Licence Agreement
This licence agreement (Licence) comprises these terms and any other terms agreed and set out in the Order Form for the Solution (Solution Order Form), and is a legal agreement between the person or entity set out in the Solution Order Form (you and your) and ACRE PLATFORMS LIMITED, a company incorporated in England and Wales with company number 11508306 whose registered office is at Zetland House, Units E-G 4th Floor, 5-25 Scrutton Street, London, EC2A 4HJ (Acre).
Acre allows your Authorised Users to use the Solution on your behalf subject to the terms of this Licence. Acre does not sell the Solution (or any of its Intellectual Property Rights therein) to you. Acre and its licensors remain the owners of the Solution at all times.
Important notice
USE OF THE SOLUTION IS STRICTLY SUBJECT TO THE TERMS OF THIS LICENCE AND YOU AGREE THAT THE TERMS OF THIS LICENCE WILL BIND YOU AND YOUR AUTHORISED USERS WHEN YOU USE THE SOLUTION. FOR THE AVOIDANCE OF DOUBT, THE TERMS OF THIS LICENCE WILL CONTINUE TO APPLY TO ANY ACRE CONTENT PROCESSED BY YOU OR YOUR AUTHORISED USERS FOLLOWING EXPIRY OR TERMINATION OF THIS LICENCE. THE TERMS OF THIS LICENCE INCLUDE, IN PARTICULAR, LIMITATIONS ON LIABILITY IN CLAUSE 12.
IF YOU DO NOT AGREE TO THE TERMS OF THIS LICENCE, NEITHER YOU NOR YOUR AUTHORISED USERS MAY USE THE SOLUTION.
You should save and print a copy of this Licence for future reference.
It is agreed:
1. DEFINITIONS & INTERPRETATION
1.1 In this Licence, unless the context otherwise require, the definitions set out in this Licence shall apply throughout this Licence.
1.2 In this Licence, if there is any conflict, ambiguity or inconsistency, the order of precedence for this Licence shall be as follows in descending order of preference:
(a) the terms set out in the Solution Order Form;
(b) the Third Party Terms (as defined in clause 3.5);
(c) the remaining terms of this Licence.
1.3 Where Acre allows your Authorised Users to use the Solution on your behalf without, or in advance of, the Solution Order Form being entered into, then all such use shall be deemed to be use on a trial basis for a limited period (as determined by Acre at its sole discretion) only, subject to these terms.
2. LICENCE
2.1 In consideration of the Fees and you agreeing to abide by the terms of this Licence, Acre hereby grants to you a non-exclusive, personal and non-transferable licence during the Term to use the Solution solely for your business operations in the United Kingdom (only).
2.2 You will not (and will not assist any third party to):
(a) other than as permitted by this Licence, commercialise by way of service offering or otherwise, to or for any third party, the Solution (in whole or part); or
(b) develop, promote or resell any solution that competes with the Solution.
2.3 Acre shall have the right to update and revise the terms of this Licence from time to time by giving you not less than 14 days’ notice.
3. SERVICES
Acre Services
3.1 In consideration of the Fees, Acre agrees to provide the Support Services in respect of the Solution.
3.2 Acre does not warrant that use of the Solution will be uninterrupted or error-free.
3.3 You will provide Acre with all reasonable assistance required by Acre in the provision of the Support Services and to enable Acre to perform its relevant obligations under this Licence.
3.4 You acknowledge that Acre may utilise non-dedicated infrastructure, virtualised infrastructure and/or private networks when providing the Solution, and that Acre is entitled to reconfigure the set-up of the Production Environment at any time provided that it does not materially reduce the functionality of the Solution or its ability to meet performance requirements.
Third Party Services
3.5 Third Party Services provided to you may be subject to terms of use required by the Third Party Service Provider (Third Party Terms). Such Third Party Terms may be set out in a direct agreement between the Third Party Service Provider and you (Direct Agreement) or in schedule 2 or may be otherwise notified to you. You and your Authorised Users must comply with all Third Party Terms and any changes to them. In the event of any inconsistency or ambiguity between any of the Third Party Terms and any of the other terms of this Licence, then the relevant Third Party Term shall take precedence as it applies to the relevant Third Party Service (only).
3.6 If you are required to enter into a Direct Agreement with a Third Party Service Provider then you:
(a) shall notify Acre immediately if the Direct Agreement expires or is terminated; and
(b) hereby indemnify Acre against any loss or damage that Acre suffers or incurs as a result of you not having a Direct Agreement in place or any breach of such Direct Agreement.
3.7 Acre will notify you as soon as reasonably practicable if Acre is no longer able to provide any of the Third Party Services and Acre shall reflect any revised Third Party Fees in the following invoice.
3.8 You acknowledge that any hypertext links to other websites, extranets or portals provided via the Solution do not constitute an endorsement or warranty in relation to the content therein and that you and your Authorised Users shall access and use the Third Party Services and links at your own risk.
3.9 You undertake that you and your Authorised Users shall comply with all policies and procedures which may be required by Third Party Service Providers, and to enter into all necessary documentation required by Third Party Service Providers in order to receive the Third Party Services.
4. REGULATORY REQUIREMENTS
4.1 You acknowledge that:
(a) you assume sole responsibility for advice and/or recommendations provided to your Customers in using the Solution; and
(b) you are responsible for compliance with all laws or regulations concerning your business, including, but not limited to, the rules of the FCA or any other regulations, requirements, stipulations or conditions made by any professional or regulatory organisation to which you or your Authorised Users may be subject from time to time; and
(c) Acre shall have no liability for any loss or damage arising from any processing of the Broker Data or the Customer Data by Acre at the direction of you or your Authorised Users.
5. YOUR OBLIGATIONS
5.1 Except as expressly authorised in this Licence or as may be allowed by any applicable law which is incapable of exclusion by agreement between the parties, you will and will procure that your Authorised Users will:
(a) not attempt to rent, lease, transfer, copy, modify, duplicate, timeshare, create derivative works from, frame, mirror, republish, download, display, transmit, distribute or otherwise commercially exploit all or any part of the Solution or the Acre Content and/or the Production Environment as applicable in any form or media or by any means;
(b) not attempt to de-compile, reverse compile, disassemble, reverse engineer or otherwise reduce to human-perceivable form all or any part of the Solution or the Acre Content and/or the Production Environment;
(c) not access all or any part of the Solution, Acre Content, the Production Environment, Reports and/or the Support Services in order to build a product or service which competes with the Solution, Acre Content, Production Environment and/or the Support Services;
(d) take all reasonable steps to protect the Solution, Acre Content, Production Environment and/or Support Services from unauthorised access or use;
(e) use best efforts to prevent third parties from obtaining Passwords or other credentials;
(f) immediately inform Acre of any actual or potential unauthorised access to a Password, the Solution, Acre Content, Production Environment and/or Support Services or any other risk to the security, integrity or stability of the Solution of which you are or become aware;
(g) co-operate fully with Acre in the investigation and resolution of any suspected or confirmed incident involving the security, integrity or stability of the Solution or the Platform, including the provision of any and all relevant data and records held by you or on your behalf; and
(h) comply in full with the Third Party Terms and not do anything that would cause Acre to be in breach of the Third Party Terms.
