Master Terms of Business

Part 1 — Framework

1. About these terms

These Master Terms of Business ("Terms") govern the services Talitu provides to business clients. Talitu Ltd. is a company registered in the United Kingdom under company number 10295016, with registered office at 483 Green Lanes, London N13 4BS ("Talitu", "we", "us", "our").

What we do. Talitu is a technology, digital and AI consultancy. Depending on what we agree with you, the Services may include any combination of consulting and technical advisory work, discovery and strategy, product and service design, software engineering and application development, data engineering, analytics and machine learning, AI systems, agents, automation and integrations, cloud, infrastructure and platform engineering, quality assurance, testing and technical audits, implementation, migration and systems integration, managed services, maintenance and support, training and enablement, project teams and forward deployed engineers, individual contractors and staff augmentation, recruitment, introduction and permanent placement services, white label and subcontracted delivery, and any other professional or technology services we agree with you.

These Terms do not commit us to provide, or you to buy, any particular service. They set the rules that apply whenever we do agree to work together.

Business clients only. These Terms apply to companies, partnerships, charities, public bodies and other organisations acting in the course of business. They are not consumer terms. If you are an individual using the Talitu website rather than buying Services, our Terms of Use apply to you instead.

2. How the contract is formed

A contract between us is formed when you and Talitu agree an Engagement Document, whether by signature, a written or emailed acceptance, or a purchase order that refers to a Talitu proposal. Each Engagement Document is a separate contract, and it incorporates these Terms and any Schedules it says apply.

If you ask us to start work before an Engagement Document is signed and we agree to do so, these Terms apply to that work from the moment it starts, and we will charge for it on the basis set out in the most recent proposal or rate card we have given you.

Your standard terms do not apply. Any terms printed on or referred to in your purchase order, vendor portal, supplier questionnaire or other document do not form part of the contract between us unless we have expressly agreed to them in writing and signed by an authorised signatory of Talitu.

3. Order of precedence

If there is a conflict between documents, the following order applies, highest first:

• the Engagement Document, but only where it expressly states that it overrides these Terms or a Schedule, and only for that engagement;
• any Schedule that the Engagement Document says applies;
• these Terms;
• our other policies, including the Acceptable Use Policy and the Privacy Policy.

An Engagement Document does not override these Terms just by being silent or by saying something different in passing. It has to say so.

4. Definitions

• Affiliate — any entity that controls, is controlled by, or is under common control with a party.
• Applicable Laws — the laws, regulations and regulatory rules that apply to a party in performing or receiving the Services.
• Assigned Personnel — Personnel specifically assigned to work for or alongside you, including forward deployed engineers, embedded consultants and staff augmentation resources.
• Background Materials — Talitu's pre-existing and independently developed software, tools, libraries, templates, frameworks, methodologies, prompts, models, processes, documentation, know-how and other materials, including anything we develop outside an engagement or reuse across clients.
• Change Request — a documented change to scope, Deliverables, assumptions, Personnel, timing or fees, agreed under section 7.
• Client ("you", "your") — the business or organisation that buys Services from Talitu under an Engagement Document.
• Client Materials — the data, content, code, documentation, logos, images, copy, systems and other materials you or anyone on your behalf gives us or gives us access to.
• Deliverables — the reports, designs, specifications, software, documentation, configurations, models, data outputs or other materials expressly identified as deliverables in an Engagement Document.
• Engagement Document — a statement of work, proposal, order form, engagement letter, work order, quotation or similar document agreed between Talitu and you that describes a specific piece of work.
• Managed Services — ongoing operation, maintenance, monitoring, support or improvement services.
• Personnel — Talitu's employees, officers, contractors, consultants, subcontractors, Affiliates and other workers involved in delivering the Services.
• Services — any consulting, professional, technical, software, digital, AI, managed, personnel, recruitment or related services described in an Engagement Document.
• Third-Party Materials — open-source software, vendor products, AI models, cloud platforms, licensed materials and other components owned by third parties.
• Work Product — materials created specifically in performing an engagement, whether or not identified as Deliverables, and subject to the intellectual property terms in the applicable Engagement Document.

Part 2 — Delivering the services

5. Provision of the Services

Talitu will provide the Services described in each Engagement Document with reasonable skill and care, in a professional manner, and in line with any specifications and acceptance criteria that Engagement Document sets out.

How we organise the work. We decide how to organise, staff, sequence and resource an engagement, subject to any requirements expressly agreed with you in the Engagement Document. Where an Engagement Document names individuals, section 10 explains when we may change them.

Timetables. Dates, durations, milestones and delivery estimates are estimates based on the assumptions recorded in the Engagement Document. They are not binding unless the Engagement Document expressly says a date is a binding commitment. Time is not of the essence unless we have agreed in writing that it is.

What affects delivery. Delivery depends on you giving us the access, information, decisions and approvals we need when we need them. Late or incomplete information, unavailable systems or environments, changed requirements, unavailable client staff and delays in approvals may all affect timing, sequence and cost. Section 7 explains what happens then.

Scope. We are not required to perform work that is outside the agreed scope. Additional or changed work is handled through a Change Request.

No guarantee of commercial outcome. Estimates, proposals, business cases, models and projections are prepared in good faith on the information available at the time. They are not commitments and they do not guarantee a particular saving, revenue, volume, accuracy rate, valuation or return on investment. Where an Engagement Document sets out a specific measure we have agreed to meet, that measure applies, and nothing else does.

6. Your obligations

Delivering the Services is a joint effort. You will:

• give us accurate, complete and timely information, and tell us promptly if information you have given us changes or turns out to be wrong;
• make decisions, give approvals and provide sign-off within the timeframes agreed in the Engagement Document;
• name a person with authority to make decisions and approve Change Requests on your behalf, and tell us if that person changes;
• give us timely access to the people, systems, environments, data and premises we need, as set out in section 9;
• provide suitable internal ownership of the project on your side, including the business and technical people the work depends on;
• give us lawful instructions, and hold the licences, consents, permissions and regulatory approvals needed for the work and for anything you ask us to do;
• keep your own systems secure, take and test your own backups, and be responsible for the security of your environments and credentials;
• carry out your own testing and user acceptance where the Engagement Document says so;
• provide a safe working environment and comply with your duties on health, safety and welfare where our Personnel work at your premises;
• treat our Personnel lawfully and respectfully, including on discrimination, harassment and whistleblowing;
• cooperate with any employment status, tax or right-to-work assessments the law requires, and give us the information we reasonably need for them;
• comply with, and give us a copy of, any of your policies you expect our Personnel to follow.

We are not responsible for delay, cost, defect or failure caused by you not meeting these obligations, and any resulting impact on the timetable or fees is handled under section 7.

7. Assumptions, delays and change control

Assumptions and dependencies. Each Engagement Document records the assumptions and dependencies the price and timetable rest on. If an assumption turns out to be wrong, or a dependency is not met, we will tell you and we may re-estimate the affected work.

Change Requests. Either of us may ask for a change to scope, Deliverables, assumptions, Personnel, timing or fees. A change only takes effect once both of us have agreed it in writing, including any effect on fees and dates. We may charge at our then current rates for preparing a detailed estimate for a substantial change, if we tell you before we start.

Until a Change Request is agreed, we continue with the work as originally scoped. We are not obliged to start changed work before the Change Request is agreed, and if we do so at your request, you pay for it on a time and materials basis.

Client delay. If work is delayed or disrupted by something within your control, we may: reschedule the affected work to the next slot our team has available; charge for the time our Personnel were held ready but could not be productively used; and recover any committed third-party or contractor costs we cannot cancel. We will act reasonably and will keep those charges to what we cannot avoid.

Cancelled or rescheduled work. Where you cancel or reschedule booked work at short notice, the cancellation terms in the Engagement Document or the applicable Schedule apply. If neither says anything, we may charge for time we have reserved and cannot fill.

