contemplating) selling; and (e) to any person who we reasonably believe may apply to a court or other competent authority for disclosure of that personal information where, in our reasonable opinion, such court or authority would be reasonably likely to order disclosure of that personal information. Except as provided in this privacy policy, we will not provide your information to third parties.

5. International data transfers

Information that we collect may be stored and processed in and transferred between any of the countries in which we operate in order to enable us to use the information in accordance with this privacy policy. Information that you provide may be transferred to other countries including the United States, which do not have data protection laws equivalent to those in force in the European Economic Area. In addition, the personal information that you submit for publication on the website will be published on the internet and may be available, via the internet, around the world. We cannot prevent the use or misuse of such information by others. You expressly agree to such transfers of personal information.

6. Security of your personal information

We will take reasonable technical and organisational precautions to prevent the loss, misuse or alteration of your personal information. We will store all the personal information you provide on our secure (password- and firewall-protected) servers. You acknowledge that the transmission of information over the internet is inherently insecure, and we cannot guarantee the security of data sent over the internet. You are responsible for keeping your password and other login details confidential. We will not ask you for your password (except when you log in to the website).

7. Policy amendments

We may update this privacy policy from time to time by posting a new version on our website. You should check this page occasionally to ensure you are happy with any changes.

8. Your data protection rights

Where we act as controller of your personal data, you may have the following rights, subject to the conditions, limitations and exemptions in applicable data protection law:

• to be informed about how your personal data is used;
• to access your personal data;
• to rectify inaccurate or incomplete personal data;
• to request erasure of your personal data;
• to restrict the processing of your personal data;
• to data portability, where applicable;
• to object to processing, including an absolute right to object to direct marketing; and
• not to be subject to certain decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects.

You may also withdraw consent at any time where we rely on consent. Withdrawal does not affect processing carried out before consent was withdrawn.

These rights are not absolute and may not apply in every case. We may retain or continue to process personal data where permitted or required by law.

To exercise a right, contact allstreet@allstreet.org. We may request information reasonably necessary to verify your identity and will respond within the period required by applicable law. Requests are normally free of charge, but we may charge a reasonable fee or refuse a request where permitted by law.

Where we process personal data on behalf of a business customer, that customer is normally the controller. You should submit your request to that customer. We will assist the customer as required by our agreement and applicable law.

9. Third party websites

The website contains links to other websites. We are not responsible for the privacy policies or practices of third party websites.

10. Updating information

Please let us know if the personal information, which we hold, about you needs to be corrected or updated.

11. Contact

If you have any questions about this privacy policy or our treatment of your personal information, please write to us by email to  allstreet@allstreet.org or by post to The Frames, 1 Phipp Street, London EC2A 4PS.

12. Data controller

The data controller responsible in respect of the information collected on this website is All Street Research Ltd. Our data protection registration number is ZA075697.

Questions or Complaints?

If you have any queries at all regarding this site, the products featured on the site or any of the terms, please do not hesitate to contact us via e-mail at all@allstreet.org and we will be more than happy to assist you.

Processing Customer Data

Where All Street Research Limited, trading as Sevva AI, processes personal data submitted to the Service by a business customer, the customer normally acts as controller and we act as processor. Customer Data may include users’ contact, account, professional and technical information, together with content submitted through the Service.

We process Customer Data only to provide, host, secure, maintain and support the Service, in accordance with the customer’s documented instructions and applicable data protection law. We require authorised personnel to maintain confidentiality and use reasonable technical and organisational security measures.

We may use service providers to support functions such as hosting, communications, analytics and technical support. Where required, they are subject to appropriate data-protection terms. If Customer Data is transferred internationally, we use a legally recognised transfer mechanism where applicable.

Our Data Processing Addendum addresses security, service providers, international transfers, assistance with individual rights, data breaches, audits, and the return or deletion of Customer Data when services end. It forms part of the relevant customer agreement where applicable.