5.2 Acre reserves all rights not expressly granted in this Licence.
5.3 You will take all appropriate steps to ensure that the access, transmission, downloading, distribution or storing of any materials (including any Acre Content) by you or any of your Authorised Users:
(a) is not harmful, threatening, defamatory, obscene, infringing, harassing or racially or ethnically offensive;
(b) does not violate any domestic or international law, regulation, treaty, code of practice, infringe the Intellectual Property Rights of any person, facilitate illegal activity, or promote unlawful violence;
(c) is not otherwise likely to damage Acre's or any Third Party Service Provider's reputation and goodwill,
and Acre reserves the right, without liability or prejudice to its other rights, to immediately disable access to any material that breaches the provisions of this clause 5.3.
5.4 You will keep Acre and the Third Party Service Providers fully and effectively indemnified against any loss, damages, liabilities and costs (including reasonable legal costs) suffered by them (or any of them) as a result of any breach of any legal or regulatory requirements applicable to the nature of data hosted for you in the Production Environment including any restrictions imposed on the processing, import or export of such data, in all cases where such breach is caused by any act or omission by you or any of your Authorised Users or where you or any of your Authorised Users has failed to act in accordance with the terms of this Licence.
5.5 If Acre:
(a) reasonably suspects that you or any of your Authorised Users is in breach of clause 5.3; or
(b) is ordered to do so by a court of competent jurisdiction or appropriate regulatory body, Acre may remove any offending material and/or suspend access to all or part of the Solution as reasonably necessary to effect such removal.
5.6 You will and will procure that your Authorised Users will:
(a) provide to Acre all necessary access to such information as may be required by Acre, in order to provide the Solution and perform the Support Services, including but not limited to the security access information;
(b) comply with all applicable laws and regulations with respect to your activities under this Licence;
(c) carry out all obligations on your part set out in this Licence in a timely and efficient manner, provided that in the event of any delay or failure in the carrying-out of any of those obligations, any agreed timetable or delivery schedule will be adjusted as reasonably necessary to take account of such delay or failure; and
(d) be solely responsible for procuring and maintaining your network connections and telecommunications links from your systems to the Production Environment, and for all problems, conditions, delays, delivery failures and all other loss or damage arising from or relating to your network connections or telecommunications links or caused by the internet.
6. FEES
6.1 The Solution Fees will be payable in accordance with the Solution Order Form.
6.2 The Third Party Fees will be payable in accordance with the Solution Order Form only where:
(a) use of the Solution is deemed by Acre to be use outside of Fair Use; and/or
(b) the Solution is not being used, or Acre suspects that the Solution is not being used, in accordance with the terms of this Licence.
6.3 Unless otherwise specified in the Solution Order Form, Acre shall invoice you at the end of each calendar month for the Fees and you will pay the Fees to Acre without deduction or set-off, by bank transfer in GBP, within 30 days of the date of Acre’s invoice.
6.4 If the Licence terminates for any reason at any time prior to expiry of the Minimum Period, then Acre shall be entitled to invoice you for any Fees that would have otherwise been payable by you during the Initial Free Period and you shall pay such invoiced amount to Acre without deduction or set-off, by bank transfer in GBP, within 30 days of the date of Acre’s invoice.
6.5 If you fail to make any payment due to Acre by the due date (other than a payment which is the subject of a bona fide dispute), then, without prejudice to any of its other rights or remedies, Acre may:
(a) charge you interest on the overdue sum from the due date until payment of the overdue sum, whether before or after judgement, interest at a rate of 4% per year above the Bank of England’s base rate from time to time, but at 4% a year for any period when the base rate is below 0%; and/or
(b) suspend access to all or part of the Solution if any undisputed sum is not paid within 30 days of its due date, until such time as the undisputed some has been paid.
7. CONFIDENTIALITY
7.1 Each party (which in the case of you will include your Authorised Users) receiving Confidential Information (Recipient) from the other (Disclosing Party) shall keep that information confidential and comply with this clause 7. In particular the Recipient shall:
(a) use the Disclosing Party's Confidential Information solely for the purposes of fulfilling its obligations under this Licence;
(b) keep the Disclosing Party's Confidential Information secure, and without prejudice to the foregoing, take no lesser security measures and degree of care to protect the Disclosing Party's Confidential Information than the Recipient applies to its own confidential or proprietary information; and
(c) not disclose to any third party any of the Disclosing Party's Confidential Information except with the prior written consent of the Disclosing Party or in accordance with this clause 7.
7.2 Notwithstanding clause 7.1, the Recipient may disclose the Disclosing Party's Confidential Information to its directors, officers, employees and any sub-contractors or other third party (including, in respect of Acre, any Third Party Service Provider) who are directly involved in, and need to know such Confidential Information for the purpose of, the provision or receipt of the Support Services and/or the provision of the Solution.
7.3 The Recipient shall ensure that its directors, officers, employees and any sub-contractors or other third party referred to in clause 7.2 are aware of the confidential nature of the information and shall instruct them:
(a) to keep it confidential; and
(b) not to disclose it to any third party (other than those persons to whom it has already been disclosed in accordance with the terms of this Licence).
7.4 The obligations of confidentiality set out in this clause 7 shall not apply to the extent that the Recipient can demonstrate that the Confidential Information in question:
(a) is or has become readily publicly available without restriction through no fault of the Recipient or its employees or agents;
(b) is or was received without restriction from a third party lawfully in possession of such information and lawfully empowered to disclose such information;
(c) was rightfully in the possession of the Recipient without restriction prior to its disclosure by the Disclosing Party;
(d) it is or was independently developed by the Recipient's employees without access to the Disclosing Party's Confidential Information; and/or
(e) is disclosed pursuant to a requirement imposed by a court of competent jurisdiction or competent regulator, except that prior to any disclosure pursuant to this clause 7.4, the Recipient shall notify the Disclosing Party and shall give the Disclosing Party an opportunity to participate in objecting to the production of the Confidential Information (to the extent practicable and permissible).
7.5 Nothing herein shall permit the Recipient to disclose or use the Confidential Information of the Disclosing Party, except as explicitly permitted in this Licence, and then only on an "as needed" basis for purposes of this Licence.
