OVERVIEW

This Schedule defines how business customers may use Ductio profiles, intelligence, reports and exports. It permits ordinary professional use and controlled sharing of assignment results with commissioning clients. API delivery, bulk data licensing and resale require express additional rights. Sections 1 to 11 and the completed Annex A form the contractual schedule when incorporated into an accepted Order.

1 Application and interpretation

1.1 This Schedule governs licensed use and distribution of Ductio Intelligence supplied by DUCTIO LTD, company number 17303286, to the business Customer identified in the accepted Order. It applies only where that Order incorporates the identified version. Mandatory international-transfer terms prevail for their subject matter, followed by the DPA for personal-data processing; express lawful Order variations apply only where the provision varied is identified. This Schedule governs intelligence use and distribution, the Product and Usage Schedule governs measurement and entitlements, Product Specific Terms govern enabled service-specific matters and the AUP governs acceptable use and proportionate enforcement. The Customer Terms govern remaining matters, including fees, liability, indemnities, suspension, termination and disputes. Internal policies and privacy notices do not create additional customer warranties or repurposing rights merely by being listed.

1.2 Ductio Intelligence means professional profiles, company records, signals, scores, compilations and other intelligence supplied from Ductio or its licensed sources. A Report is a project-specific presentation, assessment, shortlist or analysis generated through the Services. An Export is a permitted copy delivered outside the platform, including a downloaded file or an approved integration transfer. An Assignment is the defined executive search, succession, leadership or investment engagement recorded in a Project and permitted by the Order.

1.3 Customer Content means material supplied by or on behalf of the Customer, including its own notes, documents and lawful additions. Customer-specific analysis derived from that material remains subject to the DPA where Ductio acts as processor. Embedding Ductio Intelligence in a Report does not convert that intelligence into Customer Content or remove its licence restrictions.

1.4 A Commissioning Client is the identified organisation engaging the Customer for an Assignment. Permitted Recipients are that client’s personnel and professional advisers who need the results for that Assignment. Affiliate organisations, portfolio companies and unrelated clients are not automatically licensed users or recipients.

1.5 Annex A must identify purchased rights, permitted purposes, sharing scope, export permissions and applicable Source Conditions. Blank fields do not grant API, bulk, resale, public distribution or unlimited rights. Any material licence deviation must identify the provision varied and be accepted by both parties. The Customer Terms version incorporated into the Order governs contract changes; a later website update does not replace the purchased version.

1.6 Applicable Law includes UK GDPR and the Data Protection Act 2018 as amended, including the Data (Use and Access) Act 2025 to the extent in force; EU GDPR where applicable; the Equality Act 2010 and applicable EU and national equality law; applicable electronic-communications law; relevant copyright and database-right law; and Regulation (EU) 2024/1689 on artificial intelligence as amended, to the extent applicable and in force. Each party must meet the obligations applicable to its actual activities and role. This Schedule does not assert that every law applies to every deployment.

2 Ordinary platform licence

2.1 During the agreed subscription or trial period, Ductio grants the Customer a non-exclusive, non-transferable licence for Authorised Users to access and use enabled intelligence for the purchased professional purposes. Ductio supports executive search, assessment, succession, leadership and board analysis, workforce planning and investment due diligence only within the scope recorded in the Order. Rights cover the enabled profiles, evidence, analyses and Reports; they do not promise every data source, field or intelligence engine. Limited onward rights under section 3 are allowed. Assignment-specific Reports containing Customer Content remain confidential and subject to the DPA where applicable.

2.2 Authorised users may search, inspect, compare, annotate and analyse profiles, create assignment Reports, and make permitted Exports within the purchased allowances. Permitted internal use includes necessary review by the Customer’s employees and advisers bound by confidentiality, without giving them unlicensed platform access. Contractor, affiliate and guest access must follow the Order and seat rules.