Customers may request our Data Processing Addendum and current subprocessor information by emailing sales@sevva.ai.

Annex EU-B2B — EU Business-to-Business Data Protection Terms

Sevva / All Street Research Limited (company number 9108009)

1. Application

1.1 The Customer represents and warrants that it is a legal person or other organisation established in the European Union, contracting wholly in the course of business and not as a consumer, and that no individual is permitted to use the Services in a personal capacity.

1.2 The Services are supplied only to the Customer, under a B2B commercial agreement, and are accessed only by Authorised Users provisioned under the Customer's subscription. Sevva does not provide the Services directly to individuals in the European Union, does not permit individual self-service or consumer registration, and does not contract with individuals in the European Union for the Services.

1.3 Sevva does not direct marketing of the Services at individuals in the European Union as consumers.

1.4 The parties acknowledge that these facts are the basis of this Annex and of the Article 3(2)/Article 27 position in Part 7.

2. Roles

2.1 The Customer is the controller of Customer Personal Data.

2.2 Sevva is a processor of Customer Personal Data. Sevva does not determine the purposes of the processing or the essential means of it.

2.3 Sevva shall not become a controller, joint controller or independent controller of Customer Personal Data by reason of anything done under the Agreement. Sevva's decisions are limited to technical and organisational matters that are not essential to the purposes of processing, and are made consistently with clause 8.

2.4 Sevva acts as a controller only in respect of its own account, contract administration and statutory records, as described in the Sevva Privacy Policy. Nothing in this Annex extends that controllership to Customer Personal Data.

3. Documented Instructions

3.1 Standing Instructions. The Customer instructs Sevva to process Customer Personal Data solely for the provision, operation, hosting, maintenance, security, support, backup, disaster recovery and integrity of the Services, and for compliance with Sevva's obligations under the Agreement and applicable law, and for no other purpose.

3.2 Details of processing. The subject matter of the processing is the provision of the Services. The duration is the term of the Agreement plus the deletion period in clause 13. The nature of the processing is the storage and retrieval of Customer Personal Data as necessary for clause 3.1. The categories of data subjects are the Customer's Authorised Users and its administrative contacts. The categories of personal data are business identification and contact data (such as username, name, business email address and telephone number), authentication and account data, access and security event records, and any content the Customer or its Authorised Users submit to the Services. The obligations and rights of the Customer are as set out in this Annex. Special category data and data relating to criminal convictions or offences are not intended to be processed, and shall not be submitted without the prior written agreement of Sevva.

3.3 Record of instructions. The Customer's acceptance of the Agreement, together with clause 3.1, constitutes the Customer's documented instructions for that processing. Further instructions must be given in writing to Sevva and become part of the documented instructions when confirmed in writing.

3.4 No processing outside instructions. Sevva shall not process Customer Personal Data except on the Customer's documented instructions, including with regard to transfers to third countries, unless required to do so by Union or Member State law, in which case Sevva shall inform the Customer before processing unless that law prohibits it on important grounds of public interest.

3.5 Infringing instructions. Sevva shall inform the Customer without undue delay if, in its opinion, an instruction infringes the GDPR.

3.6 Confidentiality. Persons authorised to process Customer Personal Data are subject to confidentiality obligations, and access is limited to those who need it to perform the Standing Instructions.

3.7 Records. Sevva maintains records sufficient to demonstrate that processing is carried out on documented instructions, and shall provide them to the Customer or a supervisory authority on request.

4. No Processing for Sevva's Own Purposes

4.1 Sevva shall not process Customer Personal Data for its own purposes, or to train, fine-tune or evaluate any machine-learning model, or to create benchmarks, indices, aggregate commercial datasets or comparable output, or for advertising, profiling or marketing, or to sell or disclose it to any third party except as permitted by clause 9 or 12.

4.2 Sevva may create aggregated or anonymised data only where it does not identify and cannot reasonably be used to identify any individual.