Dormant engagements. If an engagement is paused or inactive for more than 60 days because of something within your control, we may treat it as suspended, release the assigned team, invoice for work done and committed costs, and require a new Change Request or Engagement Document, at our then current rates, before work restarts.

8. Acceptance

This section applies where an Engagement Document identifies Deliverables and acceptance criteria.

When we submit a Deliverable, you have the acceptance period stated in the Engagement Document (or 10 business days if it does not state one) to test it against the agreed acceptance criteria and either accept it or give us written notice of the specific ways it fails to meet those criteria.

Deemed acceptance. A Deliverable is treated as accepted if you do not give us a valid rejection notice within the acceptance period, or if you use it in live operation for anything other than agreed testing.

Correcting defects. If you validly reject a Deliverable, we will correct the identified failures at our cost within a reasonable period and resubmit it. If the same Deliverable is validly rejected on the same grounds three times, you may, as your only remedy, end the affected part of the engagement and recover the fees you have paid for that Deliverable.

What is not a defect. Acceptance is measured against the agreed acceptance criteria, not against a subjective view of whether the work is complete or satisfactory. A request for something the acceptance criteria do not require is a Change Request, not a defect, and so is a problem caused by Client Materials, your systems, Third-Party Materials, changes made by anyone other than us, or use of a Deliverable in a way we did not intend or recommend.

9. Access to your systems, premises and people

To deliver the Services we typically need access to things you control. Depending on the engagement, that may include your systems and software, source-code repositories, cloud environments and accounts, networks, devices, offices and other premises, data, development, test and production environments, third-party platforms you use, your documentation, and your people.

You authorise Talitu and its Personnel to access, configure, modify and operate those systems and accounts as reasonably necessary to deliver the Services. You confirm that:

• you have the right and authority to grant that access, and granting it does not breach any third-party terms or agreements binding on you;
• the access you give is safe, lawful and appropriate for the work;
• you hold and maintain the licences, subscriptions and permissions needed for us to use the software and platforms involved;
• the credentials and instructions you give us are accurate and current;
• you have told us about any restrictions, sensitivities, regulated activities, hazards or security requirements that apply.

Keeping access current. You are responsible for revoking access promptly when it is no longer needed or you are no longer entitled to grant it, for keeping payment details for connected platforms up to date, and for platform charges billed directly to you, for example cloud hosting, AI model usage, telephony or messaging charges.

We may refuse access arrangements. We may decline, or stop using, an access arrangement we reasonably consider insecure, unlawful or inappropriate, including shared credentials, unsupported systems, or access wider than the work requires. If that materially affects delivery, section 7 applies.

Where things run. Whether a system we build runs in an environment you control or one we host is agreed in the Engagement Document. It is not automatic either way, and it affects who holds the provider relationship, who is billed for usage and which parts of Schedule 2 and Schedule 7 can apply.

10. Our people and subcontractors

We may perform the Services using our employees, independent contractors, specialist consultants, Affiliates, delivery partners and subcontractors. We remain responsible to you for the Services they perform, to the extent set out in these Terms and the Engagement Document.

Your approval of a subcontractor is only needed where the Engagement Document, an agreed security requirement or data protection law requires it. Where approval is needed, you will not withhold or delay it unreasonably.

Changing people. We may change the Personnel assigned to an engagement, including anyone named in an Engagement Document, and will use reasonable efforts to provide a replacement of comparable skill and to manage the handover. We do not charge you for the time a replacement spends getting up to speed on work the person they replaced had already been briefed on, unless you asked for the change.

Removing people. You may ask us in writing, with reasons, to remove someone from your engagement. Where the request is reasonable we will do so and provide a replacement as soon as we reasonably can. Removal at your request does not suspend fees or timetables unless the Engagement Document says so.

Employment status. Our Personnel are engaged by Talitu or by our subcontractors. Nothing in these Terms makes them your employees or workers, and nothing in them makes us or our Personnel employees, workers or agents of yours. This section records what we intend, but it does not override employment, agency worker or tax law where those laws apply of their own force. Where we supply Assigned Personnel, Schedule 3 applies and deals with status, supervision and tax in more detail.

Part 3 — Commercial terms

11. Fees and charging models

The fees for each engagement are set out in the Engagement Document. Depending on what we agree, an engagement may be charged on any of these bases, or a combination of them:

• a fixed project fee;
• time and materials, at hourly or daily rates;
• a monthly retainer or capacity commitment;
• managed service fees;
• subscription or platform fees;
• usage-based fees;
• milestone payments;
• a deposit or mobilisation fee;
• a minimum commitment, whether by value, days or duration;
• contractor day rates, including overtime and on-call charges;
• recruitment, introduction, placement and transfer fees;
• travel, subsistence and other expenses;
• third-party licences, cloud, model, data and telecommunications costs;
• other pass-through costs we incur for you.

Rates and reviews. Rates are those in the Engagement Document or our current rate card. We may increase rates once in any 12-month period on 30 days' written notice. Where an Engagement Document has a fixed price or a fixed term, the increase does not apply to that engagement until it is renewed or extended, unless the Engagement Document says otherwise.

Minimum commitments. Where you have committed to a minimum value, number of days or duration, that commitment is payable whether or not you use it, unless the Engagement Document says otherwise.

12. Invoicing, timesheets and purchase orders

Unless the Engagement Document says otherwise, invoices are payable within 14 days of the invoice date, in the currency stated, without set-off or deduction.

Time-based work. Where work is charged by time, we record it on timesheets. You approve timesheets weekly. A timesheet is treated as approved if you do not query it in writing within 5 business days of receiving it. Approved time is invoiced monthly in arrears.

Personnel supply. Where we supply Assigned Personnel, we usually pay those people before you pay us. Payment terms for that work are 14 days and are not negotiable down through a purchase order or supplier portal without our written agreement.

Purchase orders. If your process requires a purchase order, you must give us a valid one before work starts, and keep it current and sufficient in value for the work in flight. We are not required to start or continue work while a valid purchase order is missing, expired or exhausted, and any resulting delay is treated as a client delay under section 7. The absence of a purchase order does not excuse payment for work you have asked for and received.

13. Expenses and pass-through costs

You reimburse reasonable expenses we incur in delivering the Services, at cost, including travel, accommodation and subsistence where the work requires travel beyond our normal working locations. We follow your expenses policy where you give it to us in advance.

Third-party costs are yours where they are incurred for your benefit, including software and data licences, cloud and hosting, AI model usage, telephony and messaging, contractor platform and umbrella company charges, and any tooling the Engagement Document says you pay for. Where we buy these on your behalf we may charge them on at cost plus any handling fee stated in the Engagement Document, and we may require payment in advance.

Where a third-party cost is non-refundable or committed for a minimum term, you remain responsible for it even if the engagement ends early. Currency conversion costs and bank charges on cross-border payments are yours.

14. Taxes

All fees are exclusive of VAT and any other applicable sales, use or similar taxes, which you pay in addition at the applicable rate.

If the law requires you to withhold or deduct tax from a payment to us, you will increase the payment so that we receive the amount we would have received without the withholding, and you will give us the receipts or certificates we need to claim relief.

Each party is responsible for its own taxes on its own income, and for payroll taxes and social security contributions for its own people. Where we supply Assigned Personnel, Schedule 3 deals with off-payroll working and employment status in more detail.

15. Late payment, disputes and suspension

Late payment. If an undisputed invoice is not paid by its due date, we may charge interest and recover costs under the Late Payment of Commercial Debts (Interest) Act 1998, or, where we choose to instead, interest at 4% a year above the Bank of England base rate, calculated daily until payment.

Querying an invoice. If you think an invoice is wrong, tell us in writing within 14 days of the invoice date, with the reason, and we will look into it in good faith. You must still pay any part of the invoice that is not genuinely in dispute on time. Raising a dispute after that window does not delay payment.