7.6 To the extent that the Confidential Information of the Disclosing Party is no longer required by the Recipient to enable it to perform its obligations or exercise its rights hereunder, the Recipient shall (and shall procure that its directors, officers, employees, and any sub-contractors or third parties shall) either return such Confidential Information together with any copies, notes, transcriptions or records thereof in its control, power or possession to the Disclosing Party forthwith upon demand or at the Disclosing Party's option, destroy it and, if requested by the Disclosing Party, confirm in writing that it has returned or destroyed it.
7.7 You acknowledge that details of the Solution and the Support Services constitute Acre’s Confidential Information.
7.8 Neither party shall (except as permitted by this Licence):
(a) disclose or permit disclosure of any details (including the existence) of this Licence to any third party; and
(b) subject to clause 7.9, use the other party's name and/or brand in any promotion or marketing or announcement of orders, without the prior written consent of the other party.
7.9 You agree that Acre may name you as a user of the Solution in its marketing materials and on its website, without payment of any separate fees. If you have made favourable comments about Acre and/or the Solution, you agree that Acre may reproduce these comments in its marketing materials or on its website.
7.10 The parties acknowledge that damages may not be an adequate remedy for any breach of this clause 7 or the confidentiality undertakings entered into by their directors, employees, sub-contractors and other third parties pursuant to clause 7.3. Each party shall be entitled to seek any legal or equitable relief, including injunction, upon the breach (or reasonably anticipated breach) of this clause 7.
7.11 The operation of this clause 7 shall survive the termination or expiration of this Licence.
8. TERM & TERMINATION
8.1 This Licence shall come into force on the date that it is accepted by you and unless terminated earlier in accordance with its terms or otherwise by operation of law shall continue for the Minimum Period after which it may be terminated by either party giving notice in writing of not less than the Termination Notice Period to the other party.
8.2 Either party may, without prejudice to its other rights or remedies or to the other termination rights identified in this Licence, terminate this Licence with immediate effect at any time during the Term by written notice to the other party, if:
(a) the other party commits a material breach of this Licence which, if such breach is capable of remedy, that other party fails to remedy within 30 days of receipt of a notice from the party requiring such remedy; or
(b) any of the following events occur in respect of the other party:
(i) passes a resolution for winding-up or is subjected to a judgment or order issued by any court of competent jurisdiction ordering the sale, winding-up or other liquidation or dissolution procedure of the other party; or
(ii) has a receiver, manager, liquidator or trustee appointed (or gives notice of intention to so appoint) in accordance with applicable laws and that appointment is not revoked or withdrawn within 14 days of the appointment;
(iii) makes an assignment for the benefit of creditors generally or files or states an intention to file a proposal pursuant to any applicable law relating to bankruptcy, insolvency or creditor protection, or a receiving order is made or a petition is filed against the other party pursuant to any applicable law relating to bankruptcy, insolvency or creditor protection; or
(iv) becomes subject to any event analogous to, or enters into any arrangement analogous to, any of those events or arrangements specified in clauses 8.2(b)(i) – 8.2(b)(iii) (inclusive) (each, an Insolvency Event).
8.3 Acre may, without prejudice to its other rights or remedies or to the other termination rights identified in this Licence, terminate this Licence with immediate effect at any time during the Term by written notice to you if there is a change of Control within you.
9. SUSPENSION
9.1 Acre may, without prejudice to any other right or remedy it may have, suspend access to all or any part of the Solution:
(a) in order to comply with any order or direction of any competent court, government agency or other competent administrative or regulatory authority; or
(b) upon expiry or termination of this Licence in accordance with its terms; or
(c) pursuant to either clause 5.5 or 6.5(b).
9.2 Acre may from time to time suspend the Solution in order to carry out routine and emergency maintenance of the Production Environment. Routine maintenance shall take place outside of Acre’s standard support hours, and Acre shall give you not less than 7 days’ notice of any routine maintenance which may materially impact the provision of the Solution and, where reasonably possible, shall endeavour to perform routine maintenance in such a way as to cause minimal disruption to you. For the avoidance of doubt, emergency maintenance may take place at any time if Acre reasonably believes it to be required to ensure the security, integrity and availability of the Production Environment.
10. TERMINATION CONSEQUENCES
10.1 Expiry or termination of this Licence, however caused, shall be without prejudice to any obligations or rights of either party which may have accrued under it before termination or expiry and shall not affect any provision of this Licence which is expressly or by implication intended to come into effect on, or to continue in effect after, such termination or expiry.
10.2 Upon expiry or termination of this Licence for any reason:
(a) each party shall return any documentation, data and other material belonging to the other party (and all media of any nature containing information and data belonging to the other party) in its possession or control to that other party; and
(b) the parties shall be regarded as discharged from any further obligations in respect of the terminated Licence.
11. INTELLECTUAL PROPERTY
11.1 You acknowledge and agree on behalf of yourself and your Authorised Users that Acre and/or its licensors own all Intellectual Property Rights in the Acre Content, Production Environment and Solution.
11.2 The Intellectual Property Rights in any Third Party Services shall be the absolute property of and shall vest and remain vested in the Third Party Service Provider and, except as stated herein, nothing in this Licence shall grant any rights to, or in, such Intellectual Property Rights to you or your Authorised Users.
12. LIABILITY
12.1 All warranties, representations, undertakings, conditions or terms which may be implied or incorporated into this Licence by law, custom, trade usage or otherwise are hereby expressly excluded to the maximum extent permitted by law (including any implied warranties, representations, undertakings, conditions or terms of merchantability, satisfactory quality or fitness for a particular purpose).
12.2 Nothing in this Licence shall exclude or limit Acre’s liability for:
(a) death or personal injury caused by negligence; or
(b) fraud or fraudulent misrepresentation; or
(c) any other liability that cannot, as a matter of law, be limited or excluded.
12.3 Other than in respect of clauses 12.2, and subject to clauses 12.4 - 12.7 (inclusive), Acre’s maximum aggregate liability to you or any of your Authorised Users, whether in contract, tort (including for negligence or breach of statutory duty howsoever arising), misrepresentation (whether innocent or negligent), restitution or otherwise, arising out of or in connection with the performance or contemplated performance of this Licence or any collateral contract, shall in respect of any and all acts, omissions, defaults or events be limited to £5,000 (or an amount equal to the Solution Fees paid by you to Acre in the immediately preceding period of 12 months, if greater).