2.3 No ownership in Ductio’s platform, datasets, taxonomy, scoring methods, source material or other protected rights passes to the Customer. Ownership of Customer Content and customer-created contributions follows the Customer Terms. Reports may contain several rights layers; the Customer may use the complete Report within this Schedule without acquiring the underlying database or third-party rights. Ductio does not claim ownership of facts merely because they appear in a profile.

2.4 Use must remain within Applicable Law, the licensed purpose and Source Conditions. A licence is not an individual's consent, a lawful basis for processing or regulatory approval. Ductio intelligence is decision support, not regulated investment or legal advice, a formal background check, security clearance or a guarantee of executive performance. Nothing excludes mandatory legal rights or exceptions that cannot lawfully be excluded.

2.5 Trial use is limited to genuine evaluation and the trial Order's stated export and sharing permissions. Paid-client delivery is permitted during a trial only if expressly recorded. A free trial does not create continuing API, bulk or data-resale rights. Reports lawfully delivered during a trial remain subject to section 5; expiry does not authorise downloading the remaining search results.

3 Sharing shortlists and assignment reports

3.1 The Customer may provide a proportionate shortlist, selected profile extracts and an Assignment Report to the relevant Commissioning Client and its Permitted Recipients for evaluating that Assignment. Necessary sharing with an individual candidate of that candidate’s own information is permitted where lawful. Subject access, correction, regulatory and other legally required disclosures are addressed in section 8.

3.2 Sharing must be limited to information reasonably necessary for the Assignment. It does not permit delivery of the entire search universe, systematic profile dumps, unrestricted contact lists or a client-accessible substitute for Ductio’s database. A genuine longlist is permitted only to the extent its scope and export rights are recorded in Annex A. High record volume is not automatically legitimate because the file is labelled a report.

3.3 The Customer may charge its usual search, advisory or investment diligence fees and include permitted Reports within that service. This is permitted assignment delivery. Charging for standalone profiles, datasets, access credentials, recurring data feeds or a data product requires the separate licence in section 7.

3.4 Before voluntary sharing, the Customer shall bind the Commissioning Client in writing to use the results only for the identified Assignment, restrict recipients, protect confidentiality and personal data, preserve source notices and limitations, and prevent onward distribution, resale, reconstruction and unrelated reuse. Terms must require lawful retention, correction, restriction and deletion under sections 5 and 8 and equivalent safeguards for receiving advisers. They may be included in the client's engagement agreement; a separate Ductio contract is not required. Keep a reasonable record of recipient organisation, Assignment, delivery, supplied version and applicable restrictions. A footer notice alone does not replace binding terms.

3.5 The Customer is responsible under the Agreement for ensuring that its voluntary distribution complies with this section and for taking reasonable steps to stop and remedy known recipient misuse. No unlimited guarantee, separate strict liability or new indemnity is created. A recipient receives only the limited use permission granted through the Customer; no direct subscription or support relationship with Ductio arises.

3.6 Customer-branded or white-label Reports require the scope and branding permission recorded in Annex A. Required source attribution, rights notices, assessment dates and material limitations must remain visible. Distinguish customer edits and conclusions and do not imply Ductio endorsement. Branding does not expand distribution rights, permit a standalone data product or grant use of Ductio's name or logo in publicity without permission under the Customer Terms.

3.7 Direct client access, interactive report portals or external workspace access require expressly enabled permissions and applicable seat or guest entitlements. A shared download does not authorise password sharing or platform access. Identifiable profiles and scores may not be published on an open website, social platform or publicly accessible report under this ordinary licence.

4 Exports and permitted systems

4.1 Exports are permitted only through enabled download or integration functions and within the formats, record quantities and destinations stated in the Order. Viewing information is not an unrestricted extraction entitlement. Counting, failed exports, pooled allowances and resets follow the Product and Usage Schedule; a quantity allowance does not grant a broader licence.

4.2 Where record export is included, selected records relevant to active Assignments may be stored in the Customer’s secure ATS, CRM or document system solely for those Assignments and the retention rights in section 5. The destination must be controlled by the Customer or a service provider acting for it under appropriate confidentiality and data protection terms. The provider receives no independent commercial use rights.