Suspension. If an undisputed invoice is more than 14 days overdue, we may, after giving you 7 days' written notice, suspend all or part of the Services, withdraw Assigned Personnel and pause access to anything we host, until payment is made. Suspension does not reduce the fees payable for the period of suspension where the amounts are committed, and it does not affect any other remedy we have.

Refunds. Fees already paid are not refundable except where these Terms, the applicable Schedule or your Engagement Document say so, or where the law requires it.

Part 4 — Rights and risk

16. Intellectual property

The default position. Unless the Engagement Document says otherwise:

• Talitu owns and keeps all rights in its Background Materials;
• Third-Party Materials stay owned by their owners and are supplied to you under their own licence terms, which apply to you directly;
• you own the Client Materials;
• ownership or licensing of Deliverables and Work Product is whatever the Engagement Document says it is.

Nothing transfers until you have paid. Any assignment or licence of rights in Deliverables takes effect only when we have received payment in full of all sums due under the relevant Engagement Document. Until then you have a revocable licence to use the Deliverables for evaluation and acceptance only.

Where you take ownership. Where an Engagement Document says you own a Deliverable, we assign to you the intellectual property rights in that Deliverable with effect from payment in full, and we will do what you reasonably ask, at your cost, to record that assignment. The assignment does not cover, and we keep all rights in: our Background Materials; Third-Party Materials and open-source components; and the generic components, reusable methods, techniques, tools and improvements we develop or refine in the course of the work, so long as they do not contain or disclose your Confidential Information or Client Materials.

Licence to what is embedded. Where our Background Materials are built into a Deliverable you own or licence, and you need them to use, run or maintain that Deliverable, we grant you a perpetual, worldwide, non-exclusive, non-transferable, royalty-free licence to use, copy and modify those Background Materials as part of that Deliverable. That licence does not let you sell, sublicense or distribute the Background Materials on their own, or as part of a product that competes with Talitu.

Commercial models we may use. An Engagement Document may set any of these, and different arrangements may apply to different parts of one engagement: you own the bespoke Deliverables; you licence software Talitu owns; the parties jointly own specified material; a Talitu product is configured for you; work is produced by embedded Personnel under agreed terms; delivery is white-labelled through you to your own client; a proof of concept or prototype is supplied on limited terms and is not production ready; or a tool is used internally by Talitu and never supplied to you at all.

Our people. We will obtain from our Personnel the assignments and waivers we need to give you the rights an Engagement Document says you get.

Moral rights and non-assignable rights. Any assignment under these Terms is subject to rights that cannot be assigned as a matter of law. Where the law allows, our Personnel waive their moral rights in the Deliverables. Where a right cannot be assigned or waived, we grant you the widest licence we lawfully can in its place.

What we stay free to do. We remain free to use the general skills, ideas, concepts, techniques, experience, know-how and non-client-specific components we develop or improve while working with you, and to provide similar services to other clients, including your competitors, so long as we do not use your Confidential Information or Client Materials in doing so.

Feedback. If you send us ideas, suggestions or feedback about the Services, we may use them freely to improve our products and services, with no obligation or payment to you. Feedback is given "as is".

17. Your materials

You keep ownership of the Client Materials. You grant Talitu and its Personnel a non-exclusive, royalty-free licence to use, copy, store, adapt and process Client Materials as needed to deliver the Services and to meet our legal obligations, for as long as we need them for that purpose.

You confirm that you have the rights, consents and permissions needed to give us the Client Materials, and that our use of them as we have agreed will not infringe anyone's rights or breach any law.

18. Confidentiality

Each of us may learn confidential information about the other. "Confidential Information" means non-public information that is marked confidential, or that a reasonable person would treat as confidential given its nature, including business and marketing plans, pricing, strategy, know-how, technical information, source code, candidate information and the terms of any Engagement Document. Our Confidential Information includes our Background Materials, tools and documentation. Yours includes the business information, systems information and plans you share with us.

Each of us agrees to keep the other's Confidential Information secret using at least the same care we use for our own, and never less than reasonable care; to use it only to provide or receive the Services; and to share it only with Personnel, advisers and subcontractors who need it and who are under similar duties. Neither of us will disclose the terms of an Engagement Document to anyone else, except our professional advisers or as part of a genuine funding, sale or similar transaction, and then only under confidentiality.

This does not apply to information that is or becomes public through no fault of the receiving party, was already known without a duty of confidence, is received from someone free to share it, or is developed independently without using the other's Confidential Information. Either of us may disclose Confidential Information where the law or a regulator requires it, and where we are allowed to, we will give the other reasonable notice first.

Personal data is handled under section 19 and Schedule 6, not this section.

19. Data protection

Both of us will comply with the data protection laws that apply to us. Words like "personal data", "processing", "controller", "processor" and "personal data breach" have the meanings given in the UK GDPR and the Data Protection Act 2018, and the EU GDPR where it applies.

Our role depends on the processing. Talitu is not always a processor. Across the relationship we may act as:

• a processor, for personal data we process on your documented instructions as part of delivering the Services. Schedule 6 applies to that processing, and only to that processing;
• an independent controller, for personal data we process for our own purposes, including managing your account and our relationship with you, billing and credit control, recruitment and management of our own Personnel, business records, security monitoring, and meeting our own legal and regulatory duties. Our Privacy Policy covers that processing;
• a controller or joint controller in another context where we determine the purposes and means of the processing, in which case we will tell you and we will agree the arrangements the law requires.

Your responsibilities. You are responsible for having a lawful basis, and the right notices, consents and permissions, to give us personal data and to use the Services with it, including any consents needed for automated decision-making, marketing, recorded communications and special category data.

Sensitive data. Unless we have agreed otherwise in writing, you must not put payment card numbers, bank account details, government identifiers, health or medical records, biometric data or information about children into the Services or ask us to process them. If you do so anyway, you do it at your own risk and you are responsible for it. This does not stop us handling ordinary personal data such as names, business contact details and the content of business communications.

Embedded personnel. Where Assigned Personnel access personal data inside your systems, under your access controls and your direction, they normally do so on your behalf and as part of your processing, not ours. Schedule 3 and Schedule 6 set out how that is handled and what each of us is responsible for.

Regulatory compliance is yours. You remain responsible for compliance with the advertising, professional, financial services, consumer protection, employment, data protection and other laws that apply to your business, and with the rules of any regulator or professional body you are subject to. We do not advise on, monitor or audit your compliance, and you should take independent advice where you are unsure.

20. Warranties

Both of us warrant that we have the right and authority to enter into these Terms and each Engagement Document, and that doing so does not breach any other agreement binding on us.

You warrant that you will use the Services in line with these Terms and our Acceptable Use Policy, that you will comply with the laws applying to your business, and that you have the rights, consents and permissions needed for the Client Materials and instructions you give us.

We warrant that we will perform the Services with reasonable skill and care, using suitably skilled and experienced Personnel. Where an Engagement Document sets out defined specifications and acceptance criteria for a Deliverable, we also warrant that the Deliverable will conform to those specifications in all material respects for 30 days after acceptance.

These warranties do not apply where a problem is caused by Client Materials, your systems or data, your use of a Deliverable in a way we did not intend or recommend, changes made by anyone other than us, Third-Party Materials, or anything outside our reasonable control. If we breach the warranties in this section, your remedy is that we will re-perform the affected Services or correct the affected Deliverable within a reasonable time, and if we cannot reasonably do either, refund the fees paid for the affected work.

21. Disclaimers

Except for the warranties expressly given in section 20 and in any applicable Schedule, and to the fullest extent the law allows, we exclude all warranties, conditions and representations that would otherwise be implied by law, custom or otherwise, including any implied warranty of satisfactory quality, fitness for a particular purpose or non-infringement.