12.4 Acre will not in any circumstances be liable to you whether in contract, tort (including for negligence and breach of statutory duty howsoever arising), misrepresentation (whether innocent or negligent), restitution or otherwise, for:
(a) any loss (whether direct or indirect) of profits, data, business, business opportunities, revenue, turnover, reputation or goodwill; or
(b) loss (whether direct or indirect) of anticipated savings or wasted expenditure (including management time); or
(c) any loss or liability (whether direct or indirect) under or in relation to any other contract; or
(d) any indirect, consequential or special loss, arising out of, or in connection with, this Licence; or
(e) any loss or damage if and to the extent incurred by you as a result of a Force Majeure Event; or
(f) any loss or damage if and to the extent incurred by you as a result of either error or omission on your part or following your instructions,
in each case, whether or not Acre has been notified of the possibility or likelihood of such loss or damage occurring.
12.5 Acre shall not be liable for any loss or damage if and to the extent resulting from any of the following:
(a) unavailability of the Support Services and/or Solution due to disruption of or any failure or fault in communication apparatus, lines, network or systems (including the internet) where resolution of the same is not within Acre’s reasonable control; or
(b) the acts or omissions of any Third Party Service Provider (including, but not limited to, third party providers of telecommunications services or faults or failures in their apparatus where resolution of the same is not within Acre’s reasonable control); or
(c) suspension of the Support Services and/or Solution in accordance with clause 9; or
(d) the use of or any defect in or failure of any Third Party Services, third party application or third party integration or any changes to the any of the foregoing, in each case, whether or not Acre has been notified of the possibility or likelihood of such loss or damage occurring.
12.6 You acknowledge that Acre has no direct control over the availability of bandwidth over the entirety of the internet and that Acre shall not be responsible for any delay or failure caused by unavailability of bandwidth over networks not under Acre’s ownership or reasonable control.
12.7 For the avoidance of doubt, if any of the exclusions set out in each of clauses 12.4 – 12.6 (inclusive) is not upheld, the limit on liability at clause 12.3 shall apply.
13. FORCE MAJEURE
13.1 Acre will not be liable for any delay or failure to perform any of its obligations under this Licence if such delay or failure to perform is due to a Force Majeure Event.
13.2 If a Force Majeure Event occurs, Acre shall:
(a) promptly notify you of the occurrence of the Force Majeure Event, the date on which the Force Majeure Event started, the likely duration of the Force Majeure Event and the effects on its ability to perform under this Licence;
(b) use reasonable endeavours to mitigate the effects of the Force Majeure Event on the performance of its obligations under this Licence; and
(c) promptly notify you of the cessation of the Force Majeure Event and resume performance of the affected obligations under this Licence.
14. BROKER DATA, CUSTOMER DATA & PRIVACY
14.1 Responsibility for the legality, reliability, integrity, accuracy and quality of the Broker Data and Customer Data provided by you or your Authorised Users will rest with you, and you hereby indemnify Acre against any loss or damage that Acre suffers or incurs arising from or in connection with the processing of any of the Broker Data or Customer Data provided by you or your Authorised Users, except to the extent such loss or damage results from the act or omission of Acre.
14.2 You acknowledge that Acre or any of its Group Companies may process information about you and your Authorised Users, the Broker Data and Customer Data in the provision of the Solution and the Support Services.
14.3 The terms of Acre’s Privacy Policy (Users) shall apply in respect of all of the personal data of you and your Authorised Users processed by Acre or any of its Group Companies in the provision of the Solution and the Support Services.
14.4 Acre or its relevant Group Company will be:
(a) the data controller of any personal data processed pursuant to any use of the Acre Customer Portal by the Customer; and
(b) the joint controller (with you) of any personal data processed pursuant to any use of the Solution where Acre or its Group Company determines the purposes and means of such processing.
14.5 The terms of Acre’s Privacy Policy (Customers) shall apply in respect of all of the personal data of the Customers processed by Acre or any of its Group Companies as data controller, joint controller or data processor. Where Acre or its relevant Group Company will be the data processor, you will ensure that you have in place terms with the data subject which are substantially similar to the terms of Acre’s Privacy Policy (Customers).
14.6 You acknowledge that Acre may allow Third Party Service Providers access to information about you and your Authorised Users, the Broker Data and Customer Data as required for the interoperation of the Solution with Third Party Services. To the extent that such data constitutes personal data controlled by you and processed by Acre or any of its Group Companies in the provision of the Solution and the Support Services, the terms of Acre’s Privacy Policy (Users) and Privacy Policy (Customers) shall apply as set out in clauses 14.3 and 14.5 respectively, but otherwise Acre shall not be responsible for any disclosure, modification or deletion of such data resulting from any such access by any of the Third Party Service Providers.
14.7 Acre may collate, extract and copy data (including Broker Data and Customer Data) from the Solution in order to aggregate such data and anonymise it so as to remove any personal data (Anonymised Data). The Anonymised Data may be used by Acre for internal business purposes, delivering or improving Acre’s solutions or services (including for commercial benefit) and/or may be shared with Acre Group Companies and made available to other third parties as part of Acre’s solutions or services (or otherwise), provided always that any use of the Anonymised Data by Acre, and any distribution of such Anonymised Data outside of Acre and its Group Companies, is in accordance with applicable law.
14.8 Acre will not introduce any of your Customers to any third party without your consent, except that where any of your Customers has a relationship with another organisation using the Solution or Platform, Acre may make an introduction based upon that Customer’s consent.
14.9 You acknowledge that Acre may make Customer Data provided by you or your Authorised Users available to third parties with the consent of the relevant Customer on the basis of that Customer‘s data rights. For the avoidance of doubt, Broker Data provided by you or your Authorised Users shall not be made available to third parties without your consent.
14.10 Any introductions or referrals facilitated by Acre shall be subject to any separate terms upon which consent was given or obtained. Any credit or payment due to you will be deducted from the subsequent monthly invoice for the Fees, or where the amount exceeds the Fees due for a given month shall be paid within 30 working days.
15. NOTICES
15.1 Any notice given by one party to another under this Licence, shall be in writing, delivered by hand or by prepaid first-class or special delivery post to its registered office (in the case of a company) and its principal place of business (in all other cases) or by email.
15.2 Notices delivered by hand shall be deemed to have been served on the day of receipt (unless received after 5.30pm in which case they shall be deemed to have been served on the next working day). Notices sent by prepaid first-class post or special delivery shall be deemed to have been served 2 working days after the date of posting. Notices sent by email shall be deemed to have been served so long as no delivery failure notice is received, when dispatched.
15.3 Either party may vary its address for notices by giving notice to the other. This notice must expressly state that the new address is the address for notices.
16. ASSIGNMENT & SUB-CONTRACTING
16.1 You may not assign, novate or deal in any way with all or any part of the benefit of, or your rights or benefits under, this Licence without the prior written consent of Acre.
16.2 Acre may assign, novate, sub-contract or deal in any way with all or any part of the benefit of, or its rights or benefits under, this Licence.
