Terms of Service

1. Acceptance of these Terms

These Terms of Service ("Terms") are entered into between DataDoc Ltd, a company incorporated in England and Wales and operated by Privacy Pad ("DataDoc", "we", "us"), and the legal entity or individual that registers for, accesses or uses the Services ("Customer", "you"). By clicking "I agree", signing an Order Form, or accessing the Services, you confirm that you have read, understood and agree to be bound by these Terms and that you have authority to bind the Customer.

If you do not agree, do not use the Services.

2. Definitions

• • "Services" — the DataDoc compliance automation platform, including all websites, APIs, modules, integrations and Documentation.
• • "Customer Data" — all data, documents and content uploaded to the Services by or on behalf of the Customer.
• • "Order Form" — an order, online checkout, sign-up form or written quote referencing these Terms.
• • "Authorised Users" — the Customer's employees, contractors and agents authorised to use the Services.
• • "DPA" — the Data Processing Agreement incorporated by reference into these Terms.
• • "Documentation" — the user-facing documentation made available within the Services.
• • "Subscription Term" — the period set out in the applicable Order Form during which Authorised Users may access the Services.

3. The Services

We grant the Customer a limited, non-exclusive, non-transferable, non-sublicensable right, during the Subscription Term, to access and use the Services and Documentation solely for the Customer's internal business purposes and in accordance with these Terms, the Documentation and the applicable Order Form. We reserve all rights not expressly granted.

4. Free Trial

• • Free trials are 14 days, no payment card required.
• • Trial accounts may have feature, framework and usage limits described in the product.
• • Trials are provided "as is" without warranty and may be modified or terminated at our discretion.
• • If you do not convert to a paid plan, Customer Data uploaded during the trial is deleted within 30 days of trial expiry, unless you request earlier deletion.

5. Subscriptions, Renewal and Fees

• • Fees are set out in the Order Form or the published price list (currently £49 / month Basic, £99 / month Pro, Enterprise on application).
• • Subscriptions are billed monthly or annually in advance and are non-refundable except as expressly stated.
• • Subscriptions auto-renew for successive periods of equal length unless either party gives notice of non-renewal at least 30 days before the end of the then-current term, via in-product cancellation or email to info@privacypad.co.uk.
• • Plan upgrades take effect immediately and are pro-rated; downgrades take effect at the next renewal.
• • We may revise pricing on at least 30 days' notice; revised pricing applies from the next renewal.
• • Late payment may result in interest accruing at 4% above the Bank of England base rate and/or suspension of the Services on at least 7 days' notice.

6. Taxes

Fees are exclusive of all taxes, including UK VAT. Where required, we will charge VAT in addition to the fees. Customers established outside the UK may be subject to reverse-charge rules. The Customer is responsible for any withholding taxes; if withholding is required by law, the fees will be grossed up so that we receive the net amount stated on the invoice.

7. Acceptable Use Policy

The Customer shall, and shall procure that Authorised Users shall, not:

• • Use the Services in breach of any applicable law, regulation or third-party right;
• • Upload Customer Data without a lawful basis or in breach of data-protection law;
• • Upload malicious code, viruses, ransomware or attempt to introduce vulnerabilities;
• • Probe, scan, penetration-test or otherwise interfere with the integrity of the Services without our prior written consent;
• • Reverse-engineer, decompile, disassemble or attempt to derive the source code, model weights, prompts or architecture of the Services, except to the extent expressly permitted by law;
• • Build a competitive product or service or copy the features, functions or interface of the Services;
• • Use the Services to send unsolicited communications, infringe intellectual property, or transmit unlawful, defamatory, obscene or harmful material;
• • Resell, sublicense, lease or rent the Services to any third party;
• • Use the Services in violation of UK, EU, US or other applicable sanctions or export-control laws.

Customer is responsible for the acts and omissions of its Authorised Users and for keeping account credentials secure.

8. Customer Data and Ownership

As between the parties, the Customer retains all right, title and interest in and to the Customer Data. The Customer grants DataDoc a worldwide, royalty-free, non-exclusive licence to host, copy, transmit, process and display the Customer Data solely as necessary to provide and improve the Services and to comply with the Customer's instructions.

We may generate and use aggregated, de-identified data derived from use of the Services for analytics, benchmarking, security, product improvement and other lawful business purposes, provided such data does not identify the Customer or any individual. Customer Data is not used to train third-party foundation models.

9. Data Protection and DPA

Where the Services involve the processing of personal data on behalf of the Customer, the parties' Data Processing Agreement (incorporated by reference and available on request from info@privacypad.co.uk) applies. The DPA includes UK and EU Standard Contractual Clauses and the UK International Data Transfer Addendum where required for international transfers. In the event of conflict between these Terms and the DPA in respect of personal data, the DPA prevails.