We do not warrant that the Services or any Deliverable will be uninterrupted, error free or secure, that they will meet requirements we have not agreed, or that they will produce any particular commercial result.

22. Limitation of liability

What is never limited. Nothing in these Terms limits or excludes either party's liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, for a party's payment obligations, or for anything else that cannot be limited or excluded by law.

What neither of us is liable for. Subject to the paragraph above, and to the fullest extent the law allows, neither party is liable to the other for loss of profits, revenue, anticipated savings, goodwill, business opportunity or data, or for any indirect or consequential loss, however it arises.

The general cap. Subject to the paragraphs above, each party's total aggregate liability arising out of or in connection with an Engagement Document, whether in contract, tort (including negligence), breach of statutory duty or otherwise, is limited to the greater of:

• the fees paid and payable under that Engagement Document in the 12 months before the event giving rise to the claim; and
• £50,000.

Each Engagement Document carries its own cap. Claims relating to more than one Engagement Document are apportioned to the Engagement Document they relate to.

The higher cap. For claims arising from breach of section 18 (Confidentiality), breach of section 19 or Schedule 6 (Data protection), or infringement of a third party's intellectual property rights, the cap is instead the greater of twice the fees paid and payable under that Engagement Document in the 12 months before the event, and £250,000.

Outside the caps. Fees properly due and unpaid, and amounts payable under section 13 for committed third-party and contractor costs, do not count towards and are not limited by either cap.

Personnel claims. Where you direct, supervise or control Assigned Personnel, we are not liable for loss arising from that direction, supervision or control, or from your working environment, and Schedule 3 sets out how those risks are allocated.

Third parties. We are not liable for the acts, omissions, availability, pricing, terms, outputs or discontinuation of any third-party provider, platform, model or product, or of any supplier you selected or instructed us to use.

Time limit. Neither party may bring a claim under an Engagement Document more than 12 months after it became aware, or should reasonably have become aware, of the facts giving rise to it. This does not apply to claims for non-payment.

23. Indemnities

Your indemnity to us. You will indemnify Talitu, its Affiliates and its Personnel against any loss, damage, claim, liability and reasonable cost, including reasonable legal fees, arising from: your breach of these Terms, an Engagement Document or the Acceptable Use Policy; the Client Materials and your right to provide them; any content, claim, offer, advice or price you ask us to publish, send, generate or promote on your behalf; your instructions where we told you in writing that we had concerns and you asked us to proceed; your use of a Deliverable in production; your direction, supervision or control of Assigned Personnel, including any claim that they are your employees or workers, any employment status, tax or agency worker claim arising from your treatment of them, any injury they suffer at your premises, and any discrimination or harassment claim arising from your workplace; your handling of candidate information under Schedule 4; and your breach of any law or third-party right.

Our indemnity to you. If a third party claims that our Background Materials, or a Deliverable we created and supplied under an Engagement Document, infringes their intellectual property rights, we will defend that claim and pay the damages and reasonable costs finally awarded against you or agreed by us in settlement. This does not apply to a claim arising from: Client Materials or your instructions; Third-Party Materials and open-source components; use of a Deliverable outside what the Engagement Document allows; changes made by anyone other than us; combination with anything we did not supply; or your continued use after we asked you to stop.

If a Deliverable becomes, or we reasonably think it may become, the subject of such a claim, we may at our cost modify it so it no longer infringes, obtain the right for you to keep using it, or, if neither is reasonably achievable, end the affected engagement and refund the fees you have paid for the affected Deliverable. This paragraph is your sole remedy for third-party intellectual property claims, and our liability under it is subject to section 22.

How indemnities work. The party seeking cover must tell the other promptly in writing, let the other run the defence and any settlement, and give reasonable help at the indemnifying party's cost. The party seeking cover may take part with its own lawyers at its own cost. The party running the defence must not settle in a way that admits fault by, or imposes an obligation on, the other party without that party's written consent, which must not be unreasonably withheld.

24. Insurance

Each party will maintain insurance appropriate to its obligations, including, in our case, professional indemnity, public liability and employer's liability cover as required by law and by the nature of the Services. Where an Engagement Document specifies levels of cover, we will maintain those levels for that engagement and its limitation period, and will provide evidence of cover on reasonable request. Holding insurance does not increase the caps in section 22.

Part 5 — Conduct, ending and general

25. Compliance

Each of us agrees to comply with the laws that apply to us on:

• Bribery and corruption, including the UK Bribery Act 2010, and not to offer, give, request or accept any bribe or improper payment in connection with the Services. Each of us keeps reasonable policies and procedures to prevent this.
• Modern slavery, including the Modern Slavery Act 2015. Each of us confirms that, so far as we are aware, neither we nor anyone in our supply chain for the Services is involved in slavery, human trafficking or forced labour, and will tell the other promptly on becoming aware of a breach.
• Sanctions and export controls. Neither party will use the Services in breach of applicable sanctions or export control laws, or make them available to a sanctioned person or restricted destination.
• Fraud and the facilitation of tax evasion, including Part 3 of the Criminal Finances Act 2017. Each of us keeps reasonable prevention procedures.
• Equality, non-discrimination and harassment, including the Equality Act 2010, in how each of us treats the other's people.
• Health and safety, including your duties towards our Personnel working at your premises or under your direction.
• Whistleblowing. Neither party will penalise a person for raising a genuine concern about wrongdoing connected to the Services.

Your codes and policies. Our Personnel will comply with your reasonable site, security and conduct policies while working at your premises or on your systems, provided you have given us a copy in advance and they do not conflict with these Terms, our own obligations or the law. We are not bound by a policy simply because it exists on your intranet.

Conflicts of interest. Each of us will tell the other about any actual or likely conflict of interest affecting an engagement, and will work in good faith on how to manage it. Working for other clients in the same sector is not by itself a conflict.

Records and audit. Where the law, a regulator or the Engagement Document requires it, we will keep reasonable records of the Services and cooperate with a proportionate audit, on reasonable notice, no more than once a year unless a regulator or a substantiated breach requires more, at your cost and subject to confidentiality.

26. Third-party services and providers

The Services often depend on and integrate with third parties. Depending on the engagement these may include cloud and hosting providers, development and collaboration platforms, open-source software, AI model providers, data providers, software licensors, contractor and freelancer platforms, recruitment tools and job boards, payroll providers and umbrella companies, payment providers, vendors you have selected, and third-party consultants.

Who contracts with whom. The Engagement Document says which providers you contract with and pay directly, and which we contract with and charge on to you. Where you hold the contract, that provider's terms apply to you directly, you are responsible for its fees, and we act only within the access you give us. Where we hold the contract, we remain responsible to you for the Services as set out in these Terms, but not for the provider's own availability, pricing or product decisions.

The current list of providers that process personal data on our behalf is at talitu.com/sub-processors. We are not responsible for third-party services, their availability, their terms or changes they make, and changes they make may affect the Services.

27. Non-solicitation and transfer fees

During an engagement and for 6 months after it ends, neither party will directly or indirectly solicit for employment or engagement any of the other's people who have been materially involved in that engagement, without the other's written consent.

This does not prevent either party from making a general public advertisement not targeted at the other's people, or from hiring someone who responds to one.

Where you employ or engage any of our Personnel, whether directly or through another company, in breach of this section or within 6 months of them last working on your engagement, a transfer fee is payable as set out in Schedule 4, or, where Schedule 4 does not apply, an amount equal to 30% of that person's first year's total remuneration in the new role. This does not apply where the law does not permit such a fee, and Schedule 4 sets out the alternatives available in that case.

28. Term, suspension and termination

These Terms start when the first Engagement Document is agreed and continue until every Engagement Document has ended and neither of us has any further obligations under them.