16.3 This Licence shall be binding upon the parties and their successors and permitted assigns.
17. WAIVER & CUMULATIVE REMEDIES
17.1 The rights and remedies of each party under, or in connection with, this Licence may be waived only by express written notice. Any waiver shall apply only in the instance, and for the purpose for which, it is given. A waiver by either party pursuant to this clause will not prejudice its rights in respect of any subsequent breach of this Licence by the other party.
17.2 No right or remedy under, or in connection with, this Licence shall be precluded, waived or impaired by:
(a) any failure to exercise or delay in exercising it;
(b) any single or partial exercise of it;
(c) any earlier waiver of it, whether in whole or in part; or
(d) any of the above in relation to any other right or remedy (be it of similar or different character).
17.3 The rights and remedies arising under, or in connection with, this Licence are cumulative and, except where otherwise expressly provided in this Licence, do not exclude rights and remedies provided by law or otherwise.
18. RELATIONSHIP OF THE PARTIES
Nothing in this Licence is intended to create a partnership or joint venture or legal relationship of any kind between the parties that would impose liability upon one party for the act or failure to act of the other party, or to authorise either party to act as agent for the other. Save where expressly stated in this Licence, neither party shall have authority to make representations, act in the name or on behalf of, or otherwise to bind, the other.
19. SEVERANCE
19.1 If any provision of this Licence is or becomes illegal, invalid or unenforceable, in any respect:
(a) it shall not affect or impair the legality, validity or enforceability of any other provision of this Licence; and
(b) the parties will use reasonable endeavours to negotiate in good faith with a view to replacing it with a valid and enforceable provision which achieves to the greatest extent possible the same effect as would have been achieved by the illegal, invalid or unenforceable provision but differing from the replaced provision as little as possible.
19.2 If any illegal, invalid or unenforceable provision would be legal, valid or enforceable if some part of it were deleted, such provision shall apply with the minimum modification(s) necessary to make it legal, valid or enforceable.
20. THIRD PARTY RIGHTS
Except as expressly stated in this Licence, a person who is not a party to this Licence shall have no right under the Contracts (Rights of Third Parties) Act 1999 to enforce any term of this Licence.
21. VARIATION
Any change to this Licence shall only be valid if it is agreed in writing on behalf of Acre by its duly authorised representative.
22. ENTIRE AGREEMENT
22.1 This Licence constitutes the entire agreement and understanding between the parties in respect of its subject matter and supersedes any previous agreement, warranty, statement, representation, understanding or undertaking (in each case whether written or oral) given or made before the date of this Licence by or on behalf of the parties and relating to its subject matter.
22.2 Each party confirms that, in entering into this Licence, it has not relied upon, and shall have no remedy in respect of, any agreement, warranty, statement, representation, understanding or undertaking made by any party (whether or not that party is a party to this Licence) unless that warranty, statement, representation, understanding or undertaking is expressly set out in this Licence.
22.3 Neither party shall be entitled to the remedies of rescission or damages for misrepresentation arising out of, or in connection with, any agreement, warranty, statement, representation, understanding or undertaking whether or not it is set out in this Licence.
22.4 Nothing in this Licence shall restrict or exclude any liability for (or remedy in respect of) fraud or fraudulent misrepresentation.
23. GOVERNING LAW & JURISDICTION
23.1 This Licence and any dispute or non-contractual obligation arising out of or in connection with it shall be governed by, and construed in accordance with, the law of England and Wales.
23.2 Each party hereby submits to the exclusive jurisdiction of the courts of England and Wales over any dispute arising out of or in connection with this Licence.
23.3 Any party may, at any time, refer a dispute to adjudication, in which case the adjudication procedure set out in the TeCSA Adjudication Rules shall apply and the decision of the adjudicator shall, save in the case of fraud or manifest error, be binding upon the parties. Each party shall give effect to the decision of the adjudicator, provided that if either party does not comply with the decision of the adjudicator, then the other party shall be entitled to take proceedings in the courts of England and Wales to enforce such decision.
Schedule 1
DEFINITIONS
Acre Content means any proprietary information, including but not limited to data, databases, reports, charts, graphs, tools, software, source code, documentation and other materials that are made available to you or your Authorised Users;
Acre Customer Portal means the web application made available at https://portal.myac.re or any other such location that enables a Customer to access, update and otherwise interact with the information held in the Solution and/or Platform.
Authorised Users means users authorised by you to use the Solution on your behalf (each, an Authorised User);
Broker Data means any information relating to a case or transaction which is not considered Customer Data and any other information provided by you which does not relate to a Customer.
Confidential Information means any information which is disclosed by one party to the other party whether before or after the commencement of the Term, which is designated in writing as confidential or would appear to a reasonable person to be confidential including but not limited to information regarding a party's business, affairs, operations, customers, processes, budgets, pricing policies, products information, strategies, developments, trade secrets, know-how, design rights, market opportunities, personnel, plans or intentions, suppliers, other contracting parties, or other persons in respect of whom a confidentiality obligation may arise of the party disclosing it, and all information derived from any of the above together with the provisions of this Licence, and the negotiations relating to the same;
Control means that a person owns directly or indirectly more than 50% of the shares or securities of the other person representing the right to vote on all or substantially all matters including the election of directors (and Controls and Controlled shall be construed accordingly);
Customers means any of your customers or potential customers who uses the Solution or Acre Customer Portal directly or who receive financial products or advice from you or your Authorised Users using the Solution (each, a Customer);
Customer Data means information relating to an individual, that is held within the Solution for the purpose of advising in connection with and/or providing that individual with financial services and/or any related service;
Fair Use means use of the Solution in the ordinary course to collect Customer information, perform “know your customer” and anti-money laundering checks, pull credit report information, and make product recommendations for products whose sale is recorded in the Solution. For the avoidance of doubt, any use of the Solution to prepare business for submission where the sale is not recorded in the Solution shall be deemed to be use outside of Fair Use;
FCA means the United Kingdom Financial Conduct Authority or its successor;
Fees means the Solution Fees and the Third Party Fees;
Force Majeure Event means an event which is beyond the reasonable control of Acre including an event which falls into one or more of the following categories: strike, lockout, work stoppages, slow-downs or any other labour dispute; act of God, fire, flood and storm; war, military action, riot, civil commotion, terrorism, epidemic or pandemic; explosion or malicious damage; nuclear, chemical or biological contamination or sonic boom; compliance with a law or governmental order, rule, regulation or direction coming into force after the date of this Licence;
Group Company means a subsidiary company or holding company of the party concerned, or a subsidiary company of such holding company, all as defined in section 1159 of the Companies Act 2006, and Group Companies shall be construed accordingly;
Initial Free Period means any initial free period set out in the Solution Order Form;
Intellectual Property Rights means: (i) patents, utility models, supplementary protection certificates, petty patents, inventions (whether patentable or not), registered designs, rights in copyright (including authors' and neighbouring or related insert "moral" rights), database rights, design rights, semiconductor topography rights, mask work rights, trade marks and service marks; (ii) all registrations or applications to register any of the items referred to in paragraph (i); and (iii) all rights in the nature of any of the items referred to in paragraphs (i) or (ii) including continuations, continuations in part and divisional applications, reputation, personality or image, trade names, business names, brand names, get-up, logos, domain names and URLs, rights in unfair competition and, without prejudice to anything set out elsewhere in this definition, rights to sue for passing off and all rights having equivalent or similar effect to, and the right to apply for any of, the rights referred to in this definition in any jurisdiction;
Minimum Period means any minimum period set out in the Solution Order Form;
Password means the unique password assigned to each Authorised User that permits access to the Solution;
Platform means the Acre platform, created, hosted and maintained by or on behalf of Acre, and any successor platform thereto, that is used as the underlying infrastructure, data store, processing environment, and shared services for the delivery of multiple solutions, including the Solution;
Privacy Policy (Customer) means Acre’s standard privacy policy relating to the processing of any Customer’s personal data in force from time to time, the current version of which is available at https://www.acresoftware.com/homebuyer-privacy-policy.