4.3 A CSV, spreadsheet or editable document remains subject to this Schedule. Format does not permit population of a general candidate warehouse, unrestricted prospecting database, commercial directory or public search service. Repeated small exports, copying, screenshots or integration transfers must not be combined to reconstruct a dataset or evade licence or usage limits.

4.4 The Customer shall use proportionate access controls and secure delivery for Exports, prevent public-link exposure, and maintain retention and recipient records. Reports and material extracts must preserve source and assessment dates, material uncertainty, identity-match limitations and mandatory notices. A provider licence does not make an allegation or inferred association a verified fact. Review sensitive or irrelevant fields before distribution and distinguish customer edits from Ductio's supplied evidence.

4.5 Contractual return of Customer Content follows the Customer Terms and DPA and is separate from paid intelligence exports. Exhausted allowances or suspension must not defeat that return. It does not grant an unrestricted database copy; embedded intelligence follows the applicable Report and Source Conditions while the Customer's own material remains returnable.

4.6 No party may obtain broader rights by transforming a profile into a score, embedding, vector, derived list or summary. Derived material that identifies an individual or substantially reproduces licensed intelligence retains relevant privacy and licence limits. Genuine anonymisation must prevent reasonable re-identification; hashing, removing names or aggregation alone may be insufficient. The Customer's independently created conclusions and independently obtained lawful information remain governed by its own rights.

5 Retention after expiry or termination

5.1 On ordinary expiry or termination, the Customer loses platform access, refresh, new search and new export rights, except for any expressly agreed exit process. It may retain Reports and permitted profile extracts lawfully delivered during the term as a historical record of the relevant Assignment, and use them to complete that same Assignment or for necessary audit, legal, regulatory or professional record keeping. This limited permission survives subject to this section, sections 8 and 9, and disclosed Source Conditions.

5.2 A Commissioning Client that lawfully received the results may retain and use them on the same limited basis. Retention does not permit reuse for a new vacancy, a different client, a new investment engagement or continuing database enrichment. A renewed subscription or separately agreed licence is required for fresh Ductio research or use beyond this surviving scope. The Customer’s independently sourced records and its own conclusions remain governed by its own rights.

5.3 Retention permission is not a promise that Ductio will host results after access ends, keep them updated or store personal data indefinitely. The Customer shall apply a documented retention period justified by purpose and law, review necessity, restrict archived access and delete or irreversibly anonymise material when no longer needed. Any source-specific maximum retention period disclosed before supply applies. Historical results must retain their assessment date and must not be presented as current intelligence.

5.4 Unused raw record exports, cached API responses and other Ductio Intelligence outside section 5.1 must be removed from active systems within 30 days after access ends unless Annex A states another agreed period. Where law requires retention, retain only the necessary restricted archive for that legal purpose. Residual copies in inaccessible routine backups may remain until overwritten under the documented backup cycle, with no restored operational use; any restoration must reapply deletion and access restrictions.

5.5 Ending access for breach does not automatically cancel every lawfully obtained Report. Ductio may end the surviving licence for affected material where material misuse remains unremedied after written notice identifying the breach and the 30-day cure period in Customer Terms v0.2, or the cure period in the Customer Terms actually accepted. An irremediable material breach permits termination only on an applicable contractual ground. Urgent protective restrictions follow section 10. Necessary legal evidence and legally mandated retention remain permitted under restricted access. Termination cannot displace individual rights or lawful deletion.

5.6 Ductio's hosted return and deletion obligations follow the DPA and Customer Terms, separately from this offline licence. Under the referenced v0.2 Customer Terms and v0.1 DPA, return may be requested within 30 days after termination; active processor-held copies must be deleted within 90 days, unless an earlier lawful instruction applies, and isolated residual backups within a further maximum 90 days. The accepted contract and lawful-retention exceptions control the actual obligation. Retention of a customer-held Report neither extends hosted retention nor authorises Ductio to repurpose Customer Content.