Ending an engagement for convenience. An Engagement Document may be ended for convenience only where it says so, and then only on the notice it states. Where it is silent, an engagement can be ended only under the paragraphs below.

Ending for breach. Either of us may end an Engagement Document, or all of them, on written notice if the other commits a material breach and does not put it right within 30 days of being asked in writing, or commits a material breach that cannot be put right.

Ending for insolvency. Either of us may end an Engagement Document immediately on written notice if the other stops or threatens to stop trading, or becomes insolvent or subject to an administration, liquidation, receivership, bankruptcy or similar process that is not discharged within 30 days.

Ending for non-payment. We may end an Engagement Document on written notice if an undisputed invoice is more than 45 days overdue.

Suspension. We may suspend all or part of the Services under section 15, or where you breach the Acceptable Use Policy, where the law or a regulator requires it, or where continuing would expose either of us to a serious security, legal or safety risk. We will give notice where it is reasonable to do so.

29. What happens when an engagement ends

When an Engagement Document ends, for whatever reason:

• you pay for all Services performed up to the end date, all work in progress, and all committed third-party and contractor costs we cannot cancel;
• we deliver the Deliverables that have been completed and paid for, and any rights that transfer on payment transfer at that point;
• work in progress that has not been paid for is not delivered, and no rights in it transfer;
• each of us returns or destroys the other's Confidential Information on request, other than copies we must keep by law or in routine backups;
• we return your Client Materials in a common format if you ask within 30 days of the end date, and after that period we may delete them unless the law requires us to keep them;
• we stop accessing your systems, and you revoke our access and the access of our Personnel promptly;
• Assigned Personnel are withdrawn on the notice set out in Schedule 3, and you return any equipment and revoke any credentials you issued them;
• we stop monitoring, supporting and improving anything we were running for you, and we are not responsible for how it performs after the end date.

Transition assistance. If you ask before the end date, we will provide reasonable transition assistance and knowledge transfer to you or an incoming supplier, for up to the period stated in the Engagement Document. Transition assistance is chargeable at our then current rates unless the Engagement Document says it is included, and it is conditional on all sums due being paid.

Immediate removal of access. Either of us may require immediate revocation of access where there is a security, legal or safety reason to do so, without waiting for a notice period to run.

What survives. Sections that by their nature should continue will do so, including sections 11 to 15 (for sums due), 16 to 19, 21 to 25, 27, 29, and 32 to 34, together with any part of a Schedule expressed to survive.

30. Force majeure

Neither party is liable for delay or failure to perform caused by events outside its reasonable control, including failures, outages or material changes affecting third-party AI models, hosting providers, internet, telephony or messaging providers, and other platforms; acts of God; fire; flood; pandemic or epidemic; war or terrorism; industrial action; cyber attack; and government action. This does not excuse an obligation to pay.

The affected party will tell the other promptly and use reasonable efforts to work around the event. Where the event materially prevents performance for more than 30 days, either party may end the affected Engagement Document on written notice.

31. Publicity and references

With your prior agreement, which can be given in an Engagement Document or by email, we may use your name and logo, and describe the work we did and the results we helped you achieve, in our marketing, website, case studies and proposals. You can withdraw that agreement at any time by emailing us, and we will stop using it in new materials within a reasonable time. We will not disclose your Confidential Information in any of this without your agreement.

32. General

Independent businesses. We are independent contractors. Nothing in these Terms creates a partnership, joint venture, agency, fiduciary or employment relationship, and neither of us can bind the other.

Assignment. Neither party may transfer its rights or obligations without the other's written consent, which will not be unreasonably withheld, except that either party may transfer to a company that takes over its business or assets. We may subcontract as set out in section 10.

Whole agreement. These Terms, the Schedules that apply, the Acceptable Use Policy, the Privacy Policy and your Engagement Documents are the whole agreement between us about the Services, and replace any earlier discussions, proposals or agreements on the same subject. Neither of us has relied on any statement not set out in those documents. Nothing in this section limits liability for fraud or fraudulent misrepresentation.

No waiver. A delay in enforcing a right does not waive it. A waiver only counts if it is in writing.

Severability. If any part of these Terms is found invalid or unenforceable, the rest stays in force and the affected part is treated as removed or narrowed only as far as needed.

Notices. Formal legal notices to us go to hello@talitu.com and to our registered office at 483 Green Lanes, London N13 4BS. We send notices to the contact details in your Engagement Document. Day-to-day communication can be by email.

Changes to these Terms. We may update these Terms for new engagements at any time. The version that applies to an Engagement Document is the version in force on the date that Engagement Document was agreed, unless we both agree in writing to move to a newer version. The "last updated" date shows when the current version took effect.

Third parties. Other than Talitu's Affiliates and Personnel, who may enforce sections 22, 23 and 27, no one other than you and us has any right to enforce these Terms under the Contracts (Rights of Third Parties) Act 1999.

Counterparts and signature. An Engagement Document may be signed electronically and in counterparts, each of which is an original.

33. Governing law

These Terms, each Engagement Document and any dispute or claim arising out of or in connection with them, including non-contractual disputes, are governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

34. Contact

Questions about these Terms can be sent to hello@talitu.com or through our contact page.

Service schedules

Schedule 1 — Professional and project services

Applies where the Engagement Document says so. Typical for consulting, discovery, strategy, design, software engineering, data, integration and implementation work charged on a fixed price, milestone or time and materials basis.

1. Ways of working

Unless the Engagement Document says otherwise, work runs on a collaborative, iterative basis. We agree the scope and acceptance criteria up front, work in agreed increments, and review progress with you at agreed intervals. Where an engagement is genuinely fixed scope and fixed price, the Engagement Document will say so and will define the specification the price is based on.

2. Assumptions and dependencies

The Engagement Document records the assumptions the estimate rests on and the dependencies we need from you, typically including the availability of named client staff, access to environments and data, the state and quality of existing systems and documentation, decision turnaround times, and any third-party involvement. Section 7 of the Terms applies if an assumption is wrong or a dependency is not met.

3. Milestones and reporting

Where the Engagement Document sets milestones, we report progress against them at the agreed frequency and flag risks and issues as they arise. Missing an estimated milestone is not by itself a breach unless the Engagement Document states that the date is binding.

4. Acceptance and defects

Section 8 of the Terms governs acceptance. In addition, for software Deliverables we will correct, at our cost, defects that stop the Deliverable meeting its agreed specification and that you report within 30 days of acceptance. After that period, corrections are chargeable unless the engagement has moved to Managed Services under Schedule 2.

5. Out-of-scope requests and cancellation

Requests outside the agreed scope are handled as Change Requests. Where booked delivery time is cancelled or rescheduled by you with less than 10 business days' notice, we may charge 50% of the fees for the affected time, and with less than 5 business days' notice, 100%, in each case less anything we are able to fill.

6. Proofs of concept and prototypes

Where an Engagement Document describes a proof of concept, prototype, pilot or spike, it is supplied for evaluation only. It is not production ready, carries no warranty beyond reasonable skill and care, has no acceptance criteria unless expressly stated, and must not be used in live operation without a further Engagement Document.

7. Standard approach for AI agent engagements

This paragraph applies only to engagements to design and build a custom AI agent. Unless the Engagement Document says otherwise, our standard approach is:

• Identify. We review the operation with your team, agree which work the agent will take on and agree the baseline measure the agent will later be judged against.
• Build. We build a working agent on your data and systems, set up to follow the rules we agree with you.
• Prove. The agent runs on real work and we compare the result to the agreed baseline.
• Run. Ongoing and optional. We monitor the agent, keep it working and make changes as your business changes, for a recurring fee under Schedule 2.

Our standard commercial approach for these engagements, again unless the Engagement Document says otherwise, is that the Identify fee is credited against the Build fee if you proceed to a build; the Build fee is quoted as a single fixed price at the end of the Identify stage; the Run fee does not start until the agent has met the baseline measure agreed at the Identify stage; and you may end the Run stage on notice and keep the working agent and the custom code written specifically for you, subject to section 16 of the Terms and to payment of all sums properly due.