Privacy Policy (User) means Acre’s standard privacy policy relating to the processing of your or any Authorised User’s personal data in force from time to time, the current version of which is available at https://www.acresoftware.com/advisor-privacy-policy.
Production Environment means the combination of hardware, software, telecommunications links, Platform and network connections and other material used by Acre to provide the Solution for access by you;
Reports means individual data analysis reports, including, without limitation, summary of activities performed, charts and graphs generated by the Solution pursuant to data parameters requested by you or an Authorised User;
Solution means Acre’s proprietary customer relationship management solution for mortgage brokers (including all software and services which are made available through, or which form part of, the Solution from time to time), together with any enhancements and modifications thereto, and any accompanying materials;
Solution Fees means the fees payable by you for access to the Solution, as set out in and/or calculated pursuant to the Solution Order Form;
Support Services means any error corrections and/or modifications, documentation, or testing to be provided by Acre with respect to the Solution in accordance with Acre’s standard support policy in force from time to time;
Term means the term of this Licence, as specified under clause 8 hereunder;
Termination Notice Period means the termination notice period set out in the Solution Order Form or, if no such notice period specified in the Solution Order Form, then 30 days’ notice;
Third Party Data means any data (including financial data), information or software sourced from a third party and made available through, or which forms part of, the Solution;
Third Party Fees means the fees payable (if any) by you at Acre’s prevailing re-charge rates from time to time for access to certain Third Party Services (which may include fees for any administration in respect of such access), the current re-charge rates being those set out in and/or calculated pursuant to the Solution Order Form;
Third Party Service Provider means a third party service provider who provides Third Party Services;
Third Party Services means access to Third Party Data and access to any other software or services which are provided by, or on behalf of, a third party and which are made available through, or which form part of, the Solution.
Schedule 2
Amazon Web Services (AWS)
The Third Party Terms subject to which the Third Party Services provided by Amazon Web Services (AWS) are provided are available at https://aws.amazon.com/service-terms/ as updated from time to time.
Equifax
The Third Party Terms subject to which the Third Party Services provided by Equifax are provided are set out below:
Definitions:
Agreement means the agreement between us and the Reseller under which we make available to the Reseller certain data services for resupply to end users;
Applicable Laws means all applicable laws, enactments, rules, regulations, orders, regulatory policies, regulatory permits and licences, and any mandatory instructions or requests of a regulator, in each case which are in force from time to time, including:
- The Consumer Credit Acts 1974 and 2006;
- The Data Protection Act 2018;
- The Representation of the People (England and Wales) Regulations 2001;
- The Financial Services and Markets Act 2000 (Money Laundering Regulations 2001);
- Rules made by the Steering Committee on Reciprocity; and
- The Guide to Credit Scoring 2000
Customer means any person to whom the Reseller supplies any of the Information Services … and shall include any Customer Group Participants …;
Customer Group Participants means any members of the Customer’s group who are entitled to benefit from the Services, as approved by Equifax in writing from time to time;
Information Services means the services that you are authorised to receive via the Reseller that are provided to the Reseller under the Agreement;
Output Data means any information or data provided by us as part of the Information Services;
Reseller means the third party through whom you are authorised to access the Information Services;
us and we means Equifax Limited; and
you has the meaning in the application form set out above these terms and shall include and Customer Group Participants where applicable.
1. Confidentiality: use and non-disclosure of Output Data
1.1 You shall use the Output Data only as permitted by paragraph 4 below or as otherwise permitted by the Reseller and shall not engage in any business involving the supply of any Output Data, or any information derived from any Output Data, to any other person.
1.2 Unless expressly permitted by the Reseller, you may not disclose to any other person any of the Output Data, except:
1.2.1 when required to do so by law or any regulatory authority; or
1.2.2 to your personnel whose duties reasonably require such disclosure, on condition that you ensure that each such person to whom such disclosure is made: (a) is informed of your obligation of non-disclosure and (b) complies with that obligations as if they were bound by it.
1.3 You shall maintain adequate security measures to protect the integrity, security and confidentiality of all Output Data (including complying with Equifax’s security requirements and policies).
2. Applicable Laws
2.1 You shall comply at all times with the Applicable Laws.
2.2 You shall provide to us any information we may from time to time reasonably request in order for us to determine whether your use and possession of the Output Data is in compliance with the Applicable Laws.
2.3 We may cease to make the Output Data available to the Reseller for resupply to you if your response to any request we may make as contemplated by paragraph 2.2 above does not satisfy us that your use and possession of the Output Data is in compliance with the Applicable Laws
2.4 The use of some types of the Output Data require you to be a member of the relevant “closed user group” and enter into, and comply with, any applicable closed user group agreements.
2.5 In utilising any Output Data, you are acting as a data controller and, as such must comply with all the obligations on a data controller imposed under the Data Protection Act 2018.
3. Notices
3.1 Before using any Information Services to obtain information relating to a natural person you shall notify the person that: (a) information which the person gives you may be disclosed to a credit reference agency, which may keep a record of that information; and (b) the credit reference agency may disclose that information, and the fact that a search was made, to its other customers for the purposes of assessing the risk of giving credit and occasionally to prevent fraud, money laundering and to trace debtors. You shall give the notification to the person in writing, unless doing so would unreasonably interfere with your activities. On our request you shall send us a copy, or transcript, of the notification you use.