5.7 Where reasonably requested following expiry or a substantiated rights restriction, the Customer shall confirm completion of the relevant deletion or restriction and reasonable steps taken with known recipients. Any confirmation shall identify lawful retention exceptions and backup treatment. Ductio shall not require disclosure of unrelated client information or unrestricted system access.

6 API and automated delivery

6.1 API access requires express enablement in an accepted Order or API addendum. Ordinary platform access, a technical endpoint, export credits or possession of an API key does not provide it. An approved integration grants only its expressly recorded delivery scope.

6.2 The API record must identify endpoints and datasets, authorised application and operator, internal or external users, environments, territories, permitted purposes, request and record allowances, concurrency, caching duration, refresh rules, destinations, deletion obligations and any charges. API credentials must be secured and must not be transferred to clients or exposed publicly.

6.3 Internal API rights permit delivery only into the agreed Customer systems for the agreed purpose. External display, client access, embedded products, onward API delivery, redistribution and model training require separate express rights. API licensing does not waive bulk licensing requirements where systematic extraction or maintained datasets are intended.

6.4 Ductio may enforce agreed limits and proportionate security controls, including credential revocation for compromise. API request success is not an expansion of licence scope. Cache expiry, correction propagation and post-term deletion must be defined before activation. Material entitlement or charge changes follow the Customer Terms; undisclosed throttling must not defeat purchased rights.

6.5 The agreed application must support source notices, recipient restrictions, access records and reasonable propagation of corrections, restrictions and deletion to cached or downstream copies. The API record must distinguish machine authentication from named-user seats and define the applicable shared export pools. No undocumented endpoint, automation of the ordinary interface or key sharing may substitute for an authorised API.

7 Bulk licensing redistribution and resale

7.1 Bulk licensing means systematic supply or accumulation of datasets, substantial portions of intelligence, recurring feeds or coverage of a defined population beyond ordinary Assignment delivery. It includes reconstruction through repeated small requests. API delivery is a channel, not automatic permission for bulk licensing.

7.2 Bulk use, resale, sublicensing, embedding in another commercial product, onward feeds and redistribution require a separate signed licence or accepted Order expressly granting each relevant right. Ductio may separately license its independently sourced intelligence, including for use across Ductio products, only with lawful processing, transparency, source permissions and rights safeguards. This does not authorise sale or reuse of processor-held Customer Content, private CVs, confidential notes, recordings or client projects. The Customer cannot infer resale rights from Ductio's own business model or Privacy Policy.

7.3 The separate licence must identify licensed fields and sources, population and territory, permitted purpose, named recipient types, delivery and refresh frequency, volumes, fees, source flow-down terms, permitted derivatives and branding, redistribution chain, retention, deletion, audit arrangements and termination treatment. It must also establish the actual controller and processor roles, lawful bases, transparency, rights handling, security and transfer safeguards before personal data is supplied.

7.4 Ductio may grant only rights it holds or is authorised to sublicense. Where an upstream provider prohibits redistribution, that material must be excluded or separately authorised before delivery. The Customer must not assume that publicly available professional information is free from privacy obligations or contractual source restrictions.

7.5 Unless separately and expressly licensed, do not use Ductio Intelligence to train, fine-tune or evaluate shared or general-purpose AI models, build a shared retrieval corpus, benchmark a competing data product or offer a substitute intelligence service. Approved analysis in secure external tools solely for a permitted Assignment must be recorded in Annex A, with confidentiality, provider access, retention and training restrictions. Customer-specific processor data additionally requires documented instructions and applicable DPA arrangements. This restriction does not impede lawful independent development, good-faith validation of assignment results or mandatory legal rights.

7.6 A bulk or resale licence must require downstream recipients to apply its restrictions, retain adequate distribution records and propagate material rights notices. No recipient chain may expand source rights, purposes or retention beyond the original grant. Before delivery, document independent-controller sharing responsibilities or any Article 26 joint-controller arrangement where the facts require it. Processor transfer clauses in the DPA do not automatically cover controller-to-controller resale; any restricted transfer requires the correct instrument for the actual roles.