5. Authorised Users

5.1 Customer Personal Data relating to Authorised Users is processed because those individuals are authorised users of the Customer's subscription, and not because Sevva is offering goods or services to them.

5.2 The provision of a processing service to a business customer is not the offering of goods or services to data subjects within the meaning of Article 3(2)(a) GDPR.

6. No Monitoring of Behaviour

6.1 The Services do not include, and Sevva shall not introduce, behavioural profiling, employee productivity monitoring, workplace surveillance or behavioural analytics.

6.2 Technical records. Sevva may generate technical records necessary for the operation and security of the Services, such as authentication and access events and security and diagnostic logs. These are used only for clause 3.1, are not used to analyse, evaluate, score or predict the behaviour, performance or preferences of any individual, are not combined with other data to build profiles, and are retained only for the period stated in Sevva's retention schedule.

6.3 Sevva does not carry out any processing constituting the monitoring of the behaviour of data subjects within the meaning of Article 3(2)(b) GDPR.

7. Territorial Scope: Article 3(2) and Article 27

7.1 The parties record that: (a) Sevva is established in the United Kingdom and has no establishment in the European Union; (b) the processing of Customer Personal Data is carried out on behalf of the Customer, a controller subject to the GDPR by virtue of Article 3(1); (c) Sevva does not offer goods or services to data subjects in the European Union within Article 3(2)(a), for the reasons in Parts 1 and 5; and (d) Sevva does not monitor the behaviour of data subjects in the European Union within Article 3(2)(b), for the reasons in Part 6.

7.2 Accordingly, neither Article 3(2)(a) nor Article 3(2)(b) is engaged in respect of the processing carried out under the Agreement, Article 3(2) does not apply to Sevva in respect of that processing, and the obligation in Article 27(1) to designate a representative in the Union does not arise.

7.3 This position rests on the territorial scope of Article 3 and not on any exemption by reason of Sevva's status as a processor. Article 27(2) is not relied upon.

7.4 The position depends on the continuing accuracy of the facts in Parts 1, 5 and 6. Sevva shall notify the Customer in writing without undue delay if any of those facts ceases to be accurate, and the parties shall then review this Part 7 and, where appropriate, put in place an alternative arrangement, including the designation of a representative under Article 27 at Sevva's cost.

7.5 The Customer acknowledges that it has reviewed Parts 1, 5, 6 and 7 and does not require Sevva to designate a representative in the Union on the basis of the facts recorded in them.

7.6 Nothing in this Part 7 is an admission that Article 3(2) or Article 27 applies, and neither party is prevented from making representations to a supervisory authority.

7.7 The parties do not purport to contract out of Article 3, which operates as a matter of law. This Part records the factual basis on which the territorial assessment has been made.

8. Security

8.1 Sevva shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, having regard to the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the risk to the rights and freedoms of natural persons. Those measures address confidentiality, integrity, availability and resilience of the Services, and include measures in each of the areas required by Article 32(1) GDPR.

8.2 Sevva's security measures are documented internally, are reviewed periodically, and are described at a general level to the Customer on request under clause 16.1.

8.3 Sevva shall not materially degrade those measures during the term.

9. Sub-processors

9.1 The Customer gives general written authorisation for Sevva to engage sub-processors for functions such as hosting and infrastructure, communications, support tooling and other service components.

9.2 Sevva has reviewed its sub-processing arrangements and is satisfied that each sub-processor provides sufficient guarantees to implement appropriate technical and organisational measures, and imposes on each sub-processor by written contract data protection obligations equivalent to those in this Annex. Sevva remains fully liable to the Customer for the performance of each sub-processor's obligations.

9.3 Sevva shall give the Customer reasonable prior written notice of any addition or replacement of a sub-processor, and the Customer may object on reasonable data protection grounds. If the objection cannot be resolved, the Customer may terminate the affected Services on written notice and receive a pro-rata refund of prepaid fees for the unexpired portion.