3.2 To the extent that you are able to do so, you grant us a perpetual, royalty free right to record the information referred to in paragraph 3.1(a) for the purposes referred to in paragraph 3.1(b).
3.3 The Reseller will notify you of the search type or types you are entitled to carry out when using the Information Services. We may from time to time change the search types which you are entitled to carry out. The Reseller will notify you in writing of any such changes in reasonable time before the change becomes effective. You shall ensure that you understand which search type code we require you to use for each kind of search you carry out using the Information Services and you shall ensure that you use the correct search type code at all times when using the Information Services.
4. Permitted Use
4.1 You shall not use the Output Data for any purpose other than: (a) prevention of money laundering; or (b) ID verification.
5. Limitation of liability
5.1 You acknowledge: (a) that most of the Output Data is provided to us by third parties which we do not control, in particular in relation to the accuracy or completeness of the Output Data; (b) that the volume and nature of the information on our databases makes it impractical for us to verify it; and (c) that, if we were to attempt to verify the Output Data, we would only be able to offer the Services to you at significantly increased cost. You agree that we shall not in any circumstances be liable for any loss or damage at all arising from any inaccuracies, faults or omissions in, or in the provision of, the Output Data unless caused by our negligence or wilful default.
5.2 You agree that we shall not in any circumstances (including without limitation if we have been negligent) be liable for (a) any indirect or consequential loss or damage at all; or (b) any loss of business, capital, profit, reputation or goodwill, arising out of or in connection with the Information Services or the Output Data.
5.3 Our entire liability in respect of any single cause of action arising out of or in connection with the Output Data or the Services (whether for breach of contract, negligence, under statute or otherwise) shall be limited to £50. You shall not be entitled to recover from us and the Reseller in respect of the same loss.
5.4 We shall not be liable for any claim arising under these terms unless you give us written notice of the claim within 3 months of becoming aware of the circumstances giving rise to the claim or, if earlier, 3 months from the time you ought reasonably to have become aware of such circumstances.
5.5 Nothing in these terms shall limit or exclude our liability for death, personal injury or fraud arising from our negligence.
5.6 Except as expressly provided in these terms, all representations, conditions and warranties whether express or implied (by statute or otherwise) are hereby excluded to the fullest extent permitted by law.
6. Audit
6.1 You shall allow Equifax and any advisers to Equifax to access on reasonable notice any of your premises, personnel and relevant records as may be reasonably required in order to undertake verification of your compliance with these terms.
6.2 You shall comply with your obligations as set out in any Applicable Laws, in relation to record keeping.
6.3 Subject to the obligations of confidentiality, you shall provide Equifax (and its advisers) all reasonable co-operation, access and assistance in relation to each audit.
6.4 If the audit identifies a default by you or there are reasonable grounds for Equifax to reasonably suspect a default, then without prejudice to any other rights or remedies available:
- you shall take all necessary steps to comply with your obligations; and
- Equifax may suspend the Information Services or terminate these terms immediately upon written notice.
7. General
7.1 Where Customer Group Participants are entitled to benefit from the Information Services:
7.1.1 … the Customer Group Participants may only use the Information Services and Output Data for the Permitted Purposes, as if they were the Customer;
7.1.2 the Customer Group Participants shall comply with the terms of these terms as if they were the Customer;
7.1.3 the Customer shall be liable for the acts and omissions of the Customer Group Participants in respect of these terms as if they were its own acts and omissions;
7.1.4 any limitations and exclusions of liability in these terms for the benefit of Equifax shall apply to the Customer and the Customer’s Group Participants as if they were a single service recipient, including that any limit on Equifax's liability shall apply in aggregate to the Customer and all Customer Group Participants; and
7.1.5 for clarity, a company shall cease to be entitled to use the Information Services or receive Output Data if it ceases to be a member of the Customer’s Group.
7.2 Equifax may cease to supply those Information Services which relates to the provision of data if the data supply is no longer possible under any agreement Equifax has with third party suppliers. In such cases, the affected element of the Information Services shall terminate from the date on which Equifax can no longer perform the relevant Information Services.
7.2 These terms set out the entire agreement and understanding between you and us in connection with its subject matter. In particular, but without limitation to the generality of the foregoing, you warrant and represent that in entering into these terms you have not relied upon any statement of fact or opinion made by Equifax or our officers, servants or agents which has not been included expressly in these terms.
7.3 If any provision of these terms is or becomes invalid or unenforceable it will be severed from the rest of these terms so that it is ineffective to the extent that it is invalid or unenforceable and no other provision of these terms shall be rendered invalid, unenforceable or be otherwise affected.
7.4 In these terms: (a) the headings are inserted for convenience only and shall not affect their construction or interpretation; (b) unless the context requires otherwise, words importing the singular shall include the plural and vice versa; and (c) unless the context requires otherwise, references to any person include references to any human being, company, body corporate, association, joint venture, partnership, trust and any entity capable of suing and being sued.
7.5 These terms shall be governed by English law. The parties hereby submit to the exclusive jurisdiction of the English Courts.
Schedule 3
Onfido
The Third Party Terms subject to which the Third Party Services provided by Onfido are provided are set out below:
1. DEFINITIONS
Each of the expressions Authorised User, Customer and you shall have the meaning given to it in Schedule 1 of the Licence (of which these terms form part).
Brand Features means the trade names, trademarks, logos and other distinctive brand features of the applicable party.
Content means any information, text, graphics, or other materials uploaded, downloaded or appearing as part of the Services.
Developments means the improvements to and development of Onfido’s Identity Verification Services.
Information Security Policy has the meaning attributed to it in paragraph 4.2.1.
Personal Data means any information relating to an identified or identifiable User.
Privacy Laws means any applicable rules, laws, regulations, directives and governmental requirements currently in effect and as they become effective relating to privacy or data protection.
Processing means any operation or set of operations which is performed on personal data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Reports means a summary at a user level containing one or more of the checks provided as part of the Services.
Security Breach has the meaning attributed to it in paragraph 4.4.
Services means the identity verification services, including the Developments, offered by Onfido from time to time, as described in the Onfido Privacy Policy.
Software means any software provided by Onfido, including the software development kit (or SDK) and any maintenance release which is being made available as part of the Services.
Site means www.onfido.com and its subdomains.
2. DESCRIPTION OF PROCESSING
Telephone number (web SDK only and optional)
Content of SMS (web SDK only and optional)
IP address and associated city/country level location information
Image of the User’s face
Image of the face in the identity document
Biometric dataImage of the identity document and information describing the identity document
Video of the User
Transcribed text data from the video clip (if applicable)
3. YOUR OBLIGATIONS
3.1. You agree to provide or make available to Acre or assist Acre with the collection of Personal Data. Such information includes but is not limited to the information described in paragraph 2. You consent to Acre’s Processing to provide the Services, and you represent and warrant that you have taken all required steps to ensure that Acre may lawfully obtain the Personal Data for the purpose of providing the Services in accordance with Privacy Laws (including by having obtained all necessary consents and provided all necessary notices, where required).