8 Personal data accuracy and consequential use

8.1 Each party is responsible for the processing purposes and activities it actually controls. The DPA applies where Ductio processes for the Customer. Independently sourced Ductio Intelligence and its onward use may involve separate controller responsibilities; this Schedule neither settles roles contrary to the facts nor supplies an Article 28 arrangement for controller-to-controller disclosure.

8.2 Each controller shall establish a lawful basis, give required Articles 13 or 14 information, minimise data, maintain proportionate retention and rights processes, and complete any legally required impact assessment. Indirect collection or public availability is not an automatic exemption from transparency. A claimed notice exemption must be assessed and documented. Special category and criminal-offence processing requires applicable additional conditions; sensitive attributes may not be inferred merely from professional associations. Customer Content must not be uploaded or shared without source rights and authority.

8.3 The standard Services provide decision support. A competent reviewer with authority to change the result must meaningfully assess identity, evidence, criteria, bias and limitations before a consequential decision takes effect. Do not use the standard Services to make final hiring, rejection, promotion, dismissal or other legally or similarly significant decisions solely by automated processing. Rubber-stamping is insufficient. Maintain required explanations and challenge routes. This is a contractual restriction for the standard product, not a claim that all automated decisions are unlawful. A separately proposed automated-decision service requires agreed lawful scope and safeguards before deployment.

8.4 The parties shall cooperate proportionately on material corrections, restrictions and lawful deletion requests affecting supplied records. Ductio shall communicate identified corrections or restrictions to affected Customers where legally required or reasonably necessary to prevent material misuse. The Customer shall update active copies and inform known recipients where applicable. Restricted historical evidence may be preserved when lawfully necessary, clearly marked and excluded from operational reuse.

8.5 Nothing prevents lawful disclosures for individual rights, courts, regulators, authorised advisers or binding legal requirements. Disclose only necessary material, use available confidentiality safeguards and notify Ductio where lawful and reasonably practicable if its confidential material is affected. Individual rights and regulator powers prevail over licence restrictions.

8.6 Do not use protected characteristics, sensitive traits or proxies to discriminate unlawfully in selection or other opportunities. Equality monitoring, reasonable adjustments and lawful positive action require their own valid basis and safeguards. For UK and EU deployments, assess the actual applicable employment, equality and privacy rules; a professional profile or score is not sufficient justification for adverse treatment.

8.7 Each party shall fulfil AI obligations applicable to its actual provider, deployer or other role and intended use. Follow lawful intended-use instructions, assign competent oversight, keep required records and report material concerns. Human review does not itself remove an EU AI Act high-risk classification. A changed purpose or substantial modification requires review before use; contractual labelling does not settle regulatory status. No licence permits prohibited AI practices, unlawful social scoring, workplace emotion recognition or unlawful sensitive-trait ranking.

8.8 Professional contact details do not themselves authorise unsolicited communications. Observe UK PECR and applicable EU or national electronic-communications rules, distinguish recipient types where law requires, and honour objections and suppression records. No Export licence grants a general marketing permission.

8.9 International access or sharing must be assessed for restricted transfers, including relevant remote access. Record actual exporter and importer roles, destinations, mechanism and necessary assessment and supplementary safeguards before the transfer. Use applicable adequacy or valid safeguards; EU SCCs alone do not suffice for a restricted UK transfer. Disclosure to a Commissioning Client is not automatically covered by processor-to-subprocessor arrangements.

8.10 The standard commercial platform is not an approved environment for classified material, government secrets, security-cleared workloads or mobilisation and targeting operations. Defence, national-security and resilience research is permitted only within the expressly purchased lawful scope. Do not infer military status, sensitive beliefs or security clearance from an uncertain association. Any specialised public-sector or regulated deployment requires separate authority, intended-use review, source permissions and safeguards before activation.