Stage timings are estimates. What an AI agent achieves depends on the quality and consistency of your data, content and systems, how much of the work follows clear rules, how your team uses the agent, and the behaviour and availability of third-party platforms and AI providers. Except for a baseline measure expressly agreed in writing, we do not guarantee any particular saving, volume, accuracy rate, revenue or return. Schedule 5 also applies to these engagements.

Schedule 2 — Managed services and support

Applies where the Engagement Document says so. It does not apply to project work, consulting engagements or personnel supply.

1. What is covered

Managed Services cover the operation, monitoring, maintenance, support and agreed improvement of the systems named in the Engagement Document. They do not cover problems caused by your own systems, your misuse, changes made by anyone other than us, Third-Party Materials, or anything outside our reasonable control, and they do not include new development, which is handled under Schedule 1.

2. Support hours and contact

Support is available by email at hello@talitu.com, or any dedicated address in your Engagement Document, Monday to Friday, 9:00am to 5:30pm UK time, excluding public holidays in England. Extended or out-of-hours cover is available only where the Engagement Document says so and is charged separately.

3. Response targets

We give each reported problem a priority and aim to respond within the targets below. "Respond" means we have acknowledged it and started work, not that it is fixed. We set the final priority acting reasonably.

• Priority 1, critical: the service is down or unusable for its main purpose. Target response within 1 business day, then continuous work during support hours until there is a fix or workaround.
• Priority 2, serious: a major function is badly affected but the service is still usable overall. Target response within 1 business day.
• Priority 3, moderate: a smaller problem with a reasonable workaround. Target response within 2 business days.
• Priority 4, minor: a question, or a request for information or guidance. Target response within 5 business days.

We use commercially reasonable efforts to meet these targets during support hours. They are goals, not guarantees, and missing them is not a breach unless the Engagement Document says otherwise.

4. Availability

Where the Engagement Document states an availability target, that target applies only to components Talitu hosts and controls. Where a system runs in an environment you control, availability depends on that provider and your configuration, and no availability target applies.

Unless the Engagement Document states a different figure, the target for components we host is 99.5% in each calendar month, excluding planned maintenance we tell you about at least 48 hours ahead, problems caused by you, your systems or your connectivity, problems with third-party platforms, networks or AI providers outside our control, and force majeure events. Availability is calculated as total minutes in the month less our downtime, divided by total minutes in the month, times 100.

5. Service credits

Where an availability target applies and we miss it in a month, you may claim within 30 days a service credit of 15% of that month's recurring fee for the affected service. If we miss it in any three months within a 12-month period, you may end the affected engagement on written notice and we will refund fees pre-paid for services not yet delivered. Service credits and that termination right are your only remedies for missing an availability target.

6. Changes and continuous improvement

We may make changes needed to keep a service secure, supported and working. Improvements beyond that are delivered only to the extent the Engagement Document provides for them, whether as an allowance of days, a change budget or an agreed roadmap. There is no open-ended obligation to keep improving a service.

7. Term and notice

Managed Services run for the term in the Engagement Document and renew as it provides. Either party may end them on the notice stated there, or, if it is silent, on 30 days' written notice expiring no earlier than the end of the minimum term. Section 29 of the Terms applies on ending.

Schedule 3 — Personnel and staff augmentation

Applies where the Engagement Document says so. It covers the supply of Assigned Personnel to work for or alongside you.

1. Three delivery models

The Engagement Document must state which of these applies. Describing an arrangement as consultancy, outsourcing or forward deployed does not change what it actually is.

• Managed consultancy services. Talitu is responsible for delivering an agreed outcome, manages its own team, directs how the work is done and decides who does it. Schedule 1 usually applies alongside this schedule.
• Staff augmentation or personnel supply. Talitu supplies named or suitably qualified Personnel who work within your team and under your day-to-day direction. You direct the work; we remain their employer or engager.
• Forward deployed teams. Talitu Personnel work closely with you, potentially at your premises and inside your systems, but Talitu retains responsibility for how the work is performed unless the Engagement Document says otherwise.

2. Roles, rates and booking

The Engagement Document sets out the role, required skills and seniority, named individuals where agreed, start date, expected duration, minimum booking period, location and any remote working arrangement, working hours and the definition of a working day, the day or hourly rate, and any overtime, weekend, on-call or shift rates. A working day is 8 hours unless stated otherwise. Time beyond the standard day is chargeable only where you have approved it in advance in writing.

3. Timesheets, absence and holidays

Assigned Personnel submit timesheets weekly for your approval. Section 12 of the Terms governs approval and invoicing. You are charged for time worked and for agreed holiday, notice or standby only where the Engagement Document says so. We tell you promptly about sickness or unplanned absence and, where the absence is likely to exceed 5 consecutive working days, we will offer a suitable replacement. We give reasonable notice of planned holiday.

4. Supervision, direction and reporting

Where the model is staff augmentation, you supervise and direct the day-to-day work, set priorities, approve outputs and provide the technical direction, and you are responsible for the consequences of that direction. Where the model is managed consultancy, we do. The Engagement Document names the reporting line on each side. Whichever model applies, we retain responsibility for our contractual relationship with our Personnel, including their engagement terms, pay and the conduct standards we hold them to.

5. Substitution and replacement

We may substitute Assigned Personnel under section 10 of the Terms, giving as much notice as we reasonably can and providing someone of comparable skill. You may ask us in writing, with reasons, to replace someone whose performance or conduct is genuinely unsatisfactory. Where the request is reasonable we will replace them as soon as we reasonably can and will not charge for the replacement's reasonable handover time.

6. Your responsibilities to Assigned Personnel

Where Assigned Personnel work at your premises or under your direction, you will:

• provide a safe working environment and comply with your health and safety duties, including risk assessment, first aid and reporting of incidents;
• tell us in advance about any hazard, regulated activity, security clearance requirement or unusual working condition;
• provide the systems, equipment, access and information they need to do the work, unless the Engagement Document says we provide them;
• give clear instructions, supervision and timely approvals;
• give us copies of any workplace policies you expect them to follow;
• apply your anti-harassment, anti-discrimination, whistleblowing and grievance protections to them as you would to your own staff, and tell us promptly about any complaint or incident involving them;
• cooperate reasonably with us on their working arrangements, and give us the information we need for any status, tax or right-to-work assessment.

7. Screening, clearance and right to work

We carry out right-to-work checks required by law for our own employees and require the same from our subcontractors. Any further screening, including criminal record checks, financial probity checks, security clearance or sector-specific vetting, applies only where the Engagement Document requires it, is subject to the person's consent and to what the law allows, and is charged to you at cost. You are responsible for telling us before the start date what screening the role requires. We do not warrant that a person will pass a check we have not been asked to run.

8. Employment status, off-payroll working and tax

The Engagement Document must record which party is the client for off-payroll working purposes and, where relevant, who the fee-payer is. Where you are the client for those purposes, you are responsible for making the status determination, issuing a status determination statement to us and to the worker, operating the disagreement process, and doing so with reasonable care. Where Talitu is the fee-payer, we are responsible for the deductions the rules require of a fee-payer.

Each party will give the other the information it reasonably needs to meet these obligations, promptly and accurately, including information about the reality of supervision, direction, control and substitution. Neither party will misrepresent the working arrangements to obtain a particular status outcome.

We are responsible for PAYE, National Insurance and equivalent deductions for Personnel we employ directly. Where Personnel are engaged through a personal service company, umbrella company or agency, the Engagement Document records the arrangement and the party responsible for deductions. We only use umbrella companies that operate PAYE compliantly and we will tell you which are involved if you ask.