3.2. You are solely and fully responsible for ensuring that all Customer’s data is accurate, complete and captured in a form that Acre can process to maximise the quality of Service.
3.3. Subject to the Acre’s obligations to provide the Services with reasonable care and skill, you assume sole responsibility for conclusions drawn from use of the Services (including the Reports, the Content and the Site).
3.4. You will comply with all applicable laws and regulations (including any obligation to seek prior regulatory review, approval, or similar) with respect to its use of the Services and will not: (a) use the Services to discriminate against the Customer or in a manner that causes damage or injury to any person or property; (b) use the Services in a manner that could be reasonably expected to bring Onfido into disrepute or otherwise harm its reputation; (c) act or omit to act in a way which interferes with or compromises the integrity or security of the Services; (d) access all or any part of the Services in order to build a product or service which competes with the Services; (e) amend or remove Onfido Brand Features or “powered by Onfido” language from the Services, Site, or Software; (g) except as may be allowed by any applicable law which is incapable of exclusion by agreement between the parties: (i) attempt to copy, modify, duplicate, create derivative works from, frame, mirror, republish, download, display, transmit, or distribute all or any portion of the Services (as applicable) in any form or media or by any means to any individual or entity, including without limitation, Customers; or (ii) attempt to reverse compile, disassemble, reverse engineer or otherwise reduce to human-perceivable form all or any part of the Services; or (h) attempt to access the Services other than through the means made available to you by Onfido. Any breach of this paragraph will be deemed to be a material breach.
3.5. You acknowledge and agree the services are based on information that was not collected, in whole or in part, for the purpose of serving as a factor in establishing a consumer’s eligibility for credit or insurance to be used primarily for personal, family or household purposes, employment, or any other similar purpose. Accordingly you shall not use any services as part of its decision-making process for determining a consumer’s eligibility for credit, insurance or any other similar purpose. For the avoidance of doubt, this paragraph is not intended to prohibit you from using the Services for the purpose of verifying a Customer’s identity.
3.6. You are responsible for maintaining the confidentiality of any password(s) or security routines you are given or sets to access and use the Services, and are fully responsible for all activities that occur under the Authorised Users’ password(s) or security routines. You agree to notify Acre immediately of any accidental or unauthorised access to or use of the Services, whether suspected or confirmed. In the event of a suspected or confirmed security incident impacting Authorised User‘s use of the Services or other exigent circumstances, Acre reserves the right to immediately withdraw or suspend access to the Services and to alter the Authorised User’s password(s).
4. ACRE OBLIGATIONS
4.1. Data Processing. Acre will:
4.1.1. Process Personal Data only in accordance with this Agreement;
4.1.2. inform you if, in its opinion, an instruction from you or an Authorised User infringes any Privacy Laws;
4.1.3. not disclose or otherwise make available any Personal Data to any third party service provider acting on Acre’s behalf without first (i) imposing contractual obligations on the third party recipient that are substantially similar to those imposed on Acre under this Agreement; and (ii) including the third party service provider in Acre’s list of third party service providers before sharing any Personal Data with that third party service provider. Acre shall make the list of third party service providers available to you, and if you object to any third party service provider, you may terminate this Agreement. Acre agrees to remain liable to you for the aforementioned third party service provider’s Processing of Personal Data;
4.1.4. cooperate and assist you in responding to any Customer’s request to exercise their rights of access, rectification, erasure, restriction of Processing, data portability, objection to Processing, or any other rights available to the Customer under Privacy Laws;
4.1.5. enable you to amend, correct, or delete Personal Data;
4.1.6. where requested by you and required under Privacy Laws, provide such assistance as you reasonably require (taking into account the nature of the Processing and the information available to Onfido) for you to (i) conduct data protection impact assessments; and (ii) consult with data protection supervisory authorities;
4.1.7. take measures designed to ensure the reliability of all personnel who Process Personal Data by (i) performing background checks upon such personnel (where permissible under applicable law); (ii) assigning specific and necessity-based access privileges to such personnel; (iii) ensuring that such personnel have undergone training in data protection and privacy; and (iv) ensuring that such personnel are bound by obligations of confidentiality;
4.1.8. ensure that all Personal Data residing in the European Economic Area is not transferred out of the European Economic Area to data recipients in third countries which do not ensure an adequate level of data protection as determined by the European Commission or the Information Commissioner’s Office, unless the parties have entered into European Commission approved Standard Contractual Clauses or other data protection safeguards in compliance with Privacy Laws; and
4.1.9. provide other reasonably necessary assistance for you to meet your compliance obligations under Privacy Laws with respect to the Service.
4.2. Security Safeguards.
4.2.1. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons and in accordance with a comprehensive information security policy (Information Security Policy), Acre will establish, maintain and comply with administrative, physical, technical and organizational safeguards designed to ensure the security and confidentiality of Personal Data and to prevent the unauthorised disclosure of, or access to, Personal Data.
4.2.2. Acre’s Information Security Policy will: (i) implement back-up and disaster recovery systems; (ii) continuously assess risks to the security of Personal Data by (1) assessing the likelihood and potential damage of such risks, taking into account the sensitivity and risk of the Personal Data, (2) identifying internal and external threats that could result in a Security Breach, and (3) conducting penetration testing; and (iii) take appropriate steps to protect against such risks.
4.3. Audits
4.3.1. Acre will, keep at its normal place of business detailed, accurate and up-to-date records relating to the Processing of Personal Data by you.
4.3.2. Acre shall, subject to confidentiality obligations, make available to you all information … required and reasonably necessary to demonstrate Onfido’s compliance with its obligations under Privacy Laws.
4.3.3. Acre shall promptly resolve all data protection and security issues discovered by you and reported to you that reveal a breach or potential breach by Acre of any of its obligations under this Agreement or Privacy Laws.
4.4. Security Breach. In the event Acre confirms any breach of security involving its facilities, networks or systems and any unauthorised disclosure of, or access to, Personal Data (each, a Security Breach), Acre will (i) promptly notify you of the Security Breach; and (ii) provide all reasonable help for you to investigate and remedy the Security Breach.
4.5. Return or Destruction of Personal Data. When Acre no longer needs to Process Personal Data to fulfill the purposes for processing identified in this Agreement, Acre will (a) cease all use of Personal Data; and (b) destroy all Personal Data (unless storage of any Personal Data is required by applicable law, including Privacy Laws).