10. Security

We maintain a written information security programme aligned with SOC 2 Type II and ISO 27001:2022, including encryption in transit (TLS 1.2+) and at rest (AES-256), role-based access control, multi-factor authentication for production systems, continuous monitoring, annual penetration testing and a documented incident response process. We will notify affected Customers without undue delay, and in any event within 72 hours of becoming aware, of any confirmed personal data breach affecting their Customer Data.

11. Service Level Agreement

• • Basic: commercially reasonable efforts; no formal uptime SLA.
• • Pro: 99.5% monthly uptime target.
• • Enterprise: 99.9% monthly uptime SLA with service credits as set out in the Order Form.

Excluded from uptime calculations: scheduled maintenance (notified at least 72 hours in advance), emergency maintenance, force majeure, third-party failures outside our reasonable control, Customer-caused incidents and beta features. Service credits are the Customer's sole and exclusive remedy for SLA shortfalls.

12. Support

• • Basic: email support, best-effort response.
• • Pro: priority email support, 1 business-day response target during UK business hours.
• • Enterprise: named customer success contact, 4-hour response for critical issues, 24/7 incident escalation.

Support requests should be raised via the contact form or to info@privacypad.co.uk.

13. AI Outputs — Important Disclaimer

The Services use Advanced AI to assist with compliance analysis, policy drafting, vendor assessment and RFP responses. AI outputs are decision-support only and may contain inaccuracies, omissions or material that does not reflect the latest law or regulator guidance. Outputs do not constitute legal, regulatory, professional or audit advice.

The Customer is responsible for human review of all AI outputs before relying on them and for engaging suitably qualified professionals as needed. To the maximum extent permitted by law, we exclude all liability arising from the Customer's reliance on AI outputs without independent verification.

14. Beta and Early-Access Features

Features designated as "beta", "preview", "early access" or similar are provided "as-is", may change or be withdrawn at any time without notice, are excluded from any SLA and may have reduced or different security and privacy characteristics. The Customer's use is at its own risk.

15. Third-Party Services and Integrations

The Services may integrate with third-party products. Use of those products is governed by the applicable third-party terms and is at the Customer's risk. We are not responsible for, and do not warrant or support, third-party products. Disabling, suspending or terminating an integration at the Customer's request will not entitle the Customer to a refund.

16. Intellectual Property

Subject to the limited licence granted to the Customer, DataDoc and its licensors retain all right, title and interest in and to the Services, Documentation, models, prompts, training data, designs, trademarks and any improvements, derivatives, feedback and suggestions. The Customer grants DataDoc a perpetual, royalty-free licence to use feedback for any purpose without obligation.

17. Confidentiality

Each party will protect the other party's Confidential Information using the same degree of care it uses for its own (and not less than reasonable care) and will use it solely for the purposes of these Terms. Confidential Information excludes information that is or becomes publicly available, was already known, is independently developed without reference to the disclosure, or is required to be disclosed by law, court order or competent regulator (with prompt notice where lawful). These obligations survive termination for 5 years (indefinitely for trade secrets).

18. Warranties

Each party warrants that it has the corporate authority to enter into these Terms.

We warrant that during the Subscription Term the Services will perform in all material respects in accordance with the Documentation. As the Customer's sole remedy and our sole liability for breach of this warranty, we will use commercially reasonable efforts to correct the non-conformity, or, if unable to do so within a reasonable period, refund the prepaid fees for the affected period.

The Customer warrants that it has all necessary rights, consents and lawful bases to upload Customer Data and authorise its processing as contemplated by these Terms.

EXCEPT AS EXPRESSLY STATED, AND TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE SERVICES ARE PROVIDED "AS IS" AND ALL OTHER WARRANTIES, CONDITIONS AND REPRESENTATIONS, EXPRESS OR IMPLIED, INCLUDING SATISFACTORY QUALITY, FITNESS FOR PURPOSE, NON-INFRINGEMENT AND ACCURACY, ARE EXCLUDED.

19. Indemnities

By DataDoc: we will defend the Customer against any third-party claim that the Services, when used in accordance with these Terms, infringe a UK or EU registered patent, copyright or trademark, and pay damages finally awarded or agreed in settlement. If the Services are or are likely to be enjoined, we may at our option (i) procure the right to continue use, (ii) modify them to be non-infringing, or (iii) terminate the affected subscription and refund pre-paid unused fees. This indemnity does not apply to claims arising from Customer Data, Customer-caused modifications, combinations with non-DataDoc products, or use outside the Documentation.

By the Customer: the Customer will defend DataDoc against any third-party claim arising from Customer Data, breach of section 7 (Acceptable Use) or section 8 (Customer Data warranties), and pay damages finally awarded or agreed in settlement.