Nothing in this schedule attempts to displace employment, agency worker or tax law. Where a worker acquires rights against you as a matter of law, this schedule allocates the cost of that between us but does not change the worker's rights.

9. Confidentiality, data and intellectual property

Assigned Personnel are bound by confidentiality obligations at least as protective as section 18 of the Terms. Where they access personal data inside your systems under your access controls, they do so on your behalf, you remain the controller, and you are responsible for access control, monitoring and logging within your environment. We do not receive or retain copies of your data from that access unless the Engagement Document says we do, in which case Schedule 6 applies to what we hold.

Intellectual property in work created by Assigned Personnel is dealt with in section 16 of the Terms and in the Engagement Document. We obtain the assignments and waivers from our Personnel needed to give effect to that.

10. Incidents and conduct

Each party tells the other promptly about any security incident, data incident, safety incident, or complaint about conduct involving Assigned Personnel, and cooperates on investigation. We may withdraw a person immediately where we reasonably consider it necessary for safety, legal or security reasons, and we will provide a replacement as soon as we reasonably can.

11. Notice, offboarding and continuity

Either party may end a personnel booking on the notice in the Engagement Document, or 4 weeks' written notice if it is silent, expiring no earlier than the end of any minimum booking period. Fees for the notice period are payable whether or not you use the time.

On the last working day, or earlier if required for security reasons, you revoke the person's access to your systems and premises and recover any equipment you issued. We recover our own equipment and confirm access has been removed on our side. We provide reasonable handover as part of the notice period at no extra charge.

12. Hiring our people

Section 27 of the Terms and Schedule 4 govern what happens if you want to employ or engage Assigned Personnel directly.

Schedule 4 — Recruitment and placement

Applies where the Engagement Document says so. It covers introducing candidates for direct employment or engagement by you, and converting Assigned Personnel to a direct hire.

1. Introductions

An introduction happens when we give you a candidate's CV or details, or the candidate meets you at our arrangement. An introduction is confidential to you and must not be passed to anyone else without our written consent. If you pass details to another organisation and that organisation engages the candidate, you pay the fee as if you had engaged them yourself.

Ownership of an introduction. If you tell us in writing within 5 business days of an introduction that you already knew the candidate and were already in an active recruitment process with them, with evidence, no fee is payable for that candidate. Otherwise the introduction is ours.

Introduction period. A fee is payable if you engage an introduced candidate, in any capacity, within 12 months of the introduction, whether or not the engagement arises from our introduction, and whether the engagement is with you or with any of your group companies, and whether it is direct or through another agency, contractor or intermediary.

2. Placement fees

The placement fee is the percentage of the candidate's first year's total remuneration stated in the Engagement Document. Total remuneration means base salary or contract value plus guaranteed bonuses, allowances and the taxable value of benefits, for the first 12 months. Where the engagement is for less than 12 months, the fee is calculated on the full-time equivalent annual figure, prorated where the Engagement Document says so.

The fee falls due on the candidate's start date and is invoiced then, payable under section 12 of the Terms. It is payable whether the engagement is permanent, fixed-term, part-time, consultancy or through the candidate's own company, and it is payable again on a re-engagement within 12 months of a previous engagement ending.

3. Rebates

Where the Engagement Document provides for a rebate and the candidate's engagement ends within the rebate period, we will, at our option, provide a replacement search at no additional fee or refund the proportion of the fee the Engagement Document sets out. A rebate applies only if you have paid the original invoice in full and on time, you tell us in writing within 7 days of the engagement ending, and the engagement did not end because of redundancy, restructuring, a change in the role, or your breach of the candidate's terms.

4. Converting Assigned Personnel to a direct hire

If you want to employ or engage Assigned Personnel directly, tell us. A transfer fee is payable as set out in the Engagement Document, or, if it is silent, at the rate in section 27 of the Terms. Where the law requires it, we will instead offer you the choice of an extended period of hire, on the existing terms, after which the person may transfer with no transfer fee, and we will tell you the length of that period when you ask about a transfer.

5. Candidate information and assessment

We pass on the information a candidate gives us and the results of any checks the Engagement Document asked us to run. We take reasonable steps to confirm that a candidate has the qualifications and experience they claim, but we do not warrant the accuracy of information a candidate provides, their suitability for the role, their performance, their conduct, or that they will accept or remain in the role.

Your assessment is final. You are responsible for satisfying yourself that a candidate is suitable, for taking up references, for confirming qualifications and right to work, for any regulatory or sector-specific vetting the role requires, and for complying with your own legal duties in recruitment, including on discrimination.

6. Candidate data

Candidate information is Confidential Information under section 18 of the Terms. In recruitment and placement work each of us acts as an independent controller of candidate personal data for our own purposes, and neither of us is the other's processor. Each party will comply with data protection law in its own handling of candidate data, will provide its own privacy information to candidates, and will tell the other promptly about any personal data breach affecting shared candidate data. You will use candidate data only to assess and engage that candidate, and will delete it when you no longer need it for that purpose.

7. Non-circumvention

You will not approach, or arrange to engage, a candidate we have introduced through a route designed to avoid a fee under this schedule, including through a group company, an intermediary, another agency or a contractor arrangement. Where you do, the fee is payable as if the engagement had been direct.

Schedule 5 — AI systems and automated outputs

Applies where the Services include artificial intelligence, machine learning, automated decision-making, generative systems or agentic automation. It does not apply to Services that do not involve them.

1. How these systems behave

AI systems generate responses, classifications, summaries, recommendations and actions automatically, and they are probabilistic rather than deterministic. The same input can produce different outputs. Outputs can contain inaccuracies, omissions, fabricated content, bias or results that are unsuitable for the context, and they may misinterpret inputs. Testing and evaluation reduce this but cannot eliminate it, and evaluation results describe how a system performed on the cases tested, not how it will behave on every future input.

2. Human review and approval

You are responsible for supervising the use of AI systems in your business. You will keep appropriate human review in place, in proportion to the impact of the output, and you will review and approve service information, pricing, policies, workflows, scripts, templates and communications the system uses or sends. Decisions with legal, financial, safety, employment, health or similarly significant effects must be approved by a person before they take effect, unless we have expressly agreed otherwise in writing and you have satisfied yourself that doing so is lawful.

You are responsible for decisions made and actions taken on the basis of AI outputs.

3. Not professional or regulated advice

AI systems we build do not provide legal, financial, tax, insurance, medical or other regulated advice, and must not be used in place of qualified professional judgement. You must not configure or deploy a system we build to give regulated advice unless you hold the necessary permissions and have told us in writing.

4. Prohibited and high-risk uses

You must not use, and must not configure, an AI system we build to: make significant decisions about individuals without human review, including on employment, credit, insurance, housing, education, benefits or access to essential services; carry out biometric identification or emotion inference about individuals; generate content that impersonates a real person without their consent; operate in a safety-critical context; or do anything prohibited by our Acceptable Use Policy or by applicable law. Where a use is high-risk under applicable AI regulation, you are responsible for the obligations that fall on the deployer of that system.

5. Models, providers and change

AI systems rely on third-party models, hosting providers and connected platforms. We will tell you which third-party services a system is expected to use and what data each receives, and we keep the current list of providers that process personal data on our behalf at talitu.com/sub-processors. Those providers' terms apply to the use of their models and may apply to you directly. Their availability, performance, pricing, model behaviour and outputs may change without notice, and we are not responsible for changes, errors, outages, deprecations or discontinuations on their part.

We may change the model or provider a system uses where needed to keep it working, secure or supported, and will tell you where the change is material.

6. Ownership of outputs

Ownership and use of the content an AI system generates are subject to applicable law and to the terms of the model provider. We do not warrant that generated output is capable of being protected by copyright, that it is original, or that it does not resemble output generated for someone else. Section 16 of the Terms governs the system itself, as distinct from the content it generates.