9 Source conditions and continuity

9.1 Source Conditions are material source-specific restrictions disclosed in Annex A and its attached register before affected supply. For each source or dataset, identify licensed fields, permitted purposes and territories, attribution, export and client-sharing rights, API and bulk or resale rights, refresh and correction requirements, retention and post-expiry rights, and any excluded fields. Ductio must hold or procure the rights it grants. An unidentified supplier's terms cannot impose undisclosed customer duties.

9.2 Where an existing lawful entitlement is affected by a legal requirement or loss of upstream rights, Ductio shall promptly explain the affected material and restriction to the extent permitted, limit action to what is necessary, and seek a compliant replacement or practical alternative. New commercial restrictions or broader charges cannot be imposed retroactively through a website update.

9.3 If purchased use is materially reduced and no reasonable alternative is available, the Customer may terminate the affected Service and receive a proportionate refund of prepaid unused fees for it. Other remedies follow the Customer Terms. Necessary immediate legal restrictions may take effect before notice, with notice as soon as lawful and practicable.

9.4 A correction or rights restriction may require affected copies to be updated, restricted or deleted, subject to lawful evidence retention. Supplier contract expiry alone does not retrospectively revoke a surviving Report licence unless that limitation was disclosed before supply or continued use would infringe rights or law.

10 Compliance and enforcement

10.1 The Customer shall keep reasonable records of licensed users, Assignments, material exports and voluntary client distributions sufficient to explain compliance. Ductio may request proportionate information concerning a suspected breach. This Schedule does not create unrestricted access to the Customer’s systems or confidential client files; any audit right and its limits follow the Customer Terms or separate licence.

10.2 For credible misuse, Ductio may restrict affected exports, credentials, sharing, users or material under the Customer Terms and AUP. Consider legitimate explanations; unusual volume or an exhausted allowance alone is not proof. Give reasons where lawful, a reasonable opportunity to respond and review, and restore mistaken or resolved restrictions promptly. Immediate action may protect against active extraction, serious harm, unlawful disclosure or a credible security threat, confined to affected functions where practicable. A review request may use the contractual contact or the support or contact route at www.ductio.co.uk; formal notices follow the Customer Terms.

10.3 Remedial steps may include stopping unauthorised delivery, correcting access, withdrawing links, asking known recipients to delete unauthorised copies and confirming proportionate remediation. Enforcement must protect lawful evidence retention and Customer Content return rights. No punitive retrospective licence fee, automatic upgrade or unagreed overage is created.

10.4 Proven breach, termination, injunctions, damages and other remedies remain subject to the Customer Terms and applicable law. No additional liability cap, indemnity or uncapped exposure is introduced by this Schedule.

11 Order records and survival

11.1 Retain this accepted version, completed Annex A, source register and applicable API or bulk addenda with each Order. Record the accepting organisation, representative, time and document versions, with an immutable snapshot or accessible version reference. Changes follow the accepted Customer Terms. Publishing a newer schedule does not silently replace accepted rights.

11.2 Sections concerning ownership, permitted retained results, recipient restrictions, personal data, confidentiality, deletion and enforcement survive only to the extent necessary to govern retained material and accrued obligations. Survival does not extend subscription access or grant new delivery rights.

11.3 Ductio's online legal directory shall identify this Schedule's approved version and effective date, its contractual purpose and access to previous versions, alongside Customer Terms, Product Specific Terms where available, Product and Usage Schedule, AUP, DPA and relevant schedules, Privacy Policy, Cookie Policy and any incorporated support schedule. Distinguish contract documents from privacy notices and internal governance. An entry alone does not incorporate a draft, grant rights or constitute approval. Each trial or paid Order must provide direct access to its applicable contract set before acceptance.

 

ANNEX A LICENCE ENTITLEMENT RECORD

Complete every applicable field with the accepted Order. Use “not included” or “not applicable” where appropriate. This record grants no rights until completed and accepted. Operational usage quantities are recorded in the Product and Usage Schedule and must agree with this licence record.