Each indemnity is conditional on the indemnified party giving prompt notice, granting sole control of the defence and settlement, and providing reasonable cooperation.

20. Limitation of Liability

Nothing in these Terms limits or excludes liability that cannot be limited or excluded by law, including for death or personal injury caused by negligence, fraud or fraudulent misrepresentation.

Subject to the foregoing, to the maximum extent permitted by law:

• • Neither party is liable for indirect, incidental, special, consequential or punitive damages, or for loss of profits, revenue, business, goodwill, anticipated savings, or loss or corruption of data;
• • Each party's total aggregate liability under or in connection with these Terms in any 12-month period is capped at the fees paid or payable by the Customer in the 12 months preceding the event giving rise to liability;
• • A super-cap of two times that amount applies to liability arising under the indemnities, breach of confidentiality or breach of data-protection obligations, where set out in the Order Form for Enterprise customers.

21. Insurance

We maintain appropriate insurance for a business of our size and nature, including cyber liability and professional indemnity cover. Certificates of insurance are available to Enterprise customers on request.

22. Suspension

We may suspend access to the Services, in whole or in part, on notice (or immediately where necessary to protect the Services or other customers) where the Customer fails to pay sums when due, materially breaches these Terms (including the Acceptable Use Policy), or where suspension is required by law or to address a security risk.

23. Term and Termination

These Terms continue for the duration of the Subscription Term and any renewals. Either party may terminate immediately by written notice if the other:

• • Materially breaches these Terms and fails to cure within 30 days of written notice;
• • Becomes insolvent, enters administration or undergoes an analogous insolvency event.

On termination: (i) all rights to use the Services cease; (ii) the Customer may export Customer Data within 30 days using the in-product export tools; (iii) we will then delete Customer Data in accordance with our retention schedule, save where retention is required by law; (iv) provisions which by their nature should survive (including IP, confidentiality, payment, indemnities, liability, governing law) shall survive.

24. Modifications to the Services

We may modify the Services from time to time, including adding, removing or changing features. We will not materially diminish core functionality during a paid Subscription Term; if we do, the Customer's sole remedy is to terminate the affected subscription and receive a pro-rata refund of pre-paid unused fees.

25. Compliance with Laws

Each party will comply with all laws applicable to its performance of these Terms, including the UK Bribery Act 2010, the Modern Slavery Act 2015, applicable anti-money-laundering laws and applicable sanctions and export-control regimes (UK, EU and US OFAC). Neither party will engage in any activity, practice or conduct which would constitute an offence under any of the foregoing.

26. Force Majeure

Neither party is liable for any failure or delay in performance (other than payment obligations) caused by events beyond its reasonable control, including acts of God, war, terrorism, civil unrest, pandemic, government action, internet, telecommunications or hosting provider failures, cyber-attacks not caused by its negligence, and labour disputes.

27. Assignment

The Customer may not assign or novate these Terms without our prior written consent. We may assign or novate to an affiliate or to a successor in connection with a merger, acquisition, reorganisation or sale of all or substantially all of our assets or the relevant business, on notice to the Customer.

28. Notices

Notices to DataDoc must be sent to info@privacypad.co.uk. Notices to the Customer will be sent to the email address associated with the account or the billing contact. Operational notices may be given in-product. Notices are deemed received on the next business day after sending.

29. Publicity

We may identify the Customer as a customer and use its name and logo on our website and in marketing materials, in accordance with the Customer's brand guidelines where provided. The Customer may opt out at any time by emailing info@privacypad.co.uk.

30. Governing Law and Jurisdiction

These Terms and any non-contractual obligations arising out of or in connection with them are governed by the laws of England and Wales. The courts of England and Wales have exclusive jurisdiction, save that either party may seek injunctive or equitable relief in any court of competent jurisdiction to protect its intellectual property or confidential information.

31. Order of Precedence

In the event of conflict, the following order of precedence applies (highest first): (1) the executed Order Form; (2) the DPA (in respect of personal data only); (3) these Terms; (4) any policies referenced in these Terms.

32. General

• • These Terms, together with the Order Form, DPA and referenced policies, constitute the entire agreement between the parties and supersede all prior agreements.
• • If any provision is held to be invalid or unenforceable, the remaining provisions remain in full force.
• • A failure or delay to exercise any right is not a waiver of that right.
• • Nothing in these Terms creates a partnership, agency or joint venture.
• • A person who is not a party to these Terms has no rights under the Contracts (Rights of Third Parties) Act 1999.

33. Changes to These Terms

We may update these Terms from time to time. Material changes will be communicated by email and/or in-product notice at least 30 days before they take effect. Continued use after the effective date constitutes acceptance. If the Customer objects to a material adverse change, it may terminate the affected subscription on notice within 30 days and receive a pro-rata refund of pre-paid unused fees as its sole remedy.

Contact