7. Training and retention

We do not provide your data or your customers' data to third-party AI providers for training their models, except where you have expressly instructed us in writing to do so. Where you instruct us to enable a feature that involves training, retention or human review by a provider, we will tell you what it means and you are responsible for that decision. The Engagement Document records any agreed retention periods for prompts, outputs, transcripts and logs.

We may use aggregated and anonymised operational metrics and model performance signals to monitor, secure and improve our services, provided they do not identify you, your customers or any individual.

8. Production use

Moving an AI system into live operation is your decision. Before you do, you are responsible for satisfying yourself that it performs acceptably for your use case, that the human review and escalation paths are in place, that anything it says, sends, offers or prices on your behalf is accurate, lawful and compliant with the rules applying to your business, and that you have made the disclosures your customers are entitled to about interacting with an automated system.

9. The word "agent"

AI agents are software. Despite the word, they are not employees, workers, contractors or agents in the legal sense of either party, and no employment, agency, partnership or fiduciary relationship arises from their use.

Schedule 6 — Data processing addendum

Applies where and to the extent we process personal data as your processor as part of the Services ("Processor Services"), and that data is covered by UK or EU data protection law. It does not apply to processing where we act as an independent controller under section 19 of the Terms, or to personal data our Assigned Personnel access inside your systems on your behalf.

Words like "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meanings given in the UK GDPR and the Data Protection Act 2018, and the EU GDPR where it applies. Where an Engagement Document includes its own data processing agreement, that one applies instead for that engagement.

1. Roles. For personal data we process as part of the Processor Services, you are the controller and we are the processor. You are responsible for having a lawful basis, and the right notices and consents, to share that data with us and to have it processed as agreed.

2. Our instructions. We process this personal data only to provide the Processor Services and to follow your documented instructions, of which these Terms, the applicable Schedules and your Engagement Documents are the initial set, unless the law requires otherwise, in which case we will tell you first where we are allowed to. We will tell you if we believe an instruction breaches data protection law.

3. Confidentiality and security. We ensure that the people who process this personal data are under a duty of confidence. We keep appropriate technical and organisational measures, including those in Schedule 7, suitable to the risk.

4. Sub-processors. You give general authorisation for us to use sub-processors. We keep a current list at talitu.com/sub-processors, where you can subscribe to be told about changes, and we give notice through that page before a new sub-processor starts processing your personal data. You may object on reasonable data protection grounds within 14 days of that notice. If you do, we will work with you in good faith on a solution, and if we cannot find one within a reasonable time you may end the affected Service and we will refund fees pre-paid for services not yet delivered. We remain responsible to you for our sub-processors.

5. Helping you. Taking into account the nature of the processing, we will give you reasonable help with responding to data subject rights requests, keeping the data secure and dealing with personal data breaches, and data protection impact assessments and regulator consultations. If a data subject, regulator or law enforcement body contacts us directly about your data, we will, where the law allows, pass it to you rather than respond ourselves.

6. Personal data breaches. We will tell you without undue delay after becoming aware of a personal data breach affecting your personal data, and give you the information and cooperation you reasonably need to meet your own legal duties.

7. International transfers and locations. Where we or a sub-processor transfer or access your personal data outside the UK or EEA to a country without an adequacy decision, we will put an approved transfer mechanism in place, such as the UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses, taken to be entered into with the details in the Annex. If those clauses conflict with this schedule, the clauses win for the transfer they cover. Where the Engagement Document specifies approved locations from which Personnel may access your data, we will comply with them.

8. Personnel and access. We limit access to your personal data to Personnel who need it for the Processor Services, keep records of who has access, and remove access promptly when it is no longer needed or a person leaves the engagement.

9. No sale of data. We process your personal data only to provide the Processor Services. We do not sell it and do not use it for our own separate purposes, other than aggregated, anonymised data that does not identify anyone.

10. Returning or deleting data. When the Processor Services end, we delete or return your personal data as set out in section 29 of the Terms, unless the law requires us to keep it.

11. Audits. On at least 30 days' written notice, and no more than once a year unless a regulator or a substantiated breach reasonably requires more, you may ask us to demonstrate compliance with this schedule, normally by providing our security documentation and answering reasonable questions. We will agree scope and timing so it does not unduly disrupt our business.

12. Liability. Our liability under this schedule is subject to section 22 of the Terms.

Annex — details of processing. The specifics of each engagement are set out in its Engagement Document, which must record: subject matter and duration of the processing; nature and purpose of the processing; types of data subject; categories of personal data, and whether any special category data is involved; retention periods; and approved processing locations. Sub-processors are those listed at talitu.com/sub-processors.

Where an Engagement Document does not record these details, the following applies by default: the subject matter and duration are the provision of the Processor Services for the length of the engagement; the nature and purpose are the design, build, testing, operation and support of the systems described in that Engagement Document, together with related hosting and reporting; the data subjects are your customers, prospects, contacts and staff who use those systems; the categories of personal data are names, business and personal contact details, the content of communications, including recordings and transcripts where enabled, transaction and appointment details, and technical data such as IP address and device or browser information; and no special category data is requested or required, in line with the sensitive data rule in section 19 of the Terms.

Schedule 7 — Information security

Sets out the security measures Talitu maintains as standard. Where an engagement needs more, the Engagement Document or a separate security schedule agreed with you sets out what applies.

We keep a security programme based on generally accepted industry practice, proportionate to the size of our business and the risk of the Services, and we review it periodically. You are responsible for security on your side, including keeping credentials safe, securing your own systems and environments, and telling us promptly about any suspected unauthorised access.

Measures we maintain as standard

• Access control. Access to systems holding your data is limited to people who need it, on a least-privilege basis, using unique named accounts. We remove access promptly when someone no longer needs it.
• Authentication. We use multi-factor authentication, or another strong method, for remote access to our systems and to the platforms we administer.
• Encryption. We use current, industry-standard encryption for personal data in transit across public networks, and for personal data at rest where the platform or service we are using provides it.
• Credential handling. Credentials and secrets are stored in a managed secrets store or password manager, not in code, documents or messages, and are rotated when someone leaves an engagement.
• People. Our Personnel are under written confidentiality obligations. We operate joiner and leaver processes covering account creation, access review and removal, and we carry out the right-to-work checks the law requires.
• Devices and endpoints. Devices used to access your data run supported operating systems with disk encryption, automatic screen lock and current security updates.
• Patching and vulnerabilities. We apply security updates to the systems we control on a risk-prioritised basis and act on vulnerability reports affecting the components we are responsible for.
• Suppliers. We contract with sub-processors on terms requiring protections at least as protective as this schedule, and we review a supplier's security posture before giving it access to client data.
• Incidents. We keep a documented incident response process. If we discover a security incident affecting your data, we will tell you without undue delay and give you the information you reasonably need, and reasonable help, to meet your legal duties.
• Separation. We keep client environments, credentials and data logically separated, and we do not use one client's data or credentials for another client's work.

Available where an engagement requires it

The following are not part of our standard programme. Where your requirements or your regulator need them, we will agree them in the Engagement Document or a separate security schedule, and any cost is chargeable:

• independent penetration testing on an agreed schedule, and sharing of the resulting report or summary;
• criminal record checks, financial probity checks or security clearance for named Personnel;
• data loss prevention tooling and endpoint monitoring beyond the measures above;
• a formal documented risk assessment, asset register and asset lifecycle programme;
• a formal recurring security awareness training programme with completion records;
• a recognised certification such as Cyber Essentials Plus or ISO/IEC 27001;
• completion of your security questionnaire, supplier assurance process or on-site audit;
• agreed recovery point and recovery time objectives, and tested business continuity and disaster recovery arrangements.

We will tell you honestly which of these we hold at the time you ask. We do not claim controls we do not operate.