9.4 A current list of sub-processors is available to the Customer on request under clause 16.1.

9.5 No sub-processor shall process Customer Personal Data outside the United Kingdom, the European Economic Area or a country covered by an adequacy decision, save as permitted by clause 12.

10. Assistance

10.1 Taking into account the nature of the processing and the information available to it, Sevva shall assist the Customer in ensuring compliance with Articles 32 to 36 GDPR, and shall assist with requests from data subjects exercising their rights.

10.2 Where Sevva receives a request from a data subject relating to Customer Personal Data, it shall forward it to the Customer without undue delay and shall not respond to its substance.

10.3 Sevva shall make available the information necessary to demonstrate compliance with Article 28, and shall allow for and contribute to audits in accordance with clause 14.

11. Personal Data Breaches

11.1 Sevva shall notify the Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data, describing the nature of the breach, its likely consequences, the measures taken and a contact point.

11.2 Sevva shall take reasonable steps to contain and remediate the breach and shall cooperate with the Customer. Sevva shall not notify a supervisory authority or a data subject unless instructed by the Customer or required by law, in which case it shall inform the Customer where practicable.

12. Transfers

12.1 The Customer authorises Sevva to process Customer Personal Data in the United Kingdom. The European Commission's adequacy decision for the United Kingdom, renewed on 19 December 2025 and valid until 27 December 2031, provides the transfer mechanism for transfers from the European Union to the United Kingdom.

12.2 If that decision lapses or is revoked, or if Customer Personal Data is to be transferred to any other third country, Sevva shall ensure a valid Chapter V mechanism is in place before the transfer, and the parties shall execute the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module 2) as a fallback.

12.3 Overseas access by Sevva personnel is treated as a transfer for this purpose.

13. Return and Deletion

13.1 On termination or expiry, Sevva shall, at the Customer's choice, delete or return Customer Personal Data and delete existing copies, save where Union or Member State law requires storage.

13.2 Deletion shall be completed within a reasonable period following the later of termination and the Customer's export of its data, and shall extend to backups within the ordinary backup cycle. Sevva shall confirm deletion in writing on request.

14. Audit

14.1 Sevva shall respond to a reasonable data protection questionnaire within a reasonable period and shall make available the records, sub-processor list and security information referred to in clauses 3.7, 8.2 and 9.4.

14.2 The Customer, or an auditor mandated by it and bound by confidentiality, may audit Sevva's compliance with this Annex not more than once in any 12-month period, on reasonable written notice, during business hours, and without access to the personal data of other customers. Audits are at the Customer's cost unless a material breach is found.

14.3 Sevva may satisfy an audit request by providing a current independent assurance report, such as ISO/IEC 27001 certification or a SOC 2 report, together with written responses to reasonable follow-up questions.

15. General

15.1 Precedence. The following order applies: (1) this Annex; (2) any executed Data Processing Addendum; (3) Parts I and II of the Sevva Terms & Conditions; (4) Part III of those Terms & Conditions and the Sevva Privacy Policy.

15.2 Liability. Nothing in the Sevva Terms & Conditions limits either party's liability for breach of this Annex to the extent that such a limitation would be contrary to applicable law. Subject to that, the liability limits in Part II of the Terms & Conditions apply.

15.3 This Annex is governed by English law, and the courts of England and Wales have exclusive jurisdiction, save that the Customer may enforce its rights in the courts of its own Member State where mandatory law so entitles it.

15.4 This Annex may only be varied in writing by both parties. It creates no rights for any person other than the parties. Parts 7, 13 and 15 survive termination.

16. Information on Request

16.1 Sevva maintains, internally and in a form that can be produced promptly: its record of processing activities under Article 30(2); a list and description of its sub-processors; a description of its technical and organisational security measures; its retention schedule; and a record of documented instructions received. These are available to the Customer, and to a supervisory authority or auditor where appropriate, on request, and are not published in this